From 06bc18bad8fc38d966e2617b5ee58bcd3b9b33ba Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Fri, 29 Nov 2024 15:59:17 +0100 Subject: [PATCH] [Rules Migration] Add yarn command to draw graphs (#201753) ## Summary This PR implements a simple yarn command that is identical to the ones used in Elastic Assistant and Automatic Import, which draws the relevant Langgraph components used and places them in the docs folder under the correct subfolder. It also adds a tiny unit test to only ensure that the graph compiles itself, which can be easy to miss during smaller fixes to the graph. This is meant to be run manually and is not part of any CI process, but provides benefits to navigate graphs when they become more complex. --- .../docs/siem_migration/README.md | 17 ++++ .../docs/siem_migration/img/agent_graph.png | Bin 0 -> 23303 bytes x-pack/plugins/security_solution/package.json | 3 +- .../scripts/siem_migration/draw_graphs.js | 9 ++ .../siem_migration/draw_graphs_script.ts | 80 ++++++++++++++++++ .../rules/task/agent/graph.test.ts | 47 ++++++++++ .../siem_migrations/rules/task/agent/graph.ts | 8 +- 7 files changed, 159 insertions(+), 5 deletions(-) create mode 100644 x-pack/plugins/security_solution/docs/siem_migration/README.md create mode 100644 x-pack/plugins/security_solution/docs/siem_migration/img/agent_graph.png create mode 100644 x-pack/plugins/security_solution/scripts/siem_migration/draw_graphs.js create mode 100644 x-pack/plugins/security_solution/scripts/siem_migration/draw_graphs_script.ts create mode 100644 x-pack/plugins/security_solution/server/lib/siem_migrations/rules/task/agent/graph.test.ts diff --git a/x-pack/plugins/security_solution/docs/siem_migration/README.md b/x-pack/plugins/security_solution/docs/siem_migration/README.md new file mode 100644 index 0000000000000..84a2d17277ec4 --- /dev/null +++ b/x-pack/plugins/security_solution/docs/siem_migration/README.md @@ -0,0 +1,17 @@ +# SIEM Migration Library + +## Migration Process + +The SIEM migration library defines a set of UI components and services that are used to migrate third party SIEM resources like detection rules and translate them into resources that can be used in the Elastic Security app. + +## Graphs: + +The below images are generated by running the following command from the security_solution directory: + +```bash +yarn siem-migrations:graph:draw +``` + +Main agent graph: + +![Agent Graph](./img/agent_graph.png) \ No newline at end of file diff --git a/x-pack/plugins/security_solution/docs/siem_migration/img/agent_graph.png b/x-pack/plugins/security_solution/docs/siem_migration/img/agent_graph.png new file mode 100644 index 0000000000000000000000000000000000000000..a4039ef4a74461e37c9be915583e62af447d3a1c GIT binary patch literal 23303 zcmd432S8KJx-J})q7;>?fPnOl5{h&bLLgKVnpCAjAT%jb{XROMz0cnJoPF-O_rG^2>sd2v=6&a#nKd)d%&dzq7c+nxs$d8hKtKQh z5a53R7jpz(Ac~4l9>KK05Ot+L0@?t0M|ckaKsdU&!ju*6JT@@ALo)M6j2~fU7SEi2 zT>pi`r+fJMN9q8;py0oF=0EekYH9V%0{_4^{*S{IFC4Ed4Ib0j{DFCXVDmq)%n$78 z=In-l=Ft!AssmHRV@o{dvH2Tp{x{gd+4aZsk@#n15DxA?Wc_eIG$yxl)YZmcui*b~ z1D*k30A+x}kNo5B@y;n50FXEU04~S=@-t5c0IGulfLmj~{5W0#0M~;6fU4eKe!pzu zZ02hAm*fcX|1Viv0|2}E004yn06^Ub0FWB}B@F-XU+8uRA9Ne9mlOWS2H*g&0^9*W z0FD3)fDj%50rvpH0P%})fFj`XrAt44@s1GxOLT>Zh>(zol!S!