[Security Solution][Detection Engine] Adds the ability to export rules and exception lists from the Saved Object Management System

x-pack/plugins/lists/server/plugin.ts

@@ -40,9 +40,9 @@ export class ListPlugin
   }
 
   public async setup(core: CoreSetup): Promise<ListPluginSetup> {
+    const startServices = core.getStartServices();
     const { config } = this;
-
-    initSavedObjects(core.savedObjects);
+    initSavedObjects(core.savedObjects, startServices);
 
     core.http.registerRouteHandlerContext<ListsRequestHandlerContext, 'lists'>(
       'lists',

x-pack/plugins/lists/server/saved_objects/exception_list.ts

@@ -5,13 +5,22 @@
  * 2.0.
  */
 
-import { SavedObjectsType } from 'kibana/server';
+import {
+  CoreStart,
+  SavedObject,
+  SavedObjectsExportTransformContext,
+  SavedObjectsType,
+} from 'kibana/server';
 import {
   exceptionListAgnosticSavedObjectType,
   exceptionListSavedObjectType,
 } from '@kbn/securitysolution-list-utils';
 
+import { ExceptionListSoSchema } from '../schemas/saved_objects/exceptions_list_so_schema';
+
 import { migrations } from './migrations';
+import { onExport } from './on_export';
+import * as i18n from './translations';
 
 /**
  * This is a super set of exception list and exception list items. The switch
@@ -176,18 +185,68 @@ const combinedMappings: SavedObjectsType['mappings'] = {
   },
 };
 
-export const exceptionListType: SavedObjectsType = {
+export const getExceptionListType = (
+  startServices: Promise<[CoreStart, object, unknown]>
+): SavedObjectsType => ({
   hidden: false,
+  management: {
+    getTitle(savedObject: SavedObject<ExceptionListSoSchema>): string {
+      const type = savedObject.attributes.list_type;
+      switch (type) {
+        case 'list': {
+          return `${i18n.EXCEPTION_LIST_NAME}: [${savedObject.attributes.name}]`;
+        }
+        case 'item': {
+          return `${i18n.EXCEPTION_LIST_ITEM_NAME}: [${savedObject.attributes.name}]`;
+        }
+        default: {
+          throw new Error(`Unhandled type for type: ${type}`);
+        }
+      }
+    },
+    importableAndExportable: true,
+    onExport(
+      context: SavedObjectsExportTransformContext,
+      exceptionListsAndItems: Array<SavedObject<ExceptionListSoSchema>>
+    ): Promise<Array<SavedObject<ExceptionListSoSchema>>> {
+      return onExport({ context, exceptionListsAndItems, startServices });
+    },
+  },
   mappings: combinedMappings,
   migrations,
   name: exceptionListSavedObjectType,
   namespaceType: 'single',
-};
+});
 
-export const exceptionListAgnosticType: SavedObjectsType = {
+export const exceptionListAgnosticType = (
+  startServices: Promise<[CoreStart, object, unknown]>
+): SavedObjectsType => ({
   hidden: false,
+  management: {
+    getTitle(savedObject: SavedObject<ExceptionListSoSchema>): string {
+      const type = savedObject.attributes.list_type;
+      switch (type) {
+        case 'list': {
+          return `${i18n.AGNOSTIC_EXCEPTION_LIST_NAME}: [${savedObject.attributes.name}]`;
+        }
+        case 'item': {
+          return `${i18n.AGNOSTIC_EXCEPTION_LIST_ITEM_NAME}: [${savedObject.attributes.name}]`;
+        }
+        default: {
+          throw new Error(`Unhandled type for type: ${type}`);
+        }
+      }
+    },
+    importableAndExportable: true,
+    onExport(
+      context: SavedObjectsExportTransformContext,
+      exceptionListsAndItems: Array<SavedObject<ExceptionListSoSchema>>
+    ): Promise<Array<SavedObject<ExceptionListSoSchema>>> {
+      return onExport({ context, exceptionListsAndItems, startServices });
+    },
+  },
   mappings: combinedMappings,
   migrations,
   name: exceptionListAgnosticSavedObjectType,
   namespaceType: 'agnostic',
-};
+});

x-pack/plugins/lists/server/saved_objects/init_saved_objects.ts

@@ -5,11 +5,14 @@
  * 2.0.
  */
 
-import { CoreSetup } from 'kibana/server';
+import { CoreSetup, CoreStart } from 'kibana/server';
 
