Refactor search handler events refactor

CHANGELOG.md

@@ -4,6 +4,9 @@ All notable changes to the Wazuh app for Splunk project will be documented in th
 
 ## Wazuh v4.3.4 - Splunk Enterprise v8.1.[1-10], v8.2.x - Revision 4307
 
+### Changed
+- Improved Splunk search-handler event management to avoid forwarder toast error mis-interpretation. [#1327](https://github.com/wazuh/wazuh-splunk/pull/1327)
+
 ### Fixed
 - Fixed unhandled expired session when requesting Splunk DB documents. [#1329](https://github.com/wazuh/wazuh-splunk/pull/1329)
 

SplunkAppForWazuh/appserver/static/js/controllers/agents/agents/agents.html

@@ -119,13 +119,13 @@
                   <p>Most active agent</p>
                 </div>
                 <p
-                  ng-if="lastAgent && lastAgent.id && mostActiveAgent.id !== '000'"
+                  ng-if="lastAgent && lastAgent.id && mostActiveAgent.id !== '000' && mostActiveAgent"
                   ng-click="showAgent(mostActiveAgent)"
                   class="euiTitle euiTitle--small euiStat__title wz-text-link cursor-pointer">
                   {{mostActiveAgent}}
                 </p>
                 <p
-                  ng-if="!lastAgent || !lastAgent.id"
+                  ng-if="!lastAgent || !lastAgent.id || !mostActiveAgent"
                   class="euiTitle euiTitle--small euiStat__title">
                   -
                 </p>

SplunkAppForWazuh/appserver/static/js/controllers/agents/audit/agentsAuditCtrl.js

@@ -61,6 +61,13 @@ define([
         $urlTokenModel,
         $notificationService
       )
+
+      const DEFAULT_METRIC_VALUES = '-'
+      this.scope.newFiles = DEFAULT_METRIC_VALUES
+      this.scope.readFiles = DEFAULT_METRIC_VALUES
+      this.scope.filesModifiedToken = DEFAULT_METRIC_VALUES
+      this.scope.filesDeleted = DEFAULT_METRIC_VALUES
+
       this.scope.reportingEnabled = reportingEnabled
       this.scope.extensions = extensions
       this.agent = agent

SplunkAppForWazuh/appserver/static/js/controllers/agents/ciscat/agentsCiscatCtrl.js

@@ -68,6 +68,16 @@ define([
         this.state.go('overview')
       }
 
+      const DEFAULT_KPI_VALUE = '-'
+      this.scope.lastNotChecked = DEFAULT_KPI_VALUE
+      this.scope.lastPass = DEFAULT_KPI_VALUE
+      this.scope.lastScanScore = DEFAULT_KPI_VALUE
+      this.scope.lastScanDate = DEFAULT_KPI_VALUE
+      this.scope.lastErrors = DEFAULT_KPI_VALUE
+      this.scope.lastFails = DEFAULT_KPI_VALUE
+      this.scope.lastUnknown = DEFAULT_KPI_VALUE
+      this.scope.lastScanBenchmark = DEFAULT_KPI_VALUE
+
       this.scope.reportingEnabled = reportingEnabled
       this.scope.extensions = extensions
       this.agent = agent

SplunkAppForWazuh/appserver/static/js/controllers/agents/general/agentsGeneralCtrl.js

@@ -68,6 +68,13 @@ define([
         $urlTokenModel,
         $notificationService
       )
+
+      const DEFAULT_METRIC_VALUES = '-'
+      this.scope.totalAlerts = DEFAULT_METRIC_VALUES
+      this.scope.levelTwelve = DEFAULT_METRIC_VALUES
+      this.scope.authFailure = DEFAULT_METRIC_VALUES
+      this.scope.authSuccess = DEFAULT_METRIC_VALUES
+
       this.scope.reportingEnabled = reportingEnabled
       this.requestService = $requestService
       this.notification = $notificationService

SplunkAppForWazuh/appserver/static/js/controllers/agents/scap/agentsOpenScapCtrl.js

@@ -65,6 +65,12 @@ define([
         $urlTokenModel,
         $notificationService
       )
+
+      const DEFAULT_METRIC_VALUES = '0'
+      this.scope.scapLastScore = DEFAULT_METRIC_VALUES
+      this.scope.scapHighestScore = DEFAULT_METRIC_VALUES
+      this.scope.scapLowestScore = DEFAULT_METRIC_VALUES
+
       this.scope.reportingEnabled = reportingEnabled
       this.scope.extensions = extensions
       this.agent = agent

SplunkAppForWazuh/appserver/static/js/controllers/agents/vulnerabilities/agentsVulnerabilitiesCtrl.js