%3OOk`IT97S%Tls+rri$(MNN+SJ;kXjSoma@~zTx^!uyHw42w^ItWr724kqS=i{}CnCCyi`C+lr4(M7@jI+m| z;Dyc7zGP<47&b%V_s?-#*Zu@7Q^VM|JiiaeZC?8mTwnio9x8G&u1no|Lux>F_D?W> zHdcA_(+#OI*`}Z1duC?eqJK&)@AabCVHovGIm>JX@(aL_0cj$Ffx1mpQYpVCa7i`0 z%JRkN??z*4Zm?NIzGmc{=OLAP5B0l!T#4n2iK+O-o@_y`PAh#;^_EGNqi^iVSOOzZ zQC>OI2W|dv-r!UiTYVHlpzgjS@Q0hQv@~zC&=pai#lJFi{;nAQ!;ST=Pfu*AP>VF( z%>1@i+HT?OWuXu6gy?P}B^|&?qw}s|;Tk+)-#DA{<&P4B z+zf0>{3V`$^n0W3Yv@b~Pk5{&<(3kxYU%BJr8~8>1GQ>shoQ6_%H?T8D$R=ALY^o% zygsQ)w8^{xyp7l)kz)K>ESRMRMZ%En$@@3v`rpEeO&BF=g$m()walT!sPC$&;%;2y z5l~eiD6cn!eGoZhXBy0)(iOpO!s3()OgeL!N6-z%a}HA@fWxkQ=()&k2!uMdtCtWY zaS&J*@oDv7l1>)em^^xr>TfJb!_8088&a3r(QK)ND3>E5j5jT!60?$RQM)5W8(!6s zYh%9e(~Pq;F41`sb5mE25X|HapRgmn|3!frO3ekAVSM>8?xq_^4(6|;S1I=~^I1=x z{wrGXl5VOj75}R=$F3&YmH|efa!&4RSq2ITNVz5G=B=w$(F68pq~!>^&+6EhRSSdJ z!^=BsE`6SabdR+iv+`lHRFCYr(6-L~*suYA-|zfpH{ERSgKWiVjI7fiH58xj^I1yv zqXsD-yC7rZo5R9wxhUWe%DB{|ho!`qvrRL33Xy?64u`4KHaA&6mDI{$n!K=nDYL+K z9N|b$`_<{-LW4wCqv}nj71E&~?0}t!z>1vf?L>sfa991H&HboK#f{`nN6VfLOtm1k zS86D%!`_f?C6`{IA~`PEGRFC>rxT-GUeVlVrwH?KJ)0|u8p*~l6SM1{Xyhhd-A8({ zpZ(_a+f&-zz)`psNk!p<7($=5e*Zh8{cECUA<4|Ss_6{*n#gpA&X8RbyP;!PMKUs? z2Yd;MwNhzZ9_SCsD@f$+MW1ijDoojaV`^vJy#Va(QAl)6;MP0y2E&jd+CbBc20E2g zMKb%$och@5lc;;kmET3RI$N~m0RR%I|4^&{?v`eRi1kGC1NQw)M3Tz@sbfg@(ybj2zXYk}1&WufVxvzp@^6j!HkC30%q6X~C z)NX1g*@Hv{UjR~KZO$zms&t=ydW_h+00h^jT*?PQ;!xHqonG|f3J*FxVlMy*Vp}_7 z#}CI8&vi!Lwc5{;kl2izLW1n!56suZQ8l9B1BP|>4eSDfA6LDKERog*-&vA$9d<*Z zwd-WoZ^T!MX~u$qqSePYQ#hQXMH33OmU}(acN#tfmal#1XcnteiLRkEhT@>fu*h9& zTXqrp%>kC(yvB3sCs(9ZUUZ}!9dG#FnOQ%*06^|VAxP*x-2Gn2GMiWfF4UVbdXp+C z#F=BTY%Xn;$gIE5_|OS@60x;N%V|+#6)I%77vAGC%A<9Xi+^Pc@O(}e3fP^FY)%xk z%5`0+tDc5Fr}&gy$m}rRMel%HN_jKNEb^6S(RY~!#|hLm#{^Zw&_NaIS%xpAc|}C; zXISXzSmy|~*hDQLg`Wd}CAboocoo2+lU)3uha7)xyz*V z$(Fy|1s&cee{)c$KPML9@XmZEBgh~Fw(cO9|{4jK0b0mww_Ni0mSe8 zi}ZeaU!Ik+r}?7QiJUWt`~Y_!q3uFp%B)|w+-MhCs<}|B#}R`j8#MS>AF1I0^2KI{ltM zcF#Cx%;w9HlKV}8j+ZHa8tRwrKG}~j&NNjM zgw1z;SQnM6IQno+ra|t5;+mH4y?@J^<29Q}t<4b3ASW<=)$#VH_&gIS_g6@p8Ftac zw2*>C?I?qM<#fs(I?*8NFeql=x%^e;UEm^6cEO9C-th5=&8?o8M9F|h0CN23@IN^6 zsv#{#*;220p2!$X_4U`s2(=U0l2hRe0PcFtsh$ZTBC|qp8vsy!1qjqF(O$NVEQtKf z%B2%Bch9LtW!BVSmLgwf6}m_1L?8jsPM?JEHx&DKo-;{s!+07PE&vhnL8GOnqTfZ> zTAmF?UbzVnmR1~>%_^&{s7Vxr9K#Ci++7%AwBmU+Ig4djXVD{=_+shd=oi8fol^T* z8CfRdg{FMh~C@GMecjBW&B zl2ESh@fBNtr9hK6DLjT4l-q#GhlL?K?Pc4i8-gq@n_reT-yoeFv$`HFm{KSP_maw^ zo43T^s;Q$?3~4|Zo-&h;uo$oBpu&<(%qWeOuD$CS=_ONZ$;PJQ-T|pqLx1aeRUcmX=_!Vo!yd zcQJ70OX2lt{lLg69eS!l+xcpkR?UPS^TX;uq04p7y9iqmHa3wduLD8T1iE@isz%z# zby5qm=rhA8sc}OMK7qJ6v`SZ*a-0UEjrcl5uOS3?