Preliminary framework for jobscheduler and datasource #626

jowg-amazon · 2023-10-02T23:28:46Z

Description

[Describe what this change achieves]

Issues Resolved

[List any issues this PR will resolve]

Check List

New functionality includes testing.
- All tests pass
New functionality has been documented.
- New functionality has javadoc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

eirsep · 2023-10-02T23:31:46Z

src/main/java/org/opensearch/securityanalytics/threatintel/common/ThreatIntelLockService.java

+        try {
+            countDownLatch.await(clusterService.getClusterSettings().get(ThreatIntelSettings.TIMEOUT).getSeconds(), TimeUnit.SECONDS);
+            return lockReference.get();
+        } catch (InterruptedException e) {


add log.error("Custom Message",e); where ever we catch exceptions

plz also add a generic catch and handle it accordingly.

eirsep · 2023-10-03T06:45:05Z

src/main/java/org/opensearch/securityanalytics/threatintel/common/DatasourceState.java

+/**
+ * Threat intel datasource state
+ *
+ * When data source is created, it starts with CREATING state. Once the first threatIP data is generated, the state changes to AVAILABLE.


Once the first threatIP data is generated, the state changes to AVAILABLE.

Is this comment applicable to our use case too?

eirsep · 2023-10-03T06:47:10Z

src/main/java/org/opensearch/securityanalytics/threatintel/common/ThreatIntelExecutor.java

+ * Provide a list of static methods related with executors for threat intel
+ */
+public class ThreatIntelExecutor {
+    private static final String THREAD_POOL_NAME = "_plugin_securityanalytics_threatintel_datasource_update";


why is threadpool name beginning with _

also this can we shorten _securityanalytics to _sap and remove _threatIntel

eirsep · 2023-10-03T06:49:50Z

src/main/java/org/opensearch/securityanalytics/threatintel/common/ThreatIntelLockService.java

+        try {
+            countDownLatch.await(clusterService.getClusterSettings().get(ThreatIntelSettings.TIMEOUT).getSeconds(), TimeUnit.SECONDS);
+            return Optional.ofNullable(lockReference.get());
+        } catch (InterruptedException e) {


log error message

eirsep · 2023-10-03T06:50:42Z

src/main/java/org/opensearch/securityanalytics/threatintel/common/ThreatIntelSettings.java

+import org.opensearch.common.unit.TimeValue;
+
+/**
+ * Settings for Ip2Geo datasource operations


fix comment

eirsep · 2023-10-03T06:50:52Z

src/main/java/org/opensearch/securityanalytics/threatintel/common/ThreatIntelSettings.java

+public class ThreatIntelSettings {
+
+//    /**
+//     * Default endpoint to be used in threatIP datasource creation API


threat intel*?

eirsep · 2023-10-03T06:51:54Z

src/main/java/org/opensearch/securityanalytics/threatintel/common/ThreatIntelSettings.java

+    /**
+     * Timeout value for Ip2Geo processor
+     */
+    public static final Setting<TimeValue> TIMEOUT = Setting.timeSetting(


TIMEOUT is vague. can we rename with more context. what is "index_timeout"

eirsep · 2023-10-03T06:52:35Z

src/main/java/org/opensearch/securityanalytics/threatintel/dao/DatasourceDao.java

+
+    private String getIndexMapping() {
+        try {
+            try (InputStream is = DatasourceDao.class.getResourceAsStream("/mappings/threatintel_datasource.json")) {


can you also push the mapping json

eirsep · 2023-10-03T06:53:07Z

src/main/java/org/opensearch/securityanalytics/threatintel/dao/DatasourceDao.java

+                }
+            }
+        } catch (IOException e) {
+            throw new RuntimeException(e);


we shouldn't throw runtime exceptoin. we can wrap in securityanalyticsexception

log error message

eirsep · 2023-10-03T06:54:46Z

src/main/java/org/opensearch/securityanalytics/threatintel/jobscheduler/Datasource.java

+    private static final ParseField DATABASE_FIELD = new ParseField("database");
+    private static final ParseField UPDATE_STATS_FIELD = new ParseField("update_stats");
+
+    private static final ParseField FEED_FORMAT = new ParseField("field_format");


plz add CONTAINED_IOCS_FIELD to store info about list of IOCs contained in a given feed.

