import { EcsEventOutcome , EcsEventType } from 'src/core/server' ; import { AuditEvent } from '../../../security/server' ; export enum RuleAuditAction { CREATE = 'rule_create' , GET = 'rule_get' , RESOLVE = 'rule_resolve' , UPDATE = 'rule_update' , UPDATE_API_KEY = 'rule_update_api_key' , ENABLE = 'rule_enable' , DISABLE = 'rule_disable' , DELETE = 'rule_delete' , FIND = 'rule_find' , MUTE = 'rule_mute' , UNMUTE = 'rule_unmute' , MUTE_ALERT = 'rule_alert_mute' , UNMUTE_ALERT = 'rule_alert_unmute' , AGGREGATE = 'rule_aggregate' } type VerbsTuple = [ string , string , string ] ; const eventVerbs = { rule_create : [ 'create' , 'creating' , 'created' ] , rule_get : [ 'access' , 'accessing' , 'accessed' ] , rule_resolve : [ 'access' , 'accessing' , 'accessed' ] , rule_update : [ 'update' , 'updating' , 'updated' ] , rule_update_api_key : [ 'update API key of' , 'updating API key of' , 'updated API key of' ] , rule_enable : [ 'enable' , 'enabling' , 'enabled' ] , rule_disable : [ 'disable' , 'disabling' , 'disabled' ] , rule_delete : [ 'delete' , 'deleting' , 'deleted' ] , rule_find : [ 'access' , 'accessing' , 'accessed' ] , rule_mute : [ 'mute' , 'muting' , 'muted' ] , rule_unmute : [ 'unmute' , 'unmuting' , 'unmuted' ] , rule_alert_mute : [ 'mute alert of' , 'muting alert of' , 'muted alert of' ] , rule_alert_unmute : [ 'unmute alert of' , 'unmuting alert of' , 'unmuted alert of' ] , rule_aggregate : [ 'access' , 'accessing' , 'accessed' ] , } ; const eventTypes = { rule_create : 'creation' , rule_get : 'access' , rule_resolve : 'access' , rule_update : 'change' , rule_update_api_key : 'change' , rule_enable : 'change' , rule_disable : 'change' , rule_delete : 'deletion' , rule_find : 'access' , rule_mute : 'change' , rule_unmute : 'change' , rule_alert_mute : 'change' , rule_alert_unmute : 'change' , rule_aggregate : 'access' , } ; export interface RuleAuditEventParams { action : RuleAuditAction ; outcome ? : EcsEventOutcome ; savedObject ? : NonNullable < AuditEvent [ 'kibana' ] > [ 'saved_object' ] ; error ? : Error ; } export function ruleAuditEvent ( { action , savedObject , outcome , error , } ) { const doc = savedObject ? `rule [id=${ savedObject . id }]` : 'a rule' ; const [ present , progressive , past ] = eventVerbs [ action ] ; const message = error ? `Failed attempt to ${ present } ${ doc }` : outcome === 'unknown' ? `User is ${ progressive } ${ doc }` : `User has ${ past } ${ doc }` ; const type = eventTypes [ action ] ; return { message , event : { action , category : [ 'database' ] , type : type ? [ type ] : undefined , outcome : outcome ?? ( error ? 'failure' : 'success' ) , } , kibana : { saved_object : savedObject , } , error : error && { code : error . name , message : error . message , } , } ; }