%3Nh$!o+DT9r~rKxI!E=Gd%f~ z;#FCra=m1GQc(+E!`Ex;1)q!B=+qLVv#VWcCk=82jq^W8r+vfrr8`H#7O6Bqs5|}f z5Qd>_&H47og@xhLsAPlvvyws`ol~J9=!5kTzRm3kN)^$3qm6Cr`7m~l+(}-&bu@XG zw_*P42UFzc~c|*7pc4#lm{Tfw&(U6y_4y0-R)`Yy^`n4wO0o*u+ zQDo&qY&)p^Myl6PekkNl_z?YF!P0$OSryUbWXq%EJgrG@<3venbc7 z>rarY`NK@s?n=XNtK94PxmE|pj0BDh#3U2w_ecviyE|%kqcM+eKAVU$2sg(j%F%*G zQ@N=j9FB5GPUgL#=Pl|Hk^*u2r&CP=_Aisc!H;sJPHk6UciQ=aP-<3uGC0}T#H+)U znUcKL$^$}(?@8n0l`sl$f;vz9ok58V>2R-4RBX;cOC*>fOTSSYXk1|rH_vYOJ1^7W zj?Lx*)bWmEY8K5|3hA(Jk_*-8E!5y`z6mw^&Hajaxh1dUJuV8;kI#E6(Ag-sTeTlEyeTE-VXR44sI0aU$R1?)oXU$=t+Ab+(|`k0 zpDknIL1>j3wx??-cI1bU+pApG=94k8sV2_6O7y%fPero^_pHoRw8aaiQ%QfMi5;Bq zqZWatg-Oemn)2FN)2O$SSaq~wLyx|sJLXCy1@WVEpPSLij}5k z6lLNO21u=$)-{|6Z*xh_ph>1E8n-U| z67zbHiY_Q4fgi%tw(Zkx{kZ+*X+o1Bsw?Gp;{=Q}iG%t;s+!pS*s*LObxR?sKGo)w zCTuv#1UlDo%HrK;4>9Wz9ye9ReUNe>==6=~QF_RN+!7?-5r`4wu$!<{4qRzFh8;3m z^xGB>-06#BNSidPJ7v#S{KDIfBUPN%l17bbY4yuEvA2hJviIJcl%-{f-|8^qcR%b- z&3<*_A>HB7HOR~w#}7ecGF9=JlBBR6wml$Y-u&X=1I^!5jc`|uh)b^Fzbh~`tmO&i zQwv&c3+KvVYeLTne)JOh?88?v46V&)q79aJErYJEi1Cak1weA@ououC+i*5^;F8D< z!HuxdsyBVn>1tl2S?wMsl3GI?Z(Sx_G6<}}^Do;O{n|NpkxOjsQ|tmUQjaTBvWFcf z?KA3RUDw9EAD2R(N>s%Wjs>&k1npSXD0XTTgRO!Yke0?R0#&2N>EgLnJXCyCEWckW zwKUd;HqA%iiKVsr46-cOPY5zwf($D6k@6w zoJhQ?=6NNG57zLyWP`N2Bg~(m6FqK{c0J@9lCY83uH2(Qr}ZUQr~< zCQziEGQ^-yl5Ztz~P^AiEU(^$SI)XGzKi zEF>SJot2mIF)v@mY%dzwBsyPQlTeo_5>mWq(_?*KXVn+3At!LlAx}o7m=kTF+^;|d zf5cL!3Nu1%Rac!9VmK zz$zT9qYAS z80)z*IZ;(BFVxfu6_7SH-O}4O0kAjmr{dJK1`920=GI<|?3xURf_e9h0hoFC1t6|c zuJZbPD5L(jDBJ<|#cf2>`SOwTkKk&%#}WLov@VtD#1 zrt^PSVM-69sb{9C(%;9MFL4<^1CEP-*iP4*^Y+b?;PC27b%6u#63|@$u2SgMD=9UC zqqGzYUIeg3a5{}l+3q+o>l?7#~8AbCPQNfTRGL#IFJ3+a8u-7PTo4l@Jkt&n8u7YonQZRkF z`%;>08-z~%lNlS%82y$yBq zr|w<+w40XWb(QLEJ2D+TWWIacvJBNkvk|+C5^}&>lxj$|fq*VqEmY~Zj|{$gW(sCf z3^7b)inezNII3@;eyV?YR*n#k;k~ig3OAOdz~$$>4KQ-dQVQmT$hLsNmX^Nrn*bht z2Am=?;UPEwjj!qs=`pPP;#hJ9QS9iZyb1`D3l1)nFbYXvMu~gS7!EPMOc^?LL#c(W zV3BiDGzkoP36xu^NDPh-633tu&&~z}QU?pd zHZ4SkH$ze&@QKoFGq+2$;-$>k+NiQz>b|LUFA82R@YsIt^S!V9kT~=_=Z%z~`S_3E zl9DnNG9`8(h{{aGB_d=?{jx_oP>{8vEuP}bH~tM(1I)Zc0*h-D zuUdWpJ2a)w3v$yl_djX@0MP1oJlo2xeT|wOGRytc8Z!zv3nvv#rgk#p6XbfnS-~^d zlYx{JElAb1h4_`L>Va*&kS^DF6V+VDp|857@N^J<=&10tTVjuHW1(5X(2Zw!9!h;R z+BS~Qm9eMMs@B?N3<%VB12sEagDfBZp#j0M`_R3C2^UaEA2^p+Ie<;*neYQ6rOK`{ zeTw_csF>#+_4d+2NNiMjfH{|&=mU|4Y{TJKItD)@qjx6zJy`;TC&bd4M2TRiA@D4HoeC+r$-fAUacP30(*vHlRX z6)3Q3`56<`dK+!fW$B+1Z~s)HW%GNk^h~Ez z${qTtp8|jBaNl!-cbeE>s2|X?`%~ag9bD?)*=ZgFd$PMx?w5)?=Xr+3Cko^S;gRk4 z-&2FtaS1F^L%~&LVl0}Q=B(Mb&)dgj%f2!wB)a!o^GD_7_i_v`Rx1pEJC?eoHjJ%5@@@}~u(CeKtoo6zq6yv%MpZjEWbCI4>~ zSvh88rE)={&f$2kZxpGA-K1*g@*{~h^S(sdyMh7kGJp;1gl zw3m7olnSp^z;^Loi;l2fQ9s1zx?< zHoh{PF1b9M@p~P^ogdAFc7(-eSW5{{_Rvk81|%;R`w(&(`)%pU(oR49Xymg>YLi{L ze&hJ&c}9AMpl#o406}vNe#tDu$j7VP(GN4>A!FFZp^q(Plgg+r zqGZsoslf5E3x3Fokr_)^rOnw*8q4K-Juf=e_`c4q0LWrHfD7Z{7%#AU+%#)zz)#ZK z+asEtRKRV{Il_i8ZNsu2C^gtp!9K#$R+9_vl{rc#Q_2+aKeNHUE}v|u-lD>dD^}Xm zogFOS6k~S3CYda&9VMI3E^ZZxOy^`!ORMe0geI-)-x|FDv;jZkU_3glX$jX@tlxmP!