eirsep · 2023-10-03T06:54:53Z

src/main/java/org/opensearch/securityanalytics/threatintel/jobscheduler/Datasource.java

+    private static final ParseField DATABASE_FIELD = new ParseField("database");
+    private static final ParseField UPDATE_STATS_FIELD = new ParseField("update_stats");
+
+    private static final ParseField FEED_FORMAT = new ParseField("field_format");


plz add mapping json

eirsep · 2023-10-03T06:55:25Z

src/main/java/org/opensearch/securityanalytics/threatintel/jobscheduler/Datasource.java

+     * @param name name of a datasource
+     * @return name of a datasource
+     */
+    private String name;


can we mark variables as final wherever possible

eirsep · 2023-10-03T06:55:59Z

build.gradle

@@ -32,6 +32,7 @@ buildscript {

    dependencies {
        classpath "org.opensearch.gradle:build-tools:${opensearch_version}"
+        classpath "io.freefair.gradle:lombok-plugin:6.4.3"


NIT: not in favor of adding lombok because of one class. can you add manual getters, setters for now.

eirsep · 2023-10-03T06:57:01Z

...main/java/org/opensearch/securityanalytics/threatintel/jobscheduler/DatasourceExtension.java

+    /**
+     * Job index name for a datasource
+     */
+    public static final String JOB_INDEX_NAME = ".scheduler-security_analytics-threatintel-datasource";


rename following plugin's index naming convention
checking findings, alerts,detectors indices for naming convention

eirsep · 2023-10-03T07:13:23Z

src/main/java/org/opensearch/securityanalytics/threatintel/jobscheduler/DatasourceRunner.java

+        try {
+            datasourceUpdateService.deleteUnusedIndices(datasource);
+            if (DatasourceTask.DELETE_UNUSED_INDICES.equals(datasource.getTask()) == false) {
+                datasourceUpdateService.updateOrCreateGeoIpData(datasource, renewLock);


rename method

eirsep · 2023-10-03T07:13:48Z

.../java/org/opensearch/securityanalytics/threatintel/jobscheduler/DatasourceUpdateService.java

+    }
+
+    /**
+     * Update threatIp data


threat intel*

eirsep · 2023-10-03T07:14:00Z

.../java/org/opensearch/securityanalytics/threatintel/jobscheduler/DatasourceUpdateService.java

+    /**
+     * Update threatIp data
+     *
+     * The first column is ip range field regardless its header name.


comment n/a

eirsep · 2023-10-03T07:14:57Z

.../java/org/opensearch/securityanalytics/threatintel/jobscheduler/DatasourceUpdateService.java

+                        datasource.getDatabase().getFields().toString()
+                );
+            }
+            threatIpDataDao.putGeoIpData(indexName, header, reader.iterator(), renewLock);


you can pull latest changes from feature branch and use ThreatIntelFeedData dao for this and rewrite the method

not reviewing this class right now

Signed-off-by: Joanne Wang <[email protected]>

…ject#626) Signed-off-by: Joanne Wang <[email protected]>

* fix doc level query constructor (#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]>

Signed-off-by: Joanne Wang <[email protected]>

* fix doc level query constructor (#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]>

Signed-off-by: Joanne Wang <[email protected]>

* fix doc level query constructor (#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]>

