TheHive Case Connector #180138

brijesh-elastic · 2024-04-05T11:06:25Z

Summary

TheHive is a new case connector, enabling users to seamlessly transfer elastic cases to TheHive Security Incident Response Platform. This connector facilitates sub-actions such as creating cases, updating cases, and adding comments and creating alerts.

create connector

test connector

create case

create alert

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Flaky Test Runner was used on any tests changed
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2024-04-05T12:57:59Z

Pinging @elastic/response-ops-cases (Feature:Cases)

elasticmachine · 2024-04-05T12:57:59Z

Pinging @elastic/response-ops (Team:ResponseOps)

cnasikas

I did a lightweight review and left some comments. I will leave the full review and testing to the Security solution team.

cnasikas · 2024-04-10T09:58:13Z

x-pack/plugins/stack_connectors/common/thehive/constants.ts

+  PUSH_TO_SERVICE = 'pushToService',
+  CREATE_ALERT = 'createAlert',
+}
+export enum TheHiveSeverity {


I remember discussing it but just to be sure, are we sure that the severity and the TLP values are fixed and cannot be changed by users in TheHive?

Correct, users can't change or add new enum for severity and TLP in TheHive.

I confirm, the TLP, PAP and Severity are static values in TheHive

cnasikas · 2024-04-10T10:01:45Z

x-pack/plugins/stack_connectors/common/thehive/schema.ts

+    summary: schema.nullable(schema.string()),
+    impactStatus: schema.nullable(schema.string()),
+    assignee: schema.nullable(schema.string()),
+    customFields: schema.nullable(schema.arrayOf(schema.object({}, { unknowns: 'allow' }))),


Instead of schema.object({}, { unknowns: 'allow' }) you can use schema.recordOf(schema.stirng(), schema.any())

cnasikas · 2024-04-10T10:02:11Z

x-pack/plugins/stack_connectors/common/thehive/schema.ts

+]);
+
+
+export const TheHiveIncidentResponseSchema = schema.object(


Are we sure that we need all the fields to be listed in the schema? Do we use them all?

No, we don't use all of them. However, I've included them all as a precaution for future needs.

LMK your thoughts.

I am not sure what is best tbh. Assuming TheHIve will not introduce any breaking changes in the fields I do not see any harm in keeping them. If they do then our validation will start failing. The more field we have the more the chance for this to happen. If they are documented here https://docs.strangebee.com/thehive/api-docs/#operation/Create%20case then I think it is fine to keep them.

Yes, They are documented.

cnasikas · 2024-04-10T10:03:01Z

x-pack/plugins/stack_connectors/common/thehive/schema.ts

+  { unknowns: 'ignore' }
+);
+
+export const TheHiveUpdateIncidentResponseSchema = schema.any();


What does TheHive return when you update a case?

It is a PATCH request and it returns 204 No Content.

Interesting. Do you know if schema.never() works? Not of this PR, but maybe the framework should skip the validation if the response is 204 No Content.

Will check and update.

cnasikas · 2024-04-10T10:03:52Z

x-pack/plugins/stack_connectors/common/thehive/schema.ts

+    type: schema.number(),
+    message: schema.string(),
+  },
+  { unknowns: 'allow' }


Should we ignore?

Will remove it.

cnasikas · 2024-04-10T12:55:37Z

x-pack/plugins/stack_connectors/server/connector_types/thehive/thehive.ts

+    this.url = this.config.url;
+    this.organisation = this.config.organisation;
+    this.api_key = this.secrets.api_key;
+    this.urlWithoutTrailingSlash = this.url.endsWith('/') ? this.url.slice(0, -1) : this.url;


The framework will take care of that for you. You can do this.url directly in the requests.

Right. But it is needed while we returning ExternalServiceIncidentResponse.

I missed that. All good!

cnasikas · 2024-04-10T13:03:05Z

x-pack/plugins/stack_connectors/server/connector_types/thehive/thehive.ts

+      method: 'patch',
+      url: `${this.url}/api/${API_VERSION}/case/${incidentId}`,
+      data: incident,
+      headers: { Authorization: `Bearer ${this.api_key}`, 'X-Organisation': this.organisation },


It seems that the same headers are being used in all requests. What about creating a util function getHeaders where it can be used in all functions?

cnasikas · 2024-04-10T13:04:44Z

x-pack/plugins/stack_connectors/public/connector_types/thehive/params.tsx

+
+  }, [actionParams]);
+
+  useEffect(() => {


Why do we need this useEffect?

