Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Replace PrebuiltRuleAsset schema construction with Zod transform #188092

Merged
merged 4 commits into from
Jul 12, 2024
Merged

[Security Solution] Replace PrebuiltRuleAsset schema construction with Zod transform #188092

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3cb95cc
Replace PrebuiltRuleAsset schema construction with Zod transform
jpdjere Jul 11, 2024
ce6b9ee
Merge branch 'main' into prebuilt-rule-asset-transform
jpdjere Jul 11, 2024
a1d94e0
Fix
jpdjere Jul 11, 2024
1d5e0ae
Merge branch 'main' into prebuilt-rule-asset-transform
jpdjere Jul 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions .../server/lib/detection_engine/prebuilt_rules/model/rule_assets/prebuilt_rule_asset.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ describe('Prebuilt rule asset schema', () => {
// The PrebuiltRuleAsset schema is built out of the rule schema,
// but the following fields are manually omitted.
// See: detection_engine/prebuilt_rules/model/rule_assets/prebuilt_rule_asset.ts
const omittedFields = [
const omittedBaseFields = [
'actions',
'throttle',
'meta',
Expand All @@ -47,10 +47,24 @@ describe('Prebuilt rule asset schema', () => {
'outcome',
];

test.each(omittedFields)('ignores %s since it`s an omitted field', (field) => {
test.each(omittedBaseFields)(
'ignores the base %s field since it`s an omitted field',
(field) => {
const payload: Partial<PrebuiltRuleAsset> & Record<string, unknown> = {
...getPrebuiltRuleMock(),
[field]: 'some value',
};

const result = PrebuiltRuleAsset.safeParse(payload);
expectParseSuccess(result);
expect(result.data).toEqual(getPrebuiltRuleMock());
}
);

test('ignores the type specific response_actions field since it`s an omitted field', () => {
const payload: Partial<PrebuiltRuleAsset> & Record<string, unknown> = {
...getPrebuiltRuleMock(),
[field]: 'some value',
response_actions: [{ action_type_id: `.osquery`, params: {} }],
};

const result = PrebuiltRuleAsset.safeParse(payload);
Expand Down
53 changes: 22 additions & 31 deletions ...ution/server/lib/detection_engine/prebuilt_rules/model/rule_assets/prebuilt_rule_asset.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,7 @@ import {
RuleSignatureId,
RuleVersion,
BaseCreateProps,
EqlRuleCreateFields,
EsqlRuleCreateFields,
MachineLearningRuleCreateFields,
NewTermsRuleCreateFields,
QueryRuleCreateFields,
SavedQueryRuleCreateFields,
ThreatMatchRuleCreateFields,
ThresholdRuleCreateFields,
TypeSpecificCreateProps,
} from '../../../../../../common/api/detection_engine/model/rule_schema';

/**
Expand All @@ -37,28 +30,26 @@ const BASE_PROPS_REMOVED_FROM_PREBUILT_RULE_ASSET = zodMaskFor<BaseCreateProps>(
'outcome',
]);

// `response_actions` is only part of the optional fields in QueryRuleCreateFields and SavedQueryRuleCreateFields
const TYPE_SPECIFIC_PROPS_REMOVED_FROM_PREBUILT_RULE_ASSET = zodMaskFor<
QueryRuleCreateFields | SavedQueryRuleCreateFields
>()(['response_actions']);

const QueryRuleAssetFields = QueryRuleCreateFields.omit(
TYPE_SPECIFIC_PROPS_REMOVED_FROM_PREBUILT_RULE_ASSET
);
const SavedQueryRuleAssetFields = SavedQueryRuleCreateFields.omit(
TYPE_SPECIFIC_PROPS_REMOVED_FROM_PREBUILT_RULE_ASSET
);

export const RuleAssetTypeSpecificCreateProps = z.discriminatedUnion('type', [
EqlRuleCreateFields,
QueryRuleAssetFields,
SavedQueryRuleAssetFields,
ThresholdRuleCreateFields,
ThreatMatchRuleCreateFields,
MachineLearningRuleCreateFields,
NewTermsRuleCreateFields,
EsqlRuleCreateFields,
]);
/**
* Aditionally remove fields which are part only of the optional fields in the rule types that make up
* the TypeSpecificCreateProps discriminatedUnion, by using a Zod transformation which extracts out the
* necessary fields in the rules types where they exist. Fields to extract:
* - response_actions: from Query and SavedQuery rules
*/
const TypeSpecificFields = TypeSpecificCreateProps.transform((val) => {
switch (val.type) {
case 'query': {
const { response_actions: _, ...rest } = val;
return rest;
}
case 'saved_query': {
const { response_actions: _, ...rest } = val;
return rest;
}
default:
return val;
}
});
Comment on lines +39 to +52
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Very cool, this is much simpler than reconstructing type specific props from scratch. And it even creates a correct type for TypeSpecificFields which I didn't expect! Also it's extensible: this way we could omit any other fields from other rule types. Very-very cool!


function zodMaskFor<T>() {
return function <U extends keyof T>(props: U[]): Record<U, true> {
Expand All @@ -85,7 +76,7 @@ function zodMaskFor<T>() {
*/
export type PrebuiltRuleAsset = z.infer<typeof PrebuiltRuleAsset>;
export const PrebuiltRuleAsset = BaseCreateProps.omit(BASE_PROPS_REMOVED_FROM_PREBUILT_RULE_ASSET)
.and(RuleAssetTypeSpecificCreateProps)
.and(TypeSpecificFields)
.and(
z.object({
rule_id: RuleSignatureId,
Expand Down