[8.x] [SecuritySolution] Add service enrichment to detection engine (#…

…206582) (#207708) # Backport This will backport the following commits from `main` to `8.x`: - [[SecuritySolution] Add service enrichment to detection engine (#206582)](#206582)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)
elastic · Jan 22, 2025 · f9bed85 · f9bed85
1 parent c864f54
commit f9bed85
Show file tree

Hide file tree

Showing 20 changed files with 500 additions and 45 deletions.
diff --git a/...latform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/security_schema.ts b/...latform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/security_schema.ts
@@ -212,6 +212,9 @@ const SecurityAlertOptional = rt.partial({
   'kibana.alert.workflow_tags': schemaStringArray,
   'kibana.alert.workflow_user': schemaString,
   'kibana.version': schemaString,
+  'service.asset.criticality': schemaString,
+  'service.risk.calculated_level': schemaString,
+  'service.risk.calculated_score_norm': schemaNumber,
   tags: schemaStringArray,
   'user.asset.criticality': schemaString,
 });

diff --git a/.../shared/alerting/server/integration_tests/__snapshots__/alert_as_data_fields.test.ts.snap b/.../shared/alerting/server/integration_tests/__snapshots__/alert_as_data_fields.test.ts.snap
diff --git a/...curity/plugins/security_solution/common/api/detection_engine/model/alerts/8.13.0/index.ts b/...curity/plugins/security_solution/common/api/detection_engine/model/alerts/8.13.0/index.ts
@@ -40,7 +40,7 @@ export interface BaseFields8130 extends BaseFields8120 {
   [ALERT_HOST_CRITICALITY]: string | undefined;
   [ALERT_USER_CRITICALITY]: string | undefined;
   /**
-   * Risk scores fields was added aroung 8.5.0, but the fields were not added to the alert schema
+   * Risk scores fields was added around 8.5.0, but the fields were not added to the alert schema
    */
   [ALERT_HOST_RISK_SCORE_CALCULATED_LEVEL]: string | undefined;
   [ALERT_HOST_RISK_SCORE_CALCULATED_SCORE_NORM]: number | undefined;

diff --git a/...curity/plugins/security_solution/common/api/detection_engine/model/alerts/8.18.0/index.ts b/...curity/plugins/security_solution/common/api/detection_engine/model/alerts/8.18.0/index.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { AlertWithCommonFields800 } from '@kbn/rule-registry-plugin/common/schemas/8.0.0';
+import type {
+  Ancestor8160,
+  BaseFields8160,
+  EqlBuildingBlockFields8160,
+  EqlShellFields8160,
+  NewTermsFields8160,
+} from '../8.16.0';
+import type {
+  ALERT_SERVICE_CRITICALITY,
+  ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL,
+  ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM,
+} from '../../../../../field_maps/field_names';
+
+/* DO NOT MODIFY THIS SCHEMA TO ADD NEW FIELDS. These types represent the alerts that shipped in 8.18.0.
+Any changes to these types should be bug fixes so the types more accurately represent the alerts from 8.18.0.
+If you are adding new fields for a new release of Kibana, create a new sibling folder to this one
+for the version to be released and add the field(s) to the schema in that folder.
+Then, update `../index.ts` to import from the new folder that has the latest schemas, add the
+new schemas to the union of all alert schemas, and re-export the new schemas as the `*Latest` schemas.
+*/
+
+export type { Ancestor8160 as Ancestor8180 };
+
+export interface BaseFields8180 extends BaseFields8160 {
+  [ALERT_SERVICE_CRITICALITY]: string | undefined;
+  [ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL]: string | undefined;
+  [ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM]: number | undefined;
+}
+
+export interface WrappedFields8180<T extends BaseFields8160> {
+  _id: string;
+  _index: string;
+  _source: T;
+}
+
+export type GenericAlert8180 = AlertWithCommonFields800<BaseFields8180>;
+
+export type EqlShellFields8180 = EqlShellFields8160 & BaseFields8180;
+
+export type EqlBuildingBlockFields8180 = EqlBuildingBlockFields8160 & BaseFields8180;
+
+export type NewTermsFields8180 = NewTermsFields8160 & BaseFields8180;
+
+export type NewTermsAlert8180 = NewTermsFields8160 & BaseFields8180;
+
+export type EqlBuildingBlockAlert8180 = AlertWithCommonFields800<EqlBuildingBlockFields8160>;
+
+export type EqlShellAlert8180 = AlertWithCommonFields800<EqlShellFields8180>;
+
+export type DetectionAlert8180 =
+  | GenericAlert8180
+  | EqlShellAlert8180
+  | EqlBuildingBlockAlert8180
+  | NewTermsAlert8180;
diff --git a/...ions/security/plugins/security_solution/common/api/detection_engine/model/alerts/index.ts b/...ions/security/plugins/security_solution/common/api/detection_engine/model/alerts/index.ts
@@ -15,15 +15,16 @@ import type { DetectionAlert890 } from './8.9.0';
 import type { DetectionAlert8120 } from './8.12.0';
 import type { DetectionAlert8130 } from './8.13.0';
 
+import type { DetectionAlert8160 } from './8.16.0';
 import type {
-  Ancestor8160,
-  BaseFields8160,
-  DetectionAlert8160,
-  EqlBuildingBlockFields8160,
-  EqlShellFields8160,
-  NewTermsFields8160,
-  WrappedFields8160,
-} from './8.16.0';
+  Ancestor8180,
+  BaseFields8180,
+  DetectionAlert8180,
+  EqlBuildingBlockFields8180,
+  EqlShellFields8180,
+  NewTermsFields8180,
+  WrappedFields8180,
+} from './8.18.0';
 
