[wiz] Initial Release for Wiz #7839
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
|
/test |
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
jamiehynds
added
the
New Integration
|
/test |
🌐 Coverage report
|
bhapas
reviewed
Sep 20, 2023
packages/wiz/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
Show resolved
Hide resolved
packages/wiz/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
efd6
reviewed
Sep 20, 2023
packages/wiz/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json
Outdated
Show resolved
Hide resolved
| initial_interval: {{initial_interval}} | ||
| want_more: false | ||
| batch_size: {{batch_size}} | ||
| query: "query AuditLogTable($first: Int $after: String $filterBy: AuditLogEntryFilters){ auditLogEntries(first: $first after: $after filterBy: $filterBy) { nodes { id action requestId status timestamp actionParameters userAgent sourceIP serviceAccount { id name } user { id name } } pageInfo { hasNextPage endCursor } } }" |
There was a problem hiding this comment.
Is it possible to make this more readable? What is the format that is expected, must it all be on one line? If so suggest
Suggested change
| query: "query AuditLogTable($first: Int $after: String $filterBy: AuditLogEntryFilters){ auditLogEntries(first: $first after: $after filterBy: $filterBy) { nodes { id action requestId status timestamp actionParameters userAgent sourceIP serviceAccount { id name } user { id name } } pageInfo { hasNextPage endCursor } } }" | |
| query: >- | |
| query AuditLogTable($first: Int $after: String $filterBy: AuditLogEntryFilters){ | |
| auditLogEntries(first: $first after: $after filterBy: $filterBy) { | |
| nodes { | |
| id | |
| action | |
| requestId | |
| status | |
| timestamp | |
| actionParameters | |
| userAgent | |
| sourceIP | |
| serviceAccount { | |
| id | |
| name | |
| } | |
| user { | |
| id | |
| name | |
| } | |
| } | |
| pageInfo { | |
| hasNextPage | |
| endCursor | |
| } | |
| } | |
| } |
There was a problem hiding this comment.
Yes, it should be one line only otherwise it throws an error.
| state.url + "/graphql", | ||
| "application/json", | ||
| '''{ | ||
| "query": ''' + state.query.encode_json() + ''', |
There was a problem hiding this comment.
Why is this being JSON encoded?
| post_request( | ||
| state.url + "/graphql", | ||
| "application/json", | ||
| '''{ |
There was a problem hiding this comment.
I'm a little confused about why this is being done. Can you not construct an object and JSON encode it below?
There was a problem hiding this comment.
Hey @efd6, we tried constructing an object and JSON encoding it below but that throws failed eval: failed to marshal value to JSON: json: unsupported type: map[ref.Val]ref.Val error so we found this workaround to use string concatenation.
There was a problem hiding this comment.
Can you make a minimal reproducer for me? This should not happen.
There was a problem hiding this comment.
This should be fixed in v8.9. Can you check that?
| initial_interval: {{initial_interval}} | ||
| want_more: false | ||
| batch_size: {{batch_size}} | ||
| query: "query VulnerabilityFindingsPage( $filterBy: VulnerabilityFindingFilters $first: Int $after: String $orderBy: VulnerabilityFindingOrder ) { vulnerabilityFindings( filterBy: $filterBy first: $first after: $after orderBy: $orderBy ) { nodes { id portalUrl name CVEDescription CVSSSeverity score exploitabilityScore impactScore dataSourceName hasExploit hasCisaKevExploit status vendorSeverity firstDetectedAt lastDetectedAt resolvedAt description remediation detailedName version fixedVersion detectionMethod link locationPath resolutionReason epssSeverity epssPercentile epssProbability validatedInRuntime layerMetadata{ id details isBaseLayer } projects { id name slug businessUnit riskProfile { businessImpact } } ignoreRules{ id name enabled expiredAt } vulnerableAsset { ... on VulnerableAssetBase { id type name region providerUniqueId cloudProviderURL cloudPlatform status subscriptionName subscriptionExternalId subscriptionId tags hasLimitedInternetExposure hasWideInternetExposure isAccessibleFromVPN isAccessibleFromOtherVnets isAccessibleFromOtherSubscriptions } ... on VulnerableAssetVirtualMachine { operatingSystem ipAddresses } ... on VulnerableAssetServerless { runtime } ... on VulnerableAssetContainerImage { imageId } ... on VulnerableAssetContainer { ImageExternalId VmExternalId ServerlessContainer PodNamespace PodName NodeName } } } pageInfo { hasNextPage endCursor } } }" |
| post_request( | ||
| state.url + "/graphql", | ||
| "application/json", | ||
| '''{ |
| {{#if processors}} | ||
| processors: | ||
| {{processors}} | ||
| {{/if}} |
There was a problem hiding this comment.