* add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * create doc level query from threat intel feed data index docs" Signed-off-by: Surya Sashank Nistala <[email protected]> * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel feeds job runner and unit tests (#654) * fix doc level query constructor (#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * converge job scheduler code with threat intel feed integration in detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * refactored out unecessary Signed-off-by: Joanne Wang <[email protected]> * added headers and cleaned up Signed-off-by: Joanne Wang <[email protected]> * converge job scheduler and detector threat intel code Signed-off-by: Surya Sashank Nistala <[email protected]> * working on testing Signed-off-by: Joanne Wang <[email protected]> * fixed the parser and build.gradle Signed-off-by: Joanne Wang <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * create doc level query from threat intel feed data index docs" Signed-off-by: Surya Sashank Nistala <[email protected]> * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel feeds job runner and unit tests (#654) * fix doc level query constructor (#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * converge job scheduler code with threat intel feed integration in detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * converge job scheduler and detector threat intel code Signed-off-by: Surya Sashank Nistala <[email protected]> * add feed metadata config files in src and test Signed-off-by: Surya Sashank Nistala <[email protected]> * clean up some tests Signed-off-by: Joanne Wang <[email protected]> * fixed merge conflicts Signed-off-by: Joanne Wang <[email protected]> * adds ioc fields list in log type config files and ioc fields object in LogType POJO * update csv parser and new metadata field Signed-off-by: Joanne Wang <[email protected]> * fixed job scheduler interval settings Signed-off-by: Joanne Wang <[email protected]> * add tests for ioc to fields for each log type Signed-off-by: Surya Sashank Nistala <[email protected]> * removed wildcards Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]>

* add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * create doc level query from threat intel feed data index docs" Signed-off-by: Surya Sashank Nistala <[email protected]> * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel feeds job runner and unit tests (#654) * fix doc level query constructor (#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * converge job scheduler code with threat intel feed integration in detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * refactored out unecessary Signed-off-by: Joanne Wang <[email protected]> * added headers and cleaned up Signed-off-by: Joanne Wang <[email protected]> * converge job scheduler and detector threat intel code Signed-off-by: Surya Sashank Nistala <[email protected]> * working on testing Signed-off-by: Joanne Wang <[email protected]> * fixed the parser and build.gradle Signed-off-by: Joanne Wang <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * create doc level query from threat intel feed data index docs" Signed-off-by: Surya Sashank Nistala <[email protected]> * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel feeds job runner and unit tests (#654) * fix doc level query constructor (#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * converge job scheduler code with threat intel feed integration in detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * converge job scheduler and detector threat intel code Signed-off-by: Surya Sashank Nistala <[email protected]> * add feed metadata config files in src and test Signed-off-by: Surya Sashank Nistala <[email protected]> * clean up some tests Signed-off-by: Joanne Wang <[email protected]> * fixed merge conflicts Signed-off-by: Joanne Wang <[email protected]> * adds ioc fields list in log type config files and ioc fields object in LogType POJO * update csv parser and new metadata field Signed-off-by: Joanne Wang <[email protected]> * fixed job scheduler interval settings Signed-off-by: Joanne Wang <[email protected]> * add tests for ioc to fields for each log type Signed-off-by: Surya Sashank Nistala <[email protected]> * removed wildcards Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Joanne Wang <[email protected]> Co-authored-by: Joanne Wang <[email protected]>

