Skip to content

Commit 0f8369c

Browse files
toepkerdgoyamegheirseptoepkerd-zz
authored
Security Analytics 2.7 Backports (#938)
* Version bump to 2.7.1 Signed-off-by: Megha Goyal <[email protected]> * fix detector writeTo() method missing fields (#695) * fix detector writeTo() method missing fields Signed-off-by: Surya Sashank Nistala <[email protected]> * fix test Signed-off-by: Surya Sashank Nistala <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> * fix null query filter conversion from sigma to query string query (#722) * fix null query filter conversion from sigma to query string query Signed-off-by: Surya Sashank Nistala <[email protected]> * fix rule to query conversion tests for null filter Signed-off-by: Surya Sashank Nistala <[email protected]> * enhance test to verify non null doc doesnt match null query Signed-off-by: Surya Sashank Nistala <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> * * #709 Return empty response for empty mappings and no applied aliases Signed-off-by: Megha Goyal <[email protected]> * Adding integ tests for empty mappings/aliases use-cases Signed-off-by: Megha Goyal <[email protected]> * Fix unit tests for MappingsTraverser Signed-off-by: Megha Goyal <[email protected]> --------- Signed-off-by: Megha Goyal <[email protected]> * fixing build failures for previous cherry-pick PR for SAP2.7 (to be squashed) Signed-off-by: Dennis Toepker <[email protected]> * Pass rule field names in doc level queries during monitor/creation. Remove blocking actionGet() calls (#873) * pass query field names in doc level queries during monitor creation/updation Signed-off-by: Surya Sashank Nistala <[email protected]> * remove actionGet() and change get index mapping call to event driven flow Signed-off-by: Surya Sashank Nistala <[email protected]> * fix chained findings monitor Signed-off-by: Surya Sashank Nistala <[email protected]> * add finding mappings Signed-off-by: Surya Sashank Nistala <[email protected]> * remove test messages from logs Signed-off-by: Surya Sashank Nistala <[email protected]> * revert build.gradle change Signed-off-by: Surya Sashank Nistala <[email protected]> --------- Signed-off-by: Surya Sashank Nistala <[email protected]> * fixing an import Signed-off-by: Dennis Toepker <[email protected]> --------- Signed-off-by: Megha Goyal <[email protected]> Signed-off-by: Surya Sashank Nistala <[email protected]> Signed-off-by: Dennis Toepker <[email protected]> Co-authored-by: Megha Goyal <[email protected]> Co-authored-by: Surya Sashank Nistala <[email protected]> Co-authored-by: Megha Goyal <[email protected]> Co-authored-by: Dennis Toepker <[email protected]>
1 parent 5dac2c1 commit 0f8369c

File tree

10 files changed

+788
-405
lines changed

10 files changed

+788
-405
lines changed

‎src/main/java/org/opensearch/securityanalytics/mapper/MapperService.java

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,11 @@ public void createMappingAction(String indexName, String ruleTopic, String alias
7272
// since you can't update documents in non-write indices
7373
String index = indexName;
7474
boolean shouldUpsertIndexTemplate = IndexUtils.isConcreteIndex(indexName, this.clusterService.state()) == false;
75-
if (IndexUtils.isDataStream(indexName, this.clusterService.state())) {
75+
if (IndexUtils.isDataStream(indexName, this.clusterService.state()) || IndexUtils.isAlias(indexName, this.clusterService.state())) {
76+
log.debug("{} is an alias or datastream. Fetching write index for create mapping action.", indexName);
7677
String writeIndex = IndexUtils.getWriteIndex(indexName, this.clusterService.state());
7778
if (writeIndex != null) {
79+
log.debug("Write index for {} is {}", indexName, writeIndex);
7880
index = writeIndex;
7981
}
8082
}
@@ -86,6 +88,7 @@ public void onResponse(GetMappingsResponse getMappingsResponse) {
8688
applyAliasMappings(getMappingsResponse.getMappings(), ruleTopic, aliasMappings, partial, new ActionListener<>() {
8789
@Override
8890
public void onResponse(Collection<CreateMappingResult> createMappingResponse) {
91+
log.debug("Completed create mappings for {}", indexName);
8992
// We will return ack==false if one of the requests returned that
9093
// else return ack==true
9194
Optional<AcknowledgedResponse> notAckd = createMappingResponse.stream()
@@ -104,6 +107,7 @@ public void onResponse(Collection<CreateMappingResult> createMappingResponse) {
104107

