[Security Solution] Refactor Network TLS to use Search Strategy

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/all/index.ts

@@ -6,15 +6,8 @@
 
 import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
 
-import { HostItem } from '../common';
-import {
- CursorType,
- Inspect,
- Maybe,
- PageInfoPaginated,
- RequestOptionsPaginated,
- SortField,
-} from '../..';
+import { HostItem, HostsFields } from '../common';
+import { CursorType, Inspect, Maybe, PageInfoPaginated, RequestOptionsPaginated } from '../..';
 
 export interface HostsEdges {
  node: HostItem;
@@ -29,7 +22,6 @@ export interface HostsStrategyResponse extends IEsSearchResponse {
  inspect?: Maybe<Inspect>;
 }
 
-export interface HostsRequestOptions extends RequestOptionsPaginated {
- sort: SortField;
+export interface HostsRequestOptions extends RequestOptionsPaginated<HostsFields> {
  defaultIndex: string[];
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts

@@ -14,6 +14,11 @@ export enum HostPolicyResponseActionStatus {
  warning = 'warning',
 }
 
+export enum HostsFields {
+ lastSeen = 'lastSeen',
+ hostName = 'hostName',
+}
+
 export interface EndpointFields {
  endpointPolicy?: Maybe<string>;
  sensorVersion?: Maybe<string>;

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/first_last_seen/index.ts

@@ -6,8 +6,10 @@
 
 import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
 import { Inspect, Maybe, RequestOptionsPaginated } from '../..';
+import { HostsFields } from '../common';
 
-export interface HostFirstLastSeenRequestOptions extends Partial<RequestOptionsPaginated> {
+export interface HostFirstLastSeenRequestOptions
+ extends Partial<RequestOptionsPaginated<HostsFields>> {
  hostName: string;
 }
 export interface HostFirstLastSeenStrategyResponse extends IEsSearchResponse {

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/overview/index.ts

@@ -6,15 +6,15 @@
 
 import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
 
-import { HostItem } from '../common';
+import { HostItem, HostsFields } from '../common';
 import { Inspect, Maybe, RequestOptionsPaginated, TimerangeInput } from '../..';
 
 export interface HostOverviewStrategyResponse extends IEsSearchResponse {
  hostOverview: HostItem;
  inspect?: Maybe<Inspect>;
 }
 
-export interface HostOverviewRequestOptions extends Partial<RequestOptionsPaginated> {
+export interface HostOverviewRequestOptions extends Partial<RequestOptionsPaginated<HostsFields>> {
  hostName: string;
  skip?: boolean;
  timerange: TimerangeInput;

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -15,10 +15,13 @@ import {
  HostsRequestOptions,
  HostsStrategyResponse,
 } from './hosts';
+import { NetworkQueries, NetworkTlsStrategyResponse, NetworkTlsRequestOptions } from './network';
+
 export * from './hosts';
+export * from './network';
 export type Maybe<T> = T | null;
 
-export type FactoryQueryTypes = HostsQueries;
+export type FactoryQueryTypes = HostsQueries | NetworkQueries;
 
 export type SearchHit = IEsSearchResponse<object>['rawResponse']['hits']['hits'][0];
 
@@ -48,8 +51,8 @@ export enum Direction {
  desc = 'desc',
 }
 
-export interface SortField {
- field: 'lastSeen' | 'hostName';
+export interface SortField<Field = string> {
+ field: Field;
  direction: Direction;
 }
 
@@ -95,14 +98,14 @@ export interface RequestBasicOptions extends IEsSearchRequest {
  factoryQueryType?: FactoryQueryTypes;
 }
 
-export interface RequestOptions extends RequestBasicOptions {
+export interface RequestOptions<Field = string> extends RequestBasicOptions {
  pagination: PaginationInput;
- sortField?: SortField;
+ sort: SortField<Field>;
 }
 
-export interface RequestOptionsPaginated extends RequestBasicOptions {
+export interface RequestOptionsPaginated<Field = string> extends RequestBasicOptions {
  pagination: PaginationInputPaginated;
- sortField?: SortField;
+ sort: SortField<Field>;
 }
 
 export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
@@ -111,6 +114,8 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
  ? HostOverviewStrategyResponse
  : T extends HostsQueries.firstLastSeen
  ? HostFirstLastSeenStrategyResponse
+ : T extends NetworkQueries.tls
+ ? NetworkTlsStrategyResponse
  : never;
 
 export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
@@ -119,4 +124,6 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
  ? HostOverviewRequestOptions
  : T extends HostsQueries.firstLastSeen
  ? HostFirstLastSeenRequestOptions
+ : T extends NetworkQueries.tls
+ ? NetworkTlsRequestOptions
  : never;

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts

@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './tls';
+
+export enum NetworkQueries {
+ tls = 'tls',
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/tls/index.ts

@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { CursorType, Inspect, Maybe, PageInfoPaginated, RequestOptionsPaginated } from '../..';
+
+export interface TlsBuckets {
+ key: string;
+ timestamp?: {
+ value: number;
+ value_as_string: string;
+ };
+ subjects: {
+ buckets: Readonly<Array<{ key: string; doc_count: number }>>;
+ };
+ ja3: {
+ buckets: Readonly<Array<{ key: string; doc_count: number }>>;
+ };
+ issuers: {
+ buckets: Readonly<Array<{ key: string; doc_count: number }>>;
+ };
+ not_after: {
+ buckets: Readonly<Array<{ key: number; key_as_string: string; doc_count: number }>>;
+ };
+}
+
+export interface TlsNode {
+ _id?: Maybe<string>;
+ timestamp?: Maybe<string>;
+ notAfter?: Maybe<string[]>;
+ subjects?: Maybe<string[]>;
+ ja3?: Maybe<string[]>;
+ issuers?: Maybe<string[]>;
+}
+
+export enum FlowTargetSourceDest {
+ destination = 'destination',
+ source = 'source',
+}
+
+export enum TlsFields {
+ _id = '_id',
+}
+
+export interface TlsEdges {
+ node: TlsNode;
+ cursor: CursorType;
+}
+
+export interface NetworkTlsRequestOptions extends RequestOptionsPaginated<TlsFields> {
+ ip: string;
+ flowTarget: FlowTargetSourceDest;
+ defaultIndex: string[];
+}
+
+export interface NetworkTlsStrategyResponse extends IEsSearchResponse {
+ edges: TlsEdges[];
+ totalCount: number;
+ pageInfo: PageInfoPaginated;
+ inspect?: Maybe<Inspect>;
+}