elasticctl-api 0.9.0

Typed detection-rule model and endpoint wrappers for Elastic Security.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

//! Alert state re-checks.

use super::*;
use crate::{Observed, Preconditions};

/// The alert state needed for a re-check.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AlertFacet {
    /// Compare workflow status.
    Status,
    /// Compare presence only.
    Presence,
}

/// Read alert states by ID, returning absent state for missing alerts.
pub async fn observe_alerts(
    t: &Transport,
    ids: &[String],
    facet: AlertFacet,
) -> Result<Preconditions> {
    super::require_targets(ids)?;
    let mut unique = Vec::with_capacity(ids.len());
    for id in ids {
        if !unique.contains(id) {
            unique.push(id.clone());
        }
    }
    let page = alerts::search(t, &super::resolve_body(&unique)).await?;
    Ok(Preconditions(
        unique
            .into_iter()
            .map(|id| {
                let state = page.hits.iter().find(|hit| hit.id == id).map(|hit| {
                    super::observed::alert_state(super::workflow_status(&hit.source), facet)
                });
                Observed {
                    object: "alert",
                    id,
                    state,
                }
            })
            .collect(),
    ))
}