TheHive Connector for Cases #180931

brijesh-elastic · 2024-04-16T14:14:55Z

Summary

This PR implements the case support for TheHive connector.
Depends on : #180138

Screenshots

List of connectors

Configure thehive connector from cases

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Flaky Test Runner was used on any tests changed
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

Release notes

Support TheHive connector to cases

pmuellr · 2024-06-13T21:55:41Z

Curious what the state of this is, as it's still asking for a review from ResponseOps. I don't think we've gotten any specific asks to review this, so not sure if this is kinda a POC, or if we really want to merge it. But it shows up on RO PR's to review, so if it's not currently active, would be nice to close it for now ...

elasticmachine · 2024-07-23T13:15:29Z

Pinging @elastic/response-ops-cases (Feature:Cases)

semd · 2024-07-23T13:17:09Z

@elasticmachine merge upstream

semd · 2024-07-23T15:41:23Z

Hey @brijesh-elastic I have started testing this but the code does not seem ready for review yet. I am seeing errors in the parameter form, and the connector does not appear in the Cases page, because it's not configured as such.

To test it I created a temporary branch from this one and merged the main implementation branch https://github.com/brijesh-elastic/kibana/tree/thehive_case_connector. Did I miss anything? Or should I wait until the first PR is merged before starting with this one?

brijesh-elastic · 2024-07-24T04:21:29Z

To test it I created a temporary branch from this one and merged the main implementation branch https://github.com/brijesh-elastic/kibana/tree/thehive_case_connector. Did I miss anything? Or should I wait until the first PR is merged before starting with this one?

You can test on the temporary branch. It's good to go.

semd · 2024-08-26T10:46:55Z

@elasticmachine merge upstream

semd

Hi @brijesh-elastic, I see the connector supportedFeatureIds is missing CasesConnectorFeatureId here

kibana/x-pack/plugins/stack_connectors/server/connector_types/thehive/index.ts

Lines 35 to 39 in a98d141

    
           supportedFeatureIds: [ 
        
             AlertingConnectorFeatureId, 
        
             SecurityConnectorFeatureId, 
        
             UptimeConnectorFeatureId, 
        
           ],

Is it intentional? When I add the cases feature everything works well

semd · 2024-08-26T13:54:42Z

x-pack/plugins/cases/public/components/connectors/thehive/case_fields_preview.tsx

+  const mapTLP = (tlp: number | string): string => {
+    switch (tlp) {
+      case "0":
+        return 'CLEAR';
+      case "1":
+        return 'GREEN';
+      case "2":
+        return 'AMBER';
+      case "3":
+        return 'AMBER+STRICT';
+      case "4":
+        return 'RED';
+      default:
+        return 'AMBER';
+    }
+  }


Can this function be extracted outside of the component implementation? There's no need to be re-defined on each render. Also, there are 2 variables named tlp in the same block, and the linter is complaining about it.

semd · 2024-08-26T13:59:14Z

x-pack/plugins/cases/server/connectors/thehive/format.ts

+  } = (theCase.connector.fields as ConnectorTheHiveTypeFields['fields']) ?? {};
+  return {
+    tags: theCase.tags,
+    tlp: typeof tlp === 'string' ? parseInt(tlp) : tlp,


It seems we have a rule for the radix parameter of the parseInt call, the linter is complaining about it. To fix it:

Suggested change

tlp: typeof tlp === 'string' ? parseInt(tlp) : tlp,

tlp: typeof tlp === 'string' ? parseInt(tlp, 10) : tlp,

semd · 2024-08-26T14:06:18Z

@brijesh-elastic I've tested the connector, and everything is working fine. The only thing I miss is the case's status property is not synced. I noticed it is not in the mappings, but it feels a bit odd.

