[Osquery] Add support for osquery pack integration assets

src/core/server/saved_objects/migrations/integration_tests/type_registrations.test.ts

@@ -75,6 +75,7 @@ const previouslyRegisteredTypes = [
   'ml-telemetry',
   'monitoring-telemetry',
   'osquery-pack',
+  'osquery-pack-asset',
   'osquery-saved-query',
   'osquery-usage-metric',
   'osquery-manager-usage-metric',

x-pack/plugins/fleet/.storybook/context/fixtures/integration.nginx.ts

@@ -253,6 +253,7 @@ export const item: GetInfoResponse['item'] = {
       map: [],
       security_rule: [],
       tag: [],
+      osquery_pack_asset: [],
     },
     elasticsearch: {
       ingest_pipeline: [

x-pack/plugins/fleet/.storybook/context/fixtures/integration.okta.ts

@@ -104,6 +104,7 @@ export const item: GetInfoResponse['item'] = {
       index_pattern: [],
       lens: [],
       ml_module: [],
+      osquery_pack_asset: [],
       security_rule: [],
       tag: [],
     },

x-pack/plugins/fleet/common/services/package_to_package_policy.test.ts

@@ -34,6 +34,7 @@ describe('Fleet - packageToPackagePolicy', () => {
         ml_module: [],
         security_rule: [],
         tag: [],
+        osquery_pack_asset: [],
       },
       elasticsearch: {
         ingest_pipeline: [],

x-pack/plugins/fleet/common/types/models/epm.ts

@@ -74,6 +74,7 @@ export enum KibanaAssetType {
   securityRule = 'security_rule',
   mlModule = 'ml_module',
   tag = 'tag',
+  osqueryPackAsset = 'osquery_pack_asset',
 }
 
 /*
@@ -89,6 +90,7 @@ export enum KibanaSavedObjectType {
   mlModule = 'ml-module',
   securityRule = 'security-rule',
   tag = 'tag',
+  osqueryPackAsset = 'osquery-pack-asset',
 }
 
 export enum ElasticsearchAssetType {

x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/assets_facet_group.stories.tsx

@@ -37,6 +37,7 @@ export const AssetsFacetGroup = ({ width }: Args) => {
             security_rule: [],
             ml_module: [],
             tag: [],
+            osquery_pack_asset: [],
           },
           elasticsearch: {
             component_template: [],

x-pack/plugins/fleet/public/applications/integrations/sections/epm/constants.tsx

@@ -11,7 +11,7 @@ import { i18n } from '@kbn/i18n';
 import type { ServiceName } from '../../types';
 import { ElasticsearchAssetType, KibanaAssetType } from '../../types';
 
-// only allow Kibana assets for the kibana key, ES asssets for elasticsearch, etc
+// only allow Kibana assets for the kibana key, ES assets for elasticsearch, etc
 type ServiceNameToAssetTypes = Record<Extract<ServiceName, 'kibana'>, KibanaAssetType[]> &
   Record<Extract<ServiceName, 'elasticsearch'>, ElasticsearchAssetType[]>;
 
@@ -62,6 +62,9 @@ export const AssetTitleMap: Record<DisplayedAssetType, string> = {
   security_rule: i18n.translate('xpack.fleet.epm.assetTitles.securityRules', {
     defaultMessage: 'Security rules',
   }),
+  osquery_pack_asset: i18n.translate('xpack.fleet.epm.assetTitles.osqueryPackAsset', {
+    defaultMessage: 'Osquery packs',
+  }),
   ml_module: i18n.translate('xpack.fleet.epm.assetTitles.mlModules', {
     defaultMessage: 'ML modules',
   }),
@@ -91,6 +94,7 @@ export const AssetIcons: Record<KibanaAssetType, IconType> = {
   security_rule: 'securityApp',
   ml_module: 'mlApp',
   tag: 'tagApp',
+  osquery_pack_asset: 'osqueryApp',
 };
 
 export const ServiceIcons: Record<ServiceName, IconType> = {

x-pack/plugins/fleet/server/services/epm/kibana/assets/install.ts

@@ -53,6 +53,7 @@ const KibanaSavedObjectTypeMapping: Record<KibanaAssetType, KibanaSavedObjectTyp
   [KibanaAssetType.mlModule]: KibanaSavedObjectType.mlModule,
   [KibanaAssetType.securityRule]: KibanaSavedObjectType.securityRule,
   [KibanaAssetType.tag]: KibanaSavedObjectType.tag,
+  [KibanaAssetType.osqueryPackAsset]: KibanaSavedObjectType.osqueryPackAsset,
 };
 
