[Attack Discovery][Scheduling] Attack Discovery scheduling rule management (#12003) #216656

e40pud · 2025-04-01T13:52:26Z

Summary

To allow users to schedule Attack Discovery generations, we will use either Alerting Framework. These changes add functionality to manage new alerts type - Attack Discovery Schedule.

Introduced endpoints

Create AD scheduling rule route: POST /internal/elastic_assistant/attack_discovery/schedules
Read/Get AD scheduling rule by id route: GET /internal/elastic_assistant/attack_discovery/schedules/{id}
Update AD scheduling rule by id route: PUT /internal/elastic_assistant/attack_discovery/schedules/{id}
Delete AD scheduling rule by id route: DELETE /internal/elastic_assistant/attack_discovery/schedules/{id}
Enable AD scheduling rule by id route: PUT /internal/elastic_assistant/attack_discovery/schedules/{id}/_enable
Disable AD scheduling rule by id route: PUT /internal/elastic_assistant/attack_discovery/schedules/{id}/_disable
Find all existing AD scheduling rules route: GET /internal/elastic_assistant/attack_discovery/schedules/_find

NOTES

The feature is hidden behind the feature flag:

xpack.securitySolution.enableExperimental: ['assistantAttackDiscoverySchedulingEnabled']

cURL examples

Create AD scheduling rule route

curl --location 'http://localhost:5601/internal/elastic_assistant/attack_discovery/schedules' \
--header 'kbn-xsrf: true' \
--header 'elastic-api-version: 1' \
--header 'x-elastic-internal-origin: security-solution' \
--header 'Content-Type: application/json' \
--data '{
    "name": "Test Schedule",
    "schedule": {
        "interval": "10m"
    },
    "params": {
        "alertsIndexPattern": ".alerts-security.alerts-default",
        "apiConfig": {
            "connectorId": "gpt-4o",
            "actionTypeId": ".gen-ai"
        },
        "end": "now",
        "size": 100,
        "start": "now-24h"
    }
}'

Read/Get AD scheduling rule by id route

curl --location 'http://localhost:5601/internal/elastic_assistant/attack_discovery/schedules/{id}' \
--header 'kbn-xsrf: true' \
--header 'elastic-api-version: 1' \
--header 'x-elastic-internal-origin: security-solution'

Update AD scheduling rule by id route

curl --location --request PUT 'http://localhost:5601/internal/elastic_assistant/attack_discovery/schedules/{id}' \
--header 'kbn-xsrf: true' \
--header 'elastic-api-version: 1' \
--header 'x-elastic-internal-origin: security-solution' \
--header 'Content-Type: application/json' \
--data '{
    "name": "Test Schedule - Updated",
    "schedule": {
        "interval": "123m"
    },
    "params": {
        "alertsIndexPattern": ".alerts-security.alerts-default",
        "apiConfig": {
            "connectorId": "gpt-4o",
            "actionTypeId": ".gen-ai"
        },
        "end": "now",
        "size": 35,
        "start": "now-24h"
    },
    "actions": []
}'

Delete AD scheduling rule by id route

curl --location --request DELETE 'http://localhost:5601/internal/elastic_assistant/attack_discovery/schedules/{id}' \
--header 'kbn-xsrf: true' \
--header 'elastic-api-version: 1' \
--header 'x-elastic-internal-origin: security-solution'

Enable AD scheduling rule by id route

curl --location --request PUT 'http://localhost:5601/internal/elastic_assistant/attack_discovery/schedules/{id}/_enable' \
--header 'kbn-xsrf: true' \
--header 'elastic-api-version: 1' \
--header 'x-elastic-internal-origin: security-solution'

Disable AD scheduling rule by id route

curl --location --request PUT 'http://localhost:5601/internal/elastic_assistant/attack_discovery/schedules/{id}/_disable' \
--header 'kbn-xsrf: true' \
--header 'elastic-api-version: 1' \
--header 'x-elastic-internal-origin: security-solution'

Find all existing AD scheduling rules route

curl --location 'http://localhost:5601/internal/elastic_assistant/attack_discovery/schedules/_find' \
--header 'kbn-xsrf: true' \
--header 'elastic-api-version: 1' \
--header 'x-elastic-internal-origin: security-solution'