@@ -63,6 +63,13 @@ define([
         $urlTokenModel,
         $notificationService
       )
+
+      const DEFAULT_METRIC_VALUES = '-'
+      this.scope.criticalSeverity = DEFAULT_METRIC_VALUES
+      this.scope.highSeverity = DEFAULT_METRIC_VALUES
+      this.scope.mediumSeverity = DEFAULT_METRIC_VALUES
+      this.scope.lowSeverity = DEFAULT_METRIC_VALUES
+
       this.scope.reportingEnabled = reportingEnabled
       this.scope.extensions = extensions
       this.currentDataService.addFilter(

SplunkAppForWazuh/appserver/static/js/controllers/overview/audit/overviewAuditCtrl.js

@@ -60,6 +60,13 @@ define([
         $urlTokenModel,
         $notificationService
       )
+
+      const DEFAULT_METRIC_VALUES = '-'
+      this.scope.newFiles = DEFAULT_METRIC_VALUES
+      this.scope.readFiles = DEFAULT_METRIC_VALUES
+      this.scope.filesModifiedToken = DEFAULT_METRIC_VALUES
+      this.scope.filesDeleted = DEFAULT_METRIC_VALUES
+
       this.notification = $notificationService
       this.scope.reportingEnabled = reportingEnabled
       this.scope.extensions = extensions

SplunkAppForWazuh/appserver/static/js/controllers/overview/ciscat/ciscatCtrl.js

@@ -57,6 +57,17 @@ define([
         $urlTokenModel,
         $notificationService
       )
+
+      const DEFAULT_KPI_VALUE = '-'
+      this.scope.lastNotChecked = DEFAULT_KPI_VALUE
+      this.scope.lastPass = DEFAULT_KPI_VALUE
+      this.scope.lastScanScore = DEFAULT_KPI_VALUE
+      this.scope.lastScanDate = DEFAULT_KPI_VALUE
+      this.scope.lastErrors = DEFAULT_KPI_VALUE
+      this.scope.lastFails = DEFAULT_KPI_VALUE
+      this.scope.lastUnknown = DEFAULT_KPI_VALUE
+      this.scope.lastScanBenchmark = DEFAULT_KPI_VALUE
+
       this.scope.reportingEnabled = reportingEnabled
       this.scope.extensions = extensions
       this.addFilter = $currentDataService.addFilter
@@ -178,6 +189,16 @@ define([
      */
     $onInit() {
       try {
+        const DEFAULT_KPI_VALUE = '-'
+        this.scope.lastNotChecked = DEFAULT_KPI_VALUE
+        this.scope.lastPass = DEFAULT_KPI_VALUE
+        this.scope.lastScanScore = DEFAULT_KPI_VALUE
+        this.scope.lastScanDate = DEFAULT_KPI_VALUE
+        this.scope.lastErrors = DEFAULT_KPI_VALUE
+        this.scope.lastFails = DEFAULT_KPI_VALUE
+        this.scope.lastUnknown = DEFAULT_KPI_VALUE
+        this.scope.lastScanBenchmark = DEFAULT_KPI_VALUE
+
         this.addFilter(`{"rule.groups{}":"ciscat", "implicit":true}`)
         /**
          * Generates report

SplunkAppForWazuh/appserver/static/js/controllers/overview/general/overviewGeneralCtrl.js

@@ -66,6 +66,13 @@ define([
         $notificationService
       )
       this.rootScope = $rootScope
+
+      const DEFAULT_METRIC_VALUES = '-'
+      this.scope.totalAlerts = DEFAULT_METRIC_VALUES
+      this.scope.levelTwelve = DEFAULT_METRIC_VALUES
+      this.scope.authFailure = DEFAULT_METRIC_VALUES
+      this.scope.authSuccess = DEFAULT_METRIC_VALUES
+
       this.scope.reportingEnabled = reportingEnabled
       this.scope.awsExtensionEnabled = awsExtensionEnabled
       this.apiReq = $requestService.apiReq

SplunkAppForWazuh/appserver/static/js/controllers/overview/scap/overviewOpenScapCtrl.js

@@ -67,6 +67,12 @@ define([
         $urlTokenModel,
         $notificationService
       )
+
+      const DEFAULT_METRIC_VALUES = '0'
+      this.scope.scapLastScore = DEFAULT_METRIC_VALUES
+      this.scope.scapHighestScore = DEFAULT_METRIC_VALUES
+      this.scope.scapLowestScore = DEFAULT_METRIC_VALUES
+
       this.notification = $notificationService
       this.scope.reportingEnabled = reportingEnabled
       this.scope.extensions = extensions

SplunkAppForWazuh/appserver/static/js/controllers/overview/vulnerabilities/overviewVulnerabilitiesCtrl.js

