[7.x] [Security Solution] Refactor OverviewHost and OverviewNetwork to use Search Strategy (#76409)

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/all/index.ts

@@ -12,7 +12,6 @@ import { RequestOptionsPaginated } from '../..';
 
 export interface HostsEdges {
   node: HostItem;
-
   cursor: CursorType;
 }
 

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/details/index.ts

@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+
+import { Inspect, Maybe, TimerangeInput } from '../../../common';
+import { HostItem, HostsFields } from '../common';
+import { RequestOptionsPaginated } from '../..';
+
+export interface HostDetailsStrategyResponse extends IEsSearchResponse {
+  hostDetails: HostItem;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface HostDetailsRequestOptions extends Partial<RequestOptionsPaginated<HostsFields>> {
+  hostName: string;
+  skip?: boolean;
+  timerange: TimerangeInput;
+  inspect?: Maybe<Inspect>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts

@@ -7,14 +7,16 @@
 export * from './all';
 export * from './authentications';
 export * from './common';
+export * from './details';
 export * from './first_last_seen';
 export * from './overview';
 export * from './uncommon_processes';
 
 export enum HostsQueries {
   authentications = 'authentications',
+  details = 'details',
   firstLastSeen = 'firstLastSeen',
   hosts = 'hosts',
-  hostOverview = 'hostOverview',
+  overview = 'overviewHost',
   uncommonProcesses = 'uncommonProcesses',
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/overview/index.ts

@@ -5,18 +5,83 @@
  */
 
 import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
-import { Inspect, Maybe, TimerangeInput } from '../../../common';
-import { HostItem, HostsFields } from '../common';
-import { RequestOptionsPaginated } from '../..';
+import { Inspect, Maybe, SearchHit } from '../../../common';
+import { RequestBasicOptions } from '../..';
+
+export type HostOverviewRequestOptions = RequestBasicOptions;
 
 export interface HostOverviewStrategyResponse extends IEsSearchResponse {
-  hostOverview: HostItem;
   inspect?: Maybe<Inspect>;
+  overviewHost: {
+    auditbeatAuditd?: Maybe<number>;
+    auditbeatFIM?: Maybe<number>;
+    auditbeatLogin?: Maybe<number>;
+    auditbeatPackage?: Maybe<number>;
+    auditbeatProcess?: Maybe<number>;
+    auditbeatUser?: Maybe<number>;
+    endgameDns?: Maybe<number>;
+    endgameFile?: Maybe<number>;
+    endgameImageLoad?: Maybe<number>;
+    endgameNetwork?: Maybe<number>;
+    endgameProcess?: Maybe<number>;
+    endgameRegistry?: Maybe<number>;
+    endgameSecurity?: Maybe<number>;
+    filebeatSystemModule?: Maybe<number>;
+    winlogbeatSecurity?: Maybe<number>;
+    winlogbeatMWSysmonOperational?: Maybe<number>;
+  };
 }
 
-export interface HostOverviewRequestOptions extends Partial<RequestOptionsPaginated<HostsFields>> {
-  hostName: string;
-  skip?: boolean;
-  timerange: TimerangeInput;
-  inspect?: Maybe<Inspect>;
+export interface OverviewHostHit extends SearchHit {
+  aggregations: {
+    auditd_count: {
+      doc_count: number;
+    };
+    endgame_module: {
+      dns_event_count: {
+        doc_count: number;
+      };
+      file_event_count: {
+        doc_count: number;
+      };
+      image_load_event_count: {
+        doc_count: number;
+      };
+      network_event_count: {
+        doc_count: number;
+      };
+      process_event_count: {
+        doc_count: number;
+      };
+      registry_event: {
+        doc_count: number;
+      };
+      security_event_count: {
+        doc_count: number;
+      };
+    };
+    fim_count: {
+      doc_count: number;
+    };
+    system_module: {
+      login_count: {
+        doc_count: number;
+      };
+      package_count: {
+        doc_count: number;
+      };
+      process_count: {
+        doc_count: number;
+      };
+      user_count: {
+        doc_count: number;
+      };
+      filebeat_count: {
+        doc_count: number;
+      };
+    };
+    winlog_count: {
+      doc_count: number;
+    };
+  };
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -7,6 +7,8 @@
 import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
 import { ESQuery } from '../../typed_json';
 import {
+  HostDetailsStrategyResponse,
+  HostDetailsRequestOptions,
   HostOverviewStrategyResponse,
   HostAuthenticationsRequestOptions,
   HostAuthenticationsStrategyResponse,
@@ -27,6 +29,8 @@ import {
   NetworkTlsRequestOptions,
   NetworkHttpStrategyResponse,
   NetworkHttpRequestOptions,
+  NetworkOverviewStrategyResponse,
+  NetworkOverviewRequestOptions,
   NetworkTopCountriesStrategyResponse,
   NetworkTopCountriesRequestOptions,
   NetworkTopNFlowStrategyResponse,
@@ -73,7 +77,9 @@ export interface RequestOptionsPaginated<Field = string> extends RequestBasicOpt
 