…ement (elastic#12003)

elasticmachine · 2025-04-01T13:52:36Z

Pinging @elastic/security-solution (Team: SecuritySolution)

e40pud · 2025-04-01T13:55:58Z

x-pack/solutions/security/packages/features/src/attack_discovery/kibana_features.ts

@@ -35,6 +43,10 @@ export const getAttackDiscoveryBaseKibanaFeature = (): BaseKibanaFeatureConfig =
        all: [],
        read: [],
      },
+      alerting: {


Same privileges as we have for the detection alerts https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/packages/features/src/security/v2_features/kibana_features.ts#L95

…apping'

e40pud · 2025-04-01T18:36:43Z

x-pack/test/api_integration/apis/maps/maps_telemetry.ts

-      expect(geoPointFieldStats.count).to.be(55);
-      expect(geoPointFieldStats.index_count).to.be(12);
+      expect(geoPointFieldStats.count).to.be(63);
+      expect(geoPointFieldStats.index_count).to.be(13);


Updated because we added a new attack discovery alerts aad index that maps the ecs fields. Similarly to this https://github.com/elastic/kibana/pull/194322/files#r1781620194 and this https://github.com/elastic/kibana/pull/184541/files#r1628183656.

nreese

kibana-presentation integration test assertion update changes LGTM
code review only

elasticmachine · 2025-04-01T21:27:06Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: f3bb8be

Failed CI Steps

Test Failures

[job] [logs] Jest Tests #16 / Event filter form Details and Conditions should change description

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`automaticImport`	726	729	+3
`securitySolution`	7170	7173	+3
total			+6

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/elastic-assistant-common`	437	493	+56
`elasticAssistant`	44	46	+2
total			+58

Unknown metric groups

API count

id	before	after	diff
`@kbn/elastic-assistant-common`	510	578	+68
`elasticAssistant`	60	62	+2
total			+70

History

💔 Build #289124 failed e260430
💔 Build #289076 failed b895061

cc @e40pud

andrew-goldstein · 2025-04-02T17:32:52Z

x-pack/solutions/security/plugins/elastic_assistant/server/plugin.ts

@@ -89,6 +90,13 @@ export class ElasticAssistantPlugin

    registerRoutes(router, this.logger, this.getElserId);

+    // Register Attack Discovery Schedule type
+    plugins.alerting.registerType(


Consider migrating to the featureFlags service. It's available in the plugin setup lifecycle (with a little bit of 🪄 ):

public setup( core: ElasticAssistantPluginCoreSetupDependencies, plugins: ElasticAssistantPluginSetupDependencies ) { this.logger.debug('elasticAssistant: Setup'); // The featureFlags service is not available in the core setup, so we need // to wait for the start services to be available to read the feature flags. // This can take a while, but the plugin setup phase cannot run for a long time. // As a workaround, this promise does not block the setup phase. core .getStartServices() .then(([{ featureFlags }]) => { // read all feature flags: void Promise.all([ featureFlags.getBooleanValue(SAVED_ATTACK_DISCOVERIES_ENABLED_FEATURE_FLAG, false), // add more feature flags here ]).then(([savedAttackDiscoveriesFeatureFlag]) => { this.logger.debug(`feature flags are: - ${SAVED_ATTACK_DISCOVERIES_ENABLED_FEATURE_FLAG}: ${savedAttackDiscoveriesFeatureFlag} `); // ...

andrew-goldstein · 2025-04-02T17:44:03Z

...utions/security/plugins/elastic_assistant/server/routes/attack_discovery/schedules/enable.ts

+  router: IRouter<ElasticAssistantRequestHandlerContext>
+): void => {
+  router.versioned
+    .put({


Consider put -> post, because this route has side effects

andrew-goldstein · 2025-04-02T17:44:15Z

...tions/security/plugins/elastic_assistant/server/routes/attack_discovery/schedules/disable.ts

+  router: IRouter<ElasticAssistantRequestHandlerContext>
+): void => {
+  router.versioned
+    .put({


Consider put -> post, because this route has side effects

andrew-goldstein · 2025-04-02T17:59:03Z

...stant-common/impl/schemas/attack_discovery/crud_attack_discovery_schedules_route.schema.yaml

