Alerts in Correlations Part 2 #1062

riysaxen-amzn · 2024-06-10T20:35:47Z

Description

This PR contains the APIs for alerts in Correlations:
1). New acknowledge Correlation Alerts API
new API signature POST /_plugins/_security_analytics/_acknowledge/correlationAlerts

Req body: {"alerts":["4dc7f5a9-2c82-4786-81ca-433a209d5205"]}
- The API functionality will be to update the state of correlation alert to ACKNOWLEDGED/ERROR in .opensearch-sap-correlations-alerts index depending on the success and fail of this API and update the acknowledged_time field.

GetAcknowledgeAlertsResponse API response

GetAcknowledgeAlertsResponse API response
Field | Type | Description
-- | -- | --
acknowledged | List<CorrelationAlert> | List of acknowledged correlation alerts
failed | List<CorrelationAlert> | List of failed correlation alerts

2). New API: To get/retrieve list of correlation alerts:

GET /_plugins/_security_analytics/<b>correlationAlerts

Field | Data Type | Description
-- | -- | --
severityLevel | String | Severity level of the alert
alertState | String | State of the alert
sortString | String | String used for sorting the results
sortOrder | String | Order in which the results are sorted
size | Integer | Maximum number of results recieved in the response
startIndex | Integer | The pagination indicator
searchString | String | String used for searching
correlation_rule_id | String | filter by correlation Rule

Issues Resolved

Issue

Check List

New functionality includes testing.
- All tests pass
New functionality has been documented.
- New functionality has javadoc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Riya <[email protected]>

Signed-off-by: Riya Saxena <[email protected]>

Signed-off-by: Riya <[email protected]>

Signed-off-by: Riya Saxena <[email protected]>

riysaxen-amzn · 2024-06-11T23:08:29Z

plz add serde tests for request, response classes

will add all the tests in a seperate PR

Signed-off-by: Riya Saxena <[email protected]>

eirsep · 2024-06-12T00:09:44Z

why is there not an API for list correlation alerts for all rules and only per rule id?

eirsep · 2024-06-12T00:10:03Z

src/main/java/org/opensearch/securityanalytics/action/GetCorrelationAlertsRequest.java

+import static org.opensearch.action.ValidateActions.addValidationError;
+
+public class GetCorrelationAlertsRequest extends ActionRequest {
+    private String correlationRuleId;


shouldnt this be a list of rule ids?

eirsep · 2024-06-12T00:10:09Z

src/main/java/org/opensearch/securityanalytics/action/GetCorrelationAlertsRequest.java

+
+public class GetCorrelationAlertsRequest extends ActionRequest {
+    private String correlationRuleId;
+    private String correlationRuleName;


why is name required?

right now, name is not needed because we are not using it to filter the correlation Alerts but at some point we can have a requirement to filter correlations by name, because correlation Ids will always be unique but name can be same. User can create a different correlationRules with same names, there's no correlation rule name validation

riysaxen-amzn · 2024-06-12T00:13:51Z

why is there not an API for list correlation alerts for all rules and only per rule id?

yeah so the API will give all the alerts if ruleId is not passed

eirsep · 2024-06-12T00:18:16Z

src/main/resources/mappings/correlation_alert_mapping.json

eirsep

ƒew comments but LGTM from a quick scan. unit and integ tests pending

eirsep · 2024-06-12T00:18:19Z

src/test/java/org/opensearch/securityanalytics/TestHelpers.java

eirsep · 2024-06-12T00:19:35Z

src/main/java/org/opensearch/securityanalytics/correlation/alert/CorrelationAlertService.java

@@ -139,119 +149,177 @@ public void indexCorrelationAlert(CorrelationAlert correlationAlert, TimeValue i
        }
    }

+    public void getCorrelationAlerts(String ruleId, Table tableProp, ActionListener<GetCorrelationAlertsResponse> listener) {
+        BoolQueryBuilder queryBuilder = QueryBuilders.boolQuery();
+        if (ruleId != null) {


opensearch-trigger-bot · 2024-06-12T00:27:38Z

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/security-analytics/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/security-analytics/backport-2.x
# Create a new branch
git switch --create backport-1062-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 a74f509ccbac51531b77c371550b81fcd867931a
# Push it to GitHub
git push --set-upstream origin backport-1062-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/security-analytics/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport-1062-to-2.x.

