Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SIEM][Detection Engine] Critical blocker rule changes and ECS changes #55883

Merged
merged 10 commits into from
Jan 25, 2020
Merged

[SIEM][Detection Engine] Critical blocker rule changes and ECS changes #55883

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
d5b1e64
Changed techniques to be technique
FrankHassanabad Jan 24, 2020
f95433b
Generic rule cleanup
FrankHassanabad Jan 24, 2020
db1e93c
rule clean up
FrankHassanabad Jan 24, 2020
771579a
Fixed import issue where you could flip the flags on import
FrankHassanabad Jan 24, 2020
a83f1a7
Merge branch 'master' into change-technique-to-techniques
FrankHassanabad Jan 25, 2020
bd84a08
Updated json to have techniques be technique from conflict resolution
FrankHassanabad Jan 25, 2020
cf4bf84
Renamed threats to threat and cleaned up more of the rules to have in…
FrankHassanabad Jan 25, 2020
6cb92b7
Updated signal mapping
FrankHassanabad Jan 25, 2020
96ca726
Changed EIA to use the tag of Elastic and added Elastic to the other …
FrankHassanabad Jan 25, 2020
e57c6a2
Added signal threat tactic name
FrankHassanabad Jan 25, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion x-pack/legacy/plugins/siem/public/pages/detection_engine/mitre/mitre_tactics_techniques.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ export const tacticsOptions: MitreTacticsOptions[] = [
},
];

export const techniques = [
export const technique = [
{
name: '.bash_profile and .bashrc',
id: 'T1156',
Expand Down
2 changes: 1 addition & 1 deletion .../plugins/siem/public/pages/detection_engine/rules/components/description_step/helpers.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,7 @@ export const buildThreatsDescription = ({
{tactic != null ? tactic.text : ''}
</EuiLink>
<EuiFlexGroup gutterSize="none" alignItems="flexStart" direction="column">
{threat.techniques.map(technique => {
{threat.technique.map(technique => {
const myTechnique = techniquesOptions.find(t => t.id === technique.id);
return (
<EuiFlexItem>
Expand Down
4 changes: 2 additions & 2 deletions x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/mitre/helpers.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ import { IMitreAttack } from '../../types';

export const isMitreAttackInvalid = (
tacticName: string | null | undefined,
techniques: IMitreAttack[] | null | undefined
technique: IMitreAttack[] | null | undefined
) => {
if (isEmpty(tacticName) || (tacticName !== 'none' && isEmpty(techniques))) {
if (isEmpty(tacticName) || (tacticName !== 'none' && isEmpty(technique))) {
return true;
}
return false;
Expand Down
12 changes: 6 additions & 6 deletions x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/mitre/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,10 +62,10 @@ export const AddMitreThreat = ({ dataTestSubj, field, idAria, isDisabled }: AddI
if (!isEmpty(values[values.length - 1])) {
field.setValue([
...values,
{ tactic: { id: 'none', name: 'none', reference: 'none' }, techniques: [] },
{ tactic: { id: 'none', name: 'none', reference: 'none' }, technique: [] },
]);
} else {
field.setValue([{ tactic: { id: 'none', name: 'none', reference: 'none' }, techniques: [] }]);
field.setValue([{ tactic: { id: 'none', name: 'none', reference: 'none' }, technique: [] }]);
}
}, [field]);

Expand All @@ -82,7 +82,7 @@ export const AddMitreThreat = ({ dataTestSubj, field, idAria, isDisabled }: AddI
{
...values[index],
tactic: { id, reference, name },
techniques: [],
technique: [],
},
...values.slice(index + 1),
]);
Expand All @@ -96,7 +96,7 @@ export const AddMitreThreat = ({ dataTestSubj, field, idAria, isDisabled }: AddI
...values.slice(0, index),
{
...values[index],
techniques: selectedOptions,
technique: selectedOptions,
},
...values.slice(index + 1),
]);
Expand Down Expand Up @@ -133,9 +133,9 @@ export const AddMitreThreat = ({ dataTestSubj, field, idAria, isDisabled }: AddI
);

