Skip to content

Commit c2fc584

Browse files
AlexSanchez-bitosmontero
AlexSanchez-bit
and
osmontero
authored
Backlog/fix/tag rules (#2106)
* fix[frontend](rules): improved post event count validation * fix[frontend](tag_rules): added events related fields on tag rule creation --------- Co-authored-by: Osmany Montero <osmontero@icloud.com>
1 parent 5d3910b commit c2fc584

4 files changed

Lines changed: 51 additions & 4 deletions

File tree

‎frontend/src/app/data-management/alert-management/shared/components/alert-rule-create/alert-rule-create.component.ts‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ import {
3232
ALERT_STATUS_LABEL_FIELD,
3333
ALERT_TAGS_FIELD,
3434
ALERT_TIMESTAMP_FIELD,
35-
EVENT_IS_ALERT, FALSE_POSITIVE_OBJECT, LOG_RELATED_ID_EVENT_FIELD
35+
EVENT_IS_ALERT, EVENT_TAG_RULE_FIELDS, FALSE_POSITIVE_OBJECT, LOG_RELATED_ID_EVENT_FIELD
3636
} from '../../../../../shared/constants/alert/alert-field.constant';
3737
import {AUTOMATIC_REVIEW, CLOSED} from '../../../../../shared/constants/alert/alert-status.constant';
3838
import {FILTER_OPERATORS} from '../../../../../shared/constants/filter-operators.const';
@@ -84,7 +84,6 @@ export class AlertRuleCreateComponent implements OnInit, OnDestroy {
8484
ALERT_OBSERVATION_FIELD,
8585
ALERT_NOTE_FIELD,
8686
ALERT_REFERENCE_FIELD,
87-
LOG_RELATED_ID_EVENT_FIELD,
8887
EVENT_IS_ALERT,
8988
ALERT_INCIDENT_USER_FIELD,
9089
ALERT_INCIDENT_DATE_FIELD,
@@ -148,6 +147,8 @@ export class AlertRuleCreateComponent implements OnInit, OnDestroy {
148147
return acc.concat(field);
149148
}, []);
150149

150+
this.fields = [...this.fields, ...EVENT_TAG_RULE_FIELDS];
151+
151152
this.operators = FILTER_OPERATORS.filter(value => !this.excludeOperators.includes(value.operator));
152153
}
153154

@@ -232,6 +233,11 @@ export class AlertRuleCreateComponent implements OnInit, OnDestroy {
232233
}
233234

234235
getFieldValue(field: string): any {
236+
if(field.startsWith('events') && this.alert.events &&this.alert.events.length>0){
237+
let fields = field.split('.')
238+
fields.splice(0,1)
239+
return getValueFromPropertyPath(this.alert.events[0],fields.join('.'), null);
240+
}
235241
return getValueFromPropertyPath(this.alert, field, null);
236242
}
237243

‎frontend/src/app/rule-management/app-rule/components/add-after-event/add-after-event.component.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
Must be at least 1
2929
</div>
3030
<div class="invalid-feedback" *ngIf="form.get('count').touched && form.get('count').errors && form.get('count').errors['max']">
31-
Must not be greater than 50
31+
Must not be greater than 100
3232
</div>
3333
</div>
3434
</div>

‎frontend/src/app/rule-management/services/after-event-form.service.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ export class AfterEventFormService {
3636
: []
3737
),
3838
within: [event.within || ''],
39-
count: [event.count ? event.count : null, [Validators.required, Validators.min(1), Validators.max(50)]],
39+
count: [event.count ? event.count : null, [Validators.required, Validators.min(1), Validators.max(100)]],
4040
});
4141
}
4242

‎frontend/src/app/shared/constants/alert/alert-field.constant.ts‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,47 @@ export const EVENT_IS_ALERT = 'isAlert';
120120

121121
export const FALSE_POSITIVE_OBJECT = {id: 1, tagName: 'False positive', tagColor: '#f44336', systemOwner: true};
122122

