[Threat Intel 10/11] Remaining adapters, dispatcher, and fetch_source step (#287206)

Author: stephmilovic

x-pack/solutions/security/plugins/security_solution/common/threat_intel/workflows/step_types/fetch_source/fetch_source_common.ts

@@ -36,6 +36,21 @@ export const fetchSourceInputSchema = z.object({
   source: z.union([z.string(), sourceHitSchema]),
 });
 
+/** Must match the `extracted.iocs` nested mapping in setup/index_templates.ts. */
+export const iocEntrySchema = z.object({
+  type: z.string(),
+  value: z.string(),
+  defanged: z.string().optional(),
+  tier: z.string(),
+  tier_heuristic: z.string(),
+  tier_basis: z.string(),
+  port: z.number().optional(),
+  reference: z.string().optional(),
+  block_index: z.number().optional(),
+});
+
+export type IocEntry = z.infer<typeof iocEntrySchema>;
+
 /** Must match `.kibana-threat-reports` strict mapping in setup/index_templates.ts. */
 export const normalizedReportSchema = z.object({
   '@timestamp': z.string(),
@@ -69,21 +84,7 @@ export const normalizedReportSchema = z.object({
   }),
   extracted: z
     .object({
-      iocs: z
-        .array(
-          z.object({
-            type: z.string(),
-            value: z.string(),
-            defanged: z.string().optional(),
-            tier: z.string(),
-            tier_heuristic: z.string(),
-            tier_basis: z.string(),
-            port: z.number().optional(),
-            reference: z.string().optional(),
-            block_index: z.number().optional(),
-          })
-        )
-        .optional(),
+      iocs: z.array(iocEntrySchema).optional(),
       categories: z.array(z.string()).optional(),
       vulnerability: z
         .object({

x-pack/solutions/security/plugins/security_solution/public/threat_intel/jest.config.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../../../../../..',
+  roots: ['<rootDir>/x-pack/solutions/security/plugins/security_solution/public/threat_intel'],
+  coverageDirectory:
+    '<rootDir>/target/kibana-coverage/jest/x-pack/solutions/security/plugins/security_solution/public/threat_intel',
+  coverageReporters: ['text', 'html'],
+  collectCoverageFrom: [
+    '<rootDir>/x-pack/solutions/security/plugins/security_solution/public/threat_intel/**/*.{ts,tsx}',
+  ],
+  moduleNameMapper: require('../../server/__mocks__/module_name_map'),
+};

x-pack/solutions/security/plugins/security_solution/public/threat_intel/workflows/step_types/fetch_source/fetch_source_step.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import type { PublicStepDefinition } from '@kbn/workflows-extensions/public';
+import { fetchSourceStepCommonDefinition } from '../../../../../common/threat_intel/workflows/step_types/fetch_source/fetch_source_common';
+
+/** YAML editor schema for threat_intel.fetch_source (handler is server-side). */
+export const fetchSourceStepDefinition: PublicStepDefinition = {
+  ...fetchSourceStepCommonDefinition,
+  icon: React.lazy(() =>
+    import('@elastic/eui/es/components/icon/assets/download').then(({ icon }) => ({
+      default: icon,
+    }))
+  ),
+};

x-pack/solutions/security/plugins/security_solution/public/threat_intel/workflows/step_types/fetch_source/index.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { fetchSourceStepDefinition } from './fetch_source_step';

x-pack/solutions/security/plugins/security_solution/public/threat_intel/workflows/step_types/index.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { registerThreatIntelWorkflowSteps } from './register_workflow_steps';

x-pack/solutions/security/plugins/security_solution/public/threat_intel/workflows/step_types/register_workflow_steps.test.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { PublicStepDefinition } from '@kbn/workflows-extensions/public';
+import { workflowsExtensionsMock } from '@kbn/workflows-extensions/public/mocks';
+import { registerThreatIntelWorkflowSteps } from './register_workflow_steps';
+import { fetchSourceStepDefinition } from './fetch_source';
+import { FETCH_SOURCE_STEP_TYPE } from '../../../../common/threat_intel/workflows/step_types/fetch_source/fetch_source_common';
+
+type StepLoader = () => Promise<PublicStepDefinition | undefined>;
+
+describe('registerThreatIntelWorkflowSteps (public)', () => {
+  it('registers exactly one step definition for threat_intel.fetch_source', () => {
+    const workflowsExtensions = workflowsExtensionsMock.createSetup();
+
+    registerThreatIntelWorkflowSteps(workflowsExtensions);
+
+    expect(workflowsExtensions.registerStepDefinition).toHaveBeenCalledTimes(1);
+  });
+
+  it('async loader resolves to the fetch_source step definition', async () => {
+    const workflowsExtensions = workflowsExtensionsMock.createSetup();
+
+    registerThreatIntelWorkflowSteps(workflowsExtensions);
+
+    const [loader] = workflowsExtensions.registerStepDefinition.mock.calls.map(
+      ([arg]) => arg as StepLoader
+    );
+
+    const definition = await loader();
+    expect(definition).toBe(fetchSourceStepDefinition);
+    // Sanity-check the id matches the YAML-side step type so the editor
+    // can find the schema for `type: threat_intel.fetch_source`.
+    expect(definition?.id).toBe(FETCH_SOURCE_STEP_TYPE);
+  });
+});

x-pack/solutions/security/plugins/security_solution/public/threat_intel/workflows/step_types/register_workflow_steps.ts

@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { WorkflowsExtensionsPublicPluginSetup } from '@kbn/workflows-extensions/public';
+
+/**
+ * Register threat-intel-owned workflow step types with the public
+ * `workflowsExtensions` setup contract so the YAML editor's strict-schema
+ * validator (see
+ * `workflows_management/public/features/validate_workflow_yaml/model/use_workflow_json_schema.ts`)
+ * picks them up.
+ *
+ * Mirrors the server-side `registerThreatIntelWorkflowSteps` in
+ * `server/threat_intel/workflows/step_types/index.ts`. Steps are
+ * loaded lazily via async loaders to keep the heavy
+ * `fetch_source_common` Zod schemas off the critical-path bundle until the
+ * editor actually requests them.
+ *
+ * The caller is expected to invoke this only when the optional
+ * `workflowsExtensions` plugin is present and the
+ * `threatIntelSupplyEnabled` experimental feature is on, matching
+ * the gating policy applied server-side. Without that gate, dark-flagged
+ * deployments would advertise a step type whose handler is never
+ * registered.
+ */
+export const registerThreatIntelWorkflowSteps = (
+  workflowsExtensions: WorkflowsExtensionsPublicPluginSetup
+): void => {
+  workflowsExtensions.registerStepDefinition(async () =>
+    import('./fetch_source').then((m) => m.fetchSourceStepDefinition)
+  );
+};

x-pack/solutions/security/plugins/security_solution/server/threat_intel/adapters/index.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { runAdapter, UnknownAdapterError } from './run_adapter';
+export type { AdapterRunContext, FetchAdapter, NormalizedReport, SourceHit } from './types';