Marked as In progress in Kibana:

Not marked as In progress in TheHive:

Is there any reason not to sync this field?

brijesh-elastic · 2024-08-27T07:45:25Z

Hi @brijesh-elastic, I see the connector supportedFeatureIds is missing CasesConnectorFeatureId here

kibana/x-pack/plugins/stack_connectors/server/connector_types/thehive/index.ts

Lines 35 to 39 in a98d141

supportedFeatureIds: [

AlertingConnectorFeatureId,

SecurityConnectorFeatureId,

UptimeConnectorFeatureId,

],

Is it intentional? When I add the cases feature everything works well

No, Will add in next commit.

brijesh-elastic · 2024-08-27T08:29:19Z

@brijesh-elastic I've tested the connector, and everything is working fine. The only thing I miss is the case's status property is not synced. I noticed it is not in the mappings, but it feels a bit odd.

Marked as In progress in Kibana:

Not marked as In progress in TheHive:

Is there any reason not to sync this field?

Yes. In TheHive, the status field can have values such as New, InProgress, Duplicated, False Positive, InDeterminate, Other, and True Positive, which are different to the status values in Kibana. Therefore, we have decided not to sync the status field. Reference.

Initially, we faced an issue where the Update thehive incident option in the cases UI was being disable after the severity updation. So, Christos suggested the change(here) to resolve it. As a result of this change, status updates in the Kibana UI are now also triggering the Update thehive incident to being enable.

semd · 2024-08-28T08:42:32Z

@elasticmachine merge upstream

semd

Changes have been desk tested and everything is working as expected. All comments and doubts were solved. Approving on behalf of Security Solution.
LGTM

…-fix'

cnasikas · 2024-09-06T08:32:40Z

@elasticmachine merge upstream

cnasikas

Tested and LGTM! Great work! I left some minor comments. Also, I noticed that the TLP text for the dropdown selection (x-pack/plugins/cases/public/components/connectors/thehive/case_fields.tsx) and the preview (x-pack/plugins/cases/public/components/connectors/thehive/case_fields_preview.tsx) are the same. Is it possible to have a common data structure that it is shared between the components in case we want to update the text in the future? Wdyt?

cnasikas · 2024-09-06T09:03:34Z

x-pack/plugins/cases/common/types/domain/connector/v1.ts

+ */
+
+export const TheHiveFieldsRt = rt.strict({
+  tlp: rt.union([rt.number, rt.string, rt.null]),


The schema of the tlp of the connector is number and not a string. I think we should keep the same convention here for cases (number or null). This way we can avoid doing parseInt(tlp, 10) on the backend. We may need to do it on the frontend as the select dropdown accepts only strings as values (as you do here x-pack/plugins/stack_connectors/public/connector_types/thehive/params_case.tsx).

cnasikas · 2024-09-06T09:13:49Z

x-pack/plugins/cases/public/components/connectors/thehive/case_fields.tsx

+            'data-test-subj': 'tlp-field',
+            options: tlpOptions,
+            fullWidth: true,
+            hasNoInitialSelection: true,


Given that the field is required should we have a default value on the dropdown?

Yes, AMBER.

cnasikas · 2024-09-06T09:19:31Z

x-pack/plugins/cases/server/connectors/thehive/format.test.ts

+  it('it formats correctly when fields do not exist ', async () => {
+    const invalidFields = { tags: ['tag1'], severity: 'low', connector: { fields: null } } as Case;
+    const res = await format(invalidFields, []);
+    expect(res).toEqual({ tlp: null, severity: 1, tags: ['tag1'] });


Should we default the tlp to something if it is a required field on TheHive?

We've set the default TLP to AMBER in the frontend, so it will always be present in the format function.

Users can use the API and they can set the tlp to null. Does TheHive accept null as a TLP?

Yes, TheHive will accept it as null and will default set it to AMBER.

