Skip to content

Commit 7a98aa1

Browse files
opaulohopauloh
authored
[Cloud Security] Update Findings page runtime fields required for third party data compatibility (elastic#198635)
## Summary This PR enhances the solution proposed by [this PR](elastic#195702), by picking only the fields that are currently not mapped by the current Third Party integrations, this fixes performance degradation identified during the QA cycle of 8.16.0. Fixes: - elastic/security-team#11034 ### Misconfiguration Runtime fields - **rule.benchmark.rule_number**: runtime mapping kept because this field is missing on `security_solution-aws.misconfiguration_latest-v1` causing filtering out data when sorting by **Rule Number** column on the Misconfigurations Data Table. - **rule.section**: runtime mapping kept because this field is missing on `security_solution-aws.misconfiguration_latest-v1` causing filtering out data when sorting by **Framework Section** column on the Misconfigurations Data Table. - **resource.sub_type**: runtime mapping kept because this field is missing on `security_solution-aws.misconfiguration_latest-v1` causing filtering out data when sorting by **Resource Type** column on the Misconfigurations Data Table. - **orchestrator.cluster.name**: runtime mapping kept because this field is missing on `security_solution-wiz.misconfiguration_latest-v1` causing filtering out data when grouping by **Kubernetes Cluster** column on the Misconfigurations page. - **cloud.account.name**: runtime mapping kept because this field is missing on `security_solution-aws.misconfiguration_latest-v1` causing filtering out data when grouping by **Kubernetes Cluster** column on the Misconfigurations page. ### Vulnerability Runtime Fields: - **observer.vendor**: runtime mapping added because this field is mapped as `text` on `security_solution-wiz.vulnerability_latest-v1` causing filtering out when sorting by the **Vendor** column on the Vulnerability Data Table - **cloud.provider**: runtime mapping added because this field is mapped as `text` on `security_solution-wiz.vulnerability_latest-v1` causing filtering out when grouping by **Cloud Account** on the Vulnerability page. (This field is needed in order to retrieve the Cloud Provider name and icon) ## Screenshot - Left: After the changes / Right: Current https://github.com/user-attachments/assets/2cbdd8b7-131c-42e4-a881-632f8cd3854b https://github.com/user-attachments/assets/4372feb6-4c01-4047-a90a-d6728f9400fe https://github.com/user-attachments/assets/b9e32514-f2ee-4e4d-ba5f-ea3e20d4d0b2
1 parent 631ccb0 commit 7a98aa1

File tree

8 files changed

+80
-123
lines changed

8 files changed

+80
-123
lines changed

‎x-pack/plugins/cloud_security_posture/common/utils/helpers.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@ export const getBenchmarkApplicableTo = (benchmarkId: BenchmarksCisId) => {
214214
};
215215

216216
export const getCloudProviderNameFromAbbreviation = (cloudProvider: string) => {
217-
switch (cloudProvider) {
217+
switch (cloudProvider.toLowerCase()) {
218218
case 'azure':
219219
return CLOUD_PROVIDER_NAMES.AZURE;
220220
case 'aws':

‎x-pack/plugins/cloud_security_posture/public/common/constants.ts‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,3 +256,33 @@ export const VULNERABILITY_GROUPING_OPTIONS = {
256256
CLOUD_ACCOUNT_NAME: VULNERABILITY_FIELDS.CLOUD_ACCOUNT_NAME,
257257
CVE: VULNERABILITY_FIELDS.VULNERABILITY_ID,
258258
};
259+
260+
/*
261+
The fields below are default columns of the Cloud Security Data Table that need to have keyword mapping.
262+
The runtime mappings are used to prevent filtering out the data when any of these columns are sorted in the Data Table.
263+
TODO: Remove the fields below once they are mapped as Keyword in the Third Party integrations, or remove
264+
the fields from the runtime mappings if they are removed from the Data Table.
265+
*/
266+
export const CDR_VULNERABILITY_DATA_TABLE_RUNTIME_MAPPING_FIELDS: string[] = [
267+
VULNERABILITY_FIELDS.VENDOR,
268+
];
269+
export const CDR_MISCONFIGURATION_DATA_TABLE_RUNTIME_MAPPING_FIELDS: string[] = [
270+
'rule.benchmark.rule_number',
271+
'rule.section',
272+
'resource.sub_type',
273+
];
274+
275+
/*
276+
The fields below are used to group the data in the Cloud Security Data Table.
277+
The keys are the fields that are used to group the data, and the values are the fields that need to have keyword mapping
278+
to prevent filtering out the data when grouping by the key field.
279+
TODO: Remove the fields below once they are mapped as Keyword in the Third Party integrations, or remove
280+
the fields from the runtime mappings if they are removed from the Data Table.
281+
*/
282+
export const CDR_VULNERABILITY_GROUPING_RUNTIME_MAPPING_FIELDS: Record<string, string[]> = {
283+
[VULNERABILITY_GROUPING_OPTIONS.CLOUD_ACCOUNT_NAME]: [VULNERABILITY_FIELDS.CLOUD_PROVIDER],
284+
};
285+
export const CDR_MISCONFIGURATION_GROUPING_RUNTIME_MAPPING_FIELDS: Record<string, string[]> = {
286+
[FINDINGS_GROUPING_OPTIONS.ORCHESTRATOR_CLUSTER_NAME]: ['orchestrator.cluster.name'],
287+
[FINDINGS_GROUPING_OPTIONS.CLOUD_ACCOUNT_NAME]: ['cloud.account.name'],
288+
};

