"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.getSolutionValues = exports.getReferencesAggregationQuery = exports.getOnlyConnectorsFilter = exports.getOnlyAlertsCommentsFilter = exports.getMaxBucketOnCaseAggregationQuery = exports.getCountsFromBuckets = exports.getCountsAndMaxData = exports.getCountsAggregationQuery = exports.getConnectorsCardinalityAggregationQuery = exports.getBucketFromAggregation = exports.getAttachmentsFrameworkStats = exports.getAggregationsBuckets = exports.findValueInBuckets = void 0; var _lodash = require("lodash"); var _constants = require("../../../common/constants"); var _utils = require("../../client/utils"); /* * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one * or more contributor license agreements. Licensed under the Elastic License * 2.0; you may not use this file except in compliance with the Elastic License * 2.0. */ const getCountsAggregationQuery = savedObjectType => ({ counts: { date_range: { field: `${savedObjectType}.attributes.created_at`, format: 'dd/MM/YYYY', ranges: [{ from: 'now-1d', to: 'now' }, { from: 'now-1w', to: 'now' }, { from: 'now-1M', to: 'now' }] } } }); exports.getCountsAggregationQuery = getCountsAggregationQuery; const getMaxBucketOnCaseAggregationQuery = savedObjectType => ({ references: { nested: { path: `${savedObjectType}.references` }, aggregations: { cases: { filter: { term: { [`${savedObjectType}.references.type`]: _constants.CASE_SAVED_OBJECT } }, aggregations: { ids: { terms: { field: `${savedObjectType}.references.id` } }, max: { max_bucket: { buckets_path: 'ids._count' } } } } } } }); exports.getMaxBucketOnCaseAggregationQuery = getMaxBucketOnCaseAggregationQuery; const getReferencesAggregationQuery = ({ savedObjectType, referenceType, agg = 'terms' }) => ({ references: { nested: { path: `${savedObjectType}.references` }, aggregations: { referenceType: { filter: { term: { [`${savedObjectType}.references.type`]: referenceType } }, aggregations: { referenceAgg: { [agg]: { field: `${savedObjectType}.references.id` } } } } } } }); exports.getReferencesAggregationQuery = getReferencesAggregationQuery; const getConnectorsCardinalityAggregationQuery = () => getReferencesAggregationQuery({ savedObjectType: _constants.CASE_USER_ACTION_SAVED_OBJECT, referenceType: 'action', agg: 'cardinality' }); exports.getConnectorsCardinalityAggregationQuery = getConnectorsCardinalityAggregationQuery; const getCountsFromBuckets = buckets => { var _buckets$2$doc_count, _buckets$, _buckets$1$doc_count, _buckets$2, _buckets$0$doc_count, _buckets$3; return { daily: (_buckets$2$doc_count = buckets === null || buckets === void 0 ? void 0 : (_buckets$ = buckets[2]) === null || _buckets$ === void 0 ? void 0 : _buckets$.doc_count) !== null && _buckets$2$doc_count !== void 0 ? _buckets$2$doc_count : 0, weekly: (_buckets$1$doc_count = buckets === null || buckets === void 0 ? void 0 : (_buckets$2 = buckets[1]) === null || _buckets$2 === void 0 ? void 0 : _buckets$2.doc_count) !== null && _buckets$1$doc_count !== void 0 ? _buckets$1$doc_count : 0, monthly: (_buckets$0$doc_count = buckets === null || buckets === void 0 ? void 0 : (_buckets$3 = buckets[0]) === null || _buckets$3 === void 0 ? void 0 : _buckets$3.doc_count) !== null && _buckets$0$doc_count !== void 0 ? _buckets$0$doc_count : 0 }; }; exports.getCountsFromBuckets = getCountsFromBuckets; const getCountsAndMaxData = async ({ savedObjectsClient, savedObjectType, filter }) => { var _res$aggregations$cou, _res$aggregations, _res$aggregations$cou2, _res$aggregations$ref, _res$aggregations2, _res$aggregations2$re, _res$aggregations2$re2, _res$aggregations2$re3; const res = await savedObjectsClient.find({ page: 0, perPage: 0, filter, type: savedObjectType, aggs: { ...getCountsAggregationQuery(savedObjectType), ...getMaxBucketOnCaseAggregationQuery(savedObjectType) } }); const countsBuckets = (_res$aggregations$cou = (_res$aggregations = res.aggregations) === null || _res$aggregations === void 0 ? void 0 : (_res$aggregations$cou2 = _res$aggregations.counts) === null || _res$aggregations$cou2 === void 0 ? void 0 : _res$aggregations$cou2.buckets) !