Skip to content

Commit 373497a

Browse files
agusruidiazgdagusruidiazgd
committed
add zod + schema
1 parent 162c759 commit 373497a

7 files changed

Lines changed: 133 additions & 2 deletions

File tree

‎x-pack/solutions/security/packages/test-api-clients/supertest/detections.gen.ts‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ import type {
5454
RulePreviewRequestBodyInput,
5555
} from '@kbn/security-solution-plugin/common/api/detection_engine/rule_preview/rule_preview.gen';
5656
import type { SearchAlertsRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/signals/query_signals/query_signals_route.gen';
57+
import type { SearchAttacksRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/attacks/search/search_route.gen';
5758
import type { SearchRulesRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/rule_management/search_rules/search_rules_route.gen';
5859
import type { SearchUnifiedAlertsRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/unified_alerts/search/search_route.gen';
5960
import type { SetAlertAssigneesRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/alert_assignees/set_alert_assignees_route.gen';
@@ -499,6 +500,17 @@ matching documents, and inspect execution logs. Pair `invocationCount` and `time
499500
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
500501
.send(props.body as object);
501502
},
503+
/**
504+
* Find and/or aggregate attack discovery alerts that match the given query. Searches scheduled and ad hoc attack discovery alert indices for the active space only.
505+
*/
506+
searchAttacks(props: SearchAttacksProps, kibanaSpace: string = 'default') {
507+
return supertest
508+
.post(getRouteUrlForSpace('/api/detection_engine/attacks/_search', kibanaSpace))
509+
.set('kbn-xsrf', 'true')
510+
.set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31')
511+
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
512+
.send(props.body as object);
513+
},
502514
/**
503515
* Retrieve a paginated list of detection rules with KQL filter, facet counts, and search_after pagination.
504516
*/
@@ -710,6 +722,9 @@ export interface RulePreviewProps {
710722
export interface SearchAlertsProps {
711723
body: SearchAlertsRequestBodyInput;
712724
}
725+
export interface SearchAttacksProps {
726+
body: SearchAttacksRequestBodyInput;
727+
}
713728
export interface SearchRulesProps {
714729
body: SearchRulesRequestBodyInput;
715730
}

‎x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/attacks/index.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
export * from './search/search_route.gen';

‎x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/attacks/search/search_route.gen.ts‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
/*
9+
* NOTICE: Do not edit this file manually.
10+
* This file is automatically generated by the OpenAPI Generator, @kbn/openapi-generator.
11+
*
12+
* info:
13+
* title: Attack discovery alerts search API endpoint
14+
* version: 2023-10-31
15+
*/
16+
17+
import { z, lazySchema } from '@kbn/zod/v4';
18+
19+
import { QueryAlertsBodyParams } from '../../signals/query_signals/query_signals_route.gen';
20+
21+
/**
22+
* Elasticsearch query and aggregation request
23+
*/
24+
export const SearchAttacksRequestBody = lazySchema(() => QueryAlertsBodyParams);
25+
export type SearchAttacksRequestBody = z.infer<typeof SearchAttacksRequestBody>;
26+
export type SearchAttacksRequestBodyInput = z.input<typeof SearchAttacksRequestBody>;
27+
28+
/**
29+
* Elasticsearch search response
30+
*/
31+
export const SearchAttacksResponse = lazySchema(() => z.object({}).catchall(z.unknown()));
32+
export type SearchAttacksResponse = z.infer<typeof SearchAttacksResponse>;

‎x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/attacks/search/search_route.schema.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
openapi: 3.0.0
2+
info:
3+
title: Attack discovery alerts search API endpoint
4+
version: '2023-10-31'
5+
paths:
6+
/api/detection_engine/attacks/_search:
7+
post:
8+
x-labels: [serverless, ess]
9+
x-internal: true
10+
operationId: SearchAttacks
11+
x-codegen-enabled: true
12+
summary: Find and/or aggregate attack discovery alerts
13+
description: Find and/or aggregate attack discovery alerts that match the given query. Searches scheduled and ad hoc attack discovery alert indices for the active space only.
14+
tags:
15+
- Attacks API
16+
requestBody:
17+
description: Search and/or aggregation query
18+
required: true
19+
content:
20+
application/json:
21+
schema:
22+
description: Elasticsearch query and aggregation request
23+
$ref: '../../signals/query_signals/query_signals_route.schema.yaml#/components/schemas/QueryAlertsBodyParams'
24+
responses:
25+
200:
26+
description: Successful response
27+
content:
28+
application/json:
29+
schema:
30+
type: object
31+
additionalProperties: true
32+
description: Elasticsearch search response
33+
400:
34+
description: Invalid input data response
35+
content:
36+
application/json:
37+
schema:
38+
oneOf:
39+
- $ref: '../../../model/error_responses.schema.yaml#/components/schemas/PlatformErrorResponse'
40+
- $ref: '../../../model/error_responses.schema.yaml#/components/schemas/SiemErrorResponse'
41+
401:
42+
description: Unsuccessful authentication response
43+
content:
44+
application/json:
45+
schema:
46+
$ref: '../../../model/error_responses.schema.yaml#/components/schemas/PlatformErrorResponse'
47+
500:
48+
description: Internal server error response
49+
content:
50+
application/json:
51+
schema:
52+
$ref: '../../../model/error_responses.schema.yaml#/components/schemas/SiemErrorResponse'