* notification for alerting in correlation * correlation alerts mapping change * working code Signed-off-by: Riya Saxena <[email protected]> * alertsInCorrelation without notifciations Signed-off-by: Riya Saxena <[email protected]> * alertsInCorrelation without notifciations Signed-off-by: Riya Saxena <[email protected]> * alertsInCorrelation without notifciations Signed-off-by: Riya Saxena <[email protected]> * alerts in correlations notification service added Signed-off-by: Riya Saxena <[email protected]> * addressing the comments Signed-off-by: Riya Saxena <[email protected]> * addressing the comments Signed-off-by: Riya Saxena <[email protected]> * getCorrelationAlerts API changes Signed-off-by: Riya Saxena <[email protected]> * APIs added for Alerts in Correlations Signed-off-by: Riya Saxena <[email protected]> * update alerts with an errorMessage when correlationRule is deleted Signed-off-by: Riya Saxena <[email protected]> * address the design changes discussed Signed-off-by: Riya Saxena <[email protected]> * address the design changes discussed Signed-off-by: Riya Saxena <[email protected]> * fixed tests Signed-off-by: Riya Saxena <[email protected]> * minor fixes due to merge Signed-off-by: Riya Saxena <[email protected]> * alerts API changes Signed-off-by: Riya Saxena <[email protected]> * klint fixes Signed-off-by: Riya Saxena <[email protected]> * license headers added Signed-off-by: Riya Saxena <[email protected]> * fixed format violations Signed-off-by: Riya Saxena <[email protected]> --------- Signed-off-by: Riya <[email protected]> Signed-off-by: Riya Saxena <[email protected]> (cherry picked from commit a74f509) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* notification for alerting in correlation * correlation alerts mapping change * working code * alertsInCorrelation without notifciations * alertsInCorrelation without notifciations * alertsInCorrelation without notifciations * alerts in correlations notification service added * addressing the comments * addressing the comments * getCorrelationAlerts API changes * APIs added for Alerts in Correlations * update alerts with an errorMessage when correlationRule is deleted * address the design changes discussed * address the design changes discussed * fixed tests * minor fixes due to merge * alerts API changes * klint fixes * license headers added * fixed format violations --------- (cherry picked from commit a74f509) Signed-off-by: Riya <[email protected]> Signed-off-by: Riya Saxena <[email protected]> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

riysaxen-amzn · 2024-06-12T16:30:07Z

will address the remaining comments for this PR, in the follow up PR

* notification for alerting in correlation * correlation alerts mapping change * working code Signed-off-by: Riya Saxena <[email protected]> * alertsInCorrelation without notifciations Signed-off-by: Riya Saxena <[email protected]> * alertsInCorrelation without notifciations Signed-off-by: Riya Saxena <[email protected]> * alertsInCorrelation without notifciations Signed-off-by: Riya Saxena <[email protected]> * alerts in correlations notification service added Signed-off-by: Riya Saxena <[email protected]> * addressing the comments Signed-off-by: Riya Saxena <[email protected]> * addressing the comments Signed-off-by: Riya Saxena <[email protected]> * getCorrelationAlerts API changes Signed-off-by: Riya Saxena <[email protected]> * APIs added for Alerts in Correlations Signed-off-by: Riya Saxena <[email protected]> * update alerts with an errorMessage when correlationRule is deleted Signed-off-by: Riya Saxena <[email protected]> * address the design changes discussed Signed-off-by: Riya Saxena <[email protected]> * address the design changes discussed Signed-off-by: Riya Saxena <[email protected]> * fixed tests Signed-off-by: Riya Saxena <[email protected]> * minor fixes due to merge Signed-off-by: Riya Saxena <[email protected]> * alerts API changes Signed-off-by: Riya Saxena <[email protected]> * klint fixes Signed-off-by: Riya Saxena <[email protected]> * license headers added Signed-off-by: Riya Saxena <[email protected]> * fixed format violations Signed-off-by: Riya Saxena <[email protected]> --------- Signed-off-by: Riya <[email protected]> Signed-off-by: Riya Saxena <[email protected]>