== null && _res$aggregations$cou !== void 0 ? _res$aggregations$cou : []; const maxOnACase = (_res$aggregations$ref = (_res$aggregations2 = res.aggregations) === null || _res$aggregations2 === void 0 ? void 0 : (_res$aggregations2$re = _res$aggregations2.references) === null || _res$aggregations2$re === void 0 ? void 0 : (_res$aggregations2$re2 = _res$aggregations2$re.cases) === null || _res$aggregations2$re2 === void 0 ? void 0 : (_res$aggregations2$re3 = _res$aggregations2$re2.max) === null || _res$aggregations2$re3 === void 0 ? void 0 : _res$aggregations2$re3.value) !== null && _res$aggregations$ref !== void 0 ? _res$aggregations$ref : 0; return { all: { total: res.total, ...getCountsFromBuckets(countsBuckets), maxOnACase } }; }; exports.getCountsAndMaxData = getCountsAndMaxData; const getBucketFromAggregation = ({ aggs, key }) => { var _get; return (_get = (0, _lodash.get)(aggs, `${key}.buckets`)) !== null && _get !== void 0 ? _get : []; }; exports.getBucketFromAggregation = getBucketFromAggregation; const getSolutionValues = ({ caseAggregations, attachmentAggregations, filesAggregations, owner }) => { var _caseAggregations$own, _caseAggregations$own2, _caseAggregations$own3; const aggregationsBuckets = getAggregationsBuckets({ aggs: caseAggregations, keys: ['totalsByOwner', 'securitySolution.counts', 'observability.counts', 'cases.counts'] }); const totalCasesForOwner = findValueInBuckets(aggregationsBuckets.totalsByOwner, owner); const attachmentsAggsForOwner = attachmentAggregations === null || attachmentAggregations === void 0 ? void 0 : attachmentAggregations[owner]; const fileAttachmentsForOwner = filesAggregations === null || filesAggregations === void 0 ? void 0 : filesAggregations[owner]; return { total: totalCasesForOwner, ...getCountsFromBuckets(aggregationsBuckets[`${owner}.counts`]), ...getAttachmentsFrameworkStats({ attachmentAggregations: attachmentsAggsForOwner, filesAggregations: fileAttachmentsForOwner, totalCasesForOwner }), assignees: { total: (_caseAggregations$own = caseAggregations === null || caseAggregations === void 0 ? void 0 : caseAggregations[owner].totalAssignees.value) !== null && _caseAggregations$own !== void 0 ? _caseAggregations$own : 0, totalWithZero: (_caseAggregations$own2 = caseAggregations === null || caseAggregations === void 0 ? void 0 : caseAggregations[owner].assigneeFilters.buckets.zero.doc_count) !== null && _caseAggregations$own2 !== void 0 ? _caseAggregations$own2 : 0, totalWithAtLeastOne: (_caseAggregations$own3 = caseAggregations === null || caseAggregations === void 0 ? void 0 : caseAggregations[owner].assigneeFilters.buckets.atLeastOne.doc_count) !== null && _caseAggregations$own3 !== void 0 ? _caseAggregations$own3 : 0 } }; }; exports.getSolutionValues = getSolutionValues; const findValueInBuckets = (buckets, value) => { var _buckets$find$doc_cou, _buckets$find; return (_buckets$find$doc_cou = (_buckets$find = buckets.find(({ key }) => key === value)) === null || _buckets$find === void 0 ? void 0 : _buckets$find.doc_count) !== null && _buckets$find$doc_cou !