This looks like it is leftover from the template.
| - append: | ||
| field: error.message | ||
| value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' | ||
| - date: |
|
/test |
bhapas
reviewed
Sep 28, 2023
| @@ -20,4 +20,4 @@ rules: | |||
| Content-Type: | |||
| - application/json | |||
| body: | | |||
| {"data": {"auditLogEntries": {"nodes": [{"id": "8f7fa6bd-ce32-4f11-91b4-a0377438561e","action": " user Login","requestId": "8f7fa6bd-ce32-4f11-91b4-a0377438561e","status": "SUCCESS","timestamp": "2023-08-24T08:54:21.44203Z","actionParameters": {"clientID": "kr7ngoiolk3d9i8ravmuutlb6","groups": null,"name": "op-us","products": ["*"],"role": "","scopes": ["read:issues","read:reports","read:vulnerabilities","read:cloud_configuration","update:reports","create:reports"],"userEmail": "","userID": "mlipebtwsndhxdmnzdwrxzmiojxkszrh6qzfufevkpmdguxfv4cxg","userpoolID": "us-east-2_GQ3gwvxsQ"},"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36","sourceIP": null,"serviceAccount": {"id": "mlipebtwsndhxdmnzdwrxzmiojxkszrh6qzfufevkpmdguxfv4cxg","name": "op-us"},"user": null}],"pageInfo": {"hasNextPage": false,"endCursor": "eyJmaWVsZHMiOlt7IkZpZWxkIjoiVGltZXN0YW1wIiwiVmFsdWUiOiIyMDIzLTA5LTA0VDExOjE5OjM3LjgwMTU0MVoifV19"}}}} | |||
| {"data": {"auditLogEntries": {"nodes": [{"id": "8f7fa6bd-ce32-4f11-91b4-a0377438561e","action": " user Login","requestId": "8f7fa6bd-ce32-4f11-91b4-a0377438561e","status": "SUCCESS","timestamp": "2023-08-24T08:54:21.44203Z","actionParameters": {"clientID": "kr7ngoiolk3d9i8ravmuutlb6","groups": null,"name": "op-us","products": ["*"],"role": "","scopes": ["read:issues","read:reports","read:vulnerabilities","read:cloud_configuration","update:reports","create:reports"],"userEmail": "","userID": "mlipebtwsndhxdmnzdwrxzmiojxkszrh6qzfufevkpmdguxfv4cxg","userpoolID": "us-east-2_GQ3gwvxsQ"},"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36","sourceIP": null,"serviceAccount": {"id": "mlipebtwsndhxdmnzdwrxzmiojxkszrh6qzfufevkpmdguxfv4cxg","name": "op-us"},"user": null},{"id": "823b5f36-3c20-4e91-955c-9aaa486cdeab","action": "Login","requestId": "823b5f36-3c20-4e91-955c-9aaa486cdeab","status": "SUCCESS","timestamp": "2023-09-21T07:07:27.176978Z","actionParameters": {"clientID": "kr7ngoiolk3d9i8ravmuutlb6","groups": null,"name": "aembit","products": ["*"],"role": "","scopes": ["read:resources","read:reports","update:reports","create:reports"],"userEmail": "","userID": "mlipebtwsndhxdmnzdwrxzmiokcvchjpebavkufblyt6u3qowslxg","userpoolID": "us-east-2_GQ3gwvxsQ"},"userAgent": null,"sourceIP": null,"serviceAccount": {"id": "mlipebtwsndhxdmnzdwrxzmiokcvchjpebavkufblyt6u3qowslxg","name": "aembit"},"user": null},{"id": "aad8ab9c-f1bf-4a80-a1e1-13bc8769caf4","action": "Login","requestId": "aad8ab9c-f1bf-4a80-a1e1-13bc8769caf4","status": "SUCCESS","timestamp": "2023-09-21T07:07:21.105685Z","actionParameters": {"clientID": "kr7ngoiolk3d9i8ravmuutlb6","groups": null,"name": "elastic","products": ["*"],"role": "","scopes": ["read:issues","read:reports","read:vulnerabilities","update:reports","create:reports","admin:audit"],"userEmail": "","userID": "mlipebtwsndhxdmnzdwrxzmiolvzt6topjvv4nugzctcsyarazrhg","userpoolID": "us-east-2_GQ3gwvxsQ"},"userAgent": null,"sourceIP": null,"serviceAccount": {"id": "mlipebtwsndhxdmnzdwrxzmiolvzt6topjvv4nugzctcsyarazrhg","name": "elastic"},"user": null}],"pageInfo": {"hasNextPage": false,"endCursor": "eyJmaWVsZHMiOlt7IkZpZWxkIjoiVGltZXN0YW1wIiwiVmFsdWUiOiIyMDIzLTA5LTA0VDExOjE5OjM3LjgwMTU0MVoifV19"}}}} | |||
There was a problem hiding this comment.
What I am more interested in paginated responses is to have "hasNextPage": true and a new request that uses the endCursor so that the agent config behaves as expected with cursor information and pagination.
Applies to all data_streams
efd6
approved these changes
Sep 28, 2023
|
Package wiz - 0.1.0 containing this change is available at https://epr.elastic.co/search?package=wiz |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Integration release checklist
This checklist is intended for integrations maintainers to ensure consistency when creating or updating a Package, Module or Dataset for an Integration.
All changes
New Package
Log dataset changes
How to test this PR locally
Automated Test
Screenshot