-
Notifications
You must be signed in to change notification settings - Fork 76
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Surya Sashank Nistala <[email protected]>
- Loading branch information
Showing
8 changed files
with
194 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
15 changes: 15 additions & 0 deletions
15
...ensearch/securityanalytics/threatIntel/action/monitor/DeleteThreatIntelMonitorAction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| package org.opensearch.securityanalytics.threatIntel.action.monitor; | ||
|
|
||
| import org.opensearch.action.ActionType; | ||
| import org.opensearch.commons.alerting.action.DeleteMonitorResponse; | ||
| import org.opensearch.securityanalytics.threatIntel.sacommons.monitor.ThreatIntelMonitorActions; | ||
|
|
||
| public class DeleteThreatIntelMonitorAction extends ActionType<DeleteMonitorResponse> { | ||
|
|
||
| public static final DeleteThreatIntelMonitorAction INSTANCE = new DeleteThreatIntelMonitorAction(); | ||
| public static final String NAME = ThreatIntelMonitorActions.DELETE_THREAT_INTEL_MONITOR_ACTION_NAME; | ||
|
|
||
| private DeleteThreatIntelMonitorAction() { | ||
| super(NAME, DeleteMonitorResponse::new); | ||
| } | ||
| } |
37 changes: 37 additions & 0 deletions
37
...securityanalytics/threatIntel/action/monitor/request/DeleteThreatIntelMonitorRequest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| package org.opensearch.securityanalytics.threatIntel.action.monitor.request; | ||
|
|
||
| import org.opensearch.action.ActionRequest; | ||
| import org.opensearch.action.ActionRequestValidationException; | ||
| import org.opensearch.core.common.io.stream.StreamInput; | ||
| import org.opensearch.core.common.io.stream.StreamOutput; | ||
|
|
||
| import java.io.IOException; | ||
|
|
||
| public class DeleteThreatIntelMonitorRequest extends ActionRequest { | ||
|
|
||
| private String monitorId; | ||
|
|
||
| public DeleteThreatIntelMonitorRequest(String monitorId) { | ||
| super(); | ||
| this.monitorId = monitorId; | ||
| } | ||
|
|
||
| public DeleteThreatIntelMonitorRequest(StreamInput sin) throws IOException { | ||
| this(sin.readString()); | ||
| } | ||
|
|
||
| @Override | ||
| public ActionRequestValidationException validate() { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public void writeTo(StreamOutput out) throws IOException { | ||
| out.writeString(monitorId); | ||
| } | ||
|
|
||
| public String getMonitorId() { | ||
| return monitorId; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -86,4 +86,4 @@ public long getPrimaryTerm() { | |
| public ThreatIntelMonitorDto getIocScanMonitor() { | ||
| return iocScanMonitor; | ||
| } | ||
| } | ||
| } | ||
54 changes: 54 additions & 0 deletions
54
...securityanalytics/threatIntel/resthandler/monitor/RestDeleteThreatIntelMonitorAction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| package org.opensearch.securityanalytics.threatIntel.resthandler.monitor; | ||
|
|
||
|
|
||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
| import org.opensearch.client.node.NodeClient; | ||
| import org.opensearch.rest.BaseRestHandler; | ||
| import org.opensearch.rest.RestRequest; | ||
| import org.opensearch.rest.action.RestToXContentListener; | ||
| import org.opensearch.securityanalytics.SecurityAnalyticsPlugin; | ||
| import org.opensearch.securityanalytics.threatIntel.action.monitor.DeleteThreatIntelMonitorAction; | ||
| import org.opensearch.securityanalytics.threatIntel.action.monitor.request.DeleteThreatIntelMonitorRequest; | ||
| import org.opensearch.securityanalytics.threatIntel.action.monitor.request.IndexThreatIntelMonitorRequest; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.List; | ||
| import java.util.Locale; | ||
|
|
||
| import static org.opensearch.securityanalytics.threatIntel.action.monitor.request.IndexThreatIntelMonitorRequest.THREAT_INTEL_MONITOR_ID; | ||
|
|
||
| public class RestDeleteThreatIntelMonitorAction extends BaseRestHandler { | ||
|
|
||
| private static final Logger log = LogManager.getLogger(RestDeleteThreatIntelMonitorAction.class); | ||
|
|
||
| @Override | ||
| public String getName() { | ||
| return "delete_threat_intel_monitor_action"; | ||
| } | ||
|
|
||
| @Override | ||
| protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) throws IOException { | ||
| log.debug(String.format(Locale.getDefault(), | ||
| "%s %s/{%s}", | ||
| request.method(), | ||
| SecurityAnalyticsPlugin.THREAT_INTEL_MONITOR_URI, | ||
| THREAT_INTEL_MONITOR_ID)); | ||
|
|
||
