Merge branch 'main' into embeddableRebuild_controls_fix-data-editor_0…

…7-02-2024

packages/kbn-es/src/serverless_resources/project_roles/security/roles.yml

@@ -35,6 +35,7 @@ viewer:
         - '.fleet-actions*'
         - 'risk-score.risk-score-*'
         - '.asset-criticality.asset-criticality-*'
+        - '.ml-anomalies-*'
       privileges:
         - read
   applications:
@@ -100,6 +101,10 @@ editor:
         - 'read'
         - 'write'
       allow_restricted_indices: false
+    - names:
+        - '.ml-anomalies-*'
+      privileges:
+        - read
   applications:
     - application: 'kibana-.kibana'
       privileges:
@@ -154,6 +159,7 @@ t1_analyst:
         - '.fleet-actions*'
         - risk-score.risk-score-*
         - .asset-criticality.asset-criticality-*
+        - '.ml-anomalies-*'
       privileges:
         - read
   applications:
@@ -201,6 +207,7 @@ t2_analyst:
         - .fleet-agents*
         - .fleet-actions*
         - risk-score.risk-score-*
+        - '.ml-anomalies-*'
       privileges:
         - read
     - names:
@@ -262,6 +269,7 @@ t3_analyst:
         - .fleet-agents*
         - .fleet-actions*
         - risk-score.risk-score-*
+        - '.ml-anomalies-*'
       privileges:
         - read
   applications:
@@ -281,6 +289,7 @@ t3_analyst:
         - feature_siem.process_operations_all
         - feature_siem.actions_log_management_all # Response actions history
         - feature_siem.file_operations_all
+        - feature_siem.scan_operations_all
         - feature_securitySolutionCases.all
         - feature_securitySolutionAssistant.all
         - feature_actions.read
@@ -331,6 +340,7 @@ threat_intelligence_analyst:
         - .fleet-agents*
         - .fleet-actions*
         - risk-score.risk-score-*
+        - '.ml-anomalies-*'
       privileges:
         - read
   applications:
@@ -389,6 +399,7 @@ rule_author:
         - .fleet-agents*
         - .fleet-actions*
         - risk-score.risk-score-*
+        - '.ml-anomalies-*'
       privileges:
         - read
   applications:
@@ -453,6 +464,7 @@ soc_manager:
         - .fleet-agents*
         - .fleet-actions*
         - risk-score.risk-score-*
+        - '.ml-anomalies-*'
       privileges:
         - read
   applications:
@@ -513,6 +525,7 @@ detections_admin:
         - metrics-endpoint.metadata_current_*
         - .fleet-agents*
         - .fleet-actions*
+        - '.ml-anomalies-*'
       privileges:
         - read
     - names:
@@ -570,6 +583,10 @@ platform_engineer:
       privileges:
         - read
         - write
+    - names:
+        - '.ml-anomalies-*'
+      privileges:
+        - read
   applications:
     - application: 'kibana-.kibana'
       privileges:
@@ -620,6 +637,7 @@ endpoint_operations_analyst:
         - .lists*
         - .items*
         - risk-score.risk-score-*
+        - '.ml-anomalies-*'
       privileges:
         - read
     - names:
@@ -710,6 +728,10 @@ endpoint_policy_manager:
         - read
         - write
         - manage
+    - names:
+        - '.ml-anomalies-*'
+      privileges:
+        - read
   applications:
     - application: 'kibana-.kibana'
       privileges:

packages/kbn-esql-utils/src/utils/append_to_query.test.ts

@@ -31,15 +31,15 @@ describe('appendToQuery', () => {
         appendWhereClauseToESQLQuery('from logstash-* // meow', 'dest', 'tada!', '+', 'string')
       ).toBe(
         `from logstash-* // meow
-| where \`dest\`=="tada!"`
+| WHERE \`dest\`=="tada!"`
       );
     });
     it('appends a filter out where clause in an existing query', () => {
       expect(
         appendWhereClauseToESQLQuery('from logstash-* // meow', 'dest', 'tada!', '-', 'string')
       ).toBe(
         `from logstash-* // meow
-| where \`dest\`!="tada!"`
+| WHERE \`dest\`!="tada!"`
       );
     });
 
@@ -48,14 +48,14 @@ describe('appendToQuery', () => {
         appendWhereClauseToESQLQuery('from logstash-* // meow', 'dest', 'tada!', '-', 'ip')
       ).toBe(
         `from logstash-* // meow
-| where \`dest\`::string!="tada!"`
+| WHERE \`dest\`::string!="tada!"`
       );
     });
 
     it('appends a where clause in an existing query with casting to string when the type is not given', () => {
       expect(appendWhereClauseToESQLQuery('from logstash-* // meow', 'dest', 'tada!', '-')).toBe(
         `from logstash-* // meow
-| where \`dest\`::string!="tada!"`
+| WHERE \`dest\`::string!="tada!"`
       );
     });
 