When the eventAction changes, it sets subAction props and defaults the severity and TLP values.

Why do we need to put the defaults when the eventAction changes? Theoretically eventAction should never change.

When user change the toggle(for selecting a case or an alert), we are updating eventAction state accordingly and clear out all the fields and set defaults values in severity and TLP.

If that's the case then you can clear the fields inside setEventActionType when the user changes the toggle.

cnasikas · 2024-04-10T13:11:14Z

x-pack/plugins/stack_connectors/public/connector_types/thehive/params.tsx

+          onChange={(e) => setEventActionType(e.target.value as SUB_ACTION)}
+        />
+      </EuiFormRow>
+      {eventAction === SUB_ACTION.PUSH_TO_SERVICE ?


I think is better if you create two components one for each subAction and not having all logic in this component. Each component can manage its own state and the parent can reset the global state when the subAction changes.

cnasikas · 2024-04-10T13:12:16Z

x-pack/plugins/stack_connectors/public/connector_types/thehive/params.tsx

+  errors,
+  messageVariables
+}) => {
+  const [eventAction, setEventAction] = useState(actionParams.subAction ?? SUB_ACTION.PUSH_TO_SERVICE);


I was not part of the conversation so sorry if it was already discussed. Do we want the users to select if they want to create a case or an alert or we should only create alerts?

Yes, we've previously discussed providing support for both creating a case or an alert. However, I'll double-check with the team to confirm once more.

Perfect! Thanks!

…fix'

…-fix'

…ork changes

semd · 2024-06-12T07:49:01Z

x-pack/plugins/stack_connectors/public/connector_types/index.ts

@@ -69,6 +70,7 @@ export function registerConnectorTypes({
  connectorTypeRegistry.register(getTorqConnectorType());
  connectorTypeRegistry.register(getTinesConnectorType());
  connectorTypeRegistry.register(getD3SecurityConnectorType());
+  connectorTypeRegistry.register(getTheHiveConnectorType());


Hey @cnasikas, does the new convention to put new connectors under a feature flag apply to this PR?

Hey! Yes, we need to follow the new intermediate release process for all new connectors.

semd

@brijesh-elastic The code looks great, we have good test coverage, and everything works well when tested locally, both sending to theHive alerts and cases.

What I have noticed is that we don't send any information about the alerts generated when the rule is triggered.
When the alerts are received in TheHive we only have the static information defined in the connector configuration, we know the rule, but nothing else.

Is this behavior intended?

I say that because most of the connectors have a body template parameter to parse the alerts and send information about them, such as the host, IP, user... So we have some details to add to the alert description in theHive.

semd · 2024-07-12T13:06:32Z

x-pack/plugins/stack_connectors/public/connector_types/thehive/params_alert.tsx

+        <EuiComboBox
+          data-test-subj="tagsInput"
+          fullWidth
+          placeholder="Tags"


We need to apply translation here

semd · 2024-07-12T13:06:42Z

x-pack/plugins/stack_connectors/public/connector_types/thehive/params_case.tsx

+        <EuiComboBox
+          data-test-subj="tagsInput"
+          fullWidth
+          placeholder="Tags"


We need to apply translation here as well

brijesh-elastic · 2024-07-15T07:30:54Z

@brijesh-elastic The code looks great, we have good test coverage, and everything works well when tested locally, both sending to theHive alerts and cases.

What I have noticed is that we don't send any information about the alerts generated when the rule is triggered. When the alerts are received in TheHive we only have the static information defined in the connector configuration, we know the rule, but nothing else.

Is this behavior intended?

I say that because most of the connectors have a body template parameter to parse the alerts and send information about them, such as the host, IP, user... So we have some details to add to the alert description in theHive.

We've decided not to set default message variables for the description parameter, allowing users instead to add their own message variables during connector configuration. This approach doesn't limit users, enabling them to include any desired information in the alert descriptions. Additionally, following discussions with the Hive Team, we've agreed to leave this as blank.

Let me know your thoughts on this.

semd

Approving on behalf of Security Solution.
I desk-tested the PR with a local instance of TheHive, everything works well on the Security Solution side. I haven't been able to spot any issues.
The connector sends one alert to theHive (case or alert) per rule execution when alerts are detected, with the static title and description defined on the connector parameters when it is attached to the rule.