@!Gaxm>B;nL)MDV--IVO`%CyiBPMC=H^*uwv6YY-J6&bF7Q2+NXNF!-^>U;e zGN-@mh1%^F;LW@##42q#-(q#X_FX!59aim0$7C47P64B87m2g|46>UQvja}&GnOM4 z86Q;&J~w(2p_afTs^;q7y>_oaSoRREL68nt z@x8Hgk4TAu;5u6^n$uQRS;q)-t{#_c@#XiJKyvC=Qu#8aTiI13EAiJcrG8< z^Sy=Ait<)_M8mj`#_!IA8%O9i{i9iSGW$OnW)NN{p;`CT$^;rsCIxmQx7i2Ar-F=(`L(j{*;&lp-fvI@&* z3(hfusE49LP@~LCqH)~NnKURv+jdbnT5iBmDnZE4^th7siw>AA+d`LQt*G5$971!b#3UK=zjGUPeOGvk25;|gp@j7wsR#t4ZR&k#*SwbnY=-*R zEhRc=vvLaroceL#$FpRRRpkNA^*GD&)X{};*mAaSI?thw9&H5!S;bMI=EI;o(?AMg zn&ft5BWHjM7}6Y54-4y*nUi2ySsJ_m4Bm9|bQ%%sgcdRPdN{G|Wer$K5}no$d)O@_ z&ul`WwEU`31CXy$k$v${dddu-l&*~}dbnsz+Prk2c$6s;HW8zf(Mg7A1jR#Fp>#;Y zaH$9n^$6)!^ac}luuAZaVO6Ii<4eEa{raYpl7Qp+sh!v?82U^LJTw^QmabYs|8xip zpHL2D5KL7_^hT6gi!qK}x1LZcr%vP)yM1KBtLzF?Iff%Xi1ZN zyLk6uM*jxKgh1c5LD+a4V=INWmPF0?de6eD?0WGL z^FtuSfRZwiAZ=AW!rN)1EH zRcR#iWl;^;Zau0`1h6qHywY8@+fw@NY}$iz8jKPyM>K1}%2o_$FIir8RkgD#Veeks zm{6))uyA~=n*oqh;k&Nf>iV@>x#MZH`7&&L@?av<*Qryua(YVOuy>v(ooXQR-~ymM z=cDTOp^z)IDfNZCvH$Iq&hWcgfj!UiQ$3#biLy&qFa+TAB2OSiY`^7ozni_ueyCvB z87{cov?MvWi0>s=zKA~f(M|G~$Q>1Ayxe+iF4%ZLB+_qqcty45Y^uPU|7}xP)zJ`5 zuaf;2*6q9BWu;{d`?H<`E(bgRh)1&Bg#=qaXIm0sk?XWL=spMDYL9zdF9ffr74HYq z3b!O#Gv?ybtp}L2Up_?Blx%Q-y#^qYfnqji?FYpRlk8ZrGxq++XM8C|D+L3!;Ys0( zk#2jfEpnvY(A(XKR&P!hF97r;f4!1BaeuCkcZ+^CvL5;qMR~EcR%EPuNA`_+7_pQ% z?Zp1|(z5Gk?{!~gmBPQx^%qi#v6KCBK%Z5%UL|ilJ=?senBQm_N^zw>q3w-MRDeRZn2<`PkK5H&Pn|fx9b!hYjV83IONOd~FecF9k zmST{bN7%d#iW$!RD0sl2^}ebPDSuUpZ ztL)bPp&+G>qSdH_f9<=LhkslY8Gjm#^(SH%QhBq%jn`l?q_gbH_h&C61OK>$+>c)~ zYOhm%WPhmm3n2x3Ae*h&Zi+t*Oa3+20=5DFKBE6S=h4E1wo#_AP)!1BHPr`)IB^gX zsEJ1UboFxi?9{yaWx^A+GM??Zn(us>bTN8FU07HxskK3IfPJ*9M87iGFap;+a zRGE8upItJ?F92M&P5^zQ1jQ1gp*kcI#b>F9VbD&aEG8_X^WQO-8FuTY)ey4_{tZBj zuTV5qM}D5%(~P@aCZt9_Z|mc?qE4*E>(4%AjDEAC&NhUmk5MST+_<`1GfBflJiQ$l zSI;VF^$~q|0Z30<*@O2!=qF$7Tjk9)*!#*?Fi9zhZx_(`ORu~= zC~p0zyrgR}jjQ?D_3O7HoctcD@9Q-NQ2k>&@FlwdXleG+RoFfT0A`JUL?n2beKhj? z)JJ}OKB8YqX{%&s|M10V>&={LXg_{9#_-~nm1!)Ac-`SN-Do4X;SRzGy-=W#U#{(o zeUt2R#p+W{fK2faeW4&fo@QF8KvvIHZlM~>&Z_D~4H1q@{$KNDp?Q^%m%+RrMJsYY z@&~yPjt#(N)|%*oDKnhGEi~@0Z=>f@1#)R<-u@FcAD_}X@>C8avDaj>y#qVu9Y;cNwpIpC@=I28Tu zX`Arx1Mi>t)m_agf^?* zji@e2=s<{1<&Frw?FyvB)auyUxg@<=;Au~&FSdi)s7AK)LgOeGA_yX{VK1jatG=q1 zPA0%*7&zURb#Smdouw$yjt}hC!{X1~-Uo4L(FHs$9l$OV`*puQ(cUw!^T}8v-&&}; z)t6pf+~Ko|ytK##5L_D}%`S8IN(D#cPy!`o;jJcOTjoT9-a|wc96ZSJhK|s{0b)X$ zX$q}FZG(o&46+EbWm4jsura)Bi%pqIGV-Wk;x~>)Vp3w)W=b?_*o1ry1?BkdlP25> z71BM0s1X>HrGeO%NR#DW$UUj|*VOpG-gT(FHtrz?tbdefn#z~*NlKKBS6wYS{{CaH z%3>)xFxX%Uxg^4Iq_CJ+RVPzZZJ)s4r#Tg8uL#eAh3hDS)*K|78WQpYUF?9(dhwfY z#vKIjJcYUVm_vCz}&$Tu(S8Lv(;4+x z4oW=$+-}3y+FzZB8!uw>bW`i?{jW)5TU&HKHajTIa67Q4t*#JH1$XB>viexW=@>M3 z2oXu7da}Fijc+#ygJlNR^f4mPig@IT(qkpSxcCJi$T({Bs=W}$yRZ98Qodv5eX`QT ze_8A&a&MhF(C#-mBv-0_`zp_y-?Ztf{y)sb@)Ed+S4GNUxRwxM-GIiv|ZA8b?19r94YbXa!wjeAzNa zRDBbUuB^8gHp!c&=I9PLa?Kv3c&~$9wwj9_i!lr*4um}inq~t9o0V{u(~N|*{88hd ztDPzgKiU#cgcPVN`ityj-=~MTr2~h?!ZBD>6gUlAk+gr07`n(+rAcky?1M0<`hijsk0gxqJ56m{>374k+qN{AvR&nhOB&-vKtxm(U+mtg> zIjT=Q7^s|5#t?q}tb9WAlE9^dHhd1465=Zi&vYk~1_vw1bUhZx%z&xrFnBoM^{ati zckT3oSr?L1uEN>bH`T2WTk#1^jsqU<`X%d&ss8ns#-%7=Bi^^_mmjJn&b9C^m{ zzkSM8!p0Ck?