+      x-labels: [ess, serverless]
+      operationId: GetAttackDiscoverySchedules
+      description: Gets attack discovery schedule
+      summary: Gets attack discovery schedule via the Elastic Assistant


Gets attack discovery schedule via the Elastic Assistant

nit: I'm wondering if via the Elastic Assistant is applicable in this summary (and the others in this route)

andrew-goldstein · 2025-04-02T19:37:34Z

...ons/security/plugins/elastic_assistant/server/routes/attack_discovery/schedules/find.test.ts

+    });
+  });
+
+  it('should handle `dataClient.createSchedule` error', async () => {


nit: Consider createSchedule -> findSchedules

andrew-goldstein · 2025-04-02T19:41:14Z

...s/security/plugins/elastic_assistant/server/routes/attack_discovery/schedules/update.test.ts

+    });
+  });
+
+  it('should handle `dataClient.createSchedule` error', async () => {


nit: Consider createSchedule -> updateSchedule

andrew-goldstein

Thanks @e40pud for the new scheduling APIs!
✅ Desk tested locally
LGTM 🚀

[Attack Discovery][Scheduling] Attack Discovery scheduling rule manag…

9215f0e

…ement (elastic#12003)

e40pud requested a review from andrew-goldstein April 1, 2025 13:52

e40pud self-assigned this Apr 1, 2025

e40pud marked this pull request as ready for review April 1, 2025 13:52

e40pud requested review from a team as code owners April 1, 2025 13:52

e40pud commented Apr 1, 2025

View reviewed changes

kibanamachine and others added 2 commits April 1, 2025 14:03

[CI] Auto-commit changed files from 'node scripts/styled_components_m…

b895061

…apping'

Resolve integration tests

e260430

e40pud requested a review from a team as a code owner April 1, 2025 15:40

Fix integration tests

f3bb8be

e40pud requested a review from a team as a code owner April 1, 2025 18:34

e40pud commented Apr 1, 2025

View reviewed changes

nreese approved these changes Apr 1, 2025

View reviewed changes

andrew-goldstein reviewed Apr 2, 2025

View reviewed changes

andrew-goldstein approved these changes Apr 2, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Attack Discovery][Scheduling] Attack Discovery scheduling rule management (#12003) #216656

[Attack Discovery][Scheduling] Attack Discovery scheduling rule management (#12003) #216656

e40pud commented Apr 1, 2025

elasticmachine commented Apr 1, 2025

e40pud Apr 1, 2025 •

edited

Loading

e40pud Apr 1, 2025

nreese left a comment

elasticmachine commented Apr 1, 2025

API count

andrew-goldstein Apr 2, 2025

andrew-goldstein Apr 2, 2025

andrew-goldstein Apr 2, 2025

andrew-goldstein Apr 2, 2025

andrew-goldstein Apr 2, 2025

andrew-goldstein Apr 2, 2025

andrew-goldstein left a comment

[Attack Discovery][Scheduling] Attack Discovery scheduling rule management (#12003) #216656

Are you sure you want to change the base?

[Attack Discovery][Scheduling] Attack Discovery scheduling rule management (#12003) #216656

Conversation

e40pud commented Apr 1, 2025

Summary

Introduced endpoints

NOTES

cURL examples

elasticmachine commented Apr 1, 2025

e40pud Apr 1, 2025 • edited Loading

Choose a reason for hiding this comment

e40pud Apr 1, 2025

Choose a reason for hiding this comment

nreese left a comment

Choose a reason for hiding this comment

elasticmachine commented Apr 1, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

API count

History

andrew-goldstein Apr 2, 2025

Choose a reason for hiding this comment

andrew-goldstein Apr 2, 2025

Choose a reason for hiding this comment

andrew-goldstein Apr 2, 2025

Choose a reason for hiding this comment

andrew-goldstein Apr 2, 2025

Choose a reason for hiding this comment

andrew-goldstein Apr 2, 2025

Choose a reason for hiding this comment

andrew-goldstein Apr 2, 2025

Choose a reason for hiding this comment

andrew-goldstein left a comment

Choose a reason for hiding this comment

e40pud Apr 1, 2025 •

edited

Loading