‎x-pack/plugins/cloud_security_posture/public/components/cloud_provider_icon.tsx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ interface Props {
1818
}
1919

2020
const getCloudProviderIcon = (cloudProvider: string) => {
21-
switch (cloudProvider) {
21+
switch (cloudProvider.toLowerCase()) {
2222
case 'azure':
2323
return 'logoAzure';
2424
case 'aws':

‎x-pack/plugins/cloud_security_posture/public/pages/configurations/latest_findings/use_grouped_findings.tsx‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,6 @@ export interface FindingsGroupingAggregation {
5252
resourceSubType?: {
5353
buckets?: GenericBuckets[];
5454
};
55-
resourceType?: {
56-
buckets?: GenericBuckets[];
57-
};
5855
benchmarkName?: {
5956
buckets?: GenericBuckets[];
6057
};

‎x-pack/plugins/cloud_security_posture/public/pages/configurations/latest_findings/use_latest_findings.ts‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import type { CspBenchmarkRulesStates } from '@kbn/cloud-security-posture-common
2222
import type { FindingsBaseEsQuery } from '@kbn/cloud-security-posture';
2323
import { useGetCspBenchmarkRulesStatesApi } from '@kbn/cloud-security-posture/src/hooks/use_get_benchmark_rules_state_api';
2424
import type { RuntimePrimitiveTypes } from '@kbn/data-views-plugin/common';
25+
import { CDR_MISCONFIGURATION_DATA_TABLE_RUNTIME_MAPPING_FIELDS } from '../../../common/constants';
2526
import { useKibana } from '../../../common/hooks/use_kibana';
2627
import { getAggregationCount, getFindingsCountAggQuery } from '../utils/utils';
2728

@@ -41,17 +42,18 @@ interface FindingsAggs {
4142
}
4243

4344
const getRuntimeMappingsFromSort = (sort: string[][]) => {
44-
return sort.reduce((acc, [field]) => {
45-
// TODO: Add proper type for all fields available in the field selector
46-
const type: RuntimePrimitiveTypes = field === '@timestamp' ? 'date' : 'keyword';
45+
return sort
46+
.filter(([field]) => CDR_MISCONFIGURATION_DATA_TABLE_RUNTIME_MAPPING_FIELDS.includes(field))
47+
.reduce((acc, [field]) => {
48+
const type: RuntimePrimitiveTypes = 'keyword';
4749

48-
return {
49-
...acc,
50-
[field]: {
51-
type,
52-
},
53-
};
54-
}, {});
50+
return {
51+
...acc,
52+
[field]: {
53+
type,
54+
},
55+
};
56+
}, {});
5557
};
5658

5759
export const getFindingsQuery = (

‎x-pack/plugins/cloud_security_posture/public/pages/configurations/latest_findings/use_latest_findings_grouping.tsx‎

