Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SIEM][Detection Engine] Change security model to use SIEM permissions #51791

Merged
merged 2 commits into from
Nov 27, 2019
Merged

[SIEM][Detection Engine] Change security model to use SIEM permissions #51791

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fa84716
Fix security model to use siem permissions
FrankHassanabad Nov 27, 2019
a116661
Merge branch 'master' into fix-security
FrankHassanabad Nov 27, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 40 additions & 36 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/create_rules_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,13 @@ import { RulesRequest } from '../alerts/types';
import { createRulesSchema } from './schemas';
import { ServerFacade } from '../../../types';
import { readRules } from '../alerts/read_rules';
import { transformOrError } from './utils';
import { transformOrError, transformError } from './utils';

export const createCreateRulesRoute: Hapi.ServerRoute = {
method: 'POST',
path: DETECTION_ENGINE_RULES_URL,
options: {
tags: ['access:signals-all'],
tags: ['access:siem'],
validate: {
options: {
abortEarly: false,
Expand Down Expand Up @@ -62,42 +62,46 @@ export const createCreateRulesRoute: Hapi.ServerRoute = {
return headers.response().code(404);
}

if (ruleId != null) {
const rule = await readRules({ alertsClient, ruleId });
if (rule != null) {
return new Boom(`rule_id ${ruleId} already exists`, { statusCode: 409 });
try {
if (ruleId != null) {
const rule = await readRules({ alertsClient, ruleId });
if (rule != null) {
return new Boom(`rule_id ${ruleId} already exists`, { statusCode: 409 });
}
}
}

const createdRule = await createRules({
alertsClient,
actionsClient,
description,
enabled,
falsePositives,
filter,
from,
immutable,
query,
language,
outputIndex,
savedId,
meta,
filters,
ruleId: ruleId != null ? ruleId : uuid.v4(),
index,
interval,
maxSignals,
riskScore,
name,
severity,
tags,
to,
type,
threats,
references,
});
return transformOrError(createdRule);
const createdRule = await createRules({
alertsClient,
actionsClient,
description,
enabled,
falsePositives,
filter,
from,
immutable,
query,
language,
outputIndex,
savedId,
meta,
filters,
ruleId: ruleId != null ? ruleId : uuid.v4(),
index,
interval,
maxSignals,
riskScore,
name,
severity,
tags,
to,
type,
threats,
references,
});
return transformOrError(createdRule);
} catch (err) {
return transformError(err);
}
},
};

Expand Down
28 changes: 16 additions & 12 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/delete_rules_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,13 @@ import { deleteRules } from '../alerts/delete_rules';
import { ServerFacade } from '../../../types';
import { queryRulesSchema } from './schemas';
import { QueryRequest } from '../alerts/types';
import { getIdError, transformOrError } from './utils';
import { getIdError, transformOrError, transformError } from './utils';

export const createDeleteRulesRoute: Hapi.ServerRoute = {
method: 'DELETE',
path: DETECTION_ENGINE_RULES_URL,
options: {
tags: ['access:signals-all'],
tags: ['access:siem'],
validate: {
options: {
abortEarly: false,
Expand All @@ -35,17 +35,21 @@ export const createDeleteRulesRoute: Hapi.ServerRoute = {
return headers.response().code(404);
}

const rule = await deleteRules({
actionsClient,
alertsClient,
id,
ruleId,
});
try {
const rule = await deleteRules({
actionsClient,
alertsClient,
id,
ruleId,
});

if (rule != null) {
return transformOrError(rule);
} else {
return getIdError({ id, ruleId });
if (rule != null) {
return transformOrError(rule);
} else {
return getIdError({ id, ruleId });
}
} catch (err) {
return transformError(err);
}
},
};
Expand Down
26 changes: 15 additions & 11 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/find_rules_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,13 @@ import { findRules } from '../alerts/find_rules';
import { FindRulesRequest } from '../alerts/types';
import { findRulesSchema } from './schemas';
import { ServerFacade } from '../../../types';
import { transformFindAlertsOrError } from './utils';
import { transformFindAlertsOrError, transformError } from './utils';

export const createFindRulesRoute: Hapi.ServerRoute = {
method: 'GET',
path: `${DETECTION_ENGINE_RULES_URL}/_find`,
options: {
tags: ['access:signals-all'],
tags: ['access:siem'],
validate: {
options: {
abortEarly: false,
Expand All @@ -34,15 +34,19 @@ export const createFindRulesRoute: Hapi.ServerRoute = {
return headers.response().code(404);
}

const rules = await findRules({
alertsClient,
perPage: query.per_page,
page: query.page,
sortField: query.sort_field,
sortOrder: query.sort_order,
filter: query.filter,
});
return transformFindAlertsOrError(rules);
try {
const rules = await findRules({
alertsClient,
perPage: query.per_page,
page: query.page,
sortField: query.sort_field,
sortOrder: query.sort_order,
filter: query.filter,
});
return transformFindAlertsOrError(rules);
} catch (err) {
return transformError(err);
}
},
};

