wazuh-kibana-app/public/utils/filter-handler.js

/*
 * Wazuh app - Filter handler class
 * Copyright (C) 2015-2019 Wazuh, Inc.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * Find more information about this on the LICENSE file.
 */
export class FilterHandler {
  constructor(pattern) {
    this.pattern = pattern;
  }

  base() {
    return {
      meta: {
        removable: false,
        index: this.pattern,
        negate: false,
        disabled: false,
        alias: null,
        type: 'phrase',
        key: null,
        value: null,
        params: {
          query: null,
          type: 'phrase'
        }
      },
      query: {
        match: null
      },
      $state: {
        store: 'appState'
      }
    };
  }

  agentQuery(agent) {
    const result = this.base();
    result.meta.key = 'agent.id';
    result.meta.value = agent;
    result.meta.params.query = agent;
    result.query.match = {
      'agent.id': {
        query: agent,
        type: 'phrase'
      }
    };
    return result;
  }

  nodeQuery(node) {
    const result = this.base();
    result.meta.key = 'cluster.node';
    result.meta.value = node;
    result.meta.params.query = node;
    result.query.match = {
      'cluster.node': {
        query: node,
        type: 'phrase'
      }
    };
    return result;
  }

  ruleGroupQuery(group) {
    const result = this.base();
    result.meta.key = 'rule.groups';
    result.meta.value = group;
    result.meta.params.query = group;
    result.query.match = {
      'rule.groups': {
        query: group,
        type: 'phrase'
      }
    };
    return result;
  }

  ruleIdQuery(ruleId) {
    const result = this.base();
    result.meta.removable = true;
    result.meta.key = 'rule.id';
    result.meta.value = ruleId;
    result.meta.params.query = ruleId;
    result.query.match = {
      'rule.id': {
        query: ruleId,
        type: 'phrase'
      }
    };
    return result;
  }

  managerQuery(manager, isCluster) {
    const result = this.base();
    result.meta.key = isCluster ? 'cluster.name' : 'manager.name';
    result.meta.value = manager;
    result.meta.params.query = manager;
    result.query.match = isCluster
      ? {
          'cluster.name': {
            query: manager,
            type: 'phrase'
          }
        }
      : {
          'manager.name': {
            query: manager,
            type: 'phrase'
          }
        };
    return result;
  }

  pciQuery() {
    const result = this.base();
    result.meta.type = 'exists';
    result.meta.value = 'exists';
    result.meta.key = 'rule.pci_dss';
    result.exists = {
      field: 'rule.pci_dss'
    };
    delete result.query;
    return result;
  }

  gdprQuery() {
    const result = this.base();
    result.meta.type = 'exists';
    result.meta.value = 'exists';
    result.meta.key = 'rule.gdpr';
    result.exists = {
      field: 'rule.gdpr'
    };
    delete result.query;
    return result;
  }

  hipaaQuery() {
    const result = this.base();
    result.meta.type = 'exists';
    result.meta.value = 'exists';
    result.meta.key = 'rule.hipaa';
    result.exists = {
      field: 'rule.hipaa'
    };
    delete result.query;
    return result;
  }

  nistQuery() {
    const result = this.base();
    result.meta.type = 'exists';
    result.meta.value = 'exists';
    result.meta.key = 'rule.nist_800_53';
    result.exists = {
      field: 'rule.nist_800_53'
    };
    delete result.query;
    return result;
  }
}