[Entity Analytics] Internal API to upload asset criticality records via CSV file

x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/index.ts

@@ -7,3 +7,4 @@
 
 export * from './common.gen';
 export * from './get_asset_criticality_status.gen';
+export * from './upload_asset_criticality_csv.gen';

x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/upload_asset_criticality_csv.gen.ts

@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { z } from 'zod';
+
+/*
+ * NOTICE: Do not edit this file manually.
+ * This file is automatically generated by the OpenAPI Generator, @kbn/openapi-generator.
+ *
+ * info:
+ *   title: Asset Criticality Create Record Schema
+ *   version: 1.0.0
+ */
+
+export type ErrorItem = z.infer<typeof ErrorItem>;
+export const ErrorItem = z.object({
+  message: z.string(),
+  index: z.number().int(),
+});
+
+export type Stats = z.infer<typeof Stats>;
+export const Stats = z.object({
+  successful: z.number().int(),
+  failed: z.number().int(),
+  total: z.number().int(),
+});
+
+export type AssetCriticalityCsvUploadResponse = z.infer<typeof AssetCriticalityCsvUploadResponse>;
+export const AssetCriticalityCsvUploadResponse = z.object({
+  errors: z.array(ErrorItem),
+  stats: Stats,
+});

x-pack/plugins/security_solution/common/api/entity_analytics/asset_criticality/upload_asset_criticality_csv.schema.yaml

@@ -0,0 +1,73 @@
+openapi: 3.0.0
+info:
+  version: 1.0.0
+  title: Asset Criticality Create Record Schema
+servers:
+  - url: 'http://{kibana_host}:{port}'
+    variables:
+      kibana_host:
+        default: localhost
+      port:
+        default: '5601'
+paths:
+  /internal/asset_criticality/upload_csv:
+    post:
+      summary: Uploads a CSV file containing asset criticality data
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file:
+                  type: string
+                  format: binary
+                  description: The CSV file to upload.
+              required:
+                - file
+      responses:
+        '200':
+          description: CSV upload successful
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AssetCriticalityCsvUploadResponse'
+        '413':
+          description: File too large
+components:
+  schemas:
+    ErrorItem:
+      type: object
+      properties:
+        message:
+          type: string
+        index:
+          type: integer
+      required:
+        - message
+        - index
+    Stats:
+      type: object
+      properties:
+        successful:
+          type: integer
+        failed:
+          type: integer
+        total:
+          type: integer
+      required:
+        - successful
+        - failed
+        - total
+    AssetCriticalityCsvUploadResponse:
+      type: object
+      properties:
+        errors:
+          type: array
+          items:
+            $ref: '#/components/schemas/ErrorItem'
+        stats:
+          $ref: '#/components/schemas/Stats'
+      required:
+        - errors
+        - stats

x-pack/plugins/security_solution/common/constants.ts

@@ -272,6 +272,7 @@ export const RISK_ENGINE_SETTINGS_URL = `${RISK_ENGINE_URL}/settings`;
 export const ASSET_CRITICALITY_URL = `/internal/asset_criticality`;
 export const ASSET_CRITICALITY_PRIVILEGES_URL = `/internal/asset_criticality/privileges`;
 export const ASSET_CRITICALITY_STATUS_URL = `${ASSET_CRITICALITY_URL}/status`;
+export const ASSET_CRITICALITY_CSV_UPLOAD_URL = `${ASSET_CRITICALITY_URL}/upload_csv`;
 
 /**
  * Public Risk Score routes

x-pack/plugins/security_solution/common/entity_analytics/asset_criticality/constants.ts

@@ -22,6 +22,8 @@ export enum CriticalityLevels {
   LOW_IMPACT = 'low_impact',
 }
 
+export const ValidCriticalityLevels = Object.values(CriticalityLevels);
+
 /**
  * CriticalityModifiers are used to adjust the risk score based on the criticality of the asset.
  */
@@ -31,3 +33,8 @@ export const CriticalityModifiers: Record<CriticalityLevels, number> = {
   [CriticalityLevels.MEDIUM_IMPACT]: 1,
   [CriticalityLevels.LOW_IMPACT]: 0.5,
 };
+
+export const CRITICALITY_CSV_MAX_SIZE_BYTES = 1024 * 1024; // 1MB
+export const CRITICALITY_CSV_SIZE_TOLERANCE_BYTES = 1024 * 50; // ~= 50kb
+export const CRITICALITY_CSV_MAX_SIZE_BYTES_WITH_TOLERANCE =
+  CRITICALITY_CSV_MAX_SIZE_BYTES + CRITICALITY_CSV_SIZE_TOLERANCE_BYTES;

x-pack/plugins/security_solution/common/entity_analytics/asset_criticality/index.ts

