From 53826009f2a0ed0c574603621ec94b4d7610c337 Mon Sep 17 00:00:00 2001 From: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com> Date: Wed, 10 Jan 2024 19:02:16 +0100 Subject: [PATCH 1/2] Replace discover file integrity monitoring (#6287) * Replace discover * Add changelog * Update CHANGELOG.md --------- Co-authored-by: Maximiliano Ibarra <6089438+Machi3mfl@users.noreply.github.com> Co-authored-by: Federico Rodriguez --- CHANGELOG.md | 2 +- .../common/modules/modules-defaults.js | 3 ++- .../file-integrity-monitoring-columns.tsx | 22 +++++++++++++++++++ 3 files changed, 25 insertions(+), 2 deletions(-) create mode 100644 plugins/main/public/components/overview/fim/events/file-integrity-monitoring-columns.tsx diff --git a/CHANGELOG.md b/CHANGELOG.md index cfb6eeb7ee..89f97fe7d9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,7 @@ All notable changes to the Wazuh app project will be documented in this file. ### Changed -- Removed embedded discover [#6120](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6120) [#6235](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6235) [#6254](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6254) [#6285](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6285) +- Removed embedded discover [#6120](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6120) [#6235](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6235) [#6254](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6254) [#6285](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6285) [#6287](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6287) - Develop logic of a new index for the fim module [#6227](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6227) - Allow editing groups for an agent from Endpoints Summary [#6250](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6250) diff --git a/plugins/main/public/components/common/modules/modules-defaults.js b/plugins/main/public/components/common/modules/modules-defaults.js index abd5ed3dfe..eff36526b7 100644 --- a/plugins/main/public/components/common/modules/modules-defaults.js +++ b/plugins/main/public/components/common/modules/modules-defaults.js @@ -26,6 +26,7 @@ import { threatHuntingColumns } from '../wazuh-discover/config/data-grid-columns import { DashboardFim } from '../../overview/fim/dashboard/dashboard'; import { InventoryFim } from '../../overview/fim/inventory/inventory'; import React from 'react'; +import { fileIntegrityMonitoringColumns } from '../../overview/fim/events/file-integrity-monitoring-columns'; import { configurationAssessmentColumns } from '../../agents/sca/events/configuration-assessment-columns'; const DashboardTab = { @@ -90,7 +91,7 @@ export const ModulesDefaults = { buttons: [ButtonModuleExploreAgent], component: InventoryFim, }, - EventsTab, + renderDiscoverTab(DEFAULT_INDEX_PATTERN, fileIntegrityMonitoringColumns), ], availableFor: ['manager', 'agent'], }, diff --git a/plugins/main/public/components/overview/fim/events/file-integrity-monitoring-columns.tsx b/plugins/main/public/components/overview/fim/events/file-integrity-monitoring-columns.tsx new file mode 100644 index 0000000000..6027563767 --- /dev/null +++ b/plugins/main/public/components/overview/fim/events/file-integrity-monitoring-columns.tsx @@ -0,0 +1,22 @@ +import { tDataGridColumn } from '../../../common/data-grid'; + +export const fileIntegrityMonitoringColumns: tDataGridColumn[] = [ + { + id: 'agent.name', + }, + { + id: 'syscheck.path', + }, + { + id: 'syscheck.event', + }, + { + id: 'rule.description', + }, + { + id: 'rule.level', + }, + { + id: 'rule.id', + }, +]; From c42fce2eea6b5afbdcedd2eef0ddab79e268e95c Mon Sep 17 00:00:00 2001 From: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com> Date: Wed, 10 Jan 2024 19:11:54 +0100 Subject: [PATCH 2/2] Replace