 const AssetFilters: Record<string, (kibanaAssets: ArchiveAsset[]) => ArchiveAsset[]> = {
@@ -250,7 +251,7 @@ export async function installKibanaSavedObjects({
     /*
     A reference error here means that a saved object reference in the references
     array cannot be found. This is an error in the package its-self but not a fatal
-    one. For example a dashboard may still refer to the legacy `metricbeat-*` index 
+    one. For example a dashboard may still refer to the legacy `metricbeat-*` index
     pattern. We ignore reference errors here so that legacy version of a package
     can still be installed, but if a warning is logged it should be reported to
     the integrations team. */

x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.test.ts

@@ -67,6 +67,7 @@ describe('storedPackagePoliciesToAgentPermissions()', () => {
           security_rule: [],
           ml_module: [],
           tag: [],
+          osquery_pack_asset: [],
         },
         elasticsearch: {
           component_template: [],
@@ -179,6 +180,7 @@ describe('storedPackagePoliciesToAgentPermissions()', () => {
           security_rule: [],
           ml_module: [],
           tag: [],
+          osquery_pack_asset: [],
         },
         elasticsearch: {
           component_template: [],
@@ -271,6 +273,7 @@ describe('storedPackagePoliciesToAgentPermissions()', () => {
           security_rule: [],
           ml_module: [],
           tag: [],
+          osquery_pack_asset: [],
         },
         elasticsearch: {
           component_template: [],
@@ -395,6 +398,7 @@ describe('storedPackagePoliciesToAgentPermissions()', () => {
           security_rule: [],
           ml_module: [],
           tag: [],
+          osquery_pack_asset: [],
         },
         elasticsearch: {
           component_template: [],

x-pack/plugins/osquery/common/types.ts

@@ -9,6 +9,7 @@ import { PackagePolicy, PackagePolicyInput, PackagePolicyInputStream } from '../
 
 export const savedQuerySavedObjectType = 'osquery-saved-query';
 export const packSavedObjectType = 'osquery-pack';
+export const packAssetSavedObjectType = 'osquery-pack-asset';
 export const usageMetricSavedObjectType = 'osquery-manager-usage-metric';
 export type SavedObjectType =
   | 'osquery-saved-query'
@@ -68,4 +69,5 @@ export interface OsqueryManagerPackagePolicyInput extends Omit<PackagePolicyInpu
 
 export interface OsqueryManagerPackagePolicy extends Omit<PackagePolicy, 'inputs'> {
   inputs: OsqueryManagerPackagePolicyInput[];
+  read_only?: boolean;
 }

x-pack/plugins/osquery/public/assets/constants.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const INTEGRATION_ASSETS_STATUS_ID = 'integrationAssetsStatus';

x-pack/plugins/osquery/public/assets/use_assets_status.ts

@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SavedObject } from 'kibana/public';
+import { useQuery } from 'react-query';
+import { useKibana } from '../common/lib/kibana';
+import { INTEGRATION_ASSETS_STATUS_ID } from './constants';
+
+export const useAssetsStatus = () => {
+  const { http } = useKibana().services;
+
+  return useQuery<{ install: SavedObject[]; update: SavedObject[]; upToDate: SavedObject[] }>(
+    [INTEGRATION_ASSETS_STATUS_ID],
+    () => http.get('/internal/osquery/assets'),
+    {
+      keepPreviousData: true,
+    }
+  );
+};

x-pack/plugins/osquery/public/assets/use_import_assets.ts

@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useMutation, useQueryClient } from 'react-query';
+import { useKibana } from '../common/lib/kibana';
+import { useErrorToast } from '../common/hooks/use_error_toast';
+import { PACKS_ID } from '../packs/constants';
+import { INTEGRATION_ASSETS_STATUS_ID } from './constants';
+
+interface UseImportAssetsProps {
+  successToastText: string;
+}
+
+export const useImportAssets = ({ successToastText }: UseImportAssetsProps) => {
+  const queryClient = useQueryClient();
+  const {
+    http,
+    notifications: { toasts },
+  } = useKibana().services;
+  const setErrorToast = useErrorToast();
+
+  return useMutation(
+    () =>
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      http.post<any>('/internal/osquery/assets/update'),
+    {
+      onSuccess: () => {
+        setErrorToast();
+        queryClient.invalidateQueries(PACKS_ID);
+        queryClient.invalidateQueries(INTEGRATION_ASSETS_STATUS_ID);
+        toasts.addSuccess(successToastText);
+      },
+      onError: (error) => {
+        setErrorToast(error);
+      },
+    }
+  );
+};

