@Test public void getVulnerabilityTrendTest() throws Exception { String response = "{\"aggregations\":{\"date\":{\"buckets\":[{\"key_as_string\":\"2018-07-25\",\"key\":1532476800000," + "\"doc_count\":51,\"vulns\":{\"value\":11126}}]}}}"; mockStatic(PacHttpUtils.class); when(PacHttpUtils.doHttpPost(anyString(), anyString())).thenReturn(response); ReflectionTestUtils.setField(vulnerabilityRepository, "esUrl", "dummyEsURL"); Map<String, String> filter = new HashMap<>(); filter.put("tags.Application.keyword", "app"); filter.put("tags.Environment.keyword", "env"); assertTrue(vulnerabilityRepository.getVulnerabilityTrend("ag", filter, new Date(), new Date()).size() == 1); }
public List<Map<String, Object>> getVulnerabilityTrend(String assetGroup, Map<String, String> filter, Date from, Date to) throws Exception { List<Map<String, Object>> vulnTrendList = new ArrayList<>(); try { StringBuilder urlToQuery = new StringBuilder(esUrl).append("/assetgroup_stats/count_vuln/_search"); StringBuilder request = new StringBuilder( "{\"size\":0,\"query\":{\"bool\":{\"must\":[{\"match\":{\"ag.keyword\":" + "\"" + assetGroup + "\"}}"); if (filter != null) { Set<String> filterkeys = filter.keySet(); if (filterkeys.contains(TAGS_APPS)) { request.append( ",{ \"match\": {\"tags.Application.keyword\": " + "\"" + filter.get(TAGS_APPS) + "\"}}"); } if (filterkeys.contains("tags.Environment.keyword")) { request.append(",{ \"match\": {\"tags.Environment.keyword\": " + "\"" + filter.get("tags.Environment.keyword") + "\"}}"); } } String gte = null; String lte = null; if (from != null) { gte = "\"gte\": \"" + new SimpleDateFormat("yyyy-MM-dd").format(from) + "\""; } if (to != null) { lte = "\"lte\": \"" + new SimpleDateFormat("yyyy-MM-dd").format(to) + "\""; } if (gte != null && lte != null) { request.append(",{ \"range\": {\"date\": {" + gte + "," + lte + "}}}"); } else if (gte != null) { request.append(",{ \"range\": {\"date\": {" + gte + "}}}"); } else { request.append(",{ \"range\": {\"date\": {" + lte + "}}}"); } request.append( "]}},\"aggs\": {\"date\": {\"date_histogram\": {\"field\": \"date\",\"interval\": \"day\",\"format\": \"yyyy-MM-dd\"},\"aggs\": {\"vulns\": {\"sum\": {\"field\": \"count\"}}}}}}"); String responseJson = PacHttpUtils.doHttpPost(urlToQuery.toString(), request.toString()); JsonParser jsonParser = new JsonParser(); JsonObject resultJson = (JsonObject) jsonParser.parse(responseJson); JsonArray buckets = resultJson.get(AGGREGATIONS).getAsJsonObject().get("date").getAsJsonObject() .get(BUCKETS).getAsJsonArray(); if (buckets.size() > 0) { for (int i = 0; i < buckets.size(); i++) { Map<String, Object> trend = new HashMap<>(); JsonObject bucket = (JsonObject) buckets.get(i); String date = bucket.get("key_as_string").getAsString(); Long count = bucket.get(VULN).getAsJsonObject().get(VALUE).getAsLong(); trend.put("date", date); trend.put(COUNT, count); vulnTrendList.add(trend); } } } catch (Exception e) { LOGGER.error("Error in getVulnerabilityTrend from ES", e); throw e; } return vulnTrendList; }
VulnerabilityRepository implements Constants { public List<Map<String, Object>> getVulnerabilityTrend(String assetGroup, Map<String, String> filter, Date from, Date to) throws Exception { List<Map<String, Object>> vulnTrendList = new ArrayList<>(); try { StringBuilder urlToQuery = new StringBuilder(esUrl).append("/assetgroup_stats/count_vuln/_search"); StringBuilder request = new StringBuilder( "{\"size\":0,\"query\":{\"bool\":{\"must\":[{\"match\":{\"ag.keyword\":" + "\"" + assetGroup + "\"}}"); if (filter != null) { Set<String> filterkeys = filter.keySet(); if (filterkeys.contains(TAGS_APPS)) { request.append( ",{ \"match\": {\"tags.Application.keyword\": " + "\"" + filter.get(TAGS_APPS) + "\"}}"); } if (filterkeys.contains("tags.Environment.keyword")) { request.append(",{ \"match\": {\"tags.Environment.keyword\": " + "\"" + filter.get("tags.Environment.keyword") + "\"}}"); } } String gte = null; String lte = null; if (from != null) { gte = "\"gte\": \"" + new SimpleDateFormat("yyyy-MM-dd").format(from) + "\""; } if (to != null) { lte = "\"lte\": \"" + new SimpleDateFormat("yyyy-MM-dd").format(to) + "\""; } if (gte != null && lte != null) { request.append(",{ \"range\": {\"date\": {" + gte + "," + lte + "}}}"); } else if (gte != null) { request.append(",{ \"range\": {\"date\": {" + gte + "}}}"); } else { request.append(",{ \"range\": {\"date\": {" + lte + "}}}"); } request.append( "]}},\"aggs\": {\"date\": {\"date_histogram\": {\"field\": \"date\",\"interval\": \"day\",\"format\": \"yyyy-MM-dd\"},\"aggs\": {\"vulns\": {\"sum\": {\"field\": \"count\"}}}}}}"); String responseJson = PacHttpUtils.doHttpPost(urlToQuery.toString(), request.toString()); JsonParser jsonParser = new JsonParser(); JsonObject resultJson = (JsonObject) jsonParser.parse(responseJson); JsonArray buckets = resultJson.get(AGGREGATIONS).getAsJsonObject().get("date").getAsJsonObject() .get(BUCKETS).getAsJsonArray(); if (buckets.size() > 0) { for (int i = 0; i < buckets.size(); i++) { Map<String, Object> trend = new HashMap<>(); JsonObject bucket = (JsonObject) buckets.get(i); String date = bucket.get("key_as_string").getAsString(); Long count = bucket.get(VULN).getAsJsonObject().get(VALUE).getAsLong(); trend.put("date", date); trend.put(COUNT, count); vulnTrendList.add(trend); } } } catch (Exception e) { LOGGER.error("Error in getVulnerabilityTrend from ES", e); throw e; } return vulnTrendList; } }
VulnerabilityRepository implements Constants { public List<Map<String, Object>> getVulnerabilityTrend(String assetGroup, Map<String, String> filter, Date from, Date to) throws Exception { List<Map<String, Object>> vulnTrendList = new ArrayList<>(); try { StringBuilder urlToQuery = new StringBuilder(esUrl).append("/assetgroup_stats/count_vuln/_search"); StringBuilder request = new StringBuilder( "{\"size\":0,\"query\":{\"bool\":{\"must\":[{\"match\":{\"ag.keyword\":" + "\"" + assetGroup + "\"}}"); if (filter != null) { Set<String> filterkeys = filter.keySet(); if (filterkeys.contains(TAGS_APPS)) { request.append( ",{ \"match\": {\"tags.Application.keyword\": " + "\"" + filter.get(TAGS_APPS) + "\"}}"); } if (filterkeys.contains("tags.Environment.keyword")) { request.append(",{ \"match\": {\"tags.Environment.keyword\": " + "\"" + filter.get("tags.Environment.keyword") + "\"}}"); } } String gte = null; String lte = null; if (from != null) { gte = "\"gte\": \"" + new SimpleDateFormat("yyyy-MM-dd").format(from) + "\""; } if (to != null) { lte = "\"lte\": \"" + new SimpleDateFormat("yyyy-MM-dd").format(to) + "\""; } if (gte != null && lte != null) { request.append(",{ \"range\": {\"date\": {" + gte + "," + lte + "}}}"); } else if (gte != null) { request.append(",{ \"range\": {\"date\": {" + gte + "}}}"); } else { request.append(",{ \"range\": {\"date\": {" + lte + "}}}"); } request.append( "]}},\"aggs\": {\"date\": {\"date_histogram\": {\"field\": \"date\",\"interval\": \"day\",\"format\": \"yyyy-MM-dd\"},\"aggs\": {\"vulns\": {\"sum\": {\"field\": \"count\"}}}}}}"); String responseJson = PacHttpUtils.doHttpPost(urlToQuery.toString(), request.toString()); JsonParser jsonParser = new JsonParser(); JsonObject resultJson = (JsonObject) jsonParser.parse(responseJson); JsonArray buckets = resultJson.get(AGGREGATIONS).getAsJsonObject().get("date").getAsJsonObject() .get(BUCKETS).getAsJsonArray(); if (buckets.size() > 0) { for (int i = 0; i < buckets.size(); i++) { Map<String, Object> trend = new HashMap<>(); JsonObject bucket = (JsonObject) buckets.get(i); String date = bucket.get("key_as_string").getAsString(); Long count = bucket.get(VULN).getAsJsonObject().get(VALUE).getAsLong(); trend.put("date", date); trend.put(COUNT, count); vulnTrendList.add(trend); } } } catch (Exception e) { LOGGER.error("Error in getVulnerabilityTrend from ES", e); throw e; } return vulnTrendList; }  }
