Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add setting to manage policy templates behavior in Kibana #825

Merged
merged 7 commits into from
Oct 28, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions code/go/pkg/validator/validator_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -233,6 +233,12 @@ func TestValidateFile(t *testing.T) {
"found security rule assets in package but security capability is missing",
},
},
"bad_policy_template_behavior": {
"manifest.yml",
[]string{
"field policy_templates_behavior: policy_templates_behavior must be one of the following: \"all\"",
},
},
}

for pkgName, test := range tests {
Expand Down
3 changes: 3 additions & 0 deletions spec/changelog.yml
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@
- description: Add validation rule to ensure security capability is added if there is any security rule asset.
type: enhancement
link: https://github.com/elastic/package-spec/pull/820
- description: Added new policy_templates_behavior setting to manage how to show policy templates to the user in Kibana.
type: enhancement
link: https://github.com/elastic/package-spec/pull/825
- version: 3.3.0
changes:
- description: Add support for content packages.
Expand Down
31 changes: 30 additions & 1 deletion spec/integration/manifest.spec.yml
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added this new setting just for integrations.

Tried to look into kibana's code here: https://github.com/elastic/kibana/blob/e5b0b8108b392dae070b87175cf2d43522576c4d/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/hooks/use_available_packages.tsx#L82

IIUC Kibana just shows different tiles in case of integrations packages. Input packages would just show one tile. Is my understanding correct?

Or, should it be added also for input packages ?

@jen-huang @kpollich

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder why we support multiple policy templates in input packages 🤔 What could be a use case? I think we don't have any input package with more than one. Maybe we should change the spec to be more explicit about this.

Some previous discussion about this here: https://github.com/elastic/package-spec/pull/325/files#r860573848

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At least, currently all input packages defined in the integrations repository have just one policy template.

Forcing input packages to have just one policy template could be done by adding maxItems setting (it could be done in this PR or in a separate PR):

--- spec/input/manifest.spec.yml
+++ spec/input/manifest.spec.yml
@@ -38,6 +38,7 @@ spec:
     policy_templates:
       description: List of policy templates offered by this package.
       type: array
+      maxItems: 1
       items:
         type: object
         additionalProperties: false

What could be a use case?

I was thinking for instance in the "Custom logs" input package, would that make sense to add a new policy template there to read logs from another source? or would it be better to create a new input package?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIUC Kibana just shows different tiles in case of integrations packages. Input packages would just show one tile. Is my understanding correct?

Kibana does not enforce the distinction between integration and input type packages when it comes to displaying the tiles, it only reads the number of policy_templates

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking for instance in the "Custom logs" input package, would that make sense to add a new policy template there to read logs from another source? or would it be better to create a new input package?

Yes, in this case it would be better to create another input package.

Maybe a use case could be to have an input that collects from the same source, but with a different method. But in this case maybe it would be better to do #744.

I would be more leaned towards limiting input packages to a single policy.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As it is not clear whether or not input packages should have a limitation in the number of policy templates, I would suggest not doing that for now.

Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,6 @@ spec:
- organization
- division
- team

icons:
description: List of icons for by this package.
type: array
Expand Down Expand Up @@ -363,6 +362,17 @@ spec:
$ref: "#/definitions/categories"
conditions:
$ref: "#/definitions/conditions"
# requires a conditional JSON schema to update the value depending
# on the policy_templates length
policy_templates_behavior:
description: >
Expected behavior when there are more than one policy template defined.
When set to `combined_policy`, a single policy template is available that
combines all the defined templates. When set to `individual_policies`, all
policies are individually available, but there is no combined policy.
The default value is `all`, where the combined policy template is available
along with the individual policies.
type: string
policy_templates:
description: List of policy templates offered by this package.
type: array
Expand Down Expand Up @@ -487,6 +497,25 @@ spec:
- version
- type
- owner
allOf:
- if:
properties:
policy_templates:
maxItems: 1
then:
properties:
policy_templates_behavior:
enum:
- all
default: all
else:
properties:
policy_templates_behavior:
enum:
- combined_policy
- individual_policies
- all
default: all

# JSON patches for newer versions should be placed on top
versions:
Expand Down
93 changes: 93 additions & 0 deletions test/packages/bad_policy_template_behavior/LICENSE.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,93 @@
Elastic License 2.0

URL: https://www.elastic.co/licensing/elastic-license

## Acceptance

By using the software, you agree to all of the terms and conditions below.

## Copyright License

The licensor grants you a non-exclusive, royalty-free, worldwide,
non-sublicensable, non-transferable license to use, copy, distribute, make
available, and prepare derivative works of the software, in each case subject to
the limitations and conditions below.

## Limitations

You may not provide the software to third parties as a hosted or managed
service, where the service provides users with access to any substantial set of
the features or functionality of the software.

You may not move, change, disable, or circumvent the license key functionality
in the software, and you may not remove or obscure any functionality in the
software that is protected by the license key.

You may not alter, remove, or obscure any licensing, copyright, or other notices
of the licensor in the software. Any use of the licensor’s trademarks is subject
to applicable law.

## Patents

The licensor grants you a license, under any patent claims the licensor can
license, or becomes able to license, to make, have made, use, sell, offer for
sale, import and have imported the software, in each case subject to the
limitations and conditions in this license. This license does not cover any
patent claims that you cause to be infringed by modifications or additions to
the software. If you or your company make any written claim that the software
infringes or contributes to infringement of any patent, your patent license for
the software granted under these terms ends immediately. If your company makes
such a claim, your patent license ends immediately for work on behalf of your
company.

## Notices

You must ensure that anyone who gets a copy of any part of the software from you
also gets a copy of these terms.