* add mapping for indices storing threat intel feed data Signed-off-by: Surya Sashank Nistala <[email protected]> * fix feed indices mapping Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added Signed-off-by: Surya Sashank Nistala <[email protected]> * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * create doc level query from threat intel feed data index docs" Signed-off-by: Surya Sashank Nistala <[email protected]> * handle threat intel enabled check during detector updation Signed-off-by: Surya Sashank Nistala <[email protected]> * add tests for testing threat intel feed integration with detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel feeds job runner and unit tests (#654) * fix doc level query constructor (#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * converge job scheduler code with threat intel feed integration in detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * converge job scheduler and detector threat intel code Signed-off-by: Surya Sashank Nistala <[email protected]> * add feed metadata config files in src and test Signed-off-by: Surya Sashank Nistala <[email protected]> * adds ioc fields list in log type config files and ioc fields object in LogType POJO Signed-off-by: Surya Sashank Nistala <[email protected]> * fix compilation issues in tests Signed-off-by: Surya Sashank Nistala <[email protected]> * test udpate detector disabling threat intel Signed-off-by: Surya Sashank Nistala <[email protected]> * add tests for detector creation and updation with threat intel Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel test (#673) * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * create doc level query from threat intel feed data index docs" Signed-off-by: Surya Sashank Nistala <[email protected]> * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel feeds job runner and unit tests (#654) * fix doc level query constructor (#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * converge job scheduler code with threat intel feed integration in detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * refactored out unecessary Signed-off-by: Joanne Wang <[email protected]> * added headers and cleaned up Signed-off-by: Joanne Wang <[email protected]> * converge job scheduler and detector threat intel code Signed-off-by: Surya Sashank Nistala <[email protected]> * working on testing Signed-off-by: Joanne Wang <[email protected]> * fixed the parser and build.gradle Signed-off-by: Joanne Wang <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * create doc level query from threat intel feed data index docs" Signed-off-by: Surya Sashank Nistala <[email protected]> * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel feeds job runner and unit tests (#654) * fix doc level query constructor (#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * converge job scheduler code with threat intel feed integration in detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * converge job scheduler and detector threat intel code Signed-off-by: Surya Sashank Nistala <[email protected]> * add feed metadata config files in src and test Signed-off-by: Surya Sashank Nistala <[email protected]> * clean up some tests Signed-off-by: Joanne Wang <[email protected]> * fixed merge conflicts Signed-off-by: Joanne Wang <[email protected]> * adds ioc fields list in log type config files and ioc fields object in LogType POJO * update csv parser and new metadata field Signed-off-by: Joanne Wang <[email protected]> * fixed job scheduler interval settings Signed-off-by: Joanne Wang <[email protected]> * add tests for ioc to fields for each log type Signed-off-by: Surya Sashank Nistala <[email protected]> * removed wildcards Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Joanne Wang <[email protected]> Co-authored-by: Joanne Wang <[email protected]> * fix threat intel integ tests and add update detector logic Signed-off-by: Surya Sashank Nistala <[email protected]> * JS for Threat intel feeds - changed extension (#675) * merge conflicts Signed-off-by: Joanne Wang <[email protected]> * fixed java wildcards and changed update key name Signed-off-by: Joanne Wang <[email protected]> * integ test failing Signed-off-by: Joanne Wang <[email protected]> * fix job scheduler params Signed-off-by: Joanne Wang <[email protected]> * changed extension and has debug messages Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * fixed job scheduler plugin spi jar resolution * cleaned up TODOs and changed job scheduler name Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * TIF Job Runner Cleanup (#676) * merge conflicts Signed-off-by: Joanne Wang <[email protected]> * fixed java wildcards and changed update key name Signed-off-by: Joanne Wang <[email protected]> * integ test failing Signed-off-by: Joanne Wang <[email protected]> * fix job scheduler params Signed-off-by: Joanne Wang <[email protected]> * changed extension and has debug messages Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * fixed job scheduler plugin spi jar resolution * cleaned up TODOs and changed job scheduler name Signed-off-by: Joanne Wang <[email protected]> * removed google commons unused import, updated interval setting, removed rest action Signed-off-by: Joanne Wang <[email protected]> * removed policy file and updated name for job scheduler Signed-off-by: Joanne Wang <[email protected]> * responded to comments about parameter validator and TIFMetadata Signed-off-by: Joanne Wang <[email protected]> * refactored ThreatIntelFeedDataService and changed variables to public static final where possible Signed-off-by: Joanne Wang <[email protected]> * changed opensearch-sap-threatintel to opensearch-sap-threat-intel Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Joanne Wang <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * fix TIFJobParameter class Signed-off-by: Surya Sashank Nistala <[email protected]> * test detector updation when feed updation job runs Signed-off-by: Surya Sashank Nistala <[email protected]> * removed delete job scheduler code and cleaned up (#678) Signed-off-by: Joanne Wang <[email protected]> * working integ test (#680) Signed-off-by: Joanne Wang <[email protected]> * fix timeout of tif job creation Signed-off-by: Surya Sashank Nistala <[email protected]> * remove unncessary thread forking in put tif job action Signed-off-by: Surya Sashank Nistala <[email protected]> * refactoring code to address review comments Signed-off-by: Surya Sashank Nistala <[email protected]> * detector trigger detection types Signed-off-by: Surya Sashank Nistala <[email protected]> * pull out threat intel rest tests into separate test class Signed-off-by: Surya Sashank Nistala <[email protected]> * add detection types testing in detector trigger for rules and threat intel detection scenarios Signed-off-by: Surya Sashank Nistala <[email protected]> * add license header Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel field aliases in mapping view response Signed-off-by: Surya Sashank Nistala <[email protected]> * fix threat intel feed parser Signed-off-by: Surya Sashank Nistala <[email protected]> * fix workflow failing test Signed-off-by: Surya Sashank Nistala <[email protected]> * spotless check failures fixed Signed-off-by: Surya Sashank Nistala <[email protected]> * remove dockerfile (#689) Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Joanne Wang <[email protected]> Co-authored-by: Joanne Wang <[email protected]>

