Skip to content

Commit ea310a7

Browse files
JordanShJordanSh
authored
Readiness tasks validation and basic UI and Fetch service (#234316)
1 parent 9e2261d commit ea310a7

File tree

16 files changed

+995
-32
lines changed

16 files changed

+995
-32
lines changed

‎x-pack/solutions/security/packages/siem-readiness/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,5 @@
77

88
export type * from './src/types';
99
export * from './src/constants';
10+
export * from './src/readiness_tasks';
1011
export * from './src/use_log_readiness_task';

‎x-pack/solutions/security/packages/siem-readiness/src/constants.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,4 @@
55
* 2.0.
66
*/
77

8-
export const SIEM_READINESS_PACKAGE_NAME = '@kbn/siem-readiness';
98
export const POST_SIEM_READINESS_TASK_API_PATH = '/api/siem_readiness/post_task';

‎x-pack/solutions/security/packages/siem-readiness/src/readiness_tasks.ts‎

Lines changed: 355 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,355 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
import { i18n } from '@kbn/i18n';
9+
10+
export type ReadinessTaskId =
11+
| 'enable-endpoint-visibility'
12+
| 'ingest-cloud-audit-logs'
13+
| 'ingest-asset-inventory'
14+
| 'enable-kubernetes-container-logs'
15+
| 'ingest-all-cloud-logs-inventory'
16+
| 'enable-mitre-aligned-detection-rules'
17+
| 'view-detection-coverage-mitre'
18+
| 'add-threat-intel-feeds'
19+
| 'customize-create-rules'
20+
| 'use-attack-discovery'
21+
| 'maintain-rule-coverage'
22+
| 'enable-cspm-on-all-clouds'
23+
| 'investigate-alert-using-timeline'
24+
| 'use-ai-assistant-for-alert-root-cause'
25+
| 'add-external-connectors'
26+
| 'automate-response-rules-case-creation'
27+
| 'create-manage-case-workflows'
28+
| 'complete-automated-cases';
29+
30+
export interface ReadinessTaskConfig {
31+
id: ReadinessTaskId;
32+
title: string;
33+
description: string;
34+
pillar: 'visibility' | 'detection' | 'response';
35+
order: number;
36+
meta?: Record<string, unknown>;
37+
}
38+
39+
// Used to define and validate readiness tasks structure
40+
export const READINESS_TASKS: ReadinessTaskConfig[] = [
41+
/**
42+
* ### Visibility Pillar Tasks ###
43+
*/
44+
{
45+
// Completion: Elastic Defend agent running (healthy) or 3rd-party endpoint logs successfully ingested
46+
id: 'enable-endpoint-visibility',
47+
title: i18n.translate('xpack.securitySolution.readinessTask.enableEndpointVisibility.title', {
48+
defaultMessage: 'Enable Endpoint Visibility',
49+
}),
50+
description: i18n.translate(
51+
'xpack.securitySolution.readinessTask.enableEndpointVisibility.description',
52+
{
53+
defaultMessage:
54+
'Choose one of the following: (1) Deploy Elastic Defend to gain rich host and process telemetry, or (2) Ingest logs from existing endpoint protection tools (e.g. CrowdStrike, SentinelOne, Microsoft Defender) using supported integrations. This enables foundational endpoint visibility for investigation and detection',
55+
}
56+
),
57+
pillar: 'visibility',
58+
order: 1,
59+
},
60+
{
61+
// Completion: Events successfully ingested from at least one cloud provider (AWS/GCP/Azure/On-Prem)
62+
id: 'ingest-cloud-audit-logs',
63+
title: i18n.translate('xpack.securitySolution.readinessTask.ingestCloudAuditLogs.title', {
64+
defaultMessage: 'Ingest cloud/audit logs (AWS, GCP, Azure, On prem)',
65+
}),
66+
description: i18n.translate(
67+
'xpack.securitySolution.readinessTask.ingestCloudAuditLogs.description',
68+
{
69+
defaultMessage:
70+
