Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Int 11348 stop getting machine details #43

Merged
merged 3 commits into from
Jul 30, 2024
+20 −69
Merged

Int 11348 stop getting machine details #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
aef0832
Stop retrieving machine details
Gonzalo-Avalos-Ribas Jul 30, 2024
7e15234
Format
Gonzalo-Avalos-Ribas Jul 30, 2024
2bcb393
fix tests
Gonzalo-Avalos-Ribas Jul 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/steps/ms-defender/client.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ test('iterateMachinesPagination', async () => {
createMockIntegrationLogger(),
integrationConfig,
);
let spy = jest.spyOn(client as any, 'callApiWithRetry');
const spy = jest.spyOn(client as any, 'callApiWithRetry');
const machines: Machine[] = [];
await client.iterateMachines((machine) => {
machines.push(machine);
Expand Down
4 changes: 2 additions & 2 deletions src/steps/ms-defender/client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ import { GraphClient, GraphClientResponse } from '../../ms-graph/client';
import { IntegrationLogger } from '@jupiterone/integration-sdk-core';
import { ClientConfig } from '../../ms-graph/types';

const ITEMS_PER_PAGE = 200;
const ITEMS_PER_PAGE = 500;
export class DefenderClient extends GraphClient {
constructor(logger: IntegrationLogger, config: ClientConfig) {
super(logger, { ...config, isDefenderApi: true });
Expand Down Expand Up @@ -68,7 +68,7 @@ export class DefenderClient extends GraphClient {
private async iterateSecurityResource<T>({
resourceUrl,
callback,
limit = 50,
limit = ITEMS_PER_PAGE,
}: {
resourceUrl: string;
callback: (item: T) => void | Promise<void>;
Expand Down
9 changes: 0 additions & 9 deletions src/steps/ms-defender/machine/__snapshots__/index.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ exports[`#fetchEndpoints 1`] = `
{
"name": "default",
"rawData": {
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
"aadDeviceId": null,
"agentVersion": "30.123032.19864.0",
"computerDnsName": "VM1.oipfwnijg2hexlv4f1mw1ugjgg.bx.internal.cloudapp.net",
Expand Down Expand Up @@ -141,7 +140,6 @@ exports[`#fetchEndpoints 1`] = `
{
"name": "default",
"rawData": {
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
"aadDeviceId": null,
"agentVersion": "30.123102.3.0",
"computerDnsName": "gaston-ivm-test.us-central1-a.c.j1-gc-integration-dev-v3.internal",
Expand Down Expand Up @@ -269,7 +267,6 @@ exports[`#fetchEndpoints 1`] = `
{
"name": "default",
"rawData": {
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
"aadDeviceId": null,
"agentVersion": "30.124012.1.0",
"computerDnsName": "sonarqube.us-central1-a.c.j1-gc-integration-dev-v3.internal",
Expand Down Expand Up @@ -423,7 +420,6 @@ exports[`#fetchEndpoints 1`] = `
{
"name": "default",
"rawData": {
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
"aadDeviceId": null,
"agentVersion": "30.123062.10.0",
"computerDnsName": "instance-1.us-central1-a.c.j1-gc-integration-dev-v3.internal",
Expand Down Expand Up @@ -551,7 +547,6 @@ exports[`#fetchEndpoints 1`] = `
{
"name": "default",
"rawData": {
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
"aadDeviceId": null,
"agentVersion": "10.8560.20348.1906",
"computerDnsName": "int-cmdc01.contoso.com",
Expand Down Expand Up @@ -644,7 +639,6 @@ exports[`#fetchEndpoints 1`] = `
{
"name": "default",
"rawData": {
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
"aadDeviceId": null,
"agentVersion": "30.123032.19864.0",
"computerDnsName": "gonzalo.oipfwnijg2hexlv4f1mw1ugjgg.bx.internal.cloudapp.net",
Expand Down Expand Up @@ -772,7 +766,6 @@ exports[`#fetchEndpoints 1`] = `
{
"name": "default",
"rawData": {
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
"aadDeviceId": null,
"agentVersion": "30.123032.19864.0",
"computerDnsName": "VMfromsharedimage.oipfwnijg2hexlv4f1mw1ugjgg.bx.internal.cloudapp.net",
Expand Down Expand Up @@ -900,7 +893,6 @@ exports[`#fetchEndpoints 1`] = `
{
"name": "default",
"rawData": {
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
"aadDeviceId": null,
"agentVersion": "30.123032.19864.0",
"computerDnsName": "fromImage.oipfwnijg2hexlv4f1mw1ugjgg.bx.internal.cloudapp.net",
Expand Down Expand Up @@ -1028,7 +1020,6 @@ exports[`#fetchEndpoints 1`] = `
{
"name": "default",
"rawData": {
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
"aadDeviceId": null,
"agentVersion": "30.123032.19864.0",
"computerDnsName": "VMFromImage.oipfwnijg2hexlv4f1mw1ugjgg.bx.internal.cloudapp.net",
Expand Down
4 changes: 2 additions & 2 deletions src/steps/ms-defender/machine/converters.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ import {
RelationshipClass,
parseTimePropertyValue,
} from '@jupiterone/integration-sdk-core';
import { Endpoint, IpAddress, Machine } from '../../../types';
import { IpAddress, Machine } from '../../../types';
import { Entities } from '../../../constants';
import { uniq, compact } from 'lodash';
import { assignEndpoint, assignMachine } from '../../../entities';
Expand Down Expand Up @@ -57,7 +57,7 @@ export function createMachineEntity(data: Machine): Entity {
});
}