Oh perfect then!

cnasikas · 2024-09-09T16:06:13Z

x-pack/plugins/cases/public/components/connectors/thehive/types.ts

+ * 2.0.
+ */
+
+export enum TheHiveTLP {


I think is better if we do

export enum TheHiveTLP { CLEAR = 0, GREEN = 1, AMBER = 2, "AMBER+STRICT" = 3, <--- I added the + symbol so the label can be used in the UI. RED = 4, }

The reason is that by doing

Object.entries(TheHiveTLP).map( ([_, value], index) => ({ text: value, value: index, }) );

we rely on the order of the enum (index) which may change or be different in the future. If we explicitly map the key to an integer we avoid this problem. The key can be used as the value to be shown in the UI and there is no need to rely on the order of the enum. What do you think?

Yes, That make more sense. Let me change it.

cnasikas

LGTM! Thank you for your patience with my review. I tested and is working as expected.

kibana-ci · 2024-09-10T09:37:16Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: f7c3aa6

Failed CI Steps

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`cases`	807	812	+5

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`cases`	487.2KB	491.1KB	+3.9KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`cases`	150.8KB	151.0KB	+181.0B

Unknown metric groups

async chunk count

id	before	after	diff
`cases`	30	32	+2

ESLint disabled line counts

id	before	after	diff
`cases`	61	63	+2

Total ESLint disabled count

id	before	after	diff
`cases`	78	80	+2

History

💛 Build #232963 was flaky 0b5da8a
💚 Build #232784 succeeded 63b8bd6
💛 Build #232377 was flaky ac4f754
💛 Build #231670 was flaky c8e1aea
💚 Build #231406 succeeded 1aa9649
💛 Build #230369 was flaky c5ba79a

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @brijesh-elastic

## Summary This test (#180931) was introduced right before the version bump of user-events (#189949). This PR updates the one async call to be awaited, hopefully fixing the test. Solves: #192475 Unskipped tests are passing now: https://buildkite.com/elastic/kibana-pull-request/builds/233177 --------- Co-authored-by: Antonio <[email protected]>

Add support of case connector for thehive

6ddf8c5

brijesh-elastic requested a review from a team as a code owner April 16, 2024 14:14

semd self-requested a review July 23, 2024 13:14

semd assigned brijesh-elastic Jul 23, 2024

semd added release_note:feature Makes this part of the condensed release notes v8.16.0 Feature:Cases Cases feature Feature:Actions/ConnectorTypes Issues related to specific Connector Types on the Actions Framework labels Jul 23, 2024

semd added the Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) label Jul 23, 2024

Merge branch 'main' into thehive_cases_plugin

48938ec

Merge branch 'main' into thehive_cases_plugin

a98d141

semd reviewed Aug 26, 2024

View reviewed changes

Resolve comments

19b81b2

Merge branch 'main' into thehive_cases_plugin

1ea1945

semd approved these changes Aug 28, 2024

View reviewed changes

kibanamachine and others added 3 commits August 28, 2024 09:32

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

c5ba79a

…-fix'

Update docs

c58a578

Remove the hideInUi flag

db3d840

cnasikas self-requested a review September 3, 2024 08:56

Merge branch 'main' into thehive_cases_plugin

c8e1aea

Merge branch 'main' into thehive_cases_plugin

ac4f754

cnasikas reviewed Sep 6, 2024

View reviewed changes

brijesh-elastic and others added 2 commits September 9, 2024 19:12

Resolve comments

bf5598d

Merge branch 'main' into thehive_cases_plugin

63b8bd6

brijesh-elastic requested a review from cnasikas September 9, 2024 13:45

cnasikas reviewed Sep 9, 2024

View reviewed changes

brijesh-elastic and others added 2 commits September 10, 2024 13:03

Update TheHiveTLP enum to be safer in the future

0b5da8a

Merge branch 'main' into thehive_cases_plugin

f7c3aa6

brijesh-elastic requested a review from cnasikas September 10, 2024 07:36

cnasikas approved these changes Sep 10, 2024

View reviewed changes

cnasikas enabled auto-merge (squash) September 10, 2024 09:03

cnasikas merged commit 32d7316 into elastic:main Sep 10, 2024
54 checks passed

kibanamachine added the backport:skip This commit does not require backporting label Sep 10, 2024

delanni mentioned this pull request Sep 10, 2024

Unskip failing unit test (#192475) #192488

Merged

szaffarano mentioned this pull request Sep 13, 2024

[Telemetry][Security Solution] Fix integration tests on branch 9.0 #192842

Merged

1 task

This was referenced Sep 25, 2024

[8.x](backport #4292) Add TheHive connector for cases elastic/observability-docs#4303