discover Vulnerability (#6275) * Replace discover * Add explore agent * Add changelog * Fix events view with agent * Fix changelog.md --------- Co-authored-by: Federico Rodriguez --- CHANGELOG.md | 2 +- .../common/modules/modules-defaults.js | 13 +- .../common/wazuh-discover/wz-discover.tsx | 195 +++++++++++------- .../events/vulnerabilities-columns.tsx | 19 ++ 4 files changed, 157 insertions(+), 72 deletions(-) create mode 100644 plugins/main/public/components/overview/vulnerabilities/events/vulnerabilities-columns.tsx diff --git a/CHANGELOG.md b/CHANGELOG.md index 89f97fe7d9..5e0bbfe331 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,7 @@ All notable changes to the Wazuh app project will be documented in this file. ### Changed -- Removed embedded discover [#6120](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6120) [#6235](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6235) [#6254](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6254) [#6285](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6285) [#6287](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6287) +- Removed embedded discover [#6120](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6120) [#6235](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6235) [#6254](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6254) [#6285](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6285) [#6275](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6275) [#6287](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6287) - Develop logic of a new index for the fim module [#6227](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6227) - Allow editing groups for an agent from Endpoints Summary [#6250](https://github.com/wazuh/wazuh-dashboard-plugins/pull/6250) diff --git a/plugins/main/public/components/common/modules/modules-defaults.js b/plugins/main/public/components/common/modules/modules-defaults.js index eff36526b7..e44cf0349d 100644 --- a/plugins/main/public/components/common/modules/modules-defaults.js +++ b/plugins/main/public/components/common/modules/modules-defaults.js @@ -21,8 +21,9 @@ import { OfficePanel } from '../../overview/office-panel'; import { GitHubPanel } from '../../overview/github-panel'; import { DashboardVuls, InventoryVuls } from '../../overview/vulnerabilities'; import { withModuleNotForAgent } from '../hocs'; -import WazuhDiscover from '../wazuh-discover/wz-discover'; +import { WazuhDiscover } from '../wazuh-discover/wz-discover'; import { threatHuntingColumns } from '../wazuh-discover/config/data-grid-columns'; +import { vulnerabilitiesColumns } from '../../overview/vulnerabilities/events/vulnerabilities-columns'; import { DashboardFim } from '../../overview/fim/dashboard/dashboard'; import { InventoryFim } from '../../overview/fim/inventory/inventory'; import React from 'react'; @@ -186,7 +187,15 @@ export const ModulesDefaults = { name: 'Inventory', component: withModuleNotForAgent(InventoryVuls), }, - EventsTab, + { + ...renderDiscoverTab(ALERTS_INDEX_PATTERN, vulnerabilitiesColumns), + component: withModuleNotForAgent(() => ( + + )), + }, ], buttons: ['settings'], availableFor: ['manager'], diff --git a/plugins/main/public/components/common/wazuh-discover/wz-discover.tsx b/plugins/main/public/components/common/wazuh-discover/wz-discover.tsx index b22c58d0d4..8b72bb01e4 100644 --- a/plugins/main/public/components/common/wazuh-discover/wz-discover.tsx +++ b/plugins/main/public/components/common/wazuh-discover/wz-discover.tsx @@ -16,48 +16,63 @@ import { EuiPanel, } from '@elastic/eui'; import { IntlProvider } from 'react-intl'; -import { Filter, IndexPattern } from '../../../../../../src/plugins/data/common'; +import { + Filter, + IndexPattern, +} from '../../../../../../src/plugins/data/common'; import { SearchResponse } from '../../../../../../src/core/server'; import { useDocViewer } from '../doc-viewer'; import DocViewer from '../doc-viewer/doc-viewer'; import { DiscoverNoResults } from '../../overview/vulnerabilities/common/components/no_results'; import { LoadingSpinner } from '../../overview/vulnerabilities/common/components/loading_spinner'; import { useDataGrid, tDataGridColumn, exportSearchToCSV } from '../data-grid'; -import { ErrorHandler, ErrorFactory, HttpError } from '../../../react-services/error-management'; +import { + ErrorHandler, + ErrorFactory, + HttpError, +} from '../../../react-services/error-management'; import { HitsCounter } from '../../../kibana-integrations/discover/application/components/hits_counter'; import { formatNumWithCommas } from '../../../kibana-integrations/discover/application/helpers'; import useSearchBar from '../search-bar/use-search-bar'; import { search } from '../search-bar'; import { getPlugins } from '../../../kibana-services'; import { histogramChartInput } from './config/histogram-chart'; -import { useDockedSideNav } from '../hooks/useDockedSideNav' -const DashboardByRenderer = getPlugins().dashboard.DashboardContainerByValueRenderer; +import { useDockedSideNav } from '../hooks/useDockedSideNav'; +const DashboardByRenderer = + getPlugins().dashboard.DashboardContainerByValueRenderer; import './discover.scss'; +import { withErrorBoundary } from '../hocs'; export const MAX_ENTRIES_PER_QUERY = 10000; type WazuhDiscoverProps = { indexPatternName: string; tableColumns: tDataGridColumn[]; -} +}; -const WazuhDiscover = (props: WazuhDiscoverProps) => { - const { indexPatternName, tableColumns: defaultTableColumns } = props - const [sidebarDocked, setSidebarDocked] = useState(false); +const WazuhDiscoverComponent = (props: WazuhDiscoverProps) => { + const { indexPatternName, tableColumns: defaultTableColumns } = props; const SearchBar = getPlugins().data.ui.SearchBar; const [results, setResults] = useState({} as SearchResponse); const [inspectedHit, setInspectedHit] = useState(undefined); - const [indexPattern, setIndexPattern] = useState(undefined); + const [indexPattern, setIndexPattern] = useState( + undefined, + ); const [isSearching, setIsSearching] = useState(false); const [isExporting, setIsExporting] = useState(false); const sideNavDocked = useDockedSideNav(); - const onClickInspectDoc = useMemo(() => (index: number) => { - const rowClicked = results.hits.hits[index]; - setInspectedHit(rowClicked); - }, [results]); + const onClickInspectDoc = useMemo( + () => (index: number) => { + const rowClicked = results.hits.hits[index]; + setInspectedHit(rowClicked); + }, + [results], + ); - const DocViewInspectButton = ({ rowIndex }: EuiDataGridCellValueElementProps) => { + const DocViewInspectButton = ({ + rowIndex, + }: EuiDataGridCellValueElementProps) => { const inspectHintMsg = 'Inspect document details'; return ( @@ -72,8 +87,15 @@ const WazuhDiscover = (props: WazuhDiscoverProps) => { const { searchBarProps } = useSearchBar({ defaultIndexPatternID: indexPatternName, - }) - const { isLoading, filters, query, indexPatterns, dateRangeFrom, dateRangeTo } = searchBarProps; + }); + const { + isLoading, + filters, + query, + indexPatterns, + dateRangeFrom, + dateRangeTo, + } = searchBarProps; const dataGridProps = useDataGrid({ ariaLabelledBy: 'Discover events table', @@ -85,15 +107,15 @@ const WazuhDiscover = (props: WazuhDiscoverProps) => { pageIndex: 0, pageSize: 15, pageSizeOptions: [15, 25, 50, 100], - } - }) + }, + }); const { pagination, sorting, columnVisibility } = dataGridProps; const docViewerProps = useDocViewer({ doc: inspectedHit, indexPattern: indexPattern as IndexPattern, - }) + }); useEffect(() => { if (!isLoading) { @@ -108,22 +130,30 @@ const WazuhDiscover = (props: WazuhDiscoverProps) => { dateRange: { from: dateRangeFrom, to: dateRangeTo, - } - }).then((results) => { - setResults(results); - setIsSearching(false); - }).catch((error) => { - const searchError = ErrorFactory.create(HttpError, { error, message: 'Error fetching data' }) - ErrorHandler.handleError(searchError); - setIsSearching(false); + }, }) + .then(results => { + setResults(results); + setIsSearching(false); + }) + .catch(error => { + const searchError = ErrorFactory.create(HttpError, { + error, + message: 'Error fetching data', + }); + ErrorHandler.handleError(searchError); + setIsSearching(false); + }); } - }, - [JSON.stringify(searchBarProps), + }, [ + JSON.stringify(searchBarProps), JSON.stringify(pagination), - JSON.stringify(sorting)]); + JSON.stringify(sorting), + ]); - const timeField = indexPattern?.timeFieldName ? indexPattern.timeFieldName : undefined; + const timeField = indexPattern?.timeFieldName + ? indexPattern.timeFieldName + : undefined; const onClickExportResults = async () => { const params = { @@ -133,52 +163,69 @@ const WazuhDiscover = (props: WazuhDiscoverProps) => { fields: columnVisibility.visibleColumns, pagination: { pageIndex: 0, - pageSize: results.hits.total + pageSize: results.hits.total, }, - sorting - } + sorting, + }; try { setIsExporting(true); await exportSearchToCSV(params); } catch (error) { - const searchError = ErrorFactory.create(HttpError, { error, message: 'Error downloading csv report' }) + const searchError = ErrorFactory.create(HttpError, { + error, + message: 'Error downloading csv report', + }); ErrorHandler.handleError(searchError); } finally { setIsExporting(false); } - } + }; return ( - + <> - {isLoading ? - : + {isLoading ? ( + + ) : ( } - {!isLoading && results?.hits?.total === 0 ? - : null} + /> + )} + {!isLoading && results?.hits?.total === 0 ? ( + + ) : null} {!isLoading && results?.hits?.total > 0 ? ( <> - - + + - -
+ +
{ { }} - tooltip={results?.hits?.total && results?.hits?.total > MAX_ENTRIES_PER_QUERY ? { - ariaLabel: 'Warning', - content: `The query results has exceeded the limit of 10,000 hits. To provide a better experience the table only shows the first ${formatNumWithCommas(MAX_ENTRIES_PER_QUERY)} hits.`, - iconType: 'alert', - position: 'top' - } : undefined} + onResetQuery={() => {}} + tooltip={ + results?.hits?.total && + results?.hits?.total > MAX_ENTRIES_PER_QUERY + ? { + ariaLabel: 'Warning', + content: `The query results has exceeded the limit of 10,000 hits. To provide a better experience the table only shows the first ${formatNumWithCommas( + MAX_ENTRIES_PER_QUERY, + )} hits.`, + iconType: 'alert', + position: 'top', + } + : undefined + } /> + className='euiDataGrid__controlBtn' + onClick={onClickExportResults} + > Export Formated - ) + ), }} />
) : null} {inspectedHit && ( - setInspectedHit(undefined)} size="m"> + setInspectedHit(undefined)} size='m'>

Document Details

 - + - + @@ -232,8 +289,8 @@ const WazuhDiscover = (props: WazuhDiscoverProps) => { )} - + ); }; -export default WazuhDiscover; \ No newline at end of file +export const WazuhDiscover = withErrorBoundary(WazuhDiscoverComponent); diff --git a/plugins/main/public/components/overview/vulnerabilities/events/vulnerabilities-columns.tsx b/plugins/main/public/components/overview/vulnerabilities/events/vulnerabilities-columns.tsx new file mode 100644 index 0000000000..0d5568edaa --- /dev/null +++ b/plugins/main/public/components/overview/vulnerabilities/events/vulnerabilities-columns.tsx @@ -0,0 +1,19 @@ +import { tDataGridColumn } from '../../../common/data-grid'; + +export const vulnerabilitiesColumns: tDataGridColumn[] = [ + { + id: 'agent.name', + }, + { + id: 'data.vulnerability.package.name', + }, + { + id: 'data.vulnerability.cve', + }, + { + id: 'data.vulnerability.severity', + }, + { + id: 'data.vulnerability.status', + }, +];