Skip to content

Commit 92a620d

Browse files
sbcd90sbcd90
authored
return rule fields which do not have aliases (#652)
* return rule fields which do not have aliases Signed-off-by: Subhobrata Dey <[email protected]> * return rule fields which do not have aliases Signed-off-by: Subhobrata Dey <[email protected]> --------- Signed-off-by: Subhobrata Dey <[email protected]>
1 parent 884ddd0 commit 92a620d

File tree

3 files changed

+82
-4
lines changed

3 files changed

+82
-4
lines changed

‎src/main/java/org/opensearch/securityanalytics/mapper/MapperService.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -515,6 +515,8 @@ public void onResponse(GetMappingsResponse getMappingsResponse) {
515515
aliasMappingFields.put(mapping.getEcs(), Map.of("type", "alias", "path", mapping.getOcsf()));
516516
} else if (mapping.getEcs() != null) {
517517
aliasMappingFields.put(mapping.getEcs(), Map.of("type", "alias", "path", mapping.getRawField()));
518+
} else if (mapping.getEcs() == null) {
519+
aliasMappingFields.put(mapping.getRawField(), Map.of("type", "alias", "path", mapping.getRawField()));
518520
}
519521
}
520522
aliasMappingsObj.field("properties", aliasMappingFields);

‎src/test/java/org/opensearch/securityanalytics/TestHelpers.java

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,35 @@ public static String randomRule() {
259259
"level: high";
260260
}
261261

262+
public static String randomRuleForMappingView(String field) {
263+
return "title: Remote Encrypting File System Abuse\n" +
264+
"id: 5f92fff9-82e2-48eb-8fc1-8b133556a551\n" +
265+
"description: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR\n" +
266+
"references:\n" +
267+
" - https://attack.mitre.org/tactics/TA0008/\n" +
268+
" - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942\n" +
269+
" - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-EFSR.md\n" +
270+
" - https://github.com/zeronetworks/rpcfirewall\n" +
271+
" - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/\n" +
272+
"tags:\n" +
273+
" - attack.defense_evasion\n" +
274+
"status: experimental\n" +
275+
"author: Sagie Dulce, Dekel Paz\n" +
276+
"date: 2022/01/01\n" +
277+
"modified: 2022/01/01\n" +
278+
"logsource:\n" +
279+
" product: rpc_firewall\n" +
280+
" category: application\n" +
281+
" definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:df1941c5-fe89-4e79-bf10-463657acf44d or c681d488-d850-11d0-8c52-00c04fd90f7e'\n" +
282+
"detection:\n" +
283+
" selection:\n" +
284+
" "+ field + ": 'ACL'\n" +
285+
" condition: selection\n" +
286+
"falsepositives:\n" +
287+
" - Legitimate usage of remote file encryption\n" +
288+
"level: high";
289+
}
290+
262291
public static String randomRuleForCustomLogType() {
263292
return "title: Remote Encrypting File System Abuse\n" +
264293
"id: 5f92fff9-82e2-48eb-8fc1-8b133556a551\n" +

‎src/test/java/org/opensearch/securityanalytics/resthandler/RuleRestApiIT.java

Lines changed: 51 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,17 +22,13 @@
2222
import org.opensearch.securityanalytics.SecurityAnalyticsPlugin;
2323
import org.opensearch.securityanalytics.SecurityAnalyticsRestTestCase;
2424
import org.opensearch.securityanalytics.config.monitors.DetectorMonitorConfig;
25-
import org.opensearch.securityanalytics.logtype.BuiltinLogTypeLoader;
2625
import org.opensearch.securityanalytics.model.Detector;
2726
import org.opensearch.securityanalytics.model.DetectorInput;
2827
import org.opensearch.securityanalytics.model.DetectorRule;
2928
import org.opensearch.securityanalytics.model.Rule;
3029