 export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
   ? HostsStrategyResponse
-  : T extends HostsQueries.hostOverview
+  : T extends HostsQueries.details
+  ? HostDetailsStrategyResponse
+  : T extends HostsQueries.overview
   ? HostOverviewStrategyResponse
   : T extends HostsQueries.authentications
   ? HostAuthenticationsStrategyResponse
@@ -85,6 +91,8 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? NetworkDnsStrategyResponse
   : T extends NetworkQueries.http
   ? NetworkHttpStrategyResponse
+  : T extends NetworkQueries.overview
+  ? NetworkOverviewStrategyResponse
   : T extends NetworkQueries.tls
   ? NetworkTlsStrategyResponse
   : T extends NetworkQueries.topCountries
@@ -97,7 +105,9 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
 
 export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
   ? HostsRequestOptions
-  : T extends HostsQueries.hostOverview
+  : T extends HostsQueries.details
+  ? HostDetailsRequestOptions
+  : T extends HostsQueries.overview
   ? HostOverviewRequestOptions
   : T extends HostsQueries.authentications
   ? HostAuthenticationsRequestOptions
@@ -109,6 +119,8 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   ? NetworkDnsRequestOptions
   : T extends NetworkQueries.http
   ? NetworkHttpRequestOptions
+  : T extends NetworkQueries.overview
+  ? NetworkOverviewRequestOptions
   : T extends NetworkQueries.tls
   ? NetworkTlsRequestOptions
   : T extends NetworkQueries.topCountries

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts

@@ -7,13 +7,15 @@
 export * from './common';
 export * from './dns';
 export * from './http';
+export * from './overview';
 export * from './tls';
 export * from './top_countries';
 export * from './top_n_flow';
 
 export enum NetworkQueries {
   dns = 'dns',
   http = 'http',
+  overview = 'overviewNetwork',
   tls = 'tls',
   topCountries = 'topCountries',
   topNFlow = 'topNFlow',

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/overview/index.ts

@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe, SearchHit } from '../../../common';
+import { RequestBasicOptions } from '../..';
+
+export type NetworkOverviewRequestOptions = RequestBasicOptions;
+
+export interface NetworkOverviewStrategyResponse extends IEsSearchResponse {
+  inspect?: Maybe<Inspect>;
+  overviewNetwork: {
+    auditbeatSocket?: Maybe<number>;
+    filebeatCisco?: Maybe<number>;
+    filebeatNetflow?: Maybe<number>;
+    filebeatPanw?: Maybe<number>;
+    filebeatSuricata?: Maybe<number>;
+    filebeatZeek?: Maybe<number>;
+    packetbeatDNS?: Maybe<number>;
+    packetbeatFlow?: Maybe<number>;
+    packetbeatTLS?: Maybe<number>;
+  };
+}
+
+export interface OverviewNetworkHit extends SearchHit {
+  aggregations: {
+    unique_flow_count: {
+      doc_count: number;
+    };
+    unique_dns_count: {
+      doc_count: number;
+    };
+    unique_suricata_count: {
+      doc_count: number;
+    };
+    unique_zeek_count: {
+      doc_count: number;
+    };
+    unique_socket_count: {
+      doc_count: number;
+    };
+    unique_filebeat_count: {
+      unique_netflow_count: {
+        doc_count: number;
+      };
+      unique_panw_count: {
+        doc_count: number;
+      };
+      unique_cisco_count: {
+        doc_count: number;
+      };
+    };
+    unique_packetbeat_count: {
+      unique_tls_count: {
+        doc_count: number;
+      };
+    };
+  };
+}

x-pack/plugins/security_solution/cypress/fixtures/overview.json

@@ -2,37 +2,6 @@
   "data": {
     "source": {
       "id": "default",
-      "OverviewNetwork": {
-        "auditbeatSocket": 578502,
-        "filebeatCisco": 999,
-        "filebeatNetflow": 2544,
-        "filebeatPanw": 678,
-        "filebeatSuricata": 303699,
-        "filebeatZeek": 71129,
-        "packetbeatDNS": 1090,
-        "packetbeatFlow": 722153,
-        "packetbeatTLS": 340,
-        "__typename": "OverviewNetworkData"
-      },
-      "OverviewHost": {
-        "auditbeatAuditd": 123,
-        "auditbeatFIM": 345,
-        "auditbeatLogin": 456,
-        "auditbeatPackage": 567,
-        "auditbeatProcess": 678,
-        "auditbeatUser": 789,
-        "endgameDns": 391,
-        "endgameFile": 392,
-        "endgameImageLoad": 393,
-        "endgameNetwork": 394,
-        "endgameProcess": 395,
-        "endgameRegistry": 396,
-        "endgameSecurity": 397,
-        "filebeatSystemModule": 890,
-        "winlogbeatSecurity": 70,
-        "winlogbeatMWSysmonOperational": 30,
-        "__typename": "OverviewHostData"
-      },
       "status": {
         "indicesExist": true,
         "indexFields": [],

x-pack/plugins/security_solution/cypress/fixtures/overview_search_strategy.json

@@ -0,0 +1,33 @@
+{
+  "overviewNetwork": {
+    "auditbeatSocket": 578502,
+    "filebeatCisco": 999,
+    "filebeatNetflow": 2544,
+    "filebeatPanw": 678,
+    "filebeatSuricata": 303699,
+    "filebeatZeek": 71129,
+    "packetbeatDNS": 1090,
+    "packetbeatFlow": 722153,
+    "packetbeatTLS": 340,
+    "__typename": "OverviewNetworkData"
+  },
+  "overviewHost": {
+    "auditbeatAuditd": 123,
+    "auditbeatFIM": 345,
+    "auditbeatLogin": 456,
+    "auditbeatPackage": 567,
+    "auditbeatProcess": 678,
+    "auditbeatUser": 789,
+    "endgameDns": 391,
+    "endgameFile": 392,
+    "endgameImageLoad": 393,
+    "endgameNetwork": 394,
+    "endgameProcess": 395,
+    "endgameRegistry": 396,
+    "endgameSecurity": 397,
+    "filebeatSystemModule": 890,
+    "winlogbeatSecurity": 70,
+    "winlogbeatMWSysmonOperational": 30,
+    "__typename": "OverviewHostData"
+  }
+}

x-pack/plugins/security_solution/cypress/integration/overview.spec.ts

@@ -14,6 +14,7 @@ import { OVERVIEW_URL } from '../urls/navigation';
 describe('Overview Page', () => {
   before(() => {
     cy.stubSecurityApi('overview');
+    cy.stubSearchStrategyApi('overview_search_strategy');
     loginAndWaitForPage(OVERVIEW_URL);
   });
 

x-pack/plugins/security_solution/cypress/support/commands.js

@@ -39,6 +39,15 @@ Cypress.Commands.add('stubSecurityApi', function (dataFileName) {
   cy.route('POST', 'api/solutions/security/graphql', `@${dataFileName}JSON`);
 });
 
+Cypress.Commands.add('stubSearchStrategyApi', function (dataFileName) {
+  cy.on('window:before:load', (win) => {
+    win.fetch = null;
+  });
+  cy.server();
+  cy.fixture(dataFileName).as(`${dataFileName}JSON`);
+  cy.route('POST', 'internal/search/securitySolutionSearchStrategy', `@${dataFileName}JSON`);
+});
+
 Cypress.Commands.add(
   'attachFile',
   {

x-pack/plugins/security_solution/cypress/support/index.d.ts

@@ -7,6 +7,7 @@
 declare namespace Cypress {
   interface Chainable<Subject> {
     stubSecurityApi(dataFileName: string): Chainable<Subject>;
+    stubSearchStrategyApi(dataFileName: string): Chainable<Subject>;
     attachFile(fileName: string, fileType?: string): Chainable<JQuery>;
   }
 }