* add mapping for indices storing threat intel feed data Signed-off-by: Surya Sashank Nistala <[email protected]> * fix feed indices mapping Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added Signed-off-by: Surya Sashank Nistala <[email protected]> * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (opensearch-project#626) Signed-off-by: Joanne Wang <[email protected]> * create doc level query from threat intel feed data index docs" Signed-off-by: Surya Sashank Nistala <[email protected]> * handle threat intel enabled check during detector updation Signed-off-by: Surya Sashank Nistala <[email protected]> * add tests for testing threat intel feed integration with detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel feeds job runner and unit tests (opensearch-project#654) * fix doc level query constructor (opensearch-project#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (opensearch-project#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * converge job scheduler code with threat intel feed integration in detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * converge job scheduler and detector threat intel code Signed-off-by: Surya Sashank Nistala <[email protected]> * add feed metadata config files in src and test Signed-off-by: Surya Sashank Nistala <[email protected]> * adds ioc fields list in log type config files and ioc fields object in LogType POJO Signed-off-by: Surya Sashank Nistala <[email protected]> * fix compilation issues in tests Signed-off-by: Surya Sashank Nistala <[email protected]> * test udpate detector disabling threat intel Signed-off-by: Surya Sashank Nistala <[email protected]> * add tests for detector creation and updation with threat intel Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel test (opensearch-project#673) * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (opensearch-project#626) Signed-off-by: Joanne Wang <[email protected]> * create doc level query from threat intel feed data index docs" Signed-off-by: Surya Sashank Nistala <[email protected]> * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel feeds job runner and unit tests (opensearch-project#654) * fix doc level query constructor (opensearch-project#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (opensearch-project#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * converge job scheduler code with threat intel feed integration in detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * refactored out unecessary Signed-off-by: Joanne Wang <[email protected]> * added headers and cleaned up Signed-off-by: Joanne Wang <[email protected]> * converge job scheduler and detector threat intel code Signed-off-by: Surya Sashank Nistala <[email protected]> * working on testing Signed-off-by: Joanne Wang <[email protected]> * fixed the parser and build.gradle Signed-off-by: Joanne Wang <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (opensearch-project#626) Signed-off-by: Joanne Wang <[email protected]> * create doc level query from threat intel feed data index docs" Signed-off-by: Surya Sashank Nistala <[email protected]> * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * Threat intel feeds job runner and unit tests (opensearch-project#654) * fix doc level query constructor (opensearch-project#651) Signed-off-by: Surya Sashank Nistala <[email protected]> * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao Signed-off-by: Surya Sashank Nistala <[email protected]> * add threatIntelEnabled field in detector. Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel feed service and searching feeds Signed-off-by: Surya Sashank Nistala <[email protected]> * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation Signed-off-by: Surya Sashank Nistala <[email protected]> * Preliminary framework for jobscheduler and datasource (opensearch-project#626) Signed-off-by: Joanne Wang <[email protected]> * with listener and processor Signed-off-by: Joanne Wang <[email protected]> * removed actions Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * added parser Signed-off-by: Joanne Wang <[email protected]> * add unit tests Signed-off-by: Joanne Wang <[email protected]> * refactored class names Signed-off-by: Joanne Wang <[email protected]> * before moving db Signed-off-by: Joanne Wang <[email protected]> * after moving db Signed-off-by: Joanne Wang <[email protected]> * added actions to plugin and removed user schedule Signed-off-by: Joanne Wang <[email protected]> * unit tests Signed-off-by: Joanne Wang <[email protected]> * fix build error Signed-off-by: Joanne Wang <[email protected]> * changed transport naming Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * converge job scheduler code with threat intel feed integration in