@@ -70,7 +70,7 @@ describe('appendToQuery', () => {
         )
       ).toBe(
         `from logstash-* // meow
-| where \`dest\` is not null`
+| WHERE \`dest\` is not null`
       );
     });
 
@@ -85,7 +85,7 @@ describe('appendToQuery', () => {
         )
       ).toBe(
         `from logstash-* // meow
-| where \`dest\` is null`
+| WHERE \`dest\` is null`
       );
     });
 
@@ -100,7 +100,7 @@ describe('appendToQuery', () => {
         )
       ).toBe(
         `from logstash-* | where country == "GR"
-and \`dest\`=="Crete"`
+AND \`dest\`=="Crete"`
       );
     });
 

packages/kbn-esql-utils/src/utils/append_to_query.ts

@@ -85,9 +85,9 @@ export function appendWhereClauseToESQLQuery(
       }
     }
     // filter does not exist in the where clause
-    const whereClause = `and ${fieldName}${operator}${filterValue}`;
+    const whereClause = `AND ${fieldName}${operator}${filterValue}`;
     return appendToESQLQuery(baseESQLQuery, whereClause);
   }
-  const whereClause = `| where ${fieldName}${operator}${filterValue}`;
+  const whereClause = `| WHERE ${fieldName}${operator}${filterValue}`;
   return appendToESQLQuery(baseESQLQuery, whereClause);
 }

packages/kbn-esql-utils/src/utils/get_initial_esql_query.test.ts

@@ -10,6 +10,6 @@ import { getInitialESQLQuery } from './get_initial_esql_query';
 
 describe('getInitialESQLQuery', () => {
   it('should work correctly', () => {
-    expect(getInitialESQLQuery('logs*')).toBe('from logs* | limit 10');
+    expect(getInitialESQLQuery('logs*')).toBe('FROM logs* | LIMIT 10');
   });
 });

packages/kbn-esql-utils/src/utils/get_initial_esql_query.ts

@@ -11,5 +11,5 @@
  * @param indexOrIndexPattern
  */
 export function getInitialESQLQuery(indexOrIndexPattern: string): string {
-  return `from ${indexOrIndexPattern} | limit 10`;
+  return `FROM ${indexOrIndexPattern} | LIMIT 10`;
 }

packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts

@@ -186,9 +186,11 @@ function getFunctionSignaturesByReturnType(
     .sort(({ name: a }, { name: b }) => a.localeCompare(b))
     .map(({ type, name, signatures }) => {
       if (type === 'builtin') {
-        return signatures.some(({ params }) => params.length > 1) ? `${name} $0` : name;
+        return signatures.some(({ params }) => params.length > 1)
+          ? `${name.toUpperCase()} $0`
+          : name.toUpperCase();
       }
-      return `${name}($0)`;
+      return `${name.toUpperCase()}($0)`;
     });
 }
 
@@ -337,31 +339,31 @@ describe('autocomplete', () => {
   describe('New command', () => {
     testSuggestions(
       ' ',
-      sourceCommands.map((name) => name + ' $0')
+      sourceCommands.map((name) => name.toUpperCase() + ' $0')
     );
     testSuggestions(
       'from a | ',
       commandDefinitions
         .filter(({ name }) => !sourceCommands.includes(name))
-        .map(({ name }) => name + ' $0')
+        .map(({ name }) => name.toUpperCase() + ' $0')
     );
     testSuggestions(
       'from a [metadata _id] | ',
       commandDefinitions
         .filter(({ name }) => !sourceCommands.includes(name))
-        .map(({ name }) => name + ' $0')
+        .map(({ name }) => name.toUpperCase() + ' $0')
     );
     testSuggestions(
       'from a | eval var0 = a | ',
       commandDefinitions
         .filter(({ name }) => !sourceCommands.includes(name))
-        .map(({ name }) => name + ' $0')
+        .map(({ name }) => name.toUpperCase() + ' $0')
     );
     testSuggestions(
       'from a [metadata _id] | eval var0 = a | ',
       commandDefinitions
         .filter(({ name }) => !sourceCommands.includes(name))
-        .map(({ name }) => name + ' $0')
+        .map(({ name }) => name.toUpperCase() + ' $0')
     );
   });
 
@@ -371,11 +373,11 @@ describe('autocomplete', () => {
     // Monaco will filter further down here
     testSuggestions(
       'f',
-      sourceCommands.map((name) => name + ' $0')
+      sourceCommands.map((name) => name.toUpperCase() + ' $0')
     );
     testSuggestions('from ', suggestedIndexes);
     testSuggestions('from a,', suggestedIndexes);
-    testSuggestions('from a, b ', ['metadata $0', ',', '|']);
+    testSuggestions('from a, b ', ['METADATA $0', ',', '|']);
     testSuggestions('from *,', suggestedIndexes);
     testSuggestions('from index', suggestedIndexes, 5 /* space before index */);
     testSuggestions('from a, b [metadata ]', METADATA_FIELDS, ' ]');
@@ -403,14 +405,14 @@ describe('autocomplete', () => {
   });
 
   describe('show', () => {
-    testSuggestions('show ', ['info']);
+    testSuggestions('show ', ['INFO']);
     for (const fn of ['info']) {
       testSuggestions(`show ${fn} `, ['|']);
     }
   });
 
   describe('meta', () => {
-    testSuggestions('meta ', ['functions']);
+    testSuggestions('meta ', ['FUNCTIONS']);
     for (const fn of ['functions']) {
       testSuggestions(`meta ${fn} `, ['|']);
     }
@@ -522,8 +524,8 @@ describe('autocomplete', () => {
       ','
     );
 
