Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix security_rule format #175

Merged
merged 2 commits into from
May 13, 2021
Merged

Fix security_rule format #175

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1dd7fdd
Fix security_rule format
May 13, 2021
5eb274e
Update changelog
May 13, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion code/go/internal/spec/statik.go
View file
Open in desktop

Large diffs are not rendered by default.

22 changes: 15 additions & 7 deletions code/go/internal/validator/semantic/kibana_matching_object_ids.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,18 +32,26 @@ func ValidateKibanaObjectIDs(pkgRoot string) ve.ValidationErrors {
for _, objectFile := range objectFiles {
filePath := objectFile.Path()

idPath := "$.id"
// Special case: object is of type 'security_rule'
if filepath.Base(filepath.Dir(filePath)) == "security_rule" {
idPath = "$.rule_id"
}

objectID, err := objectFile.Values(idPath)
objectID, err := objectFile.Values("$.id")
if err != nil {
errs = append(errs, errors.Wrapf(err, "unable to get Kibana object ID in file [%s]", filePath))
continue
}

// Special case: object is of type 'security_rule'
if filepath.Base(filepath.Dir(filePath)) == "security_rule" {
ruleID, err := objectFile.Values("$.attributes.rule_id")
if err != nil {
errs = append(errs, errors.Wrapf(err, "unable to get rule ID in file [%s]", filePath))
continue
}

if ruleID != objectID {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's no reason these have to match.

The rule_id is only relevant to the Security solution.
The top level id is the saved object ID. It's possible that in the future we want better named SO ids. But we can loosen up this spec up then if that happens.

errs = append(errs, errors.New("rule ID is different from the object ID"))
continue
}
}

// fileID == filename without the extension == expected ID of Kibana object defined inside file.
fileName := filepath.Base(filePath)
fileExt := filepath.Ext(filePath)
Expand Down
5 changes: 4 additions & 1 deletion test/packages/bad_kibana_ids/kibana/security_rule/bad_kibana_ids-bar-baz.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
{
"rule_id": "something-else"
"attributes": {
"rule_id": "something-else"
},
"id": "something-else"
}
76 changes: 40 additions & 36 deletions test/packages/good/kibana/security_rule/000047bb-b27a-47ec-8b62-ef1a5d2c9e19.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,37 +1,41 @@
{
"author": [
"Elastic"
],
"description": "Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls.",
"false_positives": [
"Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly modified in your organization."
],
"index": [
"filebeat-*",
"logs-okta*"
],
"language": "kuery",
"license": "Elastic License v2",
"name": "Attempt to Modify an Okta Policy Rule",
"note": "The Okta Fleet integration or Filebeat module must be enabled to use this rule.",
"query": "event.dataset:okta.system and event.action:policy.rule.update",
"references": [
"https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm",
"https://developer.okta.com/docs/reference/api/system-log/",
"https://developer.okta.com/docs/reference/api/event-types/"
],
"risk_score": 21,
"rule_id": "000047bb-b27a-47ec-8b62-ef1a5d2c9e19",
"severity": "low",
"tags": [
"Elastic",
"Identity",
"Okta",
"Continuous Monitoring",
"SecOps",
"Identity and Access"
],
"timestamp_override": "event.ingested",
"type": "query",
"version": 5
}
"attributes": {
"author": [
"Elastic"
],
"description": "Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls.",
"false_positives": [
"Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly modified in your organization."
],
"index": [
"filebeat-*",
"logs-okta*"
],
"language": "kuery",
"license": "Elastic License v2",
"name": "Attempt to Modify an Okta Policy Rule",
"note": "The Okta Fleet integration or Filebeat module must be enabled to use this rule.",
"query": "event.dataset:okta.system and event.action:policy.rule.update",
"references": [
"https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm",
"https://developer.okta.com/docs/reference/api/system-log/",
"https://developer.okta.com/docs/reference/api/event-types/"
],
"risk_score": 21,
"rule_id": "000047bb-b27a-47ec-8b62-ef1a5d2c9e19",
"severity": "low",
"tags": [
"Elastic",
"Identity",
"Okta",
"Continuous Monitoring",
"SecOps",
"Identity and Access"
],
"timestamp_override": "event.ingested",
"type": "query",
"version": 5
},
"id": "000047bb-b27a-47ec-8b62-ef1a5d2c9e19",
"type": "security-rule"
}
5 changes: 4 additions & 1 deletion versions/1/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,4 +120,7 @@
link: https://github.com/elastic/package-spec/pull/172
- description: Improve version consistency in case of missing/undefined version
type: enhancement
link: https://github.com/elastic/package-spec/pull/174
link: https://github.com/elastic/package-spec/pull/174
- description: Fix security_rule format
type: bugfix
link: https://github.com/elastic/package-spec/pull/175