'Set up integrations for AWS CloudTrail, Azure Activity, GCP Admin Activity, or on-prem audit logs',
71+
}
72+
),
73+
pillar: 'visibility',
74+
order: 2,
75+
},
76+
{
77+
// Completion: Cloud asset inventory indexed or visible in Inventory dashboard
78+
id: 'ingest-asset-inventory',
79+
title: i18n.translate('xpack.securitySolution.readinessTask.ingestAssetInventory.title', {
80+
defaultMessage: 'Ingest asset inventory',
81+
}),
82+
description: i18n.translate(
83+
'xpack.securitySolution.readinessTask.ingestAssetInventory.description',
84+
{
85+
defaultMessage:
86+
'Automatically pull and index asset metadata from cloud (via integrations) or via endpoint agent. View in Asset Inventory dashboard',
87+
}
88+
),
89+
pillar: 'visibility',
90+
order: 6,
91+
},
92+
{
93+
// Completion: Ingested logs from container/k8s integration
94+
id: 'enable-kubernetes-container-logs',
95+
title: i18n.translate(
96+
'xpack.securitySolution.readinessTask.enableKubernetesContainerLogs.title',
97+
{
98+
defaultMessage: 'Enable Kubernetes or container logs',
99+
}
100+
),
101+
description: i18n.translate(
102+
'xpack.securitySolution.readinessTask.enableKubernetesContainerLogs.description',
103+
{
104+
defaultMessage:
105+
'Set up the Kubernetes integration for kubernetes.audit_logs and/or container runtime logs.',
106+
}
107+
),
108+
pillar: 'visibility',
109+
order: 10,
110+
},
111+
{
112+
// Completion: Logs + asset data present from AWS, Azure, and GCP (dynamic based on Asset Inventory/Entity store)
113+
id: 'ingest-all-cloud-logs-inventory',
114+
title: i18n.translate(
115+
'xpack.securitySolution.readinessTask.ingestAllCloudLogsInventory.title',
116+
{
117+
defaultMessage:
118+
'Ingest all 3 major cloud providers (AWS, Azure, GCP) logs and Cloud Asset Inventory',
119+
}
120+
),
121+
description: i18n.translate(
122+
'xpack.securitySolution.readinessTask.ingestAllCloudLogsInventory.description',
123+
{
124+
defaultMessage:
125+
'Onboard audit + inventory data for AWS, Azure, and GCP to show multi-cloud coverage.',
126+
}
127+
),
128+
pillar: 'visibility',
129+
order: 15,
130+
},
131+
132+
/**
133+
* ### Detection Pillar Tasks ###
134+
*/
135+
{
136+
// Completion: High-severity MITRE rules enabled and firing
137+
id: 'enable-mitre-aligned-detection-rules',
138+
title: i18n.translate(
139+
'xpack.securitySolution.readinessTask.enableMitreAlignedDetectionRules.title',
140+
{
141+
defaultMessage: 'Enable MITRE-aligned detection rules',
142+
}
143+
),
144+
description: i18n.translate(
145+
'xpack.securitySolution.readinessTask.enableMitreAlignedDetectionRules.description',
146+
{
147+
defaultMessage:
148+
"Enable Elastic's prebuilt rules mapped to MITRE ATT&CK. Evaluate rule coverage across key tactics.",
149+
}
150+
),
151+
pillar: 'detection',
152+
order: 3,
153+
},
154+
{
155+
// Completion: Coverage page visited
156+
id: 'view-detection-coverage-mitre',
157+
title: i18n.translate('xpack.securitySolution.readinessTask.viewDetectionCoverageMitre.title', {
158+
defaultMessage: 'View detection coverage across MITRE matrix',
159+
}),
160+
description: i18n.translate(
161+
'xpack.securitySolution.readinessTask.viewDetectionCoverageMitre.description',
162+
{
163+
defaultMessage:
164+
'Show tactics and techniques covered by active rules in a heatmap. Track posture',
165+
}
166+
),
167+
pillar: 'detection',
168+
order: 4,
169+
},
170+
{
171+
// Completion: Threat feed events ingested and alerts enriched
172+
id: 'add-threat-intel-feeds',
173+