detectors Signed-off-by: Surya Sashank Nistala <[email protected]> * converge job scheduler and detector threat intel code Signed-off-by: Surya Sashank Nistala <[email protected]> * add feed metadata config files in src and test Signed-off-by: Surya Sashank Nistala <[email protected]> * clean up some tests Signed-off-by: Joanne Wang <[email protected]> * fixed merge conflicts Signed-off-by: Joanne Wang <[email protected]> * adds ioc fields list in log type config files and ioc fields object in LogType POJO * update csv parser and new metadata field Signed-off-by: Joanne Wang <[email protected]> * fixed job scheduler interval settings Signed-off-by: Joanne Wang <[email protected]> * add tests for ioc to fields for each log type Signed-off-by: Surya Sashank Nistala <[email protected]> * removed wildcards Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Joanne Wang <[email protected]> Co-authored-by: Joanne Wang <[email protected]> * fix threat intel integ tests and add update detector logic Signed-off-by: Surya Sashank Nistala <[email protected]> * JS for Threat intel feeds - changed extension (opensearch-project#675) * merge conflicts Signed-off-by: Joanne Wang <[email protected]> * fixed java wildcards and changed update key name Signed-off-by: Joanne Wang <[email protected]> * integ test failing Signed-off-by: Joanne Wang <[email protected]> * fix job scheduler params Signed-off-by: Joanne Wang <[email protected]> * changed extension and has debug messages Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * fixed job scheduler plugin spi jar resolution * cleaned up TODOs and changed job scheduler name Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * TIF Job Runner Cleanup (opensearch-project#676) * merge conflicts Signed-off-by: Joanne Wang <[email protected]> * fixed java wildcards and changed update key name Signed-off-by: Joanne Wang <[email protected]> * integ test failing Signed-off-by: Joanne Wang <[email protected]> * fix job scheduler params Signed-off-by: Joanne Wang <[email protected]> * changed extension and has debug messages Signed-off-by: Joanne Wang <[email protected]> * clean up Signed-off-by: Joanne Wang <[email protected]> * fixed job scheduler plugin spi jar resolution * cleaned up TODOs and changed job scheduler name Signed-off-by: Joanne Wang <[email protected]> * removed google commons unused import, updated interval setting, removed rest action Signed-off-by: Joanne Wang <[email protected]> * removed policy file and updated name for job scheduler Signed-off-by: Joanne Wang <[email protected]> * responded to comments about parameter validator and TIFMetadata Signed-off-by: Joanne Wang <[email protected]> * refactored ThreatIntelFeedDataService and changed variables to public static final where possible Signed-off-by: Joanne Wang <[email protected]> * changed opensearch-sap-threatintel to opensearch-sap-threat-intel Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Joanne Wang <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> * fix TIFJobParameter class Signed-off-by: Surya Sashank Nistala <[email protected]> * test detector updation when feed updation job runs Signed-off-by: Surya Sashank Nistala <[email protected]> * removed delete job scheduler code and cleaned up (opensearch-project#678) Signed-off-by: Joanne Wang <[email protected]> * working integ test (opensearch-project#680) Signed-off-by: Joanne Wang <[email protected]> * fix timeout of tif job creation Signed-off-by: Surya Sashank Nistala <[email protected]> * remove unncessary thread forking in put tif job action Signed-off-by: Surya Sashank Nistala <[email protected]> * refactoring code to address review comments Signed-off-by: Surya Sashank Nistala <[email protected]> * detector trigger detection types Signed-off-by: Surya Sashank Nistala <[email protected]> * pull out threat intel rest tests into separate test class Signed-off-by: Surya Sashank Nistala <[email protected]> * add detection types testing in detector trigger for rules and threat intel detection scenarios Signed-off-by: Surya Sashank Nistala <[email protected]> * add license header Signed-off-by: Surya Sashank Nistala <[email protected]> * add threat intel field aliases in mapping view response Signed-off-by: Surya Sashank Nistala <[email protected]> * fix threat intel feed parser Signed-off-by: Surya Sashank Nistala <[email protected]> * fix workflow failing test Signed-off-by: Surya Sashank Nistala <[email protected]> * spotless check failures fixed Signed-off-by: Surya Sashank Nistala <[email protected]> * remove dockerfile (opensearch-project#689) Signed-off-by: Joanne Wang <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Joanne Wang <[email protected]> Co-authored-by: Joanne Wang <[email protected]>

