adds export modals

packages/kbn-securitysolution-