 // When new Alert schemas are created for new Kibana versions, add the DetectionAlert type from the new version
 // here, e.g. `export type DetectionAlert = DetectionAlert800 | DetectionAlert820` if a new schema is created in 8.2.0
@@ -36,14 +37,15 @@ export type DetectionAlert =
   | DetectionAlert890
   | DetectionAlert8120
   | DetectionAlert8130
-  | DetectionAlert8160;
+  | DetectionAlert8160
+  | DetectionAlert8180;
 
 export type {
-  Ancestor8160 as AncestorLatest,
-  BaseFields8160 as BaseFieldsLatest,
-  DetectionAlert8160 as DetectionAlertLatest,
-  WrappedFields8160 as WrappedFieldsLatest,
-  EqlBuildingBlockFields8160 as EqlBuildingBlockFieldsLatest,
-  EqlShellFields8160 as EqlShellFieldsLatest,
-  NewTermsFields8160 as NewTermsFieldsLatest,
+  Ancestor8180 as AncestorLatest,
+  BaseFields8180 as BaseFieldsLatest,
+  DetectionAlert8180 as DetectionAlertLatest,
+  WrappedFields8180 as WrappedFieldsLatest,
+  EqlBuildingBlockFields8180 as EqlBuildingBlockFieldsLatest,
+  EqlShellFields8180 as EqlShellFieldsLatest,
+  NewTermsFields8180 as NewTermsFieldsLatest,
 };
diff --git a/x-pack/solutions/security/plugins/security_solution/common/field_maps/8.18.0/alerts.ts b/x-pack/solutions/security/plugins/security_solution/common/field_maps/8.18.0/alerts.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { alertsFieldMap8160 } from '../8.16.0';
+import {
+  ALERT_SERVICE_CRITICALITY,
+  ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL,
+  ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM,
+} from '../field_names';
+
+export const alertsFieldMap8180 = {
+  ...alertsFieldMap8160,
+  /**
+   * Stores the criticality level for the service, as determined by analysts, in relation to the alert.
+   * The Criticality level is copied from the asset criticality index.
+   */
+  [ALERT_SERVICE_CRITICALITY]: {
+    type: 'keyword',
+    array: false,
+    required: false,
+  },
+
+  /**
+   * Stores the risk score level and score_norm level for the service, as determined by the Risk Engine, in relation to the alert.
+   * The Risk score is copied from the risk score index.
+   */
+  [ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL]: {
+    type: 'keyword',
+    array: false,
+    required: false,
+  },
+  [ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM]: {
+    type: 'float',
+    array: false,
+    required: false,
+  },
+} as const;
+
+export type AlertsFieldMap8180 = typeof alertsFieldMap8180;
diff --git a/x-pack/solutions/security/plugins/security_solution/common/field_maps/8.18.0/index.ts b/x-pack/solutions/security/plugins/security_solution/common/field_maps/8.18.0/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { AlertsFieldMap8180 } from './alerts';
+import { alertsFieldMap8180 } from './alerts';
+export type { AlertsFieldMap8180 };
+export { alertsFieldMap8180 };
diff --git a/x-pack/solutions/security/plugins/security_solution/common/field_maps/field_names.ts b/x-pack/solutions/security/plugins/security_solution/common/field_maps/field_names.ts
@@ -28,12 +28,16 @@ export const LEGACY_ALERT_USER_CRITICALITY = `${ALERT_NAMESPACE}.user.criticalit
 
 export const ALERT_HOST_CRITICALITY = `host.asset.criticality` as const;
 export const ALERT_USER_CRITICALITY = `user.asset.criticality` as const;
+export const ALERT_SERVICE_CRITICALITY = `service.asset.criticality` as const;
 export const ALERT_HOST_RISK_SCORE_CALCULATED_LEVEL = `host.risk.calculated_level` as const;
 export const ALERT_HOST_RISK_SCORE_CALCULATED_SCORE_NORM =
   `host.risk.calculated_score_norm` as const;
 export const ALERT_USER_RISK_SCORE_CALCULATED_LEVEL = `user.risk.calculated_level` as const;
 export const ALERT_USER_RISK_SCORE_CALCULATED_SCORE_NORM =
   `user.risk.calculated_score_norm` as const;
+export const ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL = `service.risk.calculated_level` as const;
+export const ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM =
+  `service.risk.calculated_score_norm` as const;
 
 export const ALERT_ORIGINAL_EVENT = `${ALERT_NAMESPACE}.original_event` as const;
 export const ALERT_ORIGINAL_EVENT_ACTION = `${ALERT_ORIGINAL_EVENT}.action` as const;

diff --git a/x-pack/solutions/security/plugins/security_solution/common/field_maps/index.ts b/x-pack/solutions/security/plugins/security_solution/common/field_maps/index.ts
@@ -4,10 +4,9 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
-import type { AlertsFieldMap8160 } from './8.16.0';
-import { alertsFieldMap8160 } from './8.16.0';
+import type { AlertsFieldMap8180 } from './8.18.0';
+import { alertsFieldMap8180 } from './8.18.0';
 import type { RulesFieldMap } from './8.0.0/rules';
 import { rulesFieldMap } from './8.0.0/rules';
-export type { AlertsFieldMap8160 as AlertsFieldMap, RulesFieldMap };
-export { alertsFieldMap8160 as alertsFieldMap, rulesFieldMap };
+export type { AlertsFieldMap8180 as AlertsFieldMap, RulesFieldMap };
+export { alertsFieldMap8180 as alertsFieldMap, rulesFieldMap };