Lines changed: 11 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import {
2121
} from '@kbn/cloud-security-posture-common';
2222
import { useGetCspBenchmarkRulesStatesApi } from '@kbn/cloud-security-posture/src/hooks/use_get_benchmark_rules_state_api';
2323
import {
24+
CDR_MISCONFIGURATION_GROUPING_RUNTIME_MAPPING_FIELDS,
2425
FINDINGS_GROUPING_OPTIONS,
2526
LOCAL_STORAGE_FINDINGS_GROUPING_KEY,
2627
} from '../../../common/constants';
@@ -90,7 +91,6 @@ const getAggregationsByGroupField = (field: string): NamedAggregation[] => {
9091
...aggMetrics,
9192
getTermAggregation('resourceName', 'resource.id'),
9293
getTermAggregation('resourceSubType', 'resource.sub_type'),
93-
getTermAggregation('resourceType', 'resource.type'),
9494
];
9595
case FINDINGS_GROUPING_OPTIONS.RULE_NAME:
9696
return [
@@ -122,62 +122,18 @@ const getAggregationsByGroupField = (field: string): NamedAggregation[] => {
122122
const getRuntimeMappingsByGroupField = (
123123
field: string
124124
): Record<string, { type: 'keyword' }> | undefined => {
125-
switch (field) {
126-
case FINDINGS_GROUPING_OPTIONS.RESOURCE_NAME:
127-
return {
128-
[FINDINGS_GROUPING_OPTIONS.RESOURCE_NAME]: {
129-
type: 'keyword',
130-
},
131-
'resource.id': {
132-
type: 'keyword',
133-
},
134-
'resource.sub_type': {
135-
type: 'keyword',
136-
},
137-
'resource.type': {
138-
type: 'keyword',
139-
},
140-
};
141-
case FINDINGS_GROUPING_OPTIONS.RULE_NAME:
142-
return {
143-
[FINDINGS_GROUPING_OPTIONS.RULE_NAME]: {
144-
type: 'keyword',
145-
},
146-
'rule.benchmark.version': {
147-
type: 'keyword',
148-
},
149-
};
150-
case FINDINGS_GROUPING_OPTIONS.CLOUD_ACCOUNT_NAME:
151-
return {
152-
[FINDINGS_GROUPING_OPTIONS.CLOUD_ACCOUNT_NAME]: {
125+
if (CDR_MISCONFIGURATION_GROUPING_RUNTIME_MAPPING_FIELDS?.[field]) {
126+
return CDR_MISCONFIGURATION_GROUPING_RUNTIME_MAPPING_FIELDS[field].reduce(
127+
(acc, runtimeField) => ({
128+
...acc,
129+
[runtimeField]: {
153130
type: 'keyword',
154131
},
155-
'rule.benchmark.name': {
156-
type: 'keyword',
157-
},
158-
'rule.benchmark.id': {
159-
type: 'keyword',
160-
},
161-
};
162-
case FINDINGS_GROUPING_OPTIONS.ORCHESTRATOR_CLUSTER_NAME:
163-
return {
164-
[FINDINGS_GROUPING_OPTIONS.ORCHESTRATOR_CLUSTER_NAME]: {
165-
type: 'keyword',
166-
},
167-
'rule.benchmark.name': {
168-
type: 'keyword',
169-
},
170-
'rule.benchmark.id': {
171-
type: 'keyword',
172-
},
173-
};
174-
default:
175-
return {
176-
[field]: {
177-
type: 'keyword',
178-
},
179-
};
132+
}),
133+
{}
134+
);
180135
}
136+
return {};
181137
};
182138

183139
/**
@@ -255,12 +211,7 @@ export const useLatestFindingsGrouping = ({
255211
size: pageSize,
256212
sort: [{ groupByField: { order: 'desc' } }, { complianceScore: { order: 'asc' } }],
257213
statsAggregations: getAggregationsByGroupField(currentSelectedGroup),
258-
runtimeMappings: {
259-
...getRuntimeMappingsByGroupField(currentSelectedGroup),
260-
'result.evaluation': {
261-
type: 'keyword',
262-
},
263-
},
214+
runtimeMappings: getRuntimeMappingsByGroupField(currentSelectedGroup),
264215
rootAggregations: [
265216
{
266217
failedFindings: {

‎x-pack/plugins/cloud_security_posture/public/pages/vulnerabilities/hooks/use_latest_vulnerabilities.tsx‎