const getSelectTechniques = (item: IMitreEnterpriseAttack, index: number, disabled: boolean) => {
const invalid = isMitreAttackInvalid(item.tactic.name, item.techniques);
const invalid = isMitreAttackInvalid(item.tactic.name, item.technique);
const options = techniquesOptions.filter(t => t.tactics.includes(kebabCase(item.tactic.name)));
const selectedOptions = item.techniques.map(technic => ({
const selectedOptions = item.technique.map(technic => ({
...technic,
label: `${technic.name} (${technic.id})`, // API doesn't allow for label field
}));
Expand Down
2 changes: 1 addition & 1 deletion .../legacy/plugins/siem/public/pages/detection_engine/rules/components/mitre/translations.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ export const TACTIC = i18n.translate('xpack.siem.detectionEngine.mitreAttack.tac
export const TECHNIQUE = i18n.translate(
'xpack.siem.detectionEngine.mitreAttack.techniquesDescription',
{
defaultMessage: 'technique',
defaultMessage: 'techniques',
}
);

Expand Down
2 changes: 1 addition & 1 deletion ...gins/siem/public/pages/detection_engine/rules/components/step_about_rule/default_value.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ export const threatsDefault = [
{
framework: 'MITRE ATT&CK',
tactic: { id: 'none', name: 'none', reference: 'none' },
techniques: [],
technique: [],
},
];

Expand Down
2 changes: 1 addition & 1 deletion ...cy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/schema.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,7 +155,7 @@ export const schema: FormSchema = {
const [{ value, path }] = args;
let hasError = false;
(value as IMitreEnterpriseAttack[]).forEach(v => {
if (isMitreAttackInvalid(v.tactic.name, v.techniques)) {
if (isMitreAttackInvalid(v.tactic.name, v.technique)) {
hasError = true;
}
});
Expand Down
2 changes: 1 addition & 1 deletion x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ const formatAboutStepData = (aboutStepData: AboutStepRule): AboutStepRuleJson =>
.map(threat => ({
...threat,
framework: 'MITRE ATT&CK',
techniques: threat.techniques.map(technique => {
technique: threat.technique.map(technique => {
const { id, name, reference } = technique;
return { id, name, reference };
}),
Expand Down
2 changes: 1 addition & 1 deletion x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/types.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,5 +134,5 @@ export interface IMitreAttack {
export interface IMitreEnterpriseAttack {
framework: string;
tactic: IMitreAttack;
techniques: IMitreAttack[];
technique: IMitreAttack[];
}
6 changes: 3 additions & 3 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ export const mockPrepackagedRule = (): PrepackagedRules => ({
{
framework: 'fake',
tactic: { id: 'fakeId', name: 'fakeName', reference: 'fakeRef' },
techniques: [{ id: 'techniqueId', name: 'techniqueName', reference: 'techniqueRef' }],
technique: [{ id: 'techniqueId', name: 'techniqueName', reference: 'techniqueRef' }],
},
],
enabled: true,
Expand Down Expand Up @@ -73,7 +73,7 @@ export const typicalPayload = (): Partial<RuleAlertParamsRest> => ({
{
framework: 'fake',
tactic: { id: 'fakeId', name: 'fakeName', reference: 'fakeRef' },
techniques: [{ id: 'techniqueId', name: 'techniqueName', reference: 'techniqueRef' }],
technique: [{ id: 'techniqueId', name: 'techniqueName', reference: 'techniqueRef' }],
},
],
});
Expand Down Expand Up @@ -306,7 +306,7 @@ export const getResult = (): RuleAlertType => ({
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down
28 changes: 14 additions & 14 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -123,7 +123,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -188,7 +188,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -253,7 +253,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -316,7 +316,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -382,7 +382,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -448,7 +448,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -514,7 +514,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -631,7 +631,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -704,7 +704,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -866,7 +866,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -987,7 +987,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -1047,7 +1047,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down Expand Up @@ -1096,7 +1096,7 @@ describe('utils', () => {
name: 'impact',
reference: 'https://attack.mitre.org/tactics/TA0040/',
},
techniques: [
technique: [
{
id: 'T1499',
name: 'endpoint denial of service',
Expand Down
Loading