diff --git a/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts b/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts index 42edbea3394e0..b7be41fb56878 100644 --- a/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts +++ b/x-pack/plugins/osquery/public/agents/use_osquery_policies.ts @@ -19,7 +19,7 @@ export const useOsqueryPolicies = () => { return useQuery( ['osqueryPolicies'], () => - http.get<{ items: Array<{ policy_id: string; policy_ids: string[] }> }>( + http.get<{ items: Array<{ policy_ids: string[] }> }>( '/internal/osquery/fleet_wrapper/package_policies', { version: API_VERSIONS.internal.v1 } ), diff --git a/x-pack/plugins/osquery/server/lib/fleet_integration.ts b/x-pack/plugins/osquery/server/lib/fleet_integration.ts index e94fb23e043e6..1bdc307009376 100644 --- a/x-pack/plugins/osquery/server/lib/fleet_integration.ts +++ b/x-pack/plugins/osquery/server/lib/fleet_integration.ts @@ -21,13 +21,16 @@ export const getPackagePolicyDeleteCallback = ]); await Promise.all( map(deletedOsqueryManagerPolicies, async (deletedOsqueryManagerPolicy) => { - if (deletedOsqueryManagerPolicy.policy_id) { + const policyIds = deletedOsqueryManagerPolicy.policy_ids?.length + ? deletedOsqueryManagerPolicy.policy_ids + : ([deletedOsqueryManagerPolicy.policy_id] as string[]); + if (policyIds[0] !== undefined) { const foundPacks = await packsClient.find({ type: packSavedObjectType, - hasReference: { + hasReference: policyIds.map((policyId: string) => ({ type: LEGACY_AGENT_POLICY_SAVED_OBJECT_TYPE, - id: deletedOsqueryManagerPolicy.policy_id, - }, + id: policyId, + })), perPage: 1000, }); @@ -43,15 +46,13 @@ export const getPackagePolicyDeleteCallback = packSavedObjectType, pack.id, { - shards: filter( - pack.attributes.shards, - (shard) => shard.key !== deletedOsqueryManagerPolicy.policy_id + shards: filter(pack.attributes.shards, (shard) => + policyIds.includes(shard.key) ), }, { - references: filter( - pack.references, - (reference) => reference.id !== deletedOsqueryManagerPolicy.policy_id + references: filter(pack.references, (reference) => + policyIds.includes(reference.id) ), } ) diff --git a/x-pack/plugins/osquery/server/routes/pack/create_pack_route.ts b/x-pack/plugins/osquery/server/routes/pack/create_pack_route.ts index 91baee991c4e0..edb2293d5bce1 100644 --- a/x-pack/plugins/osquery/server/routes/pack/create_pack_route.ts +++ b/x-pack/plugins/osquery/server/routes/pack/create_pack_route.ts @@ -152,9 +152,7 @@ export const createPackRoute = (router: IRouter, osqueryContext: OsqueryAppConte } set(draft, `inputs[0].config.osquery.value.packs.${packSO.attributes.name}`, { - shard: policyShards[packagePolicy.policy_ids[0]] // TODO - ? policyShards[packagePolicy.policy_ids[0]] - : 100, + shard: policyShards[agentPolicyId] ?? 100, queries: convertSOQueriesToPackConfig(queries), }); diff --git a/x-pack/plugins/osquery/server/routes/pack/update_pack_route.ts b/x-pack/plugins/osquery/server/routes/pack/update_pack_route.ts index 451a7daf4e1d6..532aa2c772732 100644 --- a/x-pack/plugins/osquery/server/routes/pack/update_pack_route.ts +++ b/x-pack/plugins/osquery/server/routes/pack/update_pack_route.ts @@ -7,7 +7,7 @@ import moment from 'moment-timezone'; import { set } from '@kbn/safer-lodash-set'; -import { unset, has, difference, filter, find, map, mapKeys, uniq, some, isEmpty } from 'lodash'; +import { unset, has, difference, filter, map, mapKeys, uniq, some, isEmpty } from 'lodash'; import { produce } from 'immer'; import type { PackagePolicy } from '@kbn/fleet-plugin/common'; import { @@ -194,8 +194,9 @@ export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte await Promise.all( policyIds.map((agentPolicyId) => { - const packagePolicy = find(packagePolicies, ['policy_id', agentPolicyId]); - + const packagePolicy = packagePolicies.find((policy) => + policy.policy_ids.includes(agentPolicyId) + ); if (packagePolicy) { return packagePolicyService?.update( internalSavedObjectsClient, @@ -224,7 +225,9 @@ export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte } else { await Promise.all( currentAgentPolicyIds.map((agentPolicyId) => { - const packagePolicy = find(currentPackagePolicies, ['policy_id', agentPolicyId]); + const packagePolicy = currentPackagePolicies.find((policy) => + policy.policy_ids.includes(agentPolicyId) + ); if (!packagePolicy) return; return packagePolicyService?.update( @@ -254,7 +257,9 @@ export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte await Promise.all( agentPolicyIdsToRemove.map((agentPolicyId) => { - const packagePolicy = find(currentPackagePolicies, ['policy_id', agentPolicyId]); + const packagePolicy = currentPackagePolicies.find((policy) => + policy.policy_ids.includes(agentPolicyId) + ); if (packagePolicy) { return packagePolicyService?.update( internalSavedObjectsClient, @@ -276,8 +281,9 @@ export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte await Promise.all( agentPolicyIdsToUpdate.map((agentPolicyId) => { - const packagePolicy = find(packagePolicies, ['policy_id', agentPolicyId]); - + const packagePolicy = packagePolicies.find((policy) => + policy.policy_ids.includes(agentPolicyId) + ); if (packagePolicy) { return packagePolicyService?.update( internalSavedObjectsClient, @@ -296,9 +302,7 @@ export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte draft, `inputs[0].config.osquery.value.packs.${updatedPackSO.attributes.name}`, { - shard: policyShards[packagePolicy.policy_ids[0]] // TODO - ? policyShards[packagePolicy.policy_ids[0]] - : 100, + shard: policyShards[agentPolicyId] ?? 100, queries: convertSOQueriesToPackConfig(updatedPackSO.attributes.queries), } ); @@ -331,9 +335,7 @@ export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte draft, `inputs[0].config.osquery.value.packs.${updatedPackSO.attributes.name}`, { - shard: policyShards[packagePolicy.policy_ids[0]] // TODO - ? policyShards[packagePolicy.policy_ids[0]] - : 100, + shard: policyShards[agentPolicyId] ?? 100, queries: convertSOQueriesToPackConfig(updatedPackSO.attributes.queries), } );