Lines changed: 15 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,10 @@ import {
2424
import { FindingsBaseEsQuery, showErrorToast } from '@kbn/cloud-security-posture';
2525
import type { CspVulnerabilityFinding } from '@kbn/cloud-security-posture-common/schema/vulnerabilities/latest';
2626
import type { RuntimePrimitiveTypes } from '@kbn/data-views-plugin/common';
27-
import { VULNERABILITY_FIELDS } from '../../../common/constants';
27+
import {
28+
CDR_VULNERABILITY_DATA_TABLE_RUNTIME_MAPPING_FIELDS,
29+
VULNERABILITY_FIELDS,
30+
} from '../../../common/constants';
2831
import { useKibana } from '../../../common/hooks/use_kibana';
2932
import { getCaseInsensitiveSortScript } from '../utils/custom_sort_script';
3033
type LatestFindingsRequest = IKibanaSearchRequest<SearchRequest>;
@@ -54,22 +57,18 @@ const getMultiFieldsSort = (sort: string[][]) => {
5457
};
5558

5659
const getRuntimeMappingsFromSort = (sort: string[][]) => {
57-
return sort.reduce((acc, [field]) => {
58-
// TODO: Add proper type for all fields available in the field selector
59-
const type: RuntimePrimitiveTypes =
60-
field === VULNERABILITY_FIELDS.SCORE_BASE
61-
? 'double'
62-
: field === '@timestamp'
63-
? 'date'
64-
: 'keyword';
60+
return sort
61+
.filter(([field]) => CDR_VULNERABILITY_DATA_TABLE_RUNTIME_MAPPING_FIELDS.includes(field))
62+
.reduce((acc, [field]) => {
63+
const type: RuntimePrimitiveTypes = 'keyword';
6564

66-
return {
67-
...acc,
68-
[field]: {
69-
type,
70-
},
71-
};
72-
}, {});
65+
return {
66+
...acc,
67+
[field]: {
68+
type,
69+
},
70+
};
71+
}, {});
7372
};
7473

7574
export const getVulnerabilitiesQuery = (

‎x-pack/plugins/cloud_security_posture/public/pages/vulnerabilities/hooks/use_latest_vulnerabilities_grouping.tsx‎

Lines changed: 10 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import {
2323
LOCAL_STORAGE_VULNERABILITIES_GROUPING_KEY,
2424
VULNERABILITY_GROUPING_OPTIONS,
2525
VULNERABILITY_FIELDS,
26+
CDR_VULNERABILITY_GROUPING_RUNTIME_MAPPING_FIELDS,
2627
} from '../../../common/constants';
2728
import { useDataViewContext } from '../../../common/contexts/data_view_context';
2829
import {
@@ -102,41 +103,18 @@ const getAggregationsByGroupField = (field: string): NamedAggregation[] => {
102103
const getRuntimeMappingsByGroupField = (
103104
field: string
104105
): Record<string, { type: 'keyword' }> | undefined => {
105-
switch (field) {
106-
case VULNERABILITY_GROUPING_OPTIONS.CLOUD_ACCOUNT_NAME:
107-
return {
108-
[VULNERABILITY_GROUPING_OPTIONS.CLOUD_ACCOUNT_NAME]: {
109-
type: 'keyword',
110-
},
111-
[VULNERABILITY_FIELDS.CLOUD_PROVIDER]: {
112-
type: 'keyword',
113-
},
114-
};
115-
case VULNERABILITY_GROUPING_OPTIONS.RESOURCE_NAME:
116-
return {
117-
[VULNERABILITY_GROUPING_OPTIONS.RESOURCE_NAME]: {
118-
type: 'keyword',
119-
},
120-
[VULNERABILITY_FIELDS.RESOURCE_ID]: {
121-
type: 'keyword',
122-
},
123-
};
124-
case VULNERABILITY_GROUPING_OPTIONS.CVE:
125-
return {
126-
[VULNERABILITY_GROUPING_OPTIONS.CVE]: {
127-
type: 'keyword',
128-
},
129-
[VULNERABILITY_FIELDS.DESCRIPTION]: {
130-
type: 'keyword',
131-
},
132-
};
133-
default:
134-
return {
135-
[field]: {
106+
if (CDR_VULNERABILITY_GROUPING_RUNTIME_MAPPING_FIELDS?.[field]) {
107+
return CDR_VULNERABILITY_GROUPING_RUNTIME_MAPPING_FIELDS[field].reduce(
108+
(acc, runtimeField) => ({
109+
...acc,
110+
[runtimeField]: {
136111
type: 'keyword',
137112
},
138-
};
113+
}),
114+
{}
115+
);
139116
}
117+
return {};
140118
};
141119

142120
/**

0 commit comments

Comments
 (0)