riysaxen-amzn and others added 20 commits March 5, 2024 10:08

notification for alerting in correlation

da73e7e

correlation alerts mapping change

439e0c0

Merge branch 'main' into alertsInCorrelations

e2530f5

Signed-off-by: Riya <[email protected]>

Merge branch 'main' into alertsInCorrelations

a890e73

working code

425831d

Signed-off-by: Riya Saxena <[email protected]>

alertsInCorrelation without notifciations

7e0b257

Signed-off-by: Riya Saxena <[email protected]>

alertsInCorrelation without notifciations

c244a99

Signed-off-by: Riya Saxena <[email protected]>

alertsInCorrelation without notifciations

8603d5a

Signed-off-by: Riya Saxena <[email protected]>

alerts in correlations notification service added

29ba163

Signed-off-by: Riya Saxena <[email protected]>

addressing the comments

2a4cf26

Signed-off-by: Riya Saxena <[email protected]>

addressing the comments

e23e969

Signed-off-by: Riya Saxena <[email protected]>

getCorrelationAlerts API changes

42f2b46

Signed-off-by: Riya Saxena <[email protected]>

APIs added for Alerts in Correlations

462604d

Signed-off-by: Riya Saxena <[email protected]>

update alerts with an errorMessage when correlationRule is deleted

3a1b9fa

Signed-off-by: Riya Saxena <[email protected]>

address the design changes discussed

1547393

Signed-off-by: Riya Saxena <[email protected]>

address the design changes discussed

abade3f

Signed-off-by: Riya Saxena <[email protected]>

fixed tests

5ca1899

Signed-off-by: Riya Saxena <[email protected]>

Merge branch 'main' into alertsInCorrelations

e13c6fa

merg conflict fixes

ed64333

Signed-off-by: Riya Saxena <[email protected]>

Merge branch 'main' into alertsAPI

f7f7dc2

Signed-off-by: Riya <[email protected]>

riysaxen-amzn marked this pull request as ready for review June 11, 2024 21:43

riysaxen-amzn requested review from amsiglan, AWSHurneyt, getsaurabh02, lezzago, praveensameneni, sbcd90, eirsep, jowg-amazon and engechas as code owners June 11, 2024 21:43

alerts API changes

b9615e2

Signed-off-by: Riya Saxena <[email protected]>

jowg-amazon previously approved these changes Jun 11, 2024

View reviewed changes

klint fixes

721d166

Signed-off-by: Riya Saxena <[email protected]>

riysaxen-amzn dismissed jowg-amazon’s stale review via 721d166 June 11, 2024 23:10

riysaxen-amzn added 2 commits June 11, 2024 16:20

license headers added

ff38749

Signed-off-by: Riya Saxena <[email protected]>

fixed format violations

23f6cbc

Signed-off-by: Riya Saxena <[email protected]>

riysaxen-amzn requested review from eirsep and jowg-amazon June 11, 2024 23:57

jowg-amazon approved these changes Jun 12, 2024

View reviewed changes

eirsep reviewed Jun 12, 2024

View reviewed changes

src/main/resources/mappings/correlation_alert_mapping.json

}

Copy link

Member

eirsep Jun 12, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

revert

eirsep approved these changes Jun 12, 2024

View reviewed changes

src/test/java/org/opensearch/securityanalytics/TestHelpers.java

}

Copy link

Member

eirsep Jun 12, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

revert

eirsep reviewed Jun 12, 2024

View reviewed changes

riysaxen-amzn merged commit a74f509 into opensearch-project:main Jun 12, 2024
13 of 16 checks passed

riysaxen-amzn added the backport 2.x label Jun 12, 2024

opensearch-trigger-bot bot added the failed backport label Jun 12, 2024

riysaxen-amzn added backport 2.x and removed backport 2.x failed backport labels Jun 12, 2024

opensearch-trigger-bot bot mentioned this pull request Jun 12, 2024

[Backport 2.x] Alerts in Correlations Part 2 #1069

Merged

riysaxen-amzn added the autocut label Jun 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Alerts in Correlations Part 2 #1062

Alerts in Correlations Part 2 #1062

riysaxen-amzn commented Jun 10, 2024 •

edited

Loading

riysaxen-amzn commented Jun 11, 2024

eirsep commented Jun 12, 2024

eirsep Jun 12, 2024

eirsep Jun 12, 2024

riysaxen-amzn Jun 12, 2024

riysaxen-amzn commented Jun 12, 2024

eirsep Jun 12, 2024

eirsep left a comment

eirsep Jun 12, 2024

eirsep Jun 12, 2024

opensearch-trigger-bot bot commented Jun 12, 2024

riysaxen-amzn commented Jun 12, 2024

Alerts in Correlations Part 2 #1062

Alerts in Correlations Part 2 #1062

Conversation

riysaxen-amzn commented Jun 10, 2024 • edited Loading

Description

Issues Resolved

Check List

riysaxen-amzn commented Jun 11, 2024

eirsep commented Jun 12, 2024

eirsep Jun 12, 2024

Choose a reason for hiding this comment

eirsep Jun 12, 2024

Choose a reason for hiding this comment

riysaxen-amzn Jun 12, 2024

Choose a reason for hiding this comment

riysaxen-amzn commented Jun 12, 2024

eirsep Jun 12, 2024

Choose a reason for hiding this comment

eirsep left a comment

Choose a reason for hiding this comment

eirsep Jun 12, 2024

Choose a reason for hiding this comment

eirsep Jun 12, 2024

Choose a reason for hiding this comment

opensearch-trigger-bot bot commented Jun 12, 2024

riysaxen-amzn commented Jun 12, 2024

riysaxen-amzn commented Jun 10, 2024 •

edited

Loading