diff --git a/src/main/java/org/opensearch/securityanalytics/threatIntel/transport/monitor/TransportIndexThreatIntelMonitorAction.java b/src/main/java/org/opensearch/securityanalytics/threatIntel/transport/monitor/TransportIndexThreatIntelMonitorAction.java index bc0875a13..c4902b99b 100644 --- a/src/main/java/org/opensearch/securityanalytics/threatIntel/transport/monitor/TransportIndexThreatIntelMonitorAction.java +++ b/src/main/java/org/opensearch/securityanalytics/threatIntel/transport/monitor/TransportIndexThreatIntelMonitorAction.java @@ -202,7 +202,8 @@ private Monitor buildThreatIntelMonitor(IndexThreatIntelMonitorRequest request) DocLevelMonitorInput docLevelMonitorInput = new DocLevelMonitorInput( String.format("threat intel input for monitor named %s", request.getMonitor().getName()), request.getMonitor().getIndices(), - Collections.emptyList() // no percolate queries + Collections.emptyList(), // no percolate queries + true ); List perIocTypeScanInputs = request.getMonitor().getPerIocTypeScanInputList().stream().map( it -> new PerIocTypeScanInput(it.getIocType(), it.getIndexToFieldsMap()) @@ -241,8 +242,7 @@ private Monitor buildThreatIntelMonitor(IndexThreatIntelMonitorRequest request) new DataSources(), false, null, - PLUGIN_OWNER_FIELD, - true + PLUGIN_OWNER_FIELD ); } catch (Exception e) { String error = "Error occurred while parsing monitor."; diff --git a/src/main/java/org/opensearch/securityanalytics/transport/TransportIndexDetectorAction.java b/src/main/java/org/opensearch/securityanalytics/transport/TransportIndexDetectorAction.java index 2a77a90b6..75cad056a 100644 --- a/src/main/java/org/opensearch/securityanalytics/transport/TransportIndexDetectorAction.java +++ b/src/main/java/org/opensearch/securityanalytics/transport/TransportIndexDetectorAction.java @@ -772,7 +772,7 @@ private IndexMonitorRequest createDocLevelMonitorRequest(List docLevelQueries.add(docLevelQuery); } docLevelQueries.addAll(threatIntelQueries); - DocLevelMonitorInput docLevelMonitorInput = new DocLevelMonitorInput(detector.getName(), detector.getInputs().get(0).getIndices(), docLevelQueries); + DocLevelMonitorInput docLevelMonitorInput = new DocLevelMonitorInput(detector.getName(), detector.getInputs().get(0).getIndices(), docLevelQueries, true); docLevelMonitorInputs.add(docLevelMonitorInput); List triggers = new ArrayList<>(); @@ -797,7 +797,7 @@ private IndexMonitorRequest createDocLevelMonitorRequest(List detector.getAlertsHistoryIndex(), detector.getAlertsHistoryIndexPattern(), DetectorMonitorConfig.getRuleIndexMappingsByType(), - true), enableDetectorWithDedicatedQueryIndices, null, PLUGIN_OWNER_FIELD, true); + true), enableDetectorWithDedicatedQueryIndices, null, PLUGIN_OWNER_FIELD); return new IndexMonitorRequest(monitorId, SequenceNumbers.UNASSIGNED_SEQ_NO, SequenceNumbers.UNASSIGNED_PRIMARY_TERM, refreshPolicy, restMethod, monitor, null); } @@ -877,7 +877,7 @@ private IndexMonitorRequest createDocLevelMonitorMatchAllRequest( ); docLevelQueries.add(docLevelQuery); - DocLevelMonitorInput docLevelMonitorInput = new DocLevelMonitorInput(detector.getName(), detector.getInputs().get(0).getIndices(), docLevelQueries); + DocLevelMonitorInput docLevelMonitorInput = new DocLevelMonitorInput(detector.getName(), detector.getInputs().get(0).getIndices(), docLevelQueries, false); docLevelMonitorInputs.add(docLevelMonitorInput); List triggers = new ArrayList<>(); @@ -902,7 +902,7 @@ private IndexMonitorRequest createDocLevelMonitorMatchAllRequest( detector.getAlertsHistoryIndex(), detector.getAlertsHistoryIndexPattern(), DetectorMonitorConfig.getRuleIndexMappingsByType(), - true), enableDetectorWithDedicatedQueryIndices, true, PLUGIN_OWNER_FIELD, false); + true), enableDetectorWithDedicatedQueryIndices, true, PLUGIN_OWNER_FIELD); return new IndexMonitorRequest(monitorId, SequenceNumbers.UNASSIGNED_SEQ_NO, SequenceNumbers.UNASSIGNED_PRIMARY_TERM, refreshPolicy, restMethod, monitor, null); } @@ -1078,7 +1078,7 @@ public void onResponse(GetIndexMappingsResponse getIndexMappingsResponse) { detector.getAlertsHistoryIndex(), detector.getAlertsHistoryIndexPattern(), DetectorMonitorConfig.getRuleIndexMappingsByType(), - true), false, null, PLUGIN_OWNER_FIELD, true); + true), false, null, PLUGIN_OWNER_FIELD); listener.onResponse(new IndexMonitorRequest(monitorId, SequenceNumbers.UNASSIGNED_SEQ_NO, SequenceNumbers.UNASSIGNED_PRIMARY_TERM, refreshPolicy, restMethod, monitor, null)); } diff --git a/src/test/java/org/opensearch/securityanalytics/alerts/AlertingServiceTests.java b/src/test/java/org/opensearch/securityanalytics/alerts/AlertingServiceTests.java index 84f70830c..82d6ecc5c 100644 --- a/src/test/java/org/opensearch/securityanalytics/alerts/AlertingServiceTests.java +++ b/src/test/java/org/opensearch/securityanalytics/alerts/AlertingServiceTests.java @@ -97,8 +97,7 @@ public void testGetAlerts_success() { new DataSources(), true, null, - TransportIndexDetectorAction.PLUGIN_OWNER_FIELD, - true + TransportIndexDetectorAction.PLUGIN_OWNER_FIELD ), new DocumentLevelTrigger("trigger_id_1", "my_trigger", "severity_low", List.of(), new Script("")), List.of("finding_id_1"), @@ -134,8 +133,7 @@ public void testGetAlerts_success() { new DataSources(), true, null, - TransportIndexDetectorAction.PLUGIN_OWNER_FIELD, - true + TransportIndexDetectorAction.PLUGIN_OWNER_FIELD ), new DocumentLevelTrigger("trigger_id_1", "my_trigger", "severity_low", List.of(), new Script("")), List.of("finding_id_1"), diff --git a/src/test/java/org/opensearch/securityanalytics/threatIntel/model/monitor/ThreatIntelInputTests.java b/src/test/java/org/opensearch/securityanalytics/threatIntel/model/monitor/ThreatIntelInputTests.java index 3135a2524..d56969de0 100644 --- a/src/test/java/org/opensearch/securityanalytics/threatIntel/model/monitor/ThreatIntelInputTests.java +++ b/src/test/java/org/opensearch/securityanalytics/threatIntel/model/monitor/ThreatIntelInputTests.java @@ -50,7 +50,8 @@ public void testThreatInputSerde() throws IOException { bytes, new DocLevelMonitorInput("threat intel input", List.of("index1", "index2"), - emptyList() + emptyList(), + true ) ) ), @@ -59,8 +60,7 @@ public void testThreatInputSerde() throws IOException { new DataSources(), false, null, - "security_analytics", - true + "security_analytics" ); BytesStreamOutput monitorOut = new BytesStreamOutput(); monitor.writeTo(monitorOut);