* add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao * add threatIntelEnabled field in detector. * add threat intel feed service and searching feeds * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation * Preliminary framework for jobscheduler and datasource (#626) * create doc level query from threat intel feed data index docs" * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors * Threat intel feeds job runner and unit tests (#654) * fix doc level query constructor (#651) * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao * add threatIntelEnabled field in detector. * add threat intel feed service and searching feeds * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation * Preliminary framework for jobscheduler and datasource (#626) * with listener and processor * removed actions * clean up * added parser * add unit tests * refactored class names * before moving db * after moving db * added actions to plugin and removed user schedule * unit tests * fix build error * changed transport naming --------- * converge job scheduler code with threat intel feed integration in detectors * converge job scheduler and detector threat intel code * add feed metadata config files in src and test * adds ioc fields list in log type config files and ioc fields object in LogType POJO * fix compilation issues in tests * test udpate detector disabling threat intel * add tests for detector creation and updation with threat intel * Threat intel test (#673) * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao * add threatIntelEnabled field in detector. * add threat intel feed service and searching feeds * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation * Preliminary framework for jobscheduler and datasource (#626) * create doc level query from threat intel feed data index docs" * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors * Threat intel feeds job runner and unit tests (#654) * fix doc level query constructor (#651) * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao * add threatIntelEnabled field in detector. * add threat intel feed service and searching feeds * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation * Preliminary framework for jobscheduler and datasource (#626) * with listener and processor * removed actions * clean up * added parser * add unit tests * refactored class names * before moving db * after moving db * added actions to plugin and removed user schedule * unit tests * fix build error * changed transport naming --------- * converge job scheduler code with threat intel feed integration in detectors * refactored out unecessary * added headers and cleaned up * converge job scheduler and detector threat intel code * working on testing * fixed the parser and build.gradle * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao * add threatIntelEnabled field in detector. * add threat intel feed service and searching feeds * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation * Preliminary framework for jobscheduler and datasource (#626) * create doc level query from threat intel feed data index docs" * handle threat intel enabled check during detector updation * add tests for testing threat intel feed integration with detectors * Threat intel feeds job runner and unit tests (#654) * fix doc level query constructor (#651) * add mapping for indices storing threat intel feed data * fix feed indices mapping * add threat intel feed data dao * add threatIntelEnabled field in detector. * add threat intel feed service and searching feeds * ti feed data to doc level query convertor logic added * plug threat intel feed into detector creation * Preliminary framework for jobscheduler and datasource (#626) * with listener and processor * removed actions * clean up * added parser * add unit tests * refactored class names * before moving db * after moving db * added actions to plugin and removed user schedule * unit tests * fix build error * changed transport naming --------- * converge job scheduler code with threat intel feed integration in detectors * converge job scheduler and detector threat intel code * add feed metadata config files in src and test * clean up some tests * fixed merge conflicts * adds ioc fields list in log type config files and ioc fields object in LogType POJO * update csv parser and new metadata field * fixed job scheduler interval settings * add tests for ioc to fields for each log type * removed wildcards --------- * fix threat intel integ tests and add update detector logic * JS for Threat intel feeds - changed extension (#675) * merge conflicts * fixed java wildcards and changed update key name * integ test failing * fix job scheduler params * changed extension and has debug messages * clean up * fixed job scheduler plugin spi jar resolution * cleaned up TODOs and changed job scheduler name --------- * TIF Job Runner Cleanup (#676) * merge conflicts * fixed java wildcards and changed update key name * integ test failing * fix job scheduler params * changed extension and has debug messages * clean up * fixed job scheduler plugin spi jar resolution * cleaned up TODOs and changed job scheduler name * removed google commons unused import, updated interval setting, removed rest action * removed policy file and updated name for job scheduler * responded to comments about parameter validator and TIFMetadata * refactored ThreatIntelFeedDataService and changed variables to public static final where possible * changed opensearch-sap-threatintel to opensearch-sap-threat-intel --------- * fix TIFJobParameter class * test detector updation when feed updation job runs * removed delete job scheduler code and cleaned up (#678) * working integ test (#680) * fix timeout of tif job creation * remove unncessary thread forking in put tif job action * refactoring code to address review comments * detector trigger detection types * pull out threat intel rest tests into separate test class * add detection types testing in detector trigger for rules and threat intel detection scenarios * add license header * add threat intel field aliases in mapping view response * fix threat intel feed parser * fix workflow failing test * spotless check failures fixed * remove dockerfile (#689) --------- Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Signed-off-by: Joanne Wang <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]>