export function createEndpointEntity(data: Endpoint): Entity {
export function createEndpointEntity(data: Machine): Entity {
const macAddress = extractUniquePublicMacAddresses(data.ipAddresses);

const ipAddress = compact(
Expand Down
30 changes: 13 additions & 17 deletions src/steps/ms-defender/machine/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,6 @@ export async function fetchEndpoints({
jobState,
logger,
}: IntegrationStepContext): Promise<void> {
const graphClient = new DefenderClient(logger, instance.config);
let numFailedEndpointDetails: number = 0;
let numSuccessfulEndpointDetails: number = 0;
await jobState.iterateEntities(
Expand All @@ -70,26 +69,23 @@ export async function fetchEndpoints({
}

try {
const endpoint = await graphClient.fetchEndpointDetails(machine.id);
if (endpoint) {
const endpointEntity = createEndpointEntity(endpoint);
const endpointEntity = createEndpointEntity(machine);

if (jobState.hasKey(endpoint._key)) return;
if (jobState.hasKey(endpointEntity._key)) return;

await jobState.addEntity(endpointEntity);
await jobState.addEntity(endpointEntity);

await jobState.addRelationship(
createMachineEndpointRelationship({
machineEntity,
endpointEntity,
}),
);
numSuccessfulEndpointDetails++;
}
await jobState.addRelationship(
createMachineEndpointRelationship({
machineEntity,
endpointEntity,
}),
);
numSuccessfulEndpointDetails++;
} catch (err) {
logger.warn(
{ err },
`Could not get endpoint details for machine entity ${machine.id}`,
{ err, machineId: machine.id },
`Could not create endpoint entity`,
);
numFailedEndpointDetails++;
}
Expand All @@ -98,7 +94,7 @@ export async function fetchEndpoints({

if (numFailedEndpointDetails > 0) {
logger.warn({
message: `Unable to fetch all machine endpoint details (success=${numSuccessfulEndpointDetails}, failed=${numFailedEndpointDetails})`,
message: `Unable to create all machine endpoint details (success=${numSuccessfulEndpointDetails}, failed=${numFailedEndpointDetails})`,
code: 'ERROR_FETCH_ENDPOINT_DETAILS',
});
}
Expand Down
39 changes: 1 addition & 38 deletions src/types.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
export interface Machine {
id: string;
name: string;
computerDnsName: string;
firstSeen: string;
lastSeen: string;
Expand Down Expand Up @@ -73,41 +74,3 @@ export interface Vulnerability {
exploitTypes: string[];
exploitUris: string[];
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They even used the same type, endpoint had 'name' and Odatainformation as additional. The name was also on the machine response 🐛

export interface Endpoint {
'@odata.context': string;
id: string;
computerDnsName: string;
name: string;
firstSeen: string;
lastSeen: string;
osPlatform: string;
osVersion: string;
osProcessor: string;
version: string;
lastIpAddress: string;
lastExternalIpAddress: string;
agentVersion: string;
osBuild: number | null;
healthStatus: string;
deviceValue: string;
rbacGroupId: number;
rbacGroupName: string | null;
riskScore: string;
exposureLevel: string;
isAadJoined: boolean;
aadDeviceId: string | null;
machineTags: string[];
defenderAvStatus: string;
onboardingStatus: string;
osArchitecture: string;
managedBy: string;
managedByStatus: string;
ipAddresses?: IpAddress[];
vmMetadata?: {
vmId: string;
cloudProvider: string;
resourceId: string;
subscriptionId: string;
};
}
1 change: 1 addition & 0 deletions test/mocks.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,7 @@ export function getMockMachine(): Machine {
lastSeen: '2022-05-19T08:38:59.1749659Z',
osPlatform: 'Windows10',
osVersion: null,
name: 'machineName',
osProcessor: 'x64',
version: '21H1',
lastIpAddress: '10.1.1.68',
Expand Down
Loading