VulnerabilityRepository implements Constants { public List<Map<String, Object>> getVulnerabilityTrend(String assetGroup, Map<String, String> filter, Date from, Date to) throws Exception { List<Map<String, Object>> vulnTrendList = new ArrayList<>(); try { StringBuilder urlToQuery = new StringBuilder(esUrl).append("/assetgroup_stats/count_vuln/_search"); StringBuilder request = new StringBuilder( "{\"size\":0,\"query\":{\"bool\":{\"must\":[{\"match\":{\"ag.keyword\":" + "\"" + assetGroup + "\"}}"); if (filter != null) { Set<String> filterkeys = filter.keySet(); if (filterkeys.contains(TAGS_APPS)) { request.append( ",{ \"match\": {\"tags.Application.keyword\": " + "\"" + filter.get(TAGS_APPS) + "\"}}"); } if (filterkeys.contains("tags.Environment.keyword")) { request.append(",{ \"match\": {\"tags.Environment.keyword\": " + "\"" + filter.get("tags.Environment.keyword") + "\"}}"); } } String gte = null; String lte = null; if (from != null) { gte = "\"gte\": \"" + new SimpleDateFormat("yyyy-MM-dd").format(from) + "\""; } if (to != null) { lte = "\"lte\": \"" + new SimpleDateFormat("yyyy-MM-dd").format(to) + "\""; } if (gte != null && lte != null) { request.append(",{ \"range\": {\"date\": {" + gte + "," + lte + "}}}"); } else if (gte != null) { request.append(",{ \"range\": {\"date\": {" + gte + "}}}"); } else { request.append(",{ \"range\": {\"date\": {" + lte + "}}}"); } request.append( "]}},\"aggs\": {\"date\": {\"date_histogram\": {\"field\": \"date\",\"interval\": \"day\",\"format\": \"yyyy-MM-dd\"},\"aggs\": {\"vulns\": {\"sum\": {\"field\": \"count\"}}}}}}"); String responseJson = PacHttpUtils.doHttpPost(urlToQuery.toString(), request.toString()); JsonParser jsonParser = new JsonParser(); JsonObject resultJson = (JsonObject) jsonParser.parse(responseJson); JsonArray buckets = resultJson.get(AGGREGATIONS).getAsJsonObject().get("date").getAsJsonObject() .get(BUCKETS).getAsJsonArray(); if (buckets.size() > 0) { for (int i = 0; i < buckets.size(); i++) { Map<String, Object> trend = new HashMap<>(); JsonObject bucket = (JsonObject) buckets.get(i); String date = bucket.get("key_as_string").getAsString(); Long count = bucket.get(VULN).getAsJsonObject().get(VALUE).getAsLong(); trend.put("date", date); trend.put(COUNT, count); vulnTrendList.add(trend); } } } catch (Exception e) { LOGGER.error("Error in getVulnerabilityTrend from ES", e); throw e; } return vulnTrendList; }  List<Map<String, Object>> getAllVulnerabilities(List<String> vulnAssetsAffectedQids); List<Map<String, Object>> getAllVulnerabilitiesByAssetGroup(String assetGroup, String targetType,
			Map<String, Object> mustFilter, List<String> occurrenceFieldList, int from, int size,
			Map<String, Object> mustTermsFilter); List<Map<String, Object>> getDetailsByResourceId(String assetGroup, Map<String, Object> mustFilter,
			List<String> resourceFieldList, Map<String, Object> mustTermFilter); Map<String, Long> getAssetsAffectedCount(String assetGroup, Map<String, String> filter, String parentType); List<Map<String, Object>> getVulnerabilyAcrossAppAndEnv(String assetGroup, String filter, String application,
			String parentType, String severity); List<Map<String, Object>> getVulnerabilityTrend(String assetGroup, Map<String, String> filter, Date from,