123+
// Event-related fields exposed in tag-rule conditions.
124+
// These are flattened paths into the `events` array on the alert document
125+
// ("events" is mapped as an object array, so any condition matches when ANY
126+
// event satisfies it).
127+
export const EVENT_TAG_RULE_FIELDS: UtmFieldType[] = [
128+
{label: 'Event Data Type', field: 'events.dataType', type: ElasticDataTypesEnum.STRING, visible: true},
129+
{label: 'Event Data Source', field: 'events.dataSource', type: ElasticDataTypesEnum.STRING, visible: true},
130+
{label: 'Event Action', field: 'events.action', type: ElasticDataTypesEnum.STRING, visible: true},
131+
{label: 'Event Action Result', field: 'events.actionResult', type: ElasticDataTypesEnum.STRING, visible: true},
132+
{label: 'Event Severity', field: 'events.severity', type: ElasticDataTypesEnum.STRING, visible: true},
133+
{label: 'Event Protocol', field: 'events.protocol', type: ElasticDataTypesEnum.STRING, visible: true},
134+
{label: 'Event Connection Status', field: 'events.connectionStatus', type: ElasticDataTypesEnum.STRING, visible: true},
135+
{label: 'Event Status Code', field: 'events.statusCode', type: ElasticDataTypesEnum.NUMBER, visible: true},
136+
{label: 'Event Tenant Name', field: 'events.tenantName', type: ElasticDataTypesEnum.STRING, visible: true},
137+
// Origin
138+
{label: 'Event Origin IP', field: 'events.origin.ip', type: ElasticDataTypesEnum.STRING, visible: true},
139+
{label: 'Event Origin Host', field: 'events.origin.host', type: ElasticDataTypesEnum.STRING, visible: true},
140+
{label: 'Event Origin User', field: 'events.origin.user', type: ElasticDataTypesEnum.STRING, visible: true},
141+
{label: 'Event Origin Port', field: 'events.origin.port', type: ElasticDataTypesEnum.NUMBER, visible: true},
142+
{label: 'Event Origin Domain', field: 'events.origin.domain', type: ElasticDataTypesEnum.STRING, visible: true},
143+
{label: 'Event Origin URL', field: 'events.origin.url', type: ElasticDataTypesEnum.STRING, visible: true},
144+
{label: 'Event Origin Country', field: 'events.origin.geolocation.country', type: ElasticDataTypesEnum.STRING, visible: true},
145+
{label: 'Event Origin Country Code', field: 'events.origin.geolocation.countryCode', type: ElasticDataTypesEnum.STRING, visible: true},
146+
{label: 'Event Origin City', field: 'events.origin.geolocation.city', type: ElasticDataTypesEnum.STRING, visible: true},
147+
{label: 'Event Origin ASN', field: 'events.origin.geolocation.asn', type: ElasticDataTypesEnum.STRING, visible: true},
148+
{label: 'Event Origin ASO', field: 'events.origin.geolocation.aso', type: ElasticDataTypesEnum.STRING, visible: true},
149+
// Target
150+
{label: 'Event Target IP', field: 'events.target.ip', type: ElasticDataTypesEnum.STRING, visible: true},
151+
{label: 'Event Target Host', field: 'events.target.host', type: ElasticDataTypesEnum.STRING, visible: true},
152+
{label: 'Event Target User', field: 'events.target.user', type: ElasticDataTypesEnum.STRING, visible: true},
153+
{label: 'Event Target Port', field: 'events.target.port', type: ElasticDataTypesEnum.NUMBER, visible: true},
154+
{label: 'Event Target URL', field: 'events.target.url', type: ElasticDataTypesEnum.STRING, visible: true},
155+
{label: 'Event Target Domain', field: 'events.target.domain', type: ElasticDataTypesEnum.STRING, visible: true},
156+
{label: 'Event Target File', field: 'events.target.file', type: ElasticDataTypesEnum.STRING, visible: true},
157+
{label: 'Event Target Country', field: 'events.target.geolocation.country', type: ElasticDataTypesEnum.STRING, visible: true},
158+
{label: 'Event Target Country Code', field: 'events.target.geolocation.countryCode', type: ElasticDataTypesEnum.STRING, visible: true},
159+
{label: 'Event Target City', field: 'events.target.geolocation.city', type: ElasticDataTypesEnum.STRING, visible: true},
160+
{label: 'Event Target ASN', field: 'events.target.geolocation.asn', type: ElasticDataTypesEnum.STRING, visible: true},
161+
{label: 'Event Target ASO', field: 'events.target.geolocation.aso', type: ElasticDataTypesEnum.STRING, visible: true},
162+
];
163+
123164
export const ALERT_FIELDS: UtmFieldType[] = [
124165
{
125166
label: 'Alert name',

0 commit comments

Comments
 (0)