[Security Solution] Refactor Network TLS to use Search Strategy (#76241…

…) (#76324)

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/all/index.ts

@@ -6,15 +6,8 @@
 
 import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
 
-import { HostItem } from '../common';
-import {
-  CursorType,
-  Inspect,
-  Maybe,
-  PageInfoPaginated,
-  RequestOptionsPaginated,
-  SortField,
-} from '../..';
+import { HostItem, HostsFields } from '../common';
+import { CursorType, Inspect, Maybe, PageInfoPaginated, RequestOptionsPaginated } from '../..';
 
 export interface HostsEdges {
   node: HostItem;
@@ -29,7 +22,6 @@ export interface HostsStrategyResponse extends IEsSearchResponse {
   inspect?: Maybe<Inspect>;
 }
 
-export interface HostsRequestOptions extends RequestOptionsPaginated {
-  sort: SortField;
+export interface HostsRequestOptions extends RequestOptionsPaginated<HostsFields> {
   defaultIndex: string[];
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts

@@ -14,6 +14,11 @@ export enum HostPolicyResponseActionStatus {
   warning = 'warning',
 }
 
+export enum HostsFields {
+  lastSeen = 'lastSeen',
+  hostName = 'hostName',
+}
+
 export interface EndpointFields {
   endpointPolicy?: Maybe<string>;
   sensorVersion?: Maybe<string>;

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/first_last_seen/index.ts

@@ -6,8 +6,10 @@
 
 import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
 import { Inspect, Maybe, RequestOptionsPaginated } from '../..';
+import { HostsFields } from '../common';
 
-export interface HostFirstLastSeenRequestOptions extends Partial<RequestOptionsPaginated> {
+export interface HostFirstLastSeenRequestOptions
+  extends Partial<RequestOptionsPaginated<HostsFields>> {
   hostName: string;
 }
 export interface HostFirstLastSeenStrategyResponse extends IEsSearchResponse {

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/overview/index.ts

@@ -6,15 +6,15 @@
 
 import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
 
-import { HostItem } from '../common';
+import { HostItem, HostsFields } from '../common';
 import { Inspect, Maybe, RequestOptionsPaginated, TimerangeInput } from '../..';
 
 export interface HostOverviewStrategyResponse extends IEsSearchResponse {
   hostOverview: HostItem;
   inspect?: Maybe<Inspect>;
 }
 
-export interface HostOverviewRequestOptions extends Partial<RequestOptionsPaginated> {
+export interface HostOverviewRequestOptions extends Partial<RequestOptionsPaginated<HostsFields>> {
   hostName: string;
   skip?: boolean;
   timerange: TimerangeInput;

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -15,10 +15,13 @@ import {
   HostsRequestOptions,
   HostsStrategyResponse,
 } from './hosts';
+import { NetworkQueries, NetworkTlsStrategyResponse, NetworkTlsRequestOptions } from './network';
+
 export * from './hosts';
+export * from './network';
 export type Maybe<T> = T | null;
 
-export type FactoryQueryTypes = HostsQueries;
+export type FactoryQueryTypes = HostsQueries | NetworkQueries;
 
 export type SearchHit = IEsSearchResponse<object>['rawResponse']['hits']['hits'][0];
 
@@ -48,8 +51,8 @@ export enum Direction {
   desc = 'desc',
 }
 
-export interface SortField {
-  field: 'lastSeen' | 'hostName';
+export interface SortField<Field = string> {
+  field: Field;
   direction: Direction;
 }
 
@@ -95,14 +98,14 @@ export interface RequestBasicOptions extends IEsSearchRequest {
   factoryQueryType?: FactoryQueryTypes;
 }
 
-export interface RequestOptions extends RequestBasicOptions {
+export interface RequestOptions<Field = string> extends RequestBasicOptions {
   pagination: PaginationInput;
-  sortField?: SortField;
+  sort: SortField<Field>;
 }
 
-export interface RequestOptionsPaginated extends RequestBasicOptions {
+export interface RequestOptionsPaginated<Field = string> extends RequestBasicOptions {
   pagination: PaginationInputPaginated;
-  sortField?: SortField;
+  sort: SortField<Field>;
 }
 
 export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
@@ -111,6 +114,8 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? HostOverviewStrategyResponse
   : T extends HostsQueries.firstLastSeen
   ? HostFirstLastSeenStrategyResponse
+  : T extends NetworkQueries.tls
+  ? NetworkTlsStrategyResponse
   : never;
 
 export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
@@ -119,4 +124,6 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   ? HostOverviewRequestOptions
   : T extends HostsQueries.firstLastSeen
   ? HostFirstLastSeenRequestOptions
+  : T extends NetworkQueries.tls
+  ? NetworkTlsRequestOptions
   : never;

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts

@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './tls';
+
+export enum NetworkQueries {
+  tls = 'tls',
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/tls/index.ts

@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { CursorType, Inspect, Maybe, PageInfoPaginated, RequestOptionsPaginated } from '../..';
+
+export interface TlsBuckets {
+  key: string;
+  timestamp?: {
+    value: number;
+    value_as_string: string;
+  };
+  subjects: {
+    buckets: Readonly<Array<{ key: string; doc_count: number }>>;
+  };
+  ja3: {
+    buckets: Readonly<Array<{ key: string; doc_count: number }>>;
+  };
+  issuers: {
+    buckets: Readonly<Array<{ key: string; doc_count: number }>>;
+  };
+  not_after: {
+    buckets: Readonly<Array<{ key: number; key_as_string: string; doc_count: number }>>;
+  };
+}
+
+export interface TlsNode {
+  _id?: Maybe<string>;
+  timestamp?: Maybe<string>;
+  notAfter?: Maybe<string[]>;
+  subjects?: Maybe<string[]>;
+  ja3?: Maybe<string[]>;
+  issuers?: Maybe<string[]>;
+}
+
+export enum FlowTargetSourceDest {
+  destination = 'destination',
+  source = 'source',
+}
+
+export enum TlsFields {
+  _id = '_id',
+}
+
+export interface TlsEdges {
+  node: TlsNode;
+  cursor: CursorType;
+}
+
+export interface NetworkTlsRequestOptions extends RequestOptionsPaginated<TlsFields> {
+  ip: string;
+  flowTarget: FlowTargetSourceDest;
+  defaultIndex: string[];
+}
+
+export interface NetworkTlsStrategyResponse extends IEsSearchResponse {
+  edges: TlsEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}