title: i18n.translate('xpack.securitySolution.readinessTask.addThreatIntelFeeds.title', {
174+
defaultMessage: 'Add threat intelligence feeds',
175+
}),
176+
description: i18n.translate(
177+
'xpack.securitySolution.readinessTask.addThreatIntelFeeds.description',
178+
{
179+
defaultMessage:
180+
'Integrate threat intel (Abuse.ch, etc.) to enrich alerts and correlate known IOCs.',
181+
}
182+
),
183+
pillar: 'detection',
184+
order: 7,
185+
},
186+
{
187+
// Completion: A new or edited rule has been enabled
188+
id: 'customize-create-rules',
189+
title: i18n.translate('xpack.securitySolution.readinessTask.customizeCreateRules.title', {
190+
defaultMessage: 'Customize or create new detection rules',
191+
}),
192+
description: i18n.translate(
193+
'xpack.securitySolution.readinessTask.customizeCreateRules.description',
194+
{
195+
defaultMessage:
196+
'Modify a rule or author a new one using KQL/ES QL. Demonstrates SOC maturity.',
197+
}
198+
),
199+
pillar: 'detection',
200+
order: 8,
201+
},
202+
{
203+
// Completion: Activity like running Attack Discovery multiple times or scheduling action on the Attack Discovery page
204+
id: 'use-attack-discovery',
205+
title: i18n.translate('xpack.securitySolution.readinessTask.useAttackDiscovery.title', {
206+
defaultMessage: 'Use Attack Discovery to trace MITRE-mapped threat activity',
207+
}),
208+
description: i18n.translate(
209+
'xpack.securitySolution.readinessTask.useAttackDiscovery.description',
210+
{
211+
defaultMessage:
212+
'Visualize threats in MITRE ATT&CK graph via Attack Discovery. Correlates alerts to kill chain.',
213+
}
214+
),
215+
pillar: 'detection',
216+
order: 11,
217+
},
218+
{
219+
// Completion: >90% of relevant MITRE techniques covered by tuned rules
220+
id: 'maintain-rule-coverage',
221+
title: i18n.translate('xpack.securitySolution.readinessTask.maintainRuleCoverage.title', {
222+
defaultMessage: 'Maintain >90% rule coverage',
223+
}),
224+
description: i18n.translate(
225+
'xpack.securitySolution.readinessTask.maintainRuleCoverage.description',
226+
{
227+
defaultMessage: 'Ensure high-severity rules are enabled',
228+
}
229+
),
230+
pillar: 'detection',
231+
order: 13,
232+
},
233+
{
234+
// Completion: CSPM enabled for AWS, Azure, and GCP, findings/dashboard pages visited (dynamic based on CSP footprint)
235+
id: 'enable-cspm-on-all-clouds',
236+
title: i18n.translate('xpack.securitySolution.readinessTask.enableCspmOnAllClouds.title', {
237+
defaultMessage: 'Enable CSPM on all 3 major cloud providers (AWS, Azure, GCP)',
238+
}),
239+
description: i18n.translate(
240+
'xpack.securitySolution.readinessTask.enableCspmOnAllClouds.description',
241+
{
242+
defaultMessage:
243+
'Activate cloud security posture monitoring (CSPM) for AWS, Azure, GCP. Review active findings.',
244+
}
245+
),
246+
pillar: 'detection',
247+
order: 16,
248+
},
249+
250+
/**
251+
* ### Response Pillar Tasks ###
252+
*/
253+
{
254+
// Completion: Alert annotated, tagged, or enriched in Timeline
255+
id: 'investigate-alert-using-timeline',
256+
title: i18n.translate(
257+
'xpack.securitySolution.readinessTask.investigateAlertUsingTimeline.title',
258+
{
259+
defaultMessage: 'Investigate an alert using Timeline',
260+
}
261+
),
262+
description: i18n.translate(
263+
'xpack.securitySolution.readinessTask.investigateAlertUsingTimeline.description',
264+
{
265+
defaultMessage: 'Triage an alert using the Timeline view. Add evidence and enrich context.',
266+
}
267+
),
268+
pillar: 'response',
269+
order: 5,
270+
},
271+