-    testSuggestions('from index | WHERE stringField not ', ['like $0', 'rlike $0', 'in $0']);
-    testSuggestions('from index | WHERE stringField NOT ', ['like $0', 'rlike $0', 'in $0']);
+    testSuggestions('from index | WHERE stringField not ', ['LIKE $0', 'RLIKE $0', 'IN $0']);
+    testSuggestions('from index | WHERE stringField NOT ', ['LIKE $0', 'RLIKE $0', 'IN $0']);
     testSuggestions('from index | WHERE not ', [
       ...getFieldNamesByType('boolean'),
       ...getFunctionSignaturesByReturnType('eval', 'boolean', { evalMath: true }),
@@ -577,7 +579,7 @@ describe('autocomplete', () => {
         testSuggestions(`from a | ${subExpression} ${command} stringField `, [constantPattern]);
         testSuggestions(
           `from a | ${subExpression} ${command} stringField ${constantPattern} `,
-          (command === 'dissect' ? ['append_separator = $0'] : []).concat(['|'])
+          (command === 'dissect' ? ['APPEND_SEPARATOR = $0'] : []).concat(['|'])
         );
         if (command === 'dissect') {
           testSuggestions(
@@ -616,7 +618,7 @@ describe('autocomplete', () => {
 
   describe('rename', () => {
     testSuggestions('from a | rename ', getFieldNamesByType('any'));
-    testSuggestions('from a | rename stringField ', ['as $0']);
+    testSuggestions('from a | rename stringField ', ['AS $0']);
     testSuggestions('from a | rename stringField as ', ['var0']);
   });
 
@@ -704,7 +706,7 @@ describe('autocomplete', () => {
       ],
       '('
     );
-    testSuggestions('from a | stats a=min(b) ', ['by $0', ',', '|']);
+    testSuggestions('from a | stats a=min(b) ', ['BY $0', ',', '|']);
     testSuggestions('from a | stats a=min(b) by ', [
       'var0 =',
       ...getFieldNamesByType('any'),
@@ -737,7 +739,7 @@ describe('autocomplete', () => {
     ]);
 
     // smoke testing with suggestions not at the end of the string
-    testSuggestions('from a | stats a = min(b) | sort b', ['by $0', ',', '|'], ') ');
+    testSuggestions('from a | stats a = min(b) | sort b', ['BY $0', ',', '|'], ') ');
     testSuggestions(
       'from a | stats avg(b) by stringField',
       [
@@ -854,7 +856,7 @@ describe('autocomplete', () => {
         testSuggestions(`from a ${prevCommand}| enrich _${mode.toUpperCase()}:`, policyNames, ':');
         testSuggestions(`from a ${prevCommand}| enrich _${camelCase(mode)}:`, policyNames, ':');
       }
-      testSuggestions(`from a ${prevCommand}| enrich policy `, ['on $0', 'with $0', '|']);
+      testSuggestions(`from a ${prevCommand}| enrich policy `, ['ON $0', 'WITH $0', '|']);
       testSuggestions(`from a ${prevCommand}| enrich policy on `, [
         'stringField',
         'numberField',
@@ -868,7 +870,7 @@ describe('autocomplete', () => {
         'any#Char$Field',
         'kubernetes.something.something',
       ]);
-      testSuggestions(`from a ${prevCommand}| enrich policy on b `, ['with $0', ',', '|']);
+      testSuggestions(`from a ${prevCommand}| enrich policy on b `, ['WITH $0', ',', '|']);
       testSuggestions(`from a ${prevCommand}| enrich policy on b with `, [
         'var0 =',
         ...getPolicyFields('policy'),
@@ -915,8 +917,8 @@ describe('autocomplete', () => {
       ',',
       '|',
     ]);
-    testSuggestions('from index | EVAL stringField not ', ['like $0', 'rlike $0', 'in $0']);
-    testSuggestions('from index | EVAL stringField NOT ', ['like $0', 'rlike $0', 'in $0']);
+    testSuggestions('from index | EVAL stringField not ', ['LIKE $0', 'RLIKE $0', 'IN $0']);
+    testSuggestions('from index | EVAL stringField NOT ', ['LIKE $0', 'RLIKE $0', 'IN $0']);
     testSuggestions('from index | EVAL numberField in ', ['( $0 )']);
     testSuggestions(
       'from index | EVAL numberField in ( )',