x-pack/plugins/osquery/public/packs/active_state_switch.tsx

@@ -17,6 +17,7 @@ import { useAgentPolicies } from '../agent_policies/use_agent_policies';
 import { ConfirmDeployAgentPolicyModal } from './form/confirmation_modal';
 import { useErrorToast } from '../common/hooks/use_error_toast';
 import { useUpdatePack } from './use_update_pack';
+import { PACKS_ID } from './constants';
 
 const StyledEuiLoadingSpinner = styled(EuiLoadingSpinner)`
   margin-right: ${({ theme }) => theme.eui.paddingSizes.s};
@@ -55,7 +56,7 @@ const ActiveStateSwitchComponent: React.FC<ActiveStateSwitchProps> = ({ item })
     options: {
       // @ts-expect-error update types
       onSuccess: (response) => {
-        queryClient.invalidateQueries('packList');
+        queryClient.invalidateQueries(PACKS_ID);
         setErrorToast();
         toasts.addSuccess(
           response.attributes.enabled

x-pack/plugins/osquery/public/packs/add_pack_button.tsx

@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { EuiButton, EuiButtonProps } from '@elastic/eui';
+import { useKibana, useRouterNavigate } from '../common/lib/kibana';
+
+interface AddPackButtonComponentProps {
+  fill?: EuiButtonProps['fill'];
+}
+
+const AddPackButtonComponent: React.FC<AddPackButtonComponentProps> = ({ fill = true }) => {
+  const permissions = useKibana().services.application.capabilities.osquery;
+  const newQueryLinkProps = useRouterNavigate('packs/add');
+
+  return (
+    <EuiButton
+      fill={!!fill}
+      {...newQueryLinkProps}
+      iconType="plusInCircle"
+      isDisabled={!permissions.writePacks}
+    >
+      <FormattedMessage id="xpack.osquery.packList.addPackButtonLabel" defaultMessage="Add pack" />
+    </EuiButton>
+  );
+};
+
+export const AddPackButton = React.memo(AddPackButtonComponent);

x-pack/plugins/osquery/public/packs/form/index.tsx

@@ -51,6 +51,7 @@ interface PackFormProps {
 }
 
 const PackFormComponent: React.FC<PackFormProps> = ({ defaultValue, editMode = false }) => {
+  const isReadOnly = !!defaultValue?.read_only;
   const [showConfirmationModal, setShowConfirmationModal] = useState(false);
   const handleHideConfirmationModal = useCallback(() => setShowConfirmationModal(false), []);
 
@@ -183,18 +184,20 @@ const PackFormComponent: React.FC<PackFormProps> = ({ defaultValue, editMode = f
     setShowConfirmationModal(false);
   }, [submit]);
 
+  const euiFieldProps = useMemo(() => ({ isDisabled: isReadOnly }), [isReadOnly]);
+
   return (
     <>
       <Form form={form}>
         <EuiFlexGroup>
           <EuiFlexItem>
-            <CommonUseField path="name" />
+            <CommonUseField path="name" euiFieldProps={euiFieldProps} />
           </EuiFlexItem>
         </EuiFlexGroup>
 
         <EuiFlexGroup>
           <EuiFlexItem>
-            <CommonUseField path="description" />
+            <CommonUseField path="description" euiFieldProps={euiFieldProps} />
           </EuiFlexItem>
         </EuiFlexGroup>
 
@@ -213,6 +216,7 @@ const PackFormComponent: React.FC<PackFormProps> = ({ defaultValue, editMode = f
           path="queries"
           component={QueriesField}
           handleNameChange={handleNameChange}
+          euiFieldProps={euiFieldProps}
         />
 
         <CommonUseField path="enabled" component={GhostFormField} />