kibana/x-pack/plugins/lists/server
Frank Hassanabad afae94a85e
[SIEM][Detection Engine][Lists] Adds conflict versioning and io-ts improvements to lists (#72337)
## Summary

* Adds conflict versioning by exposing the "_version" from the saved object system. It renames "version" to "_version" so that we can use regular "version" later for versioning things for pre-packaged lists abilities.
* Utilizes `t.OutputOf` in the requests and the data types to give us more correctly types
* Removes the `Identity` utility as that is adding confusion and can confuse vs code rather than improves things
* Removes extra types that were causing confusion which was an idiom from io-ts
* Changes the wording of `Partial` by removing that and instead focuses the request types on either client side or server side at this point.

NOTE: The UI can migrate to holding onto the `_version` and then push it back down when it wants to migrate to using the conflict resolution. If the UI does not push it down, then a value of undefined will be used which is indicating that no conflict errors are wanted.


Output example of posting an exception list:

❯ ./post_exception_list.sh
```ts
{
  "_tags": [
    "endpoint",
    "process",
    "malware",
    "os:linux"
  ],
  "_version": "Wzk4NiwxXQ==",
  "created_at": "2020-07-17T18:59:22.872Z",
  "created_by": "yo",
  "description": "This is a sample endpoint type exception",
  "id": "a08795b0-c85f-11ea-b1a6-c155df988a92",
  "list_id": "simple_list",
  "name": "Sample Endpoint Exception List",
  "namespace_type": "single",
  "tags": [
    "user added string for a tag",
    "malware"
  ],
  "tie_breaker_id": "b789ec05-3e0f-4344-a156-0c0f5b6e2f9c",
  "type": "detection",
  "updated_at": "2020-07-17T18:59:22.891Z",
  "updated_by": "yo"
}
```

Output example of posting an exception list item
❯ ./post_exception_list_item.sh
```ts
{
  "_tags": [
    "endpoint",
    "process",
    "malware",
    "os:linux"
  ],
  "_version": "Wzk4NywxXQ==",
  "comments": [],
  "created_at": "2020-07-17T18:59:30.286Z",
  "created_by": "yo",
  "description": "This is a sample endpoint type exception",
  "entries": [
    {
      "field": "actingProcess.file.signer",
      "operator": "excluded",
      "type": "exists"
    },
    {
      "field": "host.name",
      "operator": "included",
      "type": "match_any",
      "value": [
        "some host",
        "another host"
      ]
    }
  ],
  "id": "a4f2b800-c85f-11ea-b1a6-c155df988a92",
  "item_id": "simple_list_item",
  "list_id": "simple_list",
  "name": "Sample Endpoint Exception List",
  "namespace_type": "single",
  "tags": [
    "user added string for a tag",
    "malware"
  ],
  "tie_breaker_id": "1dc456bc-7aa9-44b4-bca3-131689cf729f",
  "type": "simple",
  "updated_at": "2020-07-17T18:59:30.304Z",
  "updated_by": "yo"
}
```

Output example of when you get an exception list:

❯ ./get_exception_list.sh simple_list
```ts
{
  "_tags": [
    "endpoint",
    "process",
    "malware",
    "os:linux"
  ],
  "_version": "WzEwNzcsMV0=",
  "created_at": "2020-07-17T18:59:22.872Z",
  "created_by": "yo",
  "description": "Different description",
  "id": "a08795b0-c85f-11ea-b1a6-c155df988a92",
  "list_id": "simple_list",
  "name": "Sample Endpoint Exception List",
  "namespace_type": "single",
  "tags": [
    "user added string for a tag",
    "malware"
  ],
  "tie_breaker_id": "b789ec05-3e0f-4344-a156-0c0f5b6e2f9c",
  "type": "endpoint",
  "updated_at": "2020-07-17T20:01:24.958Z",
  "updated_by": "yo"
}
```

Example of the error you get if you do an update of an exception list and someone else has changed it:
```ts
{
  "message": "[exception-list:a08795b0-c85f-11ea-b1a6-c155df988a92]: version conflict, required seqNo [1074], primary term [1]. current document has seqNo [1077] and primary term [1]: [version_conflict_engine_exception] [exception-list:a08795b0-c85f-11ea-b1a6-c155df988a92]: version conflict, required seqNo [1074], primary term [1]. current document has seqNo [1077] and primary term [1], with { index_uuid=\"a2mgXBO6Tl2ULDq-MTs1Tw\" & shard=\"0\" & index=\".kibana-hassanabad_1\" }",
  "status_code": 409
}
```

Lists are the same way and flavor, they encode the _version the same way that saved objects do. To see those work you run these scripts:

```ts
./post_list.sh
./post_list_item.sh
./find_list.sh
./find_list_item.sh
```



### Checklist

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
2020-07-20 11:00:06 -06:00
..
routes [SIEM][Detection Engine][Lists] Adds conflict versioning and io-ts improvements to lists (#72337) 2020-07-20 11:00:06 -06:00
saved_objects [SIEM][Exceptions] - Cleaned up and updated exception list item comment structure (#69532) 2020-06-26 14:15:35 -04:00
scripts [SIEM][Detection Engine][Lists] Adds conflict versioning and io-ts improvements to lists (#72337) 2020-07-20 11:00:06 -06:00
services [SIEM][Detection Engine][Lists] Adds conflict versioning and io-ts improvements to lists (#72337) 2020-07-20 11:00:06 -06:00
config.mock.ts [SIEM][Detection Engine] Speeds up value list imports by enabling streaming of files. 2020-07-08 20:15:18 -06:00
config.test.ts [SIEM][Detection Engine] Speeds up value list imports by enabling streaming of files. 2020-07-08 20:15:18 -06:00
config.ts [SIEM][Detection Engine] Speeds up value list imports by enabling streaming of files. 2020-07-08 20:15:18 -06:00
create_config.ts [SIEM][Detection Engine] Speeds up value list imports by enabling streaming of files. 2020-07-08 20:15:18 -06:00
error_with_status_code.ts
get_space_id.test.ts
get_space_id.ts
get_user.test.ts [SIEM][Lists] Adds test mocks and README.md to the lists plugin 2020-05-30 18:52:01 -06:00
get_user.ts
index.ts [SIEM][Detection Engine] - Update DE to work with new exceptions schema (#69715) 2020-06-25 09:47:05 -04:00
mocks.ts [SIEM][Security Solution][Endpoint] Endpoint Artifact Manifest Management + Artifact Download and Distribution (#67707) 2020-07-02 01:00:27 -04:00
plugin.ts [SIEM][Detection Engine][Lists] Adds read_privileges route for lists and list items 2020-07-09 20:36:20 -06:00
siem_server_deps.ts [SIEM][Detection Engine][Lists] Adds read_privileges route for lists and list items 2020-07-09 20:36:20 -06:00
types.ts Move and rename legacy elasticsearch client (#69797) 2020-06-29 17:43:31 +02:00