Expand Down
26 changes: 15 additions & 11 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/read_rules_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
import Hapi from 'hapi';
import { isFunction } from 'lodash/fp';
import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
import { getIdError, transformOrError } from './utils';
import { getIdError, transformOrError, transformError } from './utils';

import { readRules } from '../alerts/read_rules';
import { ServerFacade } from '../../../types';
Expand All @@ -18,7 +18,7 @@ export const createReadRulesRoute: Hapi.ServerRoute = {
method: 'GET',
path: DETECTION_ENGINE_RULES_URL,
options: {
tags: ['access:signals-all'],
tags: ['access:siem'],
validate: {
options: {
abortEarly: false,
Expand All @@ -34,15 +34,19 @@ export const createReadRulesRoute: Hapi.ServerRoute = {
if (!alertsClient || !actionsClient) {
return headers.response().code(404);
}
const rule = await readRules({
alertsClient,
id,
ruleId,
});
if (rule != null) {
return transformOrError(rule);
} else {
return getIdError({ id, ruleId });
try {
const rule = await readRules({
alertsClient,
id,
ruleId,
});
if (rule != null) {
return transformOrError(rule);
} else {
return getIdError({ id, ruleId });
}
} catch (err) {
return transformError(err);
}
},
};
Expand Down
74 changes: 39 additions & 35 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/update_rules_route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,13 @@ import { updateRules } from '../alerts/update_rules';
import { UpdateRulesRequest } from '../alerts/types';
import { updateRulesSchema } from './schemas';
import { ServerFacade } from '../../../types';
import { getIdError, transformOrError } from './utils';
import { getIdError, transformOrError, transformError } from './utils';

export const createUpdateRulesRoute: Hapi.ServerRoute = {
method: 'PUT',
path: DETECTION_ENGINE_RULES_URL,
options: {
tags: ['access:signals-all'],
tags: ['access:siem'],
validate: {
options: {
abortEarly: false,
Expand Down Expand Up @@ -61,39 +61,43 @@ export const createUpdateRulesRoute: Hapi.ServerRoute = {
return headers.response().code(404);
}

const rule = await updateRules({
alertsClient,
actionsClient,
description,
enabled,
falsePositives,
filter,
from,
immutable,
query,
language,
outputIndex,
savedId,
meta,
filters,
id,
ruleId,
index,
interval,
maxSignals,
riskScore,
name,
severity,
tags,
to,
type,
threats,
references,
});
if (rule != null) {
return transformOrError(rule);
} else {
return getIdError({ id, ruleId });
try {
const rule = await updateRules({
alertsClient,
actionsClient,
description,
enabled,
falsePositives,
filter,
from,
immutable,
query,
language,
outputIndex,
savedId,
meta,
filters,
id,
ruleId,
index,
interval,
maxSignals,
riskScore,
name,
severity,
tags,
to,
type,
threats,
references,
});
if (rule != null) {
return transformOrError(rule);
} else {
return getIdError({ id, ruleId });
}
} catch (err) {
return transformError(err);
}
},
};
Expand Down
39 changes: 39 additions & 0 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,13 @@
*/

import Boom from 'boom';

import {
transformAlertToRule,
getIdError,
transformFindAlertsOrError,
transformOrError,
transformError,
} from './utils';
import { getResult } from './__mocks__/request_responses';

Expand Down Expand Up @@ -474,4 +476,41 @@ describe('utils', () => {
expect((output as Boom).message).toEqual('Internal error transforming');
});
});

describe('transformError', () => {
test('returns boom if it is a boom object', () => {
const boom = new Boom('');
const transformed = transformError(boom);
expect(transformed).toBe(boom);
});

test('returns a boom if it is some non boom object that has a statusCode', () => {
const error: Error & { statusCode?: number } = {
statusCode: 403,
name: 'some name',
message: 'some message',
};
const transformed = transformError(error);
expect(Boom.isBoom(transformed)).toBe(true);
});

test('returns a boom with the message set', () => {
const error: Error & { statusCode?: number } = {
statusCode: 403,
name: 'some name',
message: 'some message',
};
const transformed = transformError(error);
expect(transformed.message).toBe('some message');
});

test('does not return a boom if it is some non boom object but it does not have a status Code.', () => {
const error: Error = {
name: 'some name',
message: 'some message',
};
const transformed = transformError(error);
expect(Boom.isBoom(transformed)).toBe(false);
});
});
});
Loading