%8E-BcQ+IT<6$n4XX1{g5?^}oXKTElC=|c^9D1Xj)&xDOAOkeR=8<$ z`oOmAExtr?sV87Vzsim1j%*lrEALH3zMP3zsnt-Wzner-3?RZxU4UeJBmJgS^V7hn?Do9*N^CZH+-8L{n6oV z_T}$bWyxtVlq>ZizMUL@j}6(KQ}dR3_GfqZmn{hY>)l;M9wx{1z8b%*(AzVr*!T&! z!+h0L_BJ{XZLl5Nzyj~Czto_9Xu+o)nVhO6x;p0GFwc?jsvV>p&`vqCZLmo5EoDG% z(CA=&I#O06regCOljxWQH6>*?r4&1bbJ1YrTp58;dolZl*gMnifs;0W>o1frXkvmN&dJ%|p>6mno%hAAq&<@X(N#zMZD_v zA5G@NJt}TPzMM4YyV)uN4Kct$tWYy)ce4i(`4ZES3w!Y+ztT@WOc>xMhi|sx{-p?Z zR7uJz{sGB%Ys>W~4R&z7-_NmAyWWX}-MIu5%4*a3Y91Zso^1y*V957_$45Hq;& z3DENjVj?5o?%up}xx-LjJfZv9PMSUd@aW%r`)mJE$qfEl$=VdXTsRwiapTvao;GV6c(d0+r&-rJu~wn(I{X%@DJWcr|{qw{yn&|7-jDr7V5~!#rDS zr9(bpl({4L-r$Mc>c{3*d0`8pMK&hD(<-hU-Q-6iVmxP-rD&a5f%EF*fhQ~d-F^47 zhtF|${y0_eGqrys->-BeO8PVTqv&&N#m{}%tk@gPnEq=x!pYoT?@=o8H3Pd96hQ9koS{PXiOWV9F z@VPr$?6{h1^u7F@s!f@39x5j?w?g?;iRxJFJI&X}t-{PZXFpZ&=MeT(GizZf7~cY} zYLFq^^rQG7X!6Kty?UCmZ_c7aQpMZ~EU!|pZVvb4e29|< z`jjz7{>DMxgovB+{}B)4YhGJxdPuc@I>uwdh~N&8XDw{k|4?{mEl=fLoOL7tus z(ie1w)C)U>q9(-Cy_qqiSDb`6s&n%3v`3FOahQ!quzZBz)!paADMEoxOTDe@LH84> zjQR)hb4VN6%Y(0NfBVsn^#5_GAi?FRQDw#6l!5?ki8;-0kw4wsfn?Z2gW?GUR*?xZM95KuE`rI??rV z%d>vHp~|k&$i{Y?-3289=NiK7#qlfbWcYDia=ucjih_#)O%yEB$WZTnXn^DOMlzSutW-G3fScanX6s*xuolK(hPp zFxxn;pZ9>?F9ul2`Do^Tlc2E(W-LwgD~DyqEU65(t@_#0rG*E8K&o0TtWN&myoNbw z)vF3NUp33?(rq^sU~scvM01yY87LPgp@KKh^*NLZ1P6xTSCzZAL5i}_F{WCzvSCkI zU8_!nAm<$R6Q|r*DlD8AKN5ywBfF~OSVEH?^aB8~_=TBjp*7dS<>)hF!HvM~N{GnP zI@m9O_U8S+?#*?wKdOZ6&h6h5^@IKJe9T=bH2ks~9tvA%f z#Is@Q5orUKHbHU8aZk^%`TSs{zIRDL_%|smr-r04+mFqiA+zjYx9=h%JtF;S*A;~$ zNYHb;#g(g38wS-jwZsTuy?DH)KEm-s%;h%|ePgD-B}KEY$8o}E>8!I&=O5zN6s~oF zG82@}py_hhVO24%2tnw)t|b?6!qAG-PTR0uNF1E;m5-ex8GpV9+X^mTzt&viSSf;->hMD^2sYSi7qeQ97YNW%*ojOi^wgH6n$9=ajp(ex6P&dNf`rAwweIC8 z+$`pCPBnzBLJWYa?Me+tPPCouzki|ouK8{kUb97-`_;X@xP-}azGl)@jW-f)C4->4 zN+y7f3fS!B8^~psa#qr3X!J*j&s8JBsPd#fNp)d{^+Gm7u>)K(r{rm|`Ke~Z4G>XI z2@y6<`s7tH$Ngb`8;=93PXB>mtr^5oYV2U_u?;QmE)M>@G9}7yAkAQJvuFKjFw>{k zK6I<0ic!$4RXzdB=HI?~#kBgNuW}&mLlAZ@DorkGJ#LU#vCs0gaM$eC$862$P8KV9Ed0=pGpI%ra( zi{Ld=xw34A3*0(x5JkdDok=5t7gO7tITh(|w0%q&!6rF0Bj#q)rQPqYpy)^WdHk3h= zO_HX;ZTc~>r3a-Bt`r-BxOk(6MGvY$No^B##r(I3tdVX! z>E-a~zL#4ynT6VS^Y2truExI%!P*$CTSVvizZ}f^(2N3OW;qh5U?9`zz%n(>WUBE9 z2Be0tBgEB8n3HvIhS^Xrp{Q#(Atii7q*PA>?0eSKjWl!|8z}w+D+eb$k}B-4=bT!F zw)1i=7JEnRe^eb%&d<3uL2v0Qed$Y#%J|{<+ImM(N3yy<2l~}cQJ~qLYlfO=ak@7h z$l5Xh${fJPF@t>EzV6Tbd8@-D(f?xs@_0azy5PFJd)>ZrHtt2fnds(6t}&Q4j(4CD z0#oDH`*zA_+JW$@9>0%VDNt$|yD{2juH8+IgV3`FA;>r+@$?S3B15D`4=PS#W|RnX zuM_-^Z)ZAe`J>V?*d4|&Bp_Eox?agt$g z23cETLsCTgD&sPp9VwC5AJQRJk`+&+Cife&-WMpwsZ`m;6_PyiP-3Xmb#cwv&Z|_` z;Wn07=DxC>!wwWk&gHD}SRNOxG9PzOxnw6O6l378p1eI}IH|a)Vo*FU3$`{y<;c)o zsk;&cQkh{Chi~L>aJ{pfxI1D7<2wwj1kVl$+3-EHsL_fCSF~}ks$&Oc<8n!