WIP: starting updates to TH APIs to support v2 search_jobs #235
Conversation
| if self._query_builder._process_guid is not None: | ||
| args["cb.process_guid"] = self._query_builder._process_guid | ||
| args["fl"] = "*,parent_hash,parent_name,process_cmdline,backend_timestamp,device_external_ip,device_group," \ | ||
| + "device_internal_ip,device_os,process_effective_reputation,process_reputation,ttp" | ||
| args["fields"] = ["*","parent_hash","parent_name","process_cmdline","backend_timestamp","device_external_ip", |
There was a problem hiding this comment.
Isn't the switch from "fl" to "fields" only possible if you switch from the v1 to the v2 route? (or is this one of the reasons why the PR is marked WIP?). I see it updated to v2 in some of routes here in query.py but not in any of the routes in models.py or rest_api.py and wasn't sure if that's a conflict or if it's expected.
There was a problem hiding this comment.
You're right. That's part of the reason it's WIP. I know the code as it sits is not 100% done and I'm still unfamiliar with a lot of this code. While this PR is a start in the right direction, I think I still need a bit of help getting it across the finish line.
|
Hi Jake, please check out #241. I was able to get the new v2 search API working for process searches and retrieval of events from a specific process GUID. |
|
Thanks @crahan. I'll take a look there. Since you've been able to test your changes, I'm going to close this PR for the time being. |
Pull request checklist
Please check if your PR fulfills the following requirements:
Pull request type
Please check the type of change your PR introduces:
What is the ticket or issue number?
Ticket Number: N/A
Issue Number: N/A
Pull Request Description
This is a starting point for upgrading the search jobs APIs to v2. The v2 APIs will benefit from the "Search at Scale" initiative so it'd be nice if we can push towards those APIs. I hit a couple of issues when working on this because I don't have a great environment to test any of these changes. There are a couple of
TODOcomments and I'd love some help to just verify functionality.Does this introduce a breaking change?
How Has This Been Tested?
It has not. Please help me with this!