The code LGTM. Only a couple of minor test fixes are needed.
Thanks @brijesh-elastic

elasticmachine · 2024-07-16T15:55:14Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: c9636fe

Failed CI Steps

Test Failures

[job] [logs] Jest Integration Tests #7 / Connector type config checks detect connector type changes for: .thehive
[job] [logs] Jest Integration Tests #7 / Connector type config checks detect connector type changes for: .thehive

History

💔 Build #221654 failed 51d4bea
💔 Build #221337 failed 57bb7fe

jamiehynds · 2024-07-23T10:13:26Z

Hey @cnasikas - now that @semd has completed his review, would you mind reviewing the PR from the ResponseOps side?

cnasikas · 2024-07-23T11:56:21Z

Hey @jamiehynds! The team is aware and we will review the PR soon!

js-jankisalvi

ResponseOps changes look good, follows the guidelines of sub actions framework and case connector. 👍

js-jankisalvi

The PR is great and already approved.
However, could you please hold on merging it till we confirm whether it needs to follow an intermediate release process for serverless or not.
Putting this comment as request change to stop getting it merged accidentally.

cnasikas · 2024-07-26T08:43:46Z

@elasticmachine merge upstream

cnasikas · 2024-07-26T09:06:22Z

I tested the code for the intermediate release process and is working as expected. @semd @brijesh-elastic I found a bug when I tried to use the connector with fake credentials. React is stuck in an infinite loop. I think we should fix it because this can be a valid scenario (the user puts wrong credentials or TheHive returns a 403 error).

cnasikas · 2024-07-29T08:40:21Z

@elasticmachine merge upstream

cnasikas · 2024-07-29T09:34:19Z

@semd @brijesh-elastic I tested the connector on the Stack management and I found a bug. Even though I set the Severity, the TLP, and the tags the UI does not show my values. The values are correctly persisted on the backend.

Screen.Recording.2024-07-29.at.12.07.52.PM.mov

Also for the tags (both for cases and alerts):

I think we should remove the placeholder as it has the same word with the field's label
When I type it shows "There aren't any options available". I found it confusing as the user is only allowed to create new options and not select from a list. I think we need to put the noSuggestions prop to the EuiCombobox to remove this.

cnasikas

I tested @js-jankisalvi changes and the bug fixes from @brijesh-elastic. Everything is working as expected!

kibana-ci · 2024-07-30T07:35:06Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: a6c054e

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #90 / Rules Management - Prebuilt Rules - Update Prebuilt Rules Package @ess @serverless @skipInServerlessMKI update_prebuilt_rules_package should allow user to install prebuilt rules from scratch, then install new rules and upgrade existing rules from the new package

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`stackConnectors`	265	275	+10

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`stackConnectors`	554.6KB	577.4KB	+22.9KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`alerting`	25.5KB	25.5KB	+11.0B
`stackConnectors`	53.7KB	56.1KB	+2.3KB
total			+2.3KB

Unknown metric groups

async chunk count

id	before	after	diff
`stackConnectors`	88	92	+4

ESLint disabled line counts

id	before	after	diff
`stackConnectors`	113	119	+6

Total ESLint disabled count

id	before	after	diff
`stackConnectors`	119	125	+6

History

💛 Build #224305 was flaky c269aee
💔 Build #224268 failed d5c5eca
💛 Build #223982 was flaky 103d1a9
💛 Build #223859 was flaky 3ee54d4
💔 Build #223858 failed f5a5a60
💔 Build #213038 failed fa74245

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

## Summary This PR implements the case support for TheHive connector. Depends on : #180138 ## Screenshots **List of connectors** ![image](https://github.com/elastic/kibana/assets/123942796/7236eaed-d1d5-4506-80b1-c4e43c6ce36a) **Configure thehive connector from cases** ![image](https://github.com/elastic/kibana/assets/123942796/bb4843d5-9f29-47c2-baa3-77db81a35319) ### Checklist Delete any items that are not applicable to this PR. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/)) - [x] Any UI touched in this PR does not create any new axe failures (run axe in browser: [FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/), [Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US)) - [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [x] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server)) - [x] This was checked for [cross-browser compatibility](https://www.elastic.co/support/matrix#matrix_browsers) ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Christos Nasikas <[email protected]>