%l$aNUuW@_GHQIIvS7I|~If78rjDlXGs49)4E3B&wB+FvwAl~t& zFm6p0E;Tiuhc z3V9DfD;(`B&XW-FXle>dfv)W-W>_D{d^p&Mc~E8BNUXibW99IE*6g9&Z^pz@5lE3-j(8W}kIL`59;cOu?G7f2%|02;>lKf2 z(JfJS_-MpqV&##m{D$)rT5U7GZqy>w>7l2Jz)Ew>!`Op$h@BgjY(5)ImD_`TKs21ptF4Vfvjdw%$rd|$>r)9&KVH}lF$QTpHLSMEa zEJrm0nkXC>w{O9|<^vpyU^Fc6q0hNqq!qv=97+8Ex_#snKeT1UKSOfe<3v{TpzJMR zzd3?$yvx&o~#^2J%xanl$9*#;L$({m1v@cWLNv<=Z@EYoPm>Fg2#W# zCETup;+HmLm-m3G+e9osbL0GH2CvLI)a@VTbp4;q6{;}N?~h|qbcZc#@c8A(GeVJ) zffD}k&^tP;O_=w7Toa*>lW^C0i66sY@pc>rf@6`r^oxw*DT)-VRRa)(D@au0!<)j_ zBR150q?WULUS?Z!*`#K!HVOwld-nh!v-|$%%=}-icK+uimu-lr?SIB!{LhK$AM=4f z+#D8vp_`{G|*(xza^rk~K!PA}o$4LegO1-^X zON=|chqqCA9at(gqH)3ZFVqv>MRVDBy~tO-|6utNo|?c@Lwxu#|1bCd@*w^%S`ztL zztgH7MYQi~-%isD84QGdF1-W;S?8REX}cyr_-=Ut&{aKF%d)>hAs$&0i_0 z=RbVtV^XnNkmkG^r_)sW(u%&~t((M?oTVQp>}u4F?>^oe)eYUrOOz$e zRmDuws8;HV)vXT(YGr&VrLh{uACHQv8nVfPxa4rolQeVeO*_fkwPjB@XhusnVTMqMN{1VZ{KbFAo zhiX@UwI)2`FX4&mc{Oy)T~Z;*U@4bN2?>2p9vRklN*?wpEL`uj!0DX!j7v~i>`~Id z>&m=(?J7HJW?3zjkj_GRQdEG*1we$(9NDtPHGN(hb7FVXqG|l2w!Ja9_NJSvt zC9y^{u585~GSk-9sYkvoPj|lqhT65)7yNb|bC_^qhcIdnvRISl5@bn0J(YSP}AW_P((5x{-GTh8hw z=R1U)muhe9y@Jm7^SunzwSFDkWq0_f0%>B!tC~|=^Z7CC4W`V}T46K45|Rxs#**I)d>x+o4+xKhfCHhHw=&^kDUh%^FE_aM3^looGsUFZUn+&?V1>9P|3^e?UrqsLz2a7 zmG(Av(huIiD`j8l6*2Oa+CgxlF7}1FtLS9GJF(>o`^9$bZf_=SG}mLt9jNUqmsSp$ z8lS**%{qT8y!)`ENB=VG7bvqsPTjmA87v(!lu@$esVwHbjk)M}{}BHn$f-Eo+aGItC7fEBLLI(t%8x5ypwu^>Uf&^9Fat zaVXqXhg9wfHC0i$5yGIayilI_c%aC=W^)&^OnWi1yss4oK``5>_hV{R3mE039NuoR zs|U$NVeu00qpL==8}`L z`BI)KVmwj2JtRGNV<+vyk_yrZI`d=?H)c9iGSs<^T;lE2vHK}~&keV&3YYUUxg%;A z1>Olr7c5CbI`y&~CusHg`J_%+cptI&5T8EMzznQXfbcCm))EeE4?VcntAQ2P&sR#P zH=I|syIxUb!2_j?y8yVvej9#Ukc$5{gnxTD2!v!~YoeQDql8cEYFq%C-&wZopJUbS zRNmCLS6=`M=g$q5zF_|LW;-!DrLp|TO*0lid{z`5CF0oP-c|xRZ9%(ys?!y~RU-idoaGF#ZuGj`9QU z)KIEChq{mXD2T&n6gAvo$S2&SLp^Kck? z<@IzybCm?TKZ89+6?eMj@#jLsX4Y0aYE*}a^bsie+k>Y+KH2kU8qV$qmd$#v`05?9 zju$h392Xhq@t4g1ar7gww2+JHpC)*l$wLb;jqR(gTi!u3X;Cd9`|vz;&eE~tL8tv+%W=DOZC3 zsMDX|HQ>Jpc_tX%hwB-wyzD`4gVN{pqr)Nu@z=F=W(#~7;a6f` zbxF_#9d+b0NB&r;{cp5s=RKa-jxiUGs?YJNNZ%Ianl_uk@=o`w9C_$|jtD|fuHywj zc-P6(-pF3nzWhVVy`|)st9BYt%AOhmX!}9qT+2JE#@Ro?d`!5hyY^c@e(T^G(rB&X zEjqE|gsp2o0jJln=E;6?mgA+I_%)wTQU07hAAW*AqW*uSTzNPf*cR97YddXeqZMLn z8$<?NN^KRAT1py{A*xhsEgdygBp&f0I*6@;(pp-z zC8{s)&702mzUiCy$Gd->@80j8bMAi6y}xrH{@7ckLec04+~s7irLV*r*8-tA&{}Jk2t6EZBmRMjsPn!^d+DOxcXi@B0(6j_JFogwF z`CrkU%WSqc7ua=%9Z5rC)F|b)8u!kBibz}28dytF+C;9UIA3kDb3An~R)qPsmae}w zP`hhyn7j%dJE|M_L1*+20=ZmPusjPh7yQloca{=3@o&6u%QelF#ENWt>b}wG6RnkJ z*kk9i4D?<&UAYlTs;X?QBz+~qb-K&0@tFTh=pW~b`1d~lfU~Ka?LXAyv|f4#4btuc zEu^OW?S5MM@u+_HK2MUj(od1L0crku#ruE~BsnO#Wayv}TC7H~G2DuVo|hf|H$23w z4Sz!#4$Hro=OjkrxTS3@@1O^)&Wx9}@s6bkKyeA=I_d?%y64;^43Q0by}`DPl9Z5 z${kz_hTc>zGj$g9d}?Vjj2cE_-QWJoKQP+_cN4r_)f(oe@#@0 zwtF(7`@3n^#spt0Pj2T8wqOgDn7F0s(M^IKTRu2)&md7yME;z++PsjpoEa= zGAxmOx-GeSBgmdCimZXa$de&jzfb|Wpy-Yr|M57pZ6mzZK;k^Baa1$QA!COm3f!SI zSBUe}QG?PvpDL4%zRRVClUl6r7ShOhKO(3T5_oDD5~K7O{vZ=u3C^LmrP5|xTz(l# zLuvI6SF)hyGL{8GGP{j~YN13bkdwAPJ@a9+sTD!