…rces (opensearch-project#626) (opensearch-project#627) * in case of custom indices, allow moving alerts to history index Signed-off-by: Petar Dzepina <[email protected]> * empty commit Signed-off-by: Petar Dzepina <[email protected]> * added IT for custom datasources alert ack Signed-off-by: Petar Dzepina <[email protected]> Signed-off-by: Petar Dzepina <[email protected]> (cherry picked from commit 0740d9be59113a8e4c31a5370baabe9b31761f2c) Co-authored-by: Petar Dzepina <[email protected]>

jowg-amazon requested review from amsiglan, AWSHurneyt, getsaurabh02, lezzago, praveensameneni, sbcd90 and eirsep as code owners October 2, 2023 23:28

eirsep marked this pull request as draft October 2, 2023 23:29

eirsep reviewed Oct 2, 2023

View reviewed changes

eirsep reviewed Oct 3, 2023

View reviewed changes

prelim files

a78a9c1

Signed-off-by: Joanne Wang <[email protected]>

jowg-amazon force-pushed the jobscheduler branch from a1037b0 to 0419c56 Compare October 4, 2023 00:52

jowg-amazon added 2 commits October 4, 2023 18:32

prelim framework for jobscheduler and datasource

2b8bc06

Signed-off-by: Joanne Wang <[email protected]>

clean up files + added logs

e304b8c

Signed-off-by: Joanne Wang <[email protected]>

jowg-amazon added 3 commits October 4, 2023 18:32

temp

10ffd02

Signed-off-by: Joanne Wang <[email protected]>

remove lombok

152a61f

Signed-off-by: Joanne Wang <[email protected]>

updated job scheduler and ThreatIntelFeedDataService

7ffacb9

Signed-off-by: Joanne Wang <[email protected]>

jowg-amazon force-pushed the jobscheduler branch from f6cbebe to 7ffacb9 Compare October 5, 2023 01:33

eirsep approved these changes Oct 5, 2023

View reviewed changes

eirsep marked this pull request as ready for review October 5, 2023 02:02

eirsep merged commit 18f4498 into opensearch-project:feature/threat_intel_feeds Oct 5, 2023
3 checks passed

eirsep pushed a commit that referenced this pull request Oct 9, 2023

Preliminary framework for jobscheduler and datasource (#626)

1980f26

Signed-off-by: Joanne Wang <[email protected]>

jowg-amazon added a commit to jowg-amazon/security-analytics that referenced this pull request Oct 10, 2023

Preliminary framework for jobscheduler and datasource (opensearch-pro…

2286e66

…ject#626) Signed-off-by: Joanne Wang <[email protected]>

eirsep pushed a commit that referenced this pull request Oct 12, 2023

Preliminary framework for jobscheduler and datasource (#626)

0887d91

Signed-off-by: Joanne Wang <[email protected]>

eirsep pushed a commit that referenced this pull request Oct 16, 2023

Preliminary framework for jobscheduler and datasource (#626)

c193773

Signed-off-by: Joanne Wang <[email protected]>

jowg-amazon deleted the jobscheduler branch October 20, 2023 19:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Preliminary framework for jobscheduler and datasource #626

Preliminary framework for jobscheduler and datasource #626

jowg-amazon commented Oct 2, 2023

eirsep Oct 2, 2023 •

edited

Loading

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023 •

edited

Loading

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

eirsep Oct 3, 2023

Preliminary framework for jobscheduler and datasource #626

Preliminary framework for jobscheduler and datasource #626

Conversation

jowg-amazon commented Oct 2, 2023

Description

Issues Resolved

Check List

eirsep Oct 2, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eirsep Oct 3, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eirsep Oct 2, 2023 •

edited

Loading

eirsep Oct 3, 2023 •

edited

Loading