@@ -7,3 +7,4 @@
 
 export * from './indices';
 export * from './constants';
+export * from './parse_asset_criticality_csv_row';

x-pack/plugins/security_solution/common/entity_analytics/asset_criticality/parse_asset_criticality_csv_row.test.ts

@@ -0,0 +1,133 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { parseAssetCriticalityCsvRow } from './parse_asset_criticality_csv_row';
+
+describe('parseAssetCriticalityCsvRow', () => {
+  it('should return valid false if the row has no columns', () => {
+    const result = parseAssetCriticalityCsvRow([]);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(`"Expected 3 columns, got 0"`);
+  });
+
+  it('should return valid false if the row has 2 columns', () => {
+    const result = parseAssetCriticalityCsvRow(['host', 'host-1']);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(`"Expected 3 columns, got 2"`);
+  });
+
+  it('should return valid false if the row has 4 columns', () => {
+    const result = parseAssetCriticalityCsvRow(['host', 'host-1', 'low_impact', 'extra']);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(`"Expected 3 columns, got 4"`);
+  });
+
+  it('should return valid false if the entity type is missing', () => {
+    const result = parseAssetCriticalityCsvRow(['', 'host-1', 'low_impact']);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(`"Missing entity type"`);
+  });
+
+  it('should return valid false if the entity type is invalid', () => {
+    const result = parseAssetCriticalityCsvRow(['invalid', 'host-1', 'low_impact']);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(
+      `"Invalid entity type \\"invalid\\", expected host or user"`
+    );
+  });
+
+  it('should return valid false if the entity type is invalid and only log 1000 characters', () => {
+    const invalidEntityType = 'x'.repeat(1001);
+    const result = parseAssetCriticalityCsvRow([invalidEntityType, 'host-1', 'low_impact']);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(
+      `"Invalid entity type \\"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...\\", expected host or user"`
+    );
+  });
+
+  it('should return valid false if the ID is missing', () => {
+    const result = parseAssetCriticalityCsvRow(['host', '', 'low_impact']);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(`"Missing identifier"`);
+  });
+
+  it('should return valid false if the criticality level is missing', () => {
+    const result = parseAssetCriticalityCsvRow(['host', 'host-1', '']);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(`"Missing criticality level"`);
+  });
+
+  it('should return valid false if the criticality level is invalid', () => {
+    const result = parseAssetCriticalityCsvRow(['host', 'host-1', 'invalid']);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(
+      `"Invalid criticality level \\"invalid\\", expected one of extreme_impact, high_impact, medium_impact, low_impact"`
+    );
+  });
+
+  it('should return valid false if the criticality level is invalid and only log 1000 characters', () => {
+    const invalidCriticalityLevel = 'x'.repeat(1001);
+    const result = parseAssetCriticalityCsvRow(['host', 'host-1', invalidCriticalityLevel]);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(
+      `"Invalid criticality level \\"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...\\", expected one of extreme_impact, high_impact, medium_impact, low_impact"`
+    );
+  });
+
+  it('should return valid false if the ID is too long', () => {
+    const idValue = 'x'.repeat(1001);
+    const result = parseAssetCriticalityCsvRow(['host', idValue, 'low_impact']);
+    expect(result.valid).toBe(false);
+
+    // @ts-ignore result can now only be InvalidRecord
+    expect(result.error).toMatchInlineSnapshot(
+      `"Identifier is too long, expected less than 1000 characters, got 1001"`
+    );
+  });
+
+  it('should return the parsed row', () => {
+    expect(parseAssetCriticalityCsvRow(['host', 'host-1', 'low_impact'])).toEqual({
+      valid: true,
+      record: {
+        idField: 'host.name',
+        idValue: 'host-1',
+        criticalityLevel: 'low_impact',
+      },
+    });
+  });
+
+  it('should return the parsed row if criticality level is the wrong case', () => {
+    expect(parseAssetCriticalityCsvRow(['host', 'host-1', 'LOW_IMPACT'])).toEqual({
+      valid: true,
+      record: {
+        idField: 'host.name',
+        idValue: 'host-1',
+        criticalityLevel: 'low_impact',
+      },
+    });
+  });
+});