			Date to); List<Map<String, Object>> getVulnerabilitiesDistribution(String assetGroup, String parentType); Map<String, Object> getVulnerabilitysummaryByResourceId(String resourceId); List<Map<String, Object>> getVulnerabilityDetailsByResourceId(String resourceId); @SuppressWarnings("deprecation") List<Map<String, Object>> fetchExecDirectorApps(); Map<String, Object> getUniqueHost(String assetGroup, String severity); Map<String, Object> getVulnInfo(String assetGroup, String severity); Map<String, Object> getUniqueApp(String assetGroup); List<Map<String, Object>> getAgingSummary(String assetGroup); long getTotalQualysHostCount(String index, String vulnType); Map<String, Object> getVulnerabilityByQid(String qid); Map<String, Object> getDistributionSummaryByInfraType(String assetGroup, String severitylevel,
			String parentType); Map<String, Long> getProdInfoByEnv(String assetGroup, String severitylevel); Map<String, Long> getNonProdInfoByEnv(String assetGroup, String severitylevel); List<Map<String, Object>> getDistributionSummaryByVulnType(String assetGroup, String severity); Map<String, Object> getAllQidByAG(String assetGroup, String severity); Map<String, Long> getAppsBySeverity(String assetGroup, String parentType, String severity); boolean createTrendAnnotation(TrendNote request); void createIndex(String indexName); List<Map<String, Object>> getTrendAnnotations(String ag, Date from); boolean deleteTrendAnnotation(String noteId); List<Map<String, Object>> getDataFromPacmanRDS(String query); long getRunningInstancesCount(String index, String vulnType); long getExemptedByRuleCount(String index, String vulnType); Map<String, Object> getUniqueHostBySeverity(String index, String severity); Map<String, Object> getCompliantHostsBySeverity(String assetGroup); List<String> getNonCompliantResourceIds(String index); @SuppressWarnings("deprecation") List<Map<String, Object>> fetchOrgInfoForApps(); List<Map<String, Object>> getTrendProgress(String assetGroup, String ruleId, LocalDate startDate,
			LocalDate endDate, String trendCategory); int vulnerabilityAssetsCount(String assetGroup, String targetType, Map<String, Object> mustFilter, int from,
			int size, Map<String, Object> mustTermsFilter); }
VulnerabilityRepository implements Constants { public List<Map<String, Object>> getVulnerabilityTrend(String assetGroup, Map<String, String> filter, Date from, Date to) throws Exception { List<Map<String, Object>> vulnTrendList = new ArrayList<>(); try { StringBuilder urlToQuery = new StringBuilder(esUrl).append("/assetgroup_stats/count_vuln/_search"); StringBuilder request = new StringBuilder( "{\"size\":0,\"query\":{\"bool\":{\"must\":[{\"match\":{\"ag.keyword\":" + "\"" + assetGroup + "\"}}"); if (filter != null) { Set<String> filterkeys = filter.keySet(); if (filterkeys.contains(TAGS_APPS)) { request.append( ",{ \"match\": {\"tags.Application.keyword\": " + "\"" + filter.get(TAGS_APPS) + "\"}}"); } if (filterkeys.contains("tags.Environment.keyword")) { request.append(",{ \"match\": {\"tags.Environment.keyword\": " + "\"" + filter.get("tags.Environment.keyword") + "\"}}"); } } String gte = null; String lte = null; if (from != null) { gte = "\"gte\": \"" + new SimpleDateFormat("yyyy-MM-dd").format(from) + "\""; } if (to != null) { lte = "\"lte\": \"" + new SimpleDateFormat("yyyy-MM-dd").format(to) + "\""; } if (gte != null && lte != null) { request.append(",{ \"range\": {\"date\": {" + gte + "," + lte + "}}}"); } else if (gte != null) { request.append(",{ \"range\": {\"date\": {" + gte + "}}}"); } else { request.append(",{ \"range\": {\"date\": {" + lte + "}}}"); } request.append( "]}},\"aggs\": {\"date\": {\"date_histogram\": {\"field\": \"date\",\"interval\": \"day\",\"format\": \"yyyy-MM-dd\"},\"aggs\": {\"vulns\": {\"sum\": {\"field\": \"count\"}}}}}}"); String responseJson = PacHttpUtils.doHttpPost(urlToQuery.toString(), request.toString()); JsonParser jsonParser = new JsonParser(); JsonObject