@@ -59,6 +59,13 @@ define([
         $urlTokenModel,
         $notificationService
       )
+
+      const DEFAULT_METRIC_VALUES = '-'
+      this.scope.criticalSeverity = DEFAULT_METRIC_VALUES
+      this.scope.highSeverity = DEFAULT_METRIC_VALUES
+      this.scope.mediumSeverity = DEFAULT_METRIC_VALUES
+      this.scope.lowSeverity = DEFAULT_METRIC_VALUES
+
       this.scope.reportingEnabled = reportingEnabled
       this.scope.extensions = extensions
       this.currentDataService.addFilter(

SplunkAppForWazuh/appserver/static/js/services/app-version/appVersionService.js

@@ -1,6 +1,6 @@
 const UI_METADATA = {
-  "version": "4.3.4",
-  "revision": "4307"
+  "version": "4.3.3",
+  "revision": "4306"
 }
 
 define(['../module'], function (module) {

SplunkAppForWazuh/appserver/static/js/services/visualizations/search/search-handler.js

@@ -4,8 +4,8 @@ define(['splunkjs/mvc/simplexml/searcheventhandler', '../viz/viz'], function (
 ) {
   'use strict'
 
-  const FORWARDER_ERROR =
-    'Unable to retrieve results. It may be due to a connection problem with the Splunk forwarder,\nplease try restarting this service.'
+  const FORWARDER_ERROR = `Unable to retrieve results.\n
+  It may be due to a connection problem with the Splunk forwarder,\nplease try restarting this service.`
 
   return class SearchHandler extends Viz {
     /**
@@ -61,7 +61,7 @@ define(['splunkjs/mvc/simplexml/searcheventhandler', '../viz/viz'], function (
       })
 
       this.getSearch().on('search:error', (error) => {
-        console.error(error)
+        console.error('search:error', error)
       })
 
       this.getSearch().on('search:progress', () => {
@@ -74,35 +74,26 @@ define(['splunkjs/mvc/simplexml/searcheventhandler', '../viz/viz'], function (
         if (this.loading) {
           this.scope[this.loadingBindedValue] = false
         }
-        const result = this.submittedTokenModel.get(this.token)
-        if (
-          result &&
-          result !== value &&
-          typeof result !== 'undefined' &&
-          result !== 'undefined'
-        ) {
-          this.scope[bindedValue] = result
-        } else {
-          this.scope[bindedValue] = '0'
-          this.notification && this.notification.showErrorToast(FORWARDER_ERROR)
-        }
-        this.scope.$applyAsync()
-      })
-
-      this.submittedTokenModel.on(`change:${this.token}`, () => {
-        const loadedTokenJS = this.submittedTokenModel.get(this.token)
-        if (
-          loadedTokenJS &&
-          loadedTokenJS !== value &&
-          typeof loadedTokenJS !== 'undefined' &&
-          loadedTokenJS !== 'undefined'
-        ) {
-          this.scope[bindedValue] = loadedTokenJS
-        } else {
-          this.scope[bindedValue] = '0'
-          this.notification && this.notification.showErrorToast(FORWARDER_ERROR)
-        }
-        this.scope.$applyAsync()
+
+        // More info in:
+        // https://docs.splunk.com/DocumentationStatic/WebFramework/1.5/compref_splunkresultsmodel.html#top
+        const resultModel = this.search.data('results')
+        resultModel.on('data', (data) => {
+          try {
+            if (data.hasData()) {
+              const result = this.submittedTokenModel.get(this.token)
+              this.scope[bindedValue] = result
+              this.scope.$applyAsync()
+            }
+          } catch (err) {
+            console.error('Error fetching table data ', err)
+          }
+        })
+        resultModel.on('error', (err) => {
+          console.error('Search Handler - onError: ', err)
+        })
+        if (!this.search.query?.changed?.data?.resultCount)
+          this.notification && this.notification.showWarningToast(FORWARDER_ERROR)
       })
 
       this.initSearch()

SplunkAppForWazuh/default/app.conf

@@ -3,7 +3,7 @@ is_visible = 1
 label = Wazuh
 
 [launcher]
-version = 4.3.4
+version = 4.3.3
 author = [email protected]
 description = Wazuh helps you to gain deeper security visibility into your infrastructure by monitoring hosts at an operating system and application level.
 

package.json

@@ -39,7 +39,7 @@
     "pretty": "prettier --config .prettierrc --write SplunkAppForWazuh/**/*.js SplunkAppForWazuh/**/*.html SplunkAppForWazuh/**/*.css !SplunkAppForWazuh/appserver/static/js/libs/** !SplunkAppForWazuh/appserver/static/js/utils/codemirror/**",
     "test": "mocha tests/manager.js"
   },
-  "version": "4.3.4",
-  "revision": "4307",
+  "version": "4.3.3",
+  "revision": "4306",
   "splunk": "8.2.6"
 }