[EDR Workflows][Process descendants filter] Transform event filter entry for filtering process descendant

[gergoabraham]

Summary

This PR adds logic to server side artifact logic, in order to transform Event Filter entries to the expected format, if process descendant filtering is enabled.

Conditions:

• feature flag is enabled: xpack.securitySolution.enableExperimental.filterProcessDescendantsForEventFiltersEnabled
• amongst the tags, there is the filter_process_descendants tag

Output: the output contains a new operator called descendent_of, with all the original entries listed as the operator's values, and one additional event.category is process entry.

Example input entry (only relevant fields):

            "entries": [
              {
                "field": "process.args",
                "operator": "included",
                "type": "match",
                "value": "IGNOREMYCHILDREN"
              }
            ],
            "tags": [
              "filter_process_descendants"
            ],

Example output entry:

{
  "entries": [
    {
      "type": "simple",
      "entries": [
        {
          "operator": "included",
          "type": "descendent_of", // note: writing descendEnt here to harmonise with endpoint implementation
          "value": {
            "entries": [
              {
                "type": "simple",
                "entries": [
                  {
                    "field": "process.args",
                    "operator": "included",
                    "type": "exact_cased",
                    "value": "IGNOREMYCHILDREN"
                  },
                  {
                    "field": "event.category",
                    "operator": "included",
                    "type": "exact_cased",
                    "value": "process"
                  }
                ]
              }
            ]
          }
        }
      ]
    }
  ]
}

e2e testing

• spin up Kibana with the FF enabled
• spin up a v15-snapshot Agent with Endpoint integration on VM, enroll it
• create an Event Filter with the following setup, where 'Process descendants' is selected and process.args is IGNOREMYCHILDREN:

• create a test.sh on your VM with the following content:

echo "Creating file test_file_$1.tmp"
touch test_file_$1.tmp

# recursively call the original script
if [ $1 -ge 1 ]
then
	sh test.sh $(( $1 - 1 )) $2
fi

(alternatively you can use the python script from the endpoint tests, https://github.com/elastic/endpoint-dev/blob/790c611325998c6ef8578144844d9260b8f73044/Python/endpoint/test/test_event_filtering.py#L439-L450)

• run the script sh test.sh 6 DO_NOT_IGNOREMYCHILDREN

• go to Security -> Explore -> Hosts to see the reported events
• I added some filters to easily see the events

• you should see that all events are there

• now try with sh test.sh 9 IGNOREMYCHILDREN

• now only the events of the top process are visible, the events from descendants are not

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[gergoabraham]

/ci

[elasticmachine]

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

[gergoabraham]

@elasticmachine merge upstream

[tomsonpl]

lgtm 👍

[ashokaditya]

Checked it out and works as advertised. I verified the artifact entry and that the events were generated and reported correctly.

simple event filter

artifact

event details

nested filter

nested artifact

[ashokaditya]

nit: naming

Suggested change

	const deduplicatedItems: TranslatedExceptionListItem[] = [];
	const uniqueItems: TranslatedExceptionListItem[] = [];

[gergoabraham]

1bc9e78

[ashokaditya]

nit: naming

Suggested change

	const storeDeduplicatedItem = (item: TranslatedExceptionListItem) => {
	const storeUniqueItem = (item: TranslatedExceptionListItem) => {

[gergoabraham]

1bc9e78

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: ae6a795

Failed CI Steps

• Jest Integration Tests #7

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	15.6MB	15.5MB	-4.6KB

History

• 💚 Build #218695 succeeded 5a90892
• 💛 Build #218409 was flaky 0200ab5

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @gergoabraham