resultJson = (JsonObject) jsonParser.parse(responseJson); JsonArray buckets = resultJson.get(AGGREGATIONS).getAsJsonObject().get("date").getAsJsonObject() .get(BUCKETS).getAsJsonArray(); if (buckets.size() > 0) { for (int i = 0; i < buckets.size(); i++) { Map<String, Object> trend = new HashMap<>(); JsonObject bucket = (JsonObject) buckets.get(i); String date = bucket.get("key_as_string").getAsString(); Long count = bucket.get(VULN).getAsJsonObject().get(VALUE).getAsLong(); trend.put("date", date); trend.put(COUNT, count); vulnTrendList.add(trend); } } } catch (Exception e) { LOGGER.error("Error in getVulnerabilityTrend from ES", e); throw e; } return vulnTrendList; }  List<Map<String, Object>> getAllVulnerabilities(List<String> vulnAssetsAffectedQids); List<Map<String, Object>> getAllVulnerabilitiesByAssetGroup(String assetGroup, String targetType,
			Map<String, Object> mustFilter, List<String> occurrenceFieldList, int from, int size,
			Map<String, Object> mustTermsFilter); List<Map<String, Object>> getDetailsByResourceId(String assetGroup, Map<String, Object> mustFilter,
			List<String> resourceFieldList, Map<String, Object> mustTermFilter); Map<String, Long> getAssetsAffectedCount(String assetGroup, Map<String, String> filter, String parentType); List<Map<String, Object>> getVulnerabilyAcrossAppAndEnv(String assetGroup, String filter, String application,
			String parentType, String severity); List<Map<String, Object>> getVulnerabilityTrend(String assetGroup, Map<String, String> filter, Date from,
			Date to); List<Map<String, Object>> getVulnerabilitiesDistribution(String assetGroup, String parentType); Map<String, Object> getVulnerabilitysummaryByResourceId(String resourceId); List<Map<String, Object>> getVulnerabilityDetailsByResourceId(String resourceId); @SuppressWarnings("deprecation") List<Map<String, Object>> fetchExecDirectorApps(); Map<String, Object> getUniqueHost(String assetGroup, String severity); Map<String, Object> getVulnInfo(String assetGroup, String severity); Map<String, Object> getUniqueApp(String assetGroup); List<Map<String, Object>> getAgingSummary(String assetGroup); long getTotalQualysHostCount(String index, String vulnType); Map<String, Object> getVulnerabilityByQid(String qid); Map<String, Object> getDistributionSummaryByInfraType(String assetGroup, String severitylevel,
			String parentType); Map<String, Long> getProdInfoByEnv(String assetGroup, String severitylevel); Map<String, Long> getNonProdInfoByEnv(String assetGroup, String severitylevel); List<Map<String, Object>> getDistributionSummaryByVulnType(String assetGroup, String severity); Map<String, Object> getAllQidByAG(String assetGroup, String severity); Map<String, Long> getAppsBySeverity(String assetGroup, String parentType, String severity); boolean createTrendAnnotation(TrendNote request); void createIndex(String indexName); List<Map<String, Object>> getTrendAnnotations(String ag, Date from); boolean deleteTrendAnnotation(String noteId); List<Map<String, Object>> getDataFromPacmanRDS(String query); long getRunningInstancesCount(String index, String vulnType); long getExemptedByRuleCount(String index, String vulnType); Map<String, Object> getUniqueHostBySeverity(String index, String severity); Map<String, Object> getCompliantHostsBySeverity(String assetGroup); List<String> getNonCompliantResourceIds(String index); @SuppressWarnings("deprecation") List<Map<String, Object>> fetchOrgInfoForApps(); List<Map<String, Object>> getTrendProgress(String assetGroup, String ruleId, LocalDate startDate,
			LocalDate endDate, String trendCategory); int vulnerabilityAssetsCount(String assetGroup, String targetType, Map<String, Object> mustFilter, int from,
			int size, Map<String, Object> mustTermsFilter);  }