105108
@Override
106109
public void onFailure(Exception e) {
110+
log.debug("Failed to create mappings for {}", indexName );
107111
actionListener.onFailure(e);
108112
}
109113
});

‎src/main/java/org/opensearch/securityanalytics/mapper/MapperUtils.java

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,16 @@
55

66
package org.opensearch.securityanalytics.mapper;
77

8-
import java.util.HashMap;
9-
import java.util.Locale;
10-
import java.util.Map;
118
import org.apache.commons.lang3.tuple.Pair;
129
import org.opensearch.cluster.metadata.MappingMetadata;
13-
import org.opensearch.common.collect.ImmutableOpenMap;
14-
10+
import org.opensearch.securityanalytics.util.SecurityAnalyticsException;
1511
import java.io.IOException;
1612
import java.util.ArrayList;
13+
import java.util.HashMap;
14+
import java.util.Locale;
15+
import java.util.Map;
1716
import java.util.List;
1817
import java.util.Set;
19-
import java.util.stream.Collectors;
20-
import org.opensearch.securityanalytics.util.SecurityAnalyticsException;
2118

2219
public class MapperUtils {
2320

@@ -249,7 +246,6 @@ public void onError(String error) {
249246
}
250247
});
251248
mappingsTraverser.traverse();
252-
253249
return presentPathsMappings;
254250
}
255251
}

‎src/main/java/org/opensearch/securityanalytics/model/Detector.java

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -158,12 +158,12 @@ public Detector(StreamInput sin) throws IOException {
158158
sin.readList(DetectorInput::readFrom),
159159
sin.readList(DetectorTrigger::readFrom),
160160
sin.readStringList(),
161-
sin.readString(),
162-
sin.readString(),
163-
sin.readString(),
164-
sin.readString(),
165-
sin.readString(),
166-
sin.readString(),
161+
sin.readOptionalString(),
162+
sin.readOptionalString(),
163+
sin.readOptionalString(),
164+
sin.readOptionalString(),
165+
sin.readOptionalString(),
166+
sin.readOptionalString(),
167167
sin.readMap(StreamInput::readString, StreamInput::readString)
168168
);
169169
}
@@ -196,8 +196,12 @@ public void writeTo(StreamOutput out) throws IOException {
196196
it.writeTo(out);
197197
}
198198
out.writeStringCollection(monitorIds);
199-
out.writeString(ruleIndex);
200-
199+
out.writeOptionalString(ruleIndex);
200+
out.writeOptionalString(alertsIndex);
201+
out.writeOptionalString(alertsHistoryIndex);
202+
out.writeOptionalString(alertsHistoryIndexPattern);
203+
out.writeOptionalString(findingsIndex);
204+
out.writeOptionalString(findingsIndexPattern);
201205
out.writeMap(ruleIdMonitorIdMap, StreamOutput::writeString, StreamOutput::writeString);
202206
}
203207

‎src/main/java/org/opensearch/securityanalytics/rules/backend/OSQueryBackend.java

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ public OSQueryBackend(String ruleCategory, boolean collectErrors, boolean enable
131131
this.reEscapeChar = "\\";
132132
this.reExpression = "%s: /%s/";
133133
this.cidrExpression = "%s: \"%s\"";
134-
this.fieldNullExpression = "%s: null";
134+
this.fieldNullExpression = "%s: (NOT [* TO *])";
135135
this.unboundValueStrExpression = "\"%s\"";
136136
this.unboundValueNumExpression = "\"%s\"";
137137
this.unboundWildcardExpression = "%s";
@@ -331,9 +331,12 @@ public Object convertConditionFieldEqValQueryExpr(ConditionFieldEqualsValueExpre
331331

332332
@Override
333333
public Object convertConditionValStr(ConditionValueExpression condition) throws SigmaValueError {
334+
String field = getFinalValueField();
335+
ruleQueryFields.put(field, Map.of("type", "text", "analyzer", "rule_analyzer"));
334336
SigmaString value = (SigmaString) condition.getValue();
335337
boolean containsWildcard = value.containsWildcard();
336-
return String.format(Locale.getDefault(), (containsWildcard? this.unboundWildcardExpression: this.unboundValueStrExpression), this.convertValueStr((SigmaString) condition.getValue()));
338+
return String.format(Locale.getDefault(), (containsWildcard? this.unboundWildcardExpression: this.unboundValueStrExpression),
339+
this.convertValueStr((SigmaString) condition.getValue()));
337340
}
338341

339342
@Override

0 commit comments

Comments
 (0)