&&dj5sc~i$SE*=xpdJtd@hBg=h z0HQ${wiW9zH{oK)ZJD3CEmlDILBn|~BFh2qjdYD-W&%&^5fBJD$5M_qA_Vxuw+7_* zyi@X?`DOAKMb8-+Q$oeZwDw;i>+Z4qLffwO4RAjp+Q{9&*iW+Ffmy@1_L~KdO~oh+ z=L6br&eix9bZLGhXc`*C89zOM{H)W(=_Q#Tj5lEKc#gVA?0w`r^gg9Ks~Ux*Ug=?G zbM5TN9qF@IB|+NGZ%_JY<+;4LHmSJsJS0oiZ zmYu?Df3yO8-omw#e^NHV#z~fa@J8p2Bu`)OtyzO2ou;ytP<4dP-n2r^GEBLMbgA{A-Nc0$0lKjeAcDD zZgR?H3Ys%R5NkEexCG}qw^jJDxwj!QURe7hgN|vX1A|Aa=fIBsdLB~`qk%;#u5`la z@&1{zQ)yvA*A?fT_yyRSsiN|PdFTF#{v%2vVSW7fd@q|h8q)cu1!7O+BF8W4QBu=DC8ED=z zQB{aBuBk2Rj<9VF&2BfVFHe3l*LS$I|B$_trVf^iK1Dh}7dc>4#2bHaAD6mG2OMgJ zTkB^T-;z$6?`n|G7xge~bL|o?+*5PRDX*SH_Gz}KcMBta|8%%7$ zu3jv$TtSWOn@Kdkliyd6E^QuO)joT(< zCk*FZD#QV>1qanQeB&!n;eW0-bTq3xm)nY#hqr&+(Pv<_EON029<{;p*kB3%_TCDF<)#z4SM{09* zYHCL(Gqqz)QEJEsa*|?Fm{DB;tY{3OyAaJlh){?8?g-tCz4ozO^%L)blk^~?gn5O= z?(}YI%Z$hj`t*xb=l5^bmv#8}-LS9y?2~d6W^AOSsed)NyX8eN1$ns}$L(X(aC^N8 zg;z8IG}H^<`8l=;<9WwwB@GMUy|bl0GI|0`9_R+{$S?U2Hb1f0m2* zBrzBX`$q?42PAvyqcZS5A|UUMZRTA2s2 zis6yon&o?WfkP`#FUs0go&XrV&Ra|GsC#C;)v<_M%l4(2q!2RXlXRaV<2p|&`~nZI z??B=zce>|;kB=|0fGFkEP4(5OW)!Jx$Fm?ys)cF}(pziL7@<*bH!>;*$1c|=B{pUS zcDCBBOiM0^HB)aOqGhiSH(`J{BWr9&;H114KR$k8GOby8sF> z8f}S*0uBghS1VW4lB+hQU=$zLr^%KZ^U;7bf@7&mn8B^QCBNnua5%xQ2Tq7d3V86I zHh=$(!+X-9f#nh7&8%>^7oK6tTg1pR@IiBQUly7bKz9mPQO+tv$W;qdd&o4QmWFlQ zC`mVWyoy6wrH; Promise; +} + +const mockLlm = new FakeLLM({ + response: JSON.stringify({}, null, 2), +}) as unknown as ActionsClientChatOpenAI | ActionsClientSimpleChatModel; + +const inferenceClient = {} as InferenceClient; +const connectorId = 'draw_graphs'; +const prebuiltRulesMap = {} as PrebuiltRulesMapByName; +const resourceRetriever = {} as RuleResourceRetriever; +const integrationRetriever = {} as IntegrationRetriever; + +const createLlmInstance = () => { + return mockLlm; +}; + +async function getAgentGraph(logger: Logger): Promise { + const model = createLlmInstance(); + const graph = getRuleMigrationAgent({ + model, + inferenceClient, + prebuiltRulesMap, + resourceRetriever, + integrationRetriever, + connectorId, + logger, + }); + return graph.getGraphAsync({ xray: true }); +} + +export const drawGraph = async ({ + getGraphAsync, + outputFilename, +}: { + getGraphAsync: (logger: Logger) => Promise; + outputFilename: string; +}) => { + const logger = new ToolingLog({ + level: 'info', + writeTo: process.stdout, + }) as unknown as Logger; + logger.info('Compiling graph'); + const outputPath = path.join(__dirname, outputFilename); + const graph = await getGraphAsync(logger); + const output = await graph.drawMermaidPng(); + const buffer = Buffer.from(await output.arrayBuffer()); + logger.info(`Writing graph to ${outputPath}`); + await fs.writeFile(outputPath, buffer); +}; + +export const draw = async () => { + await drawGraph({ + getGraphAsync: getAgentGraph, + outputFilename: '../../docs/siem_migration/img/agent_graph.png', + }); +}; diff --git a/x-pack/plugins/security_solution/server/lib/siem_migrations/rules/task/agent/graph.test.ts