If you modify the software, you must include in any modified copies of the
software prominent notices stating that you have modified the software.

## No Other Rights

These terms do not imply any licenses other than those expressly granted in
these terms.

## Termination

If you use the software in violation of these terms, such use is not licensed,
and your licenses will automatically terminate. If the licensor provides you
with a notice of your violation, and you cease all violation of this license no
later than 30 days after you receive that notice, your licenses will be
reinstated retroactively. However, if you violate these terms after such
reinstatement, any additional violation of these terms will cause your licenses
to terminate automatically and permanently.

## No Liability

*As far as the law allows, the software comes as is, without any warranty or
condition, and the licensor will not be liable to you for any damages arising
out of these terms or the use or nature of the software, under any kind of
legal claim.*

## Definitions

The **licensor** is the entity offering these terms, and the **software** is the
software the licensor makes available under these terms, including any portion
of it.

**you** refers to the individual or entity agreeing to these terms.

**your company** is any legal entity, sole proprietorship, or other kind of
organization that you work for, plus all organizations that have control over,
are under the control of, or are under common control with that
organization. **control** means ownership of substantially all the assets of an
entity, or the power to direct its management and policies by vote, contract, or
otherwise. Control can be direct or indirect.

**your licenses** are all the licenses granted to you for the software under
these terms.

**use** means anything you do with the software requiring one of your licenses.

**trademark** means trademarks, service marks, and similar rights.
6 changes: 6 additions & 0 deletions test/packages/bad_policy_template_behavior/changelog.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# newer versions go on top
- version: "0.0.1"
changes:
- description: Initial draft of the package
type: enhancement
link: https://github.com/elastic/integrations/pull/1 # FIXME Replace with the real PR link
84 changes: 84 additions & 0 deletions test/packages/bad_policy_template_behavior/docs/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,84 @@
<!-- Use this template language as a starting point, replacing {placeholder text} with details about the integration. -->
<!-- Find more detailed documentation guidelines in https://github.com/elastic/integrations/blob/main/docs/documentation_guidelines.md -->

# Bad Policy Template Behavior

<!-- The Bad Policy Template Behavior integration allows you to monitor {name of service}. {name of service} is {describe service}.

Use the Bad Policy Template Behavior integration to {purpose}. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference {data stream type} when troubleshooting an issue.

For example, if you wanted to {sample use case} you could {action}. Then you can {visualize|alert|troubleshoot} by {action}. -->

## Data streams

<!-- The Bad Policy Template Behavior integration collects {one|two} type{s} of data streams: {logs and/or metrics}. -->

<!-- If applicable -->
<!-- **Logs** help you keep a record of events happening in {service}.
Log data streams collected by the {name} integration include {sample data stream(s)} and more. See more details in the [Logs](#logs-reference). -->

<!-- If applicable -->
<!-- **Metrics** give you insight into the state of {service}.
Metric data streams collected by the {name} integration include {sample data stream(s)} and more. See more details in the [Metrics](#metrics-reference). -->

<!-- Optional: Any additional notes on data streams -->

## Requirements

You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it.
You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.

<!--
Optional: Other requirements including:
* System compatibility
* Supported versions of third-party products
* Permissions needed
* Anything else that could block a user from successfully using the integration
-->

## Setup

<!-- Any prerequisite instructions -->

For step-by-step instructions on how to set up an integration, see the
[Getting started](https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html) guide.

<!-- Additional set up instructions -->

<!-- If applicable -->
<!-- ## Logs reference -->

<!-- Repeat for each data stream of the current type -->
<!-- ### {Data stream name}

The `{data stream name}` data stream provides events from {source} of the following types: {list types}. -->

<!-- Optional -->
<!-- #### Example

An example event for `{data stream name}` looks as following:

{code block with example} -->

<!-- #### Exported fields

{insert table} -->

<!-- If applicable -->
<!-- ## Metrics reference -->

<!-- Repeat for each data stream of the current type -->
<!-- ### {Data stream name}

The `{data stream name}` data stream provides events from {source} of the following types: {list types}. -->

<!-- Optional -->
<!-- #### Example

An example event for `{data stream name}` looks as following:

{code block with example} -->

<!-- #### Exported fields

{insert table} -->
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
37 changes: 37 additions & 0 deletions test/packages/bad_policy_template_behavior/manifest.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
format_version: 3.3.0
name: bad_policy_template_behavior
title: "Bad Policy Template Behavior"
version: 0.0.1
source:
license: "Elastic-2.0"
description: "Package containing an unnecessary policy template behavior"
type: integration
categories:
- custom
conditions:
kibana:
version: "^8.15.2"
elastic:
subscription: "basic"
screenshots:
- src: /img/sample-screenshot.png
title: Sample screenshot
size: 600x600
type: image/png
icons:
- src: /img/sample-logo.svg
title: Sample logo
size: 32x32
type: image/svg+xml
policy_templates_behavior: combined_only
policy_templates:
- name: sample
title: Sample logs
description: Collect sample logs
inputs:
- type: logfile
title: Collect sample logs from instances
description: Collecting sample logs
owner:
github: elastic/integrations
type: elastic
3 changes: 2 additions & 1 deletion test/packages/good_v3/manifest.yml
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ vars:
title: A URL to get secrets, but not a secret itself.
type: url
show_user: true
policy_templates_behavior: individual_policies
policy_templates:
- name: apache
title: Apache logs and metrics
Expand Down Expand Up @@ -68,7 +69,7 @@ policy_templates:
- http://127.0.0.1
hide_in_deployment_modes:
- agentless
- name: apache
- name: apache-agentless
title: Apache logs and metrics in agentless
description: Collect logs and metrics from Apache instances in agentless
deployment_modes:
Expand Down