Add thehive case connector

9d1522e

brijesh-elastic requested a review from a team as a code owner April 5, 2024 11:06

cnasikas reviewed Apr 10, 2024

View reviewed changes

cnasikas added v8.15.0 and removed v8.14.0 labels Apr 11, 2024

brijesh-elastic mentioned this pull request Apr 16, 2024

TheHive Connector for Cases #180931

Merged

10 tasks

brijesh-elastic and others added 12 commits April 17, 2024 22:03

Merge branch 'main' into thehive_case_connector

8a527cc

resolve review comments

b5d8164

Merge branch 'main' into thehive_case_connector

1c8d856

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

0eeed1b

…fix'

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

4f2cc46

…-fix'

Add documentation and functional test

5f96889

update minimumLicenseRequired to platinum

86c87fd

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

d6b7ae3

…-fix'

Merge branch 'main' into thehive_case_connector

a31e7b8

Refactor UI and update server code to align with CaseConnector framew…

f576b5f

…ork changes

Merge branch 'main' into thehive_case_connector

c5eee3f

Disable Recovered ActionGroup

fa74245

semd reviewed Jun 12, 2024

View reviewed changes

semd reviewed Jul 12, 2024

View reviewed changes

Merge branch 'main' into thehive_case_connector

57bb7fe

semd removed the v8.15.0 label Jul 15, 2024

semd approved these changes Jul 15, 2024

View reviewed changes

brijesh-elastic added 2 commits July 16, 2024 11:40

Apply Translations and fix test cases

51d4bea

Resolve list and test issue

c9636fe

Resolve build failure

beb6a40

js-jankisalvi approved these changes Jul 23, 2024

View reviewed changes

js-jankisalvi requested changes Jul 24, 2024

View reviewed changes

js-jankisalvi and others added 2 commits July 25, 2024 16:38

hide the connector in UI for intermediate release

f5a5a60

Merge branch 'main' into thehive_case_connector

3ee54d4

Merge branch 'main' into thehive_case_connector

103d1a9

Resolve bugfix

d5c5eca

Merge branch 'main' into thehive_case_connector

c269aee

Preserve severity, tlp and tag values in UI

a6c054e

cnasikas approved these changes Jul 30, 2024

View reviewed changes

cnasikas requested a review from js-jankisalvi July 30, 2024 07:05

js-jankisalvi approved these changes Jul 30, 2024

View reviewed changes

cnasikas merged commit 696190d into elastic:main Jul 30, 2024
38 checks passed

kibanamachine added the backport:skip This commit does not require backporting label Jul 30, 2024

This was referenced Sep 9, 2024

Add TheHive connector elastic/docs-content#54

Merged

[DOCS][API] Add TheHive connector config and secrets #192424

Merged

lcawl mentioned this pull request Sep 10, 2024

[DOCS] Automates TheHive connector screenshots; edits UI text #192506

Merged

		]);


		export const TheHiveIncidentResponseSchema = schema.object(

TheHive Case Connector #180138

TheHive Case Connector #180138

Conversation

brijesh-elastic commented Apr 5, 2024 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Apr 5, 2024

elasticmachine commented Apr 5, 2024

cnasikas left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cnasikas Apr 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cnasikas Apr 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

semd left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brijesh-elastic commented Jul 15, 2024

semd left a comment

Choose a reason for hiding this comment

elasticmachine commented Jul 16, 2024

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

History

jamiehynds commented Jul 23, 2024

cnasikas commented Jul 23, 2024

js-jankisalvi left a comment

Choose a reason for hiding this comment

js-jankisalvi left a comment • edited Loading

Choose a reason for hiding this comment

cnasikas commented Jul 26, 2024

cnasikas commented Jul 26, 2024 • edited Loading

cnasikas commented Jul 29, 2024

cnasikas commented Jul 29, 2024

cnasikas left a comment

Choose a reason for hiding this comment

kibana-ci commented Jul 30, 2024

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

Page load bundle

async chunk count

ESLint disabled line counts

Total ESLint disabled count

History

brijesh-elastic commented Apr 5, 2024 •

edited

Loading

cnasikas left a comment •

edited

Loading

cnasikas Apr 11, 2024 •

edited

Loading

cnasikas Apr 11, 2024 •

edited

Loading

semd left a comment •

edited

Loading

js-jankisalvi left a comment •

edited

Loading

cnasikas commented Jul 26, 2024 •

edited

Loading