| String detectorId = request.param(THREAT_INTEL_MONITOR_ID); | ||
| DeleteThreatIntelMonitorRequest deleteMonitorRequest = new DeleteThreatIntelMonitorRequest(detectorId); | ||
| return channel -> client.execute( | ||
| DeleteThreatIntelMonitorAction.INSTANCE, | ||
| deleteMonitorRequest, new RestToXContentListener<>(channel) | ||
| ); | ||
| } | ||
|
|
||
| @Override | ||
| public List<Route> routes() { | ||
| return List.of( | ||
| new Route(RestRequest.Method.DELETE, String.format(Locale.getDefault(), | ||
| "%s/{%s}", | ||
| SecurityAnalyticsPlugin.THREAT_INTEL_MONITOR_URI, | ||
| THREAT_INTEL_MONITOR_ID))); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
68 changes: 68 additions & 0 deletions
68
...urityanalytics/threatIntel/transport/monitor/TransportDeleteThreatIntelMonitorAction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| package org.opensearch.securityanalytics.threatIntel.transport.monitor; | ||
|
|
||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
| import org.opensearch.OpenSearchStatusException; | ||
| import org.opensearch.action.support.ActionFilters; | ||
| import org.opensearch.action.support.HandledTransportAction; | ||
| import org.opensearch.action.support.WriteRequest; | ||
| import org.opensearch.client.Client; | ||
| import org.opensearch.client.node.NodeClient; | ||
| import org.opensearch.common.inject.Inject; | ||
| import org.opensearch.common.settings.Settings; | ||
| import org.opensearch.commons.alerting.AlertingPluginInterface; | ||
| import org.opensearch.commons.alerting.action.DeleteMonitorRequest; | ||
| import org.opensearch.commons.alerting.action.DeleteMonitorResponse; | ||
| import org.opensearch.commons.authuser.User; | ||
| import org.opensearch.core.action.ActionListener; | ||
| import org.opensearch.core.common.io.stream.NamedWriteableRegistry; | ||
| import org.opensearch.core.rest.RestStatus; | ||
| import org.opensearch.securityanalytics.settings.SecurityAnalyticsSettings; | ||
| import org.opensearch.securityanalytics.threatIntel.action.monitor.DeleteThreatIntelMonitorAction; | ||
| import org.opensearch.securityanalytics.threatIntel.action.monitor.request.DeleteThreatIntelMonitorRequest; | ||
| import org.opensearch.securityanalytics.transport.SecureTransportAction; | ||
| import org.opensearch.securityanalytics.util.SecurityAnalyticsException; | ||
| import org.opensearch.tasks.Task; | ||
| import org.opensearch.threadpool.ThreadPool; | ||
| import org.opensearch.transport.TransportService; | ||
|
|
||
| public class TransportDeleteThreatIntelMonitorAction extends HandledTransportAction<DeleteThreatIntelMonitorRequest, DeleteMonitorResponse> implements SecureTransportAction { | ||
|
|
||
| private static final Logger log = LogManager.getLogger(TransportDeleteThreatIntelMonitorAction.class); | ||
|
|
||
| private final ThreadPool threadPool; | ||
| private final Settings settings; | ||
| private final NamedWriteableRegistry namedWriteableRegistry; | ||
| private final Client client; | ||
| private volatile Boolean filterByEnabled; | ||
|
|
||
| @Inject | ||
| public TransportDeleteThreatIntelMonitorAction( | ||
| final TransportService transportService, | ||
| final ActionFilters actionFilters, | ||
| final ThreadPool threadPool, | ||
| final Settings settings, | ||
| final Client client, | ||
| final NamedWriteableRegistry namedWriteableRegistry | ||
| ) { | ||
| super(DeleteThreatIntelMonitorAction.NAME, transportService, actionFilters, DeleteThreatIntelMonitorRequest::new); | ||
| this.threadPool = threadPool; | ||
| this.settings = settings; | ||
| this.namedWriteableRegistry = namedWriteableRegistry; | ||
| this.filterByEnabled = SecurityAnalyticsSettings.FILTER_BY_BACKEND_ROLES.get(this.settings); | ||
| this.client = client; | ||
| } | ||
|
|
||
| @Override | ||
| protected void doExecute(Task task, DeleteThreatIntelMonitorRequest request, ActionListener<DeleteMonitorResponse> listener) { | ||
| User user = readUserFromThreadContext(this.threadPool); | ||
| String validateBackendRoleMessage = validateUserBackendRoles(user, this.filterByEnabled); | ||
| if (!"".equals(validateBackendRoleMessage)) { | ||
| listener.onFailure(SecurityAnalyticsException.wrap(new OpenSearchStatusException(validateBackendRoleMessage, RestStatus.FORBIDDEN))); | ||
| return; | ||
| } | ||
| AlertingPluginInterface.INSTANCE.deleteMonitor((NodeClient) client, | ||
| new DeleteMonitorRequest(request.getMonitorId(), WriteRequest.RefreshPolicy.IMMEDIATE), | ||
| listener); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters