[Security Solution] Refactor Network Top Countries to use Search Stra…

…tegy (#76244)

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -25,6 +25,8 @@ import {
  NetworkTlsRequestOptions,
  NetworkHttpStrategyResponse,
  NetworkHttpRequestOptions,
+ NetworkTopCountriesStrategyResponse,
+ NetworkTopCountriesRequestOptions,
 } from './network';
 
 export * from './hosts';
@@ -168,6 +170,8 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
  ? NetworkTlsStrategyResponse
  : T extends NetworkQueries.http
  ? NetworkHttpStrategyResponse
+ : T extends NetworkQueries.topCountries
+ ? NetworkTopCountriesStrategyResponse
  : never;
 
 export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
@@ -182,6 +186,8 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
  ? NetworkTlsRequestOptions
  : T extends NetworkQueries.http
  ? NetworkHttpRequestOptions
+ : T extends NetworkQueries.topCountries
+ ? NetworkTopCountriesRequestOptions
  : never;
 
 export type StringOrNumber = string | number;

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common/index.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export enum FlowTargetSourceDest {
+ destination = 'destination',
+ source = 'source',
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts

@@ -4,10 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export * from './tls';
+export * from './common';
 export * from './http';
+export * from './tls';
+export * from './top_countries';
 
 export enum NetworkQueries {
  http = 'http',
  tls = 'tls',
+ topCountries = 'topCountries',
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/tls/index.ts

@@ -6,6 +6,7 @@
 
 import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
 import { CursorType, Inspect, Maybe, PageInfoPaginated, RequestOptionsPaginated } from '../..';
+import { FlowTargetSourceDest } from '../common';
 
 export interface TlsBuckets {
  key: string;
@@ -36,11 +37,6 @@ export interface TlsNode {
  issuers?: Maybe<string[]>;
 }
 
-export enum FlowTargetSourceDest {
- destination = 'destination',
- source = 'source',
-}
-
 export enum TlsFields {
  _id = '_id',
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/top_countries/index.ts

@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { GeoEcs } from '../../../../ecs/geo';
+import { CursorType, Inspect, Maybe, PageInfoPaginated, RequestOptionsPaginated } from '../..';
+import { FlowTargetSourceDest } from '../common';
+
+export enum NetworkTopTablesFields {
+ bytes_in = 'bytes_in',
+ bytes_out = 'bytes_out',
+ flows = 'flows',
+ destination_ips = 'destination_ips',
+ source_ips = 'source_ips',
+}
+
+export enum NetworkDnsFields {
+ dnsName = 'dnsName',
+ queryCount = 'queryCount',
+ uniqueDomains = 'uniqueDomains',
+ dnsBytesIn = 'dnsBytesIn',
+ dnsBytesOut = 'dnsBytesOut',
+}
+
+export enum FlowTarget {
+ client = 'client',
+ destination = 'destination',
+ server = 'server',
+ source = 'source',
+}
+
+export interface GeoItem {
+ geo?: Maybe<GeoEcs>;
+ flowTarget?: Maybe<FlowTargetSourceDest>;
+}
+
+export interface TopCountriesItemSource {
+ country?: Maybe<string>;
+ destination_ips?: Maybe<number>;
+ flows?: Maybe<number>;
+ location?: Maybe<GeoItem>;
+ source_ips?: Maybe<number>;
+}
+
+export interface NetworkTopCountriesRequestOptions
+ extends RequestOptionsPaginated<NetworkTopTablesFields> {
+ flowTarget: FlowTargetSourceDest;
+ ip?: string;
+}
+
+export interface NetworkTopCountriesStrategyResponse extends IEsSearchResponse {
+ edges: NetworkTopCountriesEdges[];
+ totalCount: number;
+ pageInfo: PageInfoPaginated;
+ inspect?: Maybe<Inspect>;
+}
+
+export interface NetworkTopCountriesEdges {
+ node: NetworkTopCountriesItem;
+ cursor: CursorType;
+}
+
+export interface NetworkTopCountriesItem {
+ _id?: Maybe<string>;
+ source?: Maybe<TopCountriesItemSource>;
+ destination?: Maybe<TopCountriesItemDestination>;
+ network?: Maybe<TopNetworkTablesEcsField>;
+}
+
+export interface TopCountriesItemDestination {
+ country?: Maybe<string>;
+ destination_ips?: Maybe<number>;
+ flows?: Maybe<number>;
+ location?: Maybe<GeoItem>;
+ source_ips?: Maybe<number>;
+}
+
+export interface TopNetworkTablesEcsField {
+ bytes_in?: Maybe<number>;
+ bytes_out?: Maybe<number>;
+}
+
+export interface NetworkTopCountriesBuckets {
+ country: string;
+ key: string;
+ bytes_in: {
+ value: number;
+ };
+ bytes_out: {
+ value: number;
+ };
+ flows: number;
+ destination_ips: number;
+ source_ips: number;
+}

x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_network.tsx

@@ -4,7 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { FlowTarget, FlowTargetSourceDest } from '../../../graphql/types';
+import {
+ FlowTarget,
+ FlowTargetSourceDest,
+} from '../../../../common/search_strategy/security_solution/network';
 
 import { appendSearch } from './helpers';
 

x-pack/plugins/security_solution/public/common/components/links/index.tsx

@@ -32,7 +32,10 @@ import {
  getCreateCaseUrl,
  useFormatUrl,
 } from '../link_to';
-import { FlowTarget, FlowTargetSourceDest } from '../../../graphql/types';
+import {
+ FlowTarget,
+ FlowTargetSourceDest,
+} from '../../../../common/search_strategy/security_solution/network';
 import { useUiSetting$, useKibana } from '../../lib/kibana';
 import { isUrlInvalid } from '../../utils/validators';
 import { ExternalLinkIcon } from '../external_link_icon';

x-pack/plugins/security_solution/public/hosts/containers/hosts/index.tsx

@@ -10,13 +10,14 @@ import { useCallback, useEffect, useRef, useState } from 'react';
 import { useSelector } from 'react-redux';
 
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import { HostsEdges, PageInfoPaginated } from '../../../graphql/types';
 import { inputsModel, State } from '../../../common/store';
 import { createFilter } from '../../../common/containers/helpers';
 import { useKibana } from '../../../common/lib/kibana';
 import { hostsModel, hostsSelectors } from '../../store';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
 import {
+ HostsEdges,
+ PageInfoPaginated,
  DocValueFields,
  HostsQueries,
  HostsRequestOptions,

x-pack/plugins/security_solution/public/network/components/network_top_countries_table/columns.tsx

@@ -14,7 +14,7 @@ import {
  FlowTargetSourceDest,
  NetworkTopCountriesEdges,
  TopNetworkTablesEcsField,
-} from '../../../graphql/types';
+} from '../../../../common/search_strategy/security_solution/network';
 import { networkModel } from '../../store';
 import {
  DragEffects,

x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx

@@ -11,7 +11,7 @@ import { MockedProvider } from 'react-apollo/test-utils';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import '../../../common/mock/match_media';
-import { FlowTargetSourceDest } from '../../../graphql/types';
+import { FlowTargetSourceDest } from '../../../../common/search_strategy/security_solution/network';
 import {
  apolloClientObservable,
  mockGlobalState,
@@ -76,7 +76,7 @@ describe('NetworkTopCountries Table Component', () => {
  </ReduxStoreProvider>
  );
 
- expect(wrapper.find('Connect(NetworkTopCountriesTableComponent)')).toMatchSnapshot();
+ expect(wrapper.find('Memo(NetworkTopCountriesTableComponent)')).toMatchSnapshot();
  });
  test('it renders the IP Details NetworkTopCountries table', () => {
  const wrapper = shallow(
@@ -101,7 +101,7 @@ describe('NetworkTopCountries Table Component', () => {
  </ReduxStoreProvider>
  );
 
- expect(wrapper.find('Connect(NetworkTopCountriesTableComponent)')).toMatchSnapshot();
+ expect(wrapper.find('Memo(NetworkTopCountriesTableComponent)')).toMatchSnapshot();
  });
  });