== void 0 ? _buckets$find$doc_cou : 0; }; exports.findValueInBuckets = findValueInBuckets; const getAggregationsBuckets = ({ aggs, keys }) => keys.reduce((acc, key) => { acc[key] = getBucketFromAggregation({ aggs, key }); return acc; }, {}); exports.getAggregationsBuckets = getAggregationsBuckets; const getAttachmentsFrameworkStats = ({ attachmentAggregations, filesAggregations, totalCasesForOwner }) => { if (!attachmentAggregations) { return emptyAttachmentFramework(); } const averageFileSize = getAverageFileSize(filesAggregations); const topMimeTypes = filesAggregations === null || filesAggregations === void 0 ? void 0 : filesAggregations.topMimeTypes; return { attachmentFramework: { externalAttachments: getAttachmentRegistryStats(attachmentAggregations.externalReferenceTypes, totalCasesForOwner), persistableAttachments: getAttachmentRegistryStats(attachmentAggregations.persistableReferenceTypes, totalCasesForOwner), files: getFileAttachmentStats({ registryResults: attachmentAggregations.externalReferenceTypes, averageFileSize, totalCasesForOwner, topMimeTypes }) } }; }; exports.getAttachmentsFrameworkStats = getAttachmentsFrameworkStats; const getAverageFileSize = filesAggregations => { var _filesAggregations$av; if ((filesAggregations === null || filesAggregations === void 0 ? void 0 : (_filesAggregations$av = filesAggregations.averageSize) === null || _filesAggregations$av === void 0 ? void 0 : _filesAggregations$av.value) == null) { return 0; } return Math.round(filesAggregations.averageSize.value); }; const getAttachmentRegistryStats = (registryResults, totalCasesForOwner) => { const stats = []; for (const bucket of registryResults.buckets) { const commonFields = { average: calculateTypePerCaseAverage(bucket.doc_count, totalCasesForOwner), maxOnACase: bucket.references.cases.max.value, total: bucket.doc_count }; stats.push({ type: bucket.key, ...commonFields }); } return stats; }; const calculateTypePerCaseAverage = (typeDocCount, totalCases) => { if (typeDocCount == null || totalCases === 0) { return 0; } return Math.round(typeDocCount / totalCases); }; const getFileAttachmentStats = ({ registryResults, averageFileSize, totalCasesForOwner, topMimeTypes }) => { var _topMimeTypes$buckets, _fileBucket$reference, _fileBucket$doc_count; const fileBucket = registryResults.buckets.find(bucket => bucket.key === _constants.FILE_ATTACHMENT_TYPE); const mimeTypes = (_topMimeTypes$buckets = topMimeTypes === null || topMimeTypes === void 0 ? void 0 : topMimeTypes.buckets.map(mimeType => ({ count: mimeType.doc_count, name: mimeType.key }))) !== null && _topMimeTypes$buckets !== void 0 ? _topMimeTypes$buckets : []; return { averageSize: averageFileSize !== null && averageFileSize !== void 0 ? averageFileSize : 0, average: calculateTypePerCaseAverage(fileBucket === null || fileBucket === void 0 ? void 0 : fileBucket.doc_count, totalCasesForOwner), maxOnACase: (_fileBucket$reference = fileBucket === null || fileBucket === void 0 ? void 0 : fileBucket.references.cases.max.value) !== null && _fileBucket$reference !== void 0 ? _fileBucket$reference : 0, total: (_fileBucket$doc_count = fileBucket === null || fileBucket === void 0 ? void 0 : fileBucket.doc_count) !== null && _fileBucket$doc_count !== void 0 ? _fileBucket$doc_count : 0, topMimeTypes: mimeTypes }; }; const getOnlyAlertsCommentsFilter = () => (0, _utils.buildFilter)({ filters: ['alert'], field: 'type', operator: 'or', type: _constants.CASE_COMMENT_SAVED_OBJECT }); exports.getOnlyAlertsCommentsFilter = getOnlyAlertsCommentsFilter; const getOnlyConnectorsFilter = () => (0, _utils.buildFilter)({ filters: ['connector'], field: 'type', operator: 'or', type: _constants.CASE_USER_ACTION_SAVED_OBJECT }); exports.getOnlyConnectorsFilter = getOnlyConnectorsFilter; const emptyAttachmentFramework = () => ({ attachmentFramework: { persistableAttachments: [], externalAttachments: [], files: emptyFileAttachment() } }); const emptyFileAttachment = () => ({ average: 0, averageSize: 0, maxOnACase: 0, total: 0, topMimeTypes: [] });