‎x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77

88
export * from './alert_assignees';
99
export * from './alert_tags';
10+
export * from './attacks';
1011
export * from './fleet_integrations';
1112
export * from './index_management';
1213
export * from './model';

‎x-pack/solutions/security/plugins/security_solution/common/api/quickstart_client.gen.ts‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ import type {
2828
SetAlertTagsRequestBodyInput,
2929
SetAlertTagsResponse,
3030
} from './detection_engine/alert_tags/set_alert_tags/set_alert_tags.gen';
31+
import type {
32+
SearchAttacksRequestBodyInput,
33+
SearchAttacksResponse,
34+
} from './detection_engine/attacks/search/search_route.gen';
3135
import type { CreateAlertsIndexResponse } from './detection_engine/index_management/create_index/create_index.gen';
3236
import type { DeleteAlertsIndexResponse } from './detection_engine/index_management/delete_index/delete_index.gen';
3337
import type { ReadAlertsIndexResponse } from './detection_engine/index_management/read_index/read_index.gen';
@@ -3191,6 +3195,22 @@ matching documents, and inspect execution logs. Pair `invocationCount` and `time
31913195
})
31923196
.catch(catchAxiosErrorFormatAndThrow);
31933197
}
3198+
/**
3199+
* Find and/or aggregate attack discovery alerts that match the given query. Searches scheduled and ad hoc attack discovery alert indices for the active space only.
3200+
*/
3201+
async searchAttacks(props: SearchAttacksProps) {
3202+
this.log.info(`${new Date().toISOString()} Calling API SearchAttacks`);
3203+
return this.kbnClient
3204+
.request<SearchAttacksResponse>({
3205+
path: '/api/detection_engine/attacks/_search',
3206+
headers: {
3207+
[ELASTIC_HTTP_VERSION_HEADER]: '2023-10-31',
3208+
},
3209+
method: 'POST',
3210+
body: props.body,
3211+
})
3212+
.catch(catchAxiosErrorFormatAndThrow);
3213+
}
31943214
async searchPrivilegesIndices(props: SearchPrivilegesIndicesProps) {
31953215
this.log.info(`${new Date().toISOString()} Calling API SearchPrivilegesIndices`);
31963216
return this.kbnClient
@@ -4151,6 +4171,9 @@ export interface ScheduleRiskEngineNowProps {
41514171
export interface SearchAlertsProps {
41524172
body: SearchAlertsRequestBodyInput;
41534173
}
4174+
export interface SearchAttacksProps {
4175+
body: SearchAttacksRequestBodyInput;
4176+
}
41544177
export interface SearchPrivilegesIndicesProps {
41554178
query: SearchPrivilegesIndicesRequestQueryInput;
41564179
}

‎x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/routes/attacks/search_attacks_route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import { ATTACK_DISCOVERY_ALERTS_COMMON_INDEX_PREFIX } from '@kbn/elastic-assist
99
import { buildRouteValidationWithZod } from '@kbn/zod-helpers/v4';
1010
import { ALERTS_API_READ } from '@kbn/security-solution-features/constants';
1111

12-
import { SearchAlertsRequestBody } from '../../../../../common/api/detection_engine/signals';
12+
import { SearchAttacksRequestBody } from '../../../../../common/api/detection_engine/attacks';
1313
import { DETECTION_ENGINE_ATTACKS_SEARCH_URL } from '../../../../../common/constants';
1414
import type { SecuritySolutionPluginRouter } from '../../../../types';
1515
import { searchAlertsHandler } from '../common/search_alerts_handler';
@@ -33,7 +33,7 @@ export const searchAttacksRoute = (router: SecuritySolutionPluginRouter) => {
3333
version: '2023-10-31',
3434
validate: {
3535
request: {
36-
body: buildRouteValidationWithZod(SearchAlertsRequestBody),
36+
body: buildRouteValidationWithZod(SearchAttacksRequestBody),
3737
},
3838
},
3939
},

0 commit comments

Comments
 (0)