-import { exceptionListAgnosticType, exceptionListType } from './exception_list';
+import { exceptionListAgnosticType, getExceptionListType } from './exception_list';
 
-export const initSavedObjects = (savedObjects: CoreSetup['savedObjects']): void => {
-  savedObjects.registerType(exceptionListAgnosticType);
-  savedObjects.registerType(exceptionListType);
+export const initSavedObjects = (
+  savedObjects: CoreSetup['savedObjects'],
+  startServices: Promise<[CoreStart, object, unknown]>
+): void => {
+  savedObjects.registerType(exceptionListAgnosticType(startServices));
+  savedObjects.registerType(getExceptionListType(startServices));
 };

x-pack/plugins/lists/server/saved_objects/on_export.ts

@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CoreStart, SavedObject, SavedObjectsExportTransformContext } from 'kibana/server';
+import { getSavedObjectTypes } from '@kbn/securitysolution-list-utils';
+
+import { ExceptionListSoSchema } from '../schemas/saved_objects/exceptions_list_so_schema';
+import { getExceptionListsItemFilter } from '../services/exception_lists/find_exception_list_items';
+
+export const onExport = async ({
+  context,
+  exceptionListsAndItems,
+  startServices,
+}: {
+  context: SavedObjectsExportTransformContext;
+  exceptionListsAndItems: Array<SavedObject<ExceptionListSoSchema>>;
+  startServices: Promise<[CoreStart, object, unknown]>;
+}): Promise<Array<SavedObject<ExceptionListSoSchema>>> => {
+  const [
+    {
+      savedObjects: { getScopedClient },
+    },
+  ] = await startServices;
+  const foundListItems = (
+    await Promise.all(
+      exceptionListsAndItems
+        .filter((exceptionListAndItem) => exceptionListAndItem.attributes.list_type === 'list')
+        .map(async (exceptionListAndItem) => {
+          const savedObjectType = getSavedObjectTypes({ namespaceType: ['single'] });
+          const savedObjectsClient = getScopedClient(context.request);
+          const finder = savedObjectsClient.createPointInTimeFinder<ExceptionListSoSchema>({
+            filter: getExceptionListsItemFilter({
+              filter: [],
+              listId: [exceptionListAndItem.attributes.list_id],
+              savedObjectType,
+            }),
+            perPage: 100,
+            type: savedObjectType,
+          });
+          let foundItems: Array<SavedObject<ExceptionListSoSchema>> = [];
+          for await (const response of finder.find()) {
+            foundItems = [...response.saved_objects, ...foundItems];
+          }
+          await finder.close();
+          return foundItems;
+        })
+    )
+  ).flatMap((exceptionItem) => exceptionItem);
+
+  // remove any duplicates we found from the list items against the passed in exceptionLists
+  const removedDuplicates = exceptionListsAndItems.filter(
+    (exceptionList) => !foundListItems.some((item) => item.id === exceptionList.id)
+  );
+
+  return [...foundListItems, ...removedDuplicates];
+};

x-pack/plugins/lists/server/saved_objects/translations.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { i18n } from '@kbn/i18n';
+
+export const EXCEPTION_LIST_NAME = i18n.translate('xpack.lists.exceptions.listNameLabel', {
+  defaultMessage: 'Exception List',
+});
+
+export const EXCEPTION_LIST_ITEM_NAME = i18n.translate('xpack.lists.exceptions.listItemNameLabel', {
+  defaultMessage: 'Exception List Item',
+});
+
+export const AGNOSTIC_EXCEPTION_LIST_NAME = i18n.translate(
+  'xpack.lists.exceptions.agnosticListNameLabel',
+  {
+    defaultMessage: 'Agnostic Exception List',
+  }
+);
+
+export const AGNOSTIC_EXCEPTION_LIST_ITEM_NAME = i18n.translate(
+  'xpack.lists.exceptions.agnosticListItemNameLabel',
+  {
+    defaultMessage: 'Agnostic Exception List Item',
+  }
+);

x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts

@@ -119,7 +119,7 @@ export const signalRulesAlertType = ({
     },
     producer: SERVER_APP_ID,
     minimumLicenseRequired: 'basic',
-    isExportable: false,
+    isExportable: true,
     async executor({
       previousStartedAt,
       startedAt,