{
272+
// Completion: Summary generated on Alert - AI assistant workflow
273+
id: 'use-ai-assistant-for-alert-root-cause',
274+
title: i18n.translate(
275+
'xpack.securitySolution.readinessTask.useAiAssistantForAlertRootCause.title',
276+
{
277+
defaultMessage: 'Use AI Assistant to summarize alert context or identify root cause',
278+
}
279+
),
280+
description: i18n.translate(
281+
'xpack.securitySolution.readinessTask.useAiAssistantForAlertRootCause.description',
282+
{
283+
defaultMessage:
284+
'Ask AI to generate a quick summary or root cause for an alert. Prompt: "Summarize the root cause for this alert"',
285+
}
286+
),
287+
pillar: 'response',
288+
order: 9,
289+
},
290+
{
291+
// Completion: Jira/Slack/ServiceNow/SentinelOne/Crowdstrike connector tested and in use
292+
id: 'add-external-connectors',
293+
title: i18n.translate('xpack.securitySolution.readinessTask.addExternalConnectors.title', {
294+
defaultMessage: 'Add external connectors (Jira, Slack, ServiceNow)',
295+
}),
296+
description: i18n.translate(
297+
'xpack.securitySolution.readinessTask.addExternalConnectors.description',
298+
{
299+
defaultMessage: 'Configure Jira, Slack, or ServiceNow for alert or case forwarding.',
300+
}
301+
),
302+
pillar: 'response',
303+
order: 12,
304+
},
305+
{
306+
// Completion: At least one rule creates a case or sends notification automatically
307+
id: 'automate-response-rules-case-creation',
308+
title: i18n.translate(
309+
'xpack.securitySolution.readinessTask.automateResponseRulesCaseCreation.title',
310+
{
311+
defaultMessage: 'Automate response rules or case creation for alerts',
312+
}
313+
),
314+
description: i18n.translate(
315+
'xpack.securitySolution.readinessTask.automateResponseRulesCaseCreation.description',
316+
{
317+
defaultMessage:
318+
'Use rule actions or case templates to automatically trigger cases or actions',
319+
}
320+
),
321+
pillar: 'response',
322+
order: 14,
323+
},
324+
{
325+
// Completion: Multiple alerts triaged and closed via case workflow
326+
id: 'create-manage-case-workflows',
327+
title: i18n.translate('xpack.securitySolution.readinessTask.createManageCaseWorkflows.title', {
328+
defaultMessage: 'Create and manage case workflows',
329+
}),
330+
description: i18n.translate(
331+
'xpack.securitySolution.readinessTask.createManageCaseWorkflows.description',
332+
{
333+
defaultMessage:
334+
'Open a case, assign it, and link alerts to it. Manages SOC workflow maturity.',
335+
}
336+
),
337+
pillar: 'response',
338+
order: 17,
339+
},
340+
{
341+
// Completion: 3+ cases with automation and alert linkages resolved
342+
id: 'complete-automated-cases',
343+
title: i18n.translate('xpack.securitySolution.readinessTask.completeAutomatedCases.title', {
344+
defaultMessage: 'Complete 3+ cases with automation and external sharing',
345+
}),
346+
description: i18n.translate(
347+
'xpack.securitySolution.readinessTask.completeAutomatedCases.description',
348+
{
349+
defaultMessage: 'Demonstrate workflow maturity by automating and resolving multiple cases.',
350+
}
351+
),
352+
pillar: 'response',
353+
order: 18,
354+
},
355+
] as const;

‎x-pack/solutions/security/packages/siem-readiness/src/types.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,6 @@
77

88
export interface SiemReadinessTask {
99
task_id: string;
10-
status: 'complete' | 'incomplete';
11-
meta: Record<string, unknown>;
10+
status: 'completed' | 'incomplete';
11+
meta?: Record<string, unknown>;
1212
}

0 commit comments

Comments
 (0)