[Asset Management] Enable osquery plugin (#97422)

This commit is contained in:
Patryk Kopyciński 2021-04-20 10:20:08 +02:00 committed by GitHub
parent 0aa31add4a
commit 2e7e682023
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 135 additions and 39 deletions

View file

@ -148,6 +148,7 @@ export const applicationUsageSchema = {
ml: commonSchema,
monitoring: commonSchema,
'observability-overview': commonSchema,
osquery: commonSchema,
security_account: commonSchema,
security_access_agreement: commonSchema,
security_capture_url: commonSchema, // It's a forward app so we'll likely never report it

View file

@ -3954,6 +3954,137 @@
}
}
},
"osquery": {
"properties": {
"appId": {
"type": "keyword",
"_meta": {
"description": "The application being tracked"
}
},
"viewId": {
"type": "keyword",
"_meta": {
"description": "Always `main`"
}
},
"clicks_total": {
"type": "long",
"_meta": {
"description": "General number of clicks in the application since we started counting them"
}
},
"clicks_7_days": {
"type": "long",
"_meta": {
"description": "General number of clicks in the application over the last 7 days"
}
},
"clicks_30_days": {
"type": "long",
"_meta": {
"description": "General number of clicks in the application over the last 30 days"
}
},
"clicks_90_days": {
"type": "long",
"_meta": {
"description": "General number of clicks in the application over the last 90 days"
}
},
"minutes_on_screen_total": {
"type": "float",
"_meta": {
"description": "Minutes the application is active and on-screen since we started counting them."
}
},
"minutes_on_screen_7_days": {
"type": "float",
"_meta": {
"description": "Minutes the application is active and on-screen over the last 7 days"
}
},
"minutes_on_screen_30_days": {
"type": "float",
"_meta": {
"description": "Minutes the application is active and on-screen over the last 30 days"
}
},
"minutes_on_screen_90_days": {
"type": "float",
"_meta": {
"description": "Minutes the application is active and on-screen over the last 90 days"
}
},
"views": {
"type": "array",
"items": {
"properties": {
"appId": {
"type": "keyword",
"_meta": {
"description": "The application being tracked"
}
},
"viewId": {
"type": "keyword",
"_meta": {
"description": "The application view being tracked"
}
},
"clicks_total": {
"type": "long",
"_meta": {
"description": "General number of clicks in the application sub view since we started counting them"
}
},
"clicks_7_days": {
"type": "long",
"_meta": {
"description": "General number of clicks in the active application sub view over the last 7 days"
}
},
"clicks_30_days": {
"type": "long",
"_meta": {
"description": "General number of clicks in the active application sub view over the last 30 days"
}
},
"clicks_90_days": {
"type": "long",
"_meta": {
"description": "General number of clicks in the active application sub view over the last 90 days"
}
},
"minutes_on_screen_total": {
"type": "float",
"_meta": {
"description": "Minutes the application sub view is active and on-screen since we started counting them."
}
},
"minutes_on_screen_7_days": {
"type": "float",
"_meta": {
"description": "Minutes the application is active and on-screen active application sub view over the last 7 days"
}
},
"minutes_on_screen_30_days": {
"type": "float",
"_meta": {
"description": "Minutes the application is active and on-screen active application sub view over the last 30 days"
}
},
"minutes_on_screen_90_days": {
"type": "float",
"_meta": {
"description": "Minutes the application is active and on-screen active application sub view over the last 90 days"
}
}
}
}
}
}
},
"security_account": {
"properties": {
"appId": {

View file

@ -57,8 +57,8 @@ const NewLiveQueryPageComponent = () => {
id="xpack.osquery.newLiveQuery.pageTitle"
defaultMessage="New live query"
/>
<BetaBadge />
</h1>
<BetaBadge />
</BetaBadgeRowWrapper>
</EuiFlexItem>
</EuiFlexGroup>

View file

@ -39,8 +39,8 @@ const getNewStream = ({ id, interval, query, scheduledQueryGroupId }: GetNewStre
: null,
vars: {
id: { type: 'text', value: id },
type: 'integer',
interval: {
type: 'integer',
value: interval,
},
query: { type: 'text', value: query },

View file

@ -8,7 +8,7 @@
import { TypeOf, schema } from '@kbn/config-schema';
export const ConfigSchema = schema.object({
enabled: schema.boolean({ defaultValue: false }),
enabled: schema.boolean({ defaultValue: true }),
actionEnabled: schema.boolean({ defaultValue: false }),
savedQueries: schema.boolean({ defaultValue: false }),
packs: schema.boolean({ defaultValue: false }),

View file

@ -5,9 +5,7 @@
* 2.0.
*/
import { i18n } from '@kbn/i18n';
import {
DEFAULT_APP_CATEGORIES,
PluginInitializerContext,
CoreSetup,
CoreStart,
@ -49,40 +47,6 @@ export class OsqueryPlugin implements Plugin<OsqueryPluginSetup, OsqueryPluginSt
config: (): ConfigType => config,
};
plugins.features.registerKibanaFeature({
id: 'osquery',
name: i18n.translate('xpack.osquery.featureRegistry.osqueryFeatureName', {
defaultMessage: 'Osquery',
}),
order: 4000,
category: DEFAULT_APP_CATEGORIES.management,
app: ['osquery', 'kibana'],
catalogue: ['osquery'],
// see x-pack/plugins/features/common/feature_kibana_privileges.ts
privileges: {
all: {
app: ['osquery', 'kibana'],
api: ['osquery', 'osquery_write'],
catalogue: ['osquery'],
savedObject: {
all: [],
read: [],
},
ui: ['show', 'save'],
},
read: {
app: ['osquery', 'kibana'],
api: ['osquery'],
catalogue: ['osquery'],
savedObject: {
all: [],
read: [],
},
ui: ['show'],
},
},
});
initSavedObjects(core.savedObjects, osqueryContext);
defineRoutes(router, osqueryContext);