b/x-pack/plugins/security_solution/server/lib/siem_migrations/rules/task/agent/graph.test.ts new file mode 100644 index 0000000000000..eece827726a33 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/siem_migrations/rules/task/agent/graph.test.ts @@ -0,0 +1,47 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import type { InferenceClient } from '@kbn/inference-plugin/server'; +import type { + ActionsClientChatOpenAI, + ActionsClientSimpleChatModel, +} from '@kbn/langchain/server/language_models'; +import { loggerMock } from '@kbn/logging-mocks'; +import { FakeLLM } from '@langchain/core/utils/testing'; +import type { IntegrationRetriever } from '../util/integration_retriever'; +import type { PrebuiltRulesMapByName } from '../util/prebuilt_rules'; +import type { RuleResourceRetriever } from '../util/rule_resource_retriever'; +import { getRuleMigrationAgent } from './graph'; + +describe('getRuleMigrationAgent', () => { + const model = new FakeLLM({ + response: JSON.stringify({}, null, 2), + }) as unknown as ActionsClientChatOpenAI | ActionsClientSimpleChatModel; + + const inferenceClient = {} as InferenceClient; + const connectorId = 'draw_graphs'; + const prebuiltRulesMap = {} as PrebuiltRulesMapByName; + const resourceRetriever = {} as RuleResourceRetriever; + const integrationRetriever = {} as IntegrationRetriever; + const logger = loggerMock.create(); + + it('Ensures that the graph compiles', async () => { + try { + await getRuleMigrationAgent({ + model, + inferenceClient, + prebuiltRulesMap, + resourceRetriever, + integrationRetriever, + connectorId, + logger, + }); + } catch (error) { + throw Error(`getRuleMigrationAgent threw an error: ${error}`); + } + }); +}); diff --git a/x-pack/plugins/security_solution/server/lib/siem_migrations/rules/task/agent/graph.ts b/x-pack/plugins/security_solution/server/lib/siem_migrations/rules/task/agent/graph.ts index 078b3ffdcdcb4..4f2d2a74ff611 100644 --- a/x-pack/plugins/security_solution/server/lib/siem_migrations/rules/task/agent/graph.ts +++ b/x-pack/plugins/security_solution/server/lib/siem_migrations/rules/task/agent/graph.ts @@ -30,16 +30,16 @@ export function getRuleMigrationAgent({ logger, }); - const translateRuleGraph = new StateGraph(migrateRuleState) + const siemMigrationAgentGraph = new StateGraph(migrateRuleState) // Nodes .addNode('matchPrebuiltRule', matchPrebuiltRuleNode) - .addNode('translation', translationSubGraph) + .addNode('translationSubGraph', translationSubGraph) // Edges .addEdge(START, 'matchPrebuiltRule') .addConditionalEdges('matchPrebuiltRule', matchedPrebuiltRuleConditional) - .addEdge('translation', END); + .addEdge('translationSubGraph', END); - const graph = translateRuleGraph.compile(); + const graph = siemMigrationAgentGraph.compile(); graph.name = 'Rule Migration Graph'; // Customizes the name displayed in LangSmith return graph; }