Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Detections] Adds automatic updating for Prebuilt Security Detection Rules package #101846

Merged
merged 16 commits into from
Jun 24, 2021
Merged
Show file tree
Hide file tree
Changes from 8 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions x-pack/plugins/security_solution/public/app/home/index.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ import { useInitSourcerer, useSourcererScope } from '../../common/containers/sou
import { useKibana } from '../../common/lib/kibana';
import { DETECTIONS_SUB_PLUGIN_ID } from '../../../common/constants';
import { SourcererScopeName } from '../../common/store/sourcerer/model';
import { useUpgradeEndpointPackage } from '../../common/hooks/endpoint/upgrade';
import { useUpgradeSecurityPackages } from '../../common/hooks/use_upgrade_security_packages';
import { useThrottledResizeObserver } from '../../common/components/utils';
import { AppLeaveHandler } from '../../../../../../src/core/public';

Expand Down Expand Up @@ -73,12 +73,12 @@ const HomePageComponent: React.FC<HomePageProps> = ({ children, onAppLeave }) =>
? SourcererScopeName.detections
: SourcererScopeName.default
);
// side effect: this will attempt to upgrade the endpoint package if it is not up to date
// this will run when a user navigates to the Security Solution app and when they navigate between
// side effect: this will attempt to upgrade the endpoint + security_detectiong_engine packages if they are not
// up to date. this will run when a user navigates to the Security Solution app and when they navigate between
// tabs in the app. This is useful for keeping the endpoint package as up to date as possible until
// a background task solution can be built on the server side. Once a background task solution is available we
// can remove this.
useUpgradeEndpointPackage();
useUpgradeSecurityPackages();

return (
<SecuritySolutionAppWrapper>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,31 +6,31 @@
*/

import { useEffect } from 'react';
import { HttpFetchOptions, HttpStart } from 'src/core/public';
import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
import { HttpFetchOptions, HttpStart } from 'kibana/public';
import { useKibana } from '../../../../../../src/plugins/kibana_react/public';
import {
epmRouteService,
appRoutesService,
CheckPermissionsResponse,
BulkInstallPackagesResponse,
} from '../../../../../fleet/common';
import { StartServices } from '../../../types';
import { useIngestEnabledCheck } from './ingest_enabled';
} from '../../../../fleet/common';
import { StartServices } from '../../types';
import { useIngestEnabledCheck } from './endpoint/ingest_enabled';

/**
* Requests that the endpoint package be upgraded to the latest version
* Requests that the endpoint and security_detection_engine package be upgraded to the latest version
*
* @param http an http client for sending the request
* @param options an object containing options for the request
*/
const sendUpgradeEndpointPackage = async (
const sendUpgradeSecurityPackages = async (
http: HttpStart,
options: HttpFetchOptions = {}
): Promise<BulkInstallPackagesResponse> => {
return http.post<BulkInstallPackagesResponse>(epmRouteService.getBulkInstallPath(), {
...options,
body: JSON.stringify({
packages: ['endpoint'],
packages: ['endpoint', 'security_detection_engine'],
}),
});
};
Expand All @@ -51,7 +51,7 @@ const sendCheckPermissions = async (
});
};

export const useUpgradeEndpointPackage = () => {
export const useUpgradeSecurityPackages = () => {
const context = useKibana<StartServices>();
const { allEnabled: ingestEnabled } = useIngestEnabledCheck();

Expand Down Expand Up @@ -79,7 +79,7 @@ export const useUpgradeEndpointPackage = () => {
}

// ignore the response for now since we aren't notifying the user
await sendUpgradeEndpointPackage(context.services.http, { signal });
await sendUpgradeSecurityPackages(context.services.http, { signal });
} catch (error) {
// Ignore Errors, since this should not hinder the user's ability to use the UI

Expand Down
2 changes: 1 addition & 1 deletion x-pack/test/fleet_api_integration/config.ts
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ import { defineDockerServersConfig } from '@kbn/test';
// example: https://beats-ci.elastic.co/blue/organizations/jenkins/Ingest-manager%2Fpackage-storage/detail/snapshot/74/pipeline/257#step-302-log-1.
// It should be updated any time there is a new Docker image published for the Snapshot Distribution of the Package Registry.
export const dockerImage =
'docker.elastic.co/package-registry/distribution:b6a53ac9300333a4a45f3f7d350c9aed72061a66';
'docker.elastic.co/package-registry/distribution@sha256:35cedaaa6adac547947321fa0c3b60a63eba153ba09524b9c1a21f1247a09bd2';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc @jfsiii for awareness that this change may overlap with #101911

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks, @jen-huang. @rw-access am I correct that this only needs this SHA for now? i.e. after this lands or, say, 2 weeks from now, we should be able to update using the current approach of distribution:some_recent_tag?

Copy link
Contributor Author

@rw-access rw-access Jun 22, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, I just needed a SHA that contained security_detection_engine@0.13.0 (or more recent)
should this be switched to a tag?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that sound good to you both @jen-huang and @jfsiii?
please let me know if there are any changes I need to make

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rw-access sorry for the lag, I missed this notification.

I'm fine with leaving as a SHA. After it lands, we can return to a distribution:* tag.


export default async function ({ readConfigFile }: FtrConfigProviderContext) {
const xPackAPITestsConfig = await readConfigFile(require.resolve('../api_integration/config.ts'));
Expand Down