3130
import java.io.File;
3231
import java.io.IOException;
33-
import java.nio.file.Files;
34-
import java.nio.file.Path;
35-
import java.nio.file.Paths;
3632
import java.util.Collections;
3733
import java.util.List;
3834
import java.util.Locale;
@@ -47,6 +43,7 @@
4743
import static org.opensearch.securityanalytics.TestHelpers.randomEditedRule;
4844
import static org.opensearch.securityanalytics.TestHelpers.randomIndex;
4945
import static org.opensearch.securityanalytics.TestHelpers.randomRule;
46+
import static org.opensearch.securityanalytics.TestHelpers.randomRuleForMappingView;
5047
import static org.opensearch.securityanalytics.TestHelpers.randomRuleWithErrors;
5148
import static org.opensearch.securityanalytics.TestHelpers.windowsIndexMapping;
5249

@@ -841,4 +838,54 @@ public void testGetAllRuleCategories() throws IOException {
841838
assertTrue(categories.stream().anyMatch(e -> ((Map<String, Object>)e).get("key").equals("linux")));
842839
assertTrue(categories.stream().anyMatch(e -> ((Map<String, Object>)e).get("key").equals("waf")));
843840
}
841+
842+
@SuppressWarnings("unchecked")
843+
public void testGetMappingsViewApiForFieldAliasesWithSameName() throws IOException {
844+
String index = createTestIndex(randomIndex(), windowsIndexMapping());
845+
// Execute GetMappingsViewAction to add alias mapping for index
846+
Request request = new Request("GET", SecurityAnalyticsPlugin.MAPPINGS_VIEW_BASE_URI);
847+
// both req params and req body are supported
848+
request.addParameter("index_name", index);
849+
request.addParameter("rule_topic", randomDetectorType());
850+
Response response = client().performRequest(request);
851+
assertEquals(HttpStatus.SC_OK, response.getStatusLine().getStatusCode());
852+
Map<String, Object> respMap = responseAsMap(response);
853+
Assert.assertTrue(((List<String>) respMap.get("unmapped_index_fields")).contains("AccessList"));
854+
855+
String rule = randomRuleForMappingView("AccessList");
856+
857+
Response createResponse = makeRequest(client(), "POST", SecurityAnalyticsPlugin.RULE_BASE_URI, Collections.singletonMap("category", randomDetectorType()),
858+
new StringEntity(rule), new BasicHeader("Content-Type", "application/json"));
859+
Assert.assertEquals("Create rule failed", RestStatus.CREATED, restStatus(createResponse));
860+
Map<String, Object> responseBody = asMap(createResponse);
861+
String createdId = responseBody.get("_id").toString();
862+
863+
// Execute GetMappingsViewAction to add alias mapping for index
864+
request = new Request("GET", SecurityAnalyticsPlugin.MAPPINGS_VIEW_BASE_URI);
865+
// both req params and req body are supported
866+
request.addParameter("index_name", index);
867+
request.addParameter("rule_topic", randomDetectorType());
868+
response = client().performRequest(request);
869+
assertEquals(HttpStatus.SC_OK, response.getStatusLine().getStatusCode());
870+
respMap = responseAsMap(response);
871+
Assert.assertTrue(((Map<String, Object>) respMap.get("properties")).containsKey("AccessList"));
872+
873+
rule = randomRuleForMappingView("Access_List");
874+
875+
Response updateResponse = makeRequest(client(), "PUT", SecurityAnalyticsPlugin.RULE_BASE_URI + "/" + createdId,
876+
Map.of("category", randomDetectorType()),
877+
new StringEntity(rule), new BasicHeader("Content-Type", "application/json"));
878+
Assert.assertEquals("Update rule failed", RestStatus.OK, restStatus(updateResponse));
879+
880+
// Execute GetMappingsViewAction to add alias mapping for index
881+
request = new Request("GET", SecurityAnalyticsPlugin.MAPPINGS_VIEW_BASE_URI);
882+
// both req params and req body are supported
883+
request.addParameter("index_name", index);
884+
request.addParameter("rule_topic", randomDetectorType());
885+
response = client().performRequest(request);
886+
assertEquals(HttpStatus.SC_OK, response.getStatusLine().getStatusCode());
887+
respMap = responseAsMap(response);
888+
Assert.assertTrue(((List<String>) respMap.get("unmapped_field_aliases")).contains("Access_List"));
889+
Assert.assertTrue(((Map<String, Object>) respMap.get("properties")).containsKey("AccessList"));
890+
}
844891
}

0 commit comments

Comments
 (0)