D3 Security Sub Actions Connector

[stephmilovic]

Summary

This code comes from a PR that was originally opened by the team at D3 Security. In an effort to get this merged, I have branched off of that PR and we will go forward with this one. This PR takes D3's connector code, refactors to use sub actions, and adds the appropriate tests and documentation.

Testing

Credentials

1. Run kibana with this es server configured in kibana.dev.yml. This is the server I have set up with the D3 instance already. There is some configuration you need to do in D3 to establish the connection, so using this server will allow you to skip that step.
2. Create D3 Security connectors with above credentials
3. Test the connector by using the "Test" tab in connectors, or by running a rule that triggers a D3 Security action.
   
4. Confirm results in D3 interface. Should look like:
   
   

More info

Below is the original PR description:

Introduces a new built-in action type and sends the ElasticSearch alerts to D3 Security SOAR for incident response, workflow automation and deep investigation. This integrated alert action allows you to create Events or trigger Playbook workflow actions automatically in the D3 Security SOAR platform.

The new action type and the action connector with D3 Security SOAR are as follows:

and action params form available in Create Alert form:

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 40848f4

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
stackConnectors	195	202	+7

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
stackConnectors	440.0KB	449.8KB	+9.8KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
stackConnectors	33.4KB	34.7KB	+1.2KB

Unknown metric groups

async chunk count

id	before	after	diff
stackConnectors	67	71	+4

ESLint disabled line counts

id	before	after	diff
enterpriseSearch	19	21	+2
securitySolution	415	419	+4
stackConnectors	87	90	+3
total			+9

Total ESLint disabled count

id	before	after	diff
enterpriseSearch	20	22	+2
securitySolution	499	503	+4
stackConnectors	91	94	+3
total			+9

History

• 💔 Build #131541 failed 6d261ff
• 💚 Build #131017 succeeded 9885d3f
• 💚 Build #130649 succeeded 750b69e
• 💔 Build #130633 failed 9e8288a
• 💔 Build #130614 failed 7055370

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[semd]

Tested locally, the connector works as expected. When testing the connector on the management page it works well, events are received correctly on the D3 side. And when attached to a rule the execution alerts are also received properly with all the expected values.

It is a bit weird that the "Event Type" and "Severity" params can be empty, they are set to undefined on the D3 side, but as per the Schema they defined, it seems this is what they want.

code LGTM.

Thanks Steph! 🚀

[cnasikas]

Code LGTM!