Merged

[8.x] Add TheHive connector for cases (backport #5859) elastic/security-docs#5866

Merged

lcawl mentioned this pull request Nov 1, 2024

Add Cases to Kibana release note categories elastic/kibana-release-notes#33

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TheHive Connector for Cases #180931

TheHive Connector for Cases #180931

brijesh-elastic commented Apr 16, 2024 •

edited by cnasikas

Loading

pmuellr commented Jun 13, 2024

elasticmachine commented Jul 23, 2024

semd commented Jul 23, 2024

semd commented Jul 23, 2024

brijesh-elastic commented Jul 24, 2024

semd commented Aug 26, 2024

semd left a comment

semd Aug 26, 2024

semd Aug 26, 2024

semd commented Aug 26, 2024

brijesh-elastic commented Aug 27, 2024

brijesh-elastic commented Aug 27, 2024 •

edited

Loading

semd commented Aug 28, 2024

semd left a comment

cnasikas commented Sep 6, 2024

cnasikas left a comment •

edited

Loading

cnasikas Sep 6, 2024

cnasikas Sep 6, 2024

brijesh-elastic Sep 9, 2024

cnasikas Sep 6, 2024

brijesh-elastic Sep 9, 2024

cnasikas Sep 9, 2024 •

edited

Loading

brijesh-elastic Sep 9, 2024

cnasikas Sep 9, 2024

cnasikas Sep 9, 2024 •

edited

Loading

brijesh-elastic Sep 10, 2024

cnasikas left a comment

kibana-ci commented Sep 10, 2024

async chunk count

ESLint disabled line counts

Total ESLint disabled count

	supportedFeatureIds: [
	AlertingConnectorFeatureId,
	SecurityConnectorFeatureId,
	UptimeConnectorFeatureId,
	],

	tlp: typeof tlp === 'string' ? parseInt(tlp) : tlp,
	tlp: typeof tlp === 'string' ? parseInt(tlp, 10) : tlp,

TheHive Connector for Cases #180931

TheHive Connector for Cases #180931

Conversation

brijesh-elastic commented Apr 16, 2024 • edited by cnasikas Loading

Summary

Screenshots

Checklist

For maintainers

Release notes

pmuellr commented Jun 13, 2024

elasticmachine commented Jul 23, 2024

semd commented Jul 23, 2024

semd commented Jul 23, 2024

brijesh-elastic commented Jul 24, 2024

semd commented Aug 26, 2024

semd left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

semd commented Aug 26, 2024

brijesh-elastic commented Aug 27, 2024

brijesh-elastic commented Aug 27, 2024 • edited Loading

semd commented Aug 28, 2024

semd left a comment

Choose a reason for hiding this comment

cnasikas commented Sep 6, 2024

cnasikas left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cnasikas Sep 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cnasikas Sep 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cnasikas left a comment

Choose a reason for hiding this comment

kibana-ci commented Sep 10, 2024

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Async chunks

Page load bundle

async chunk count

ESLint disabled line counts

Total ESLint disabled count

History

brijesh-elastic commented Apr 16, 2024 •

edited by cnasikas

Loading

brijesh-elastic commented Aug 27, 2024 •

edited

Loading

cnasikas left a comment •

edited

Loading

cnasikas Sep 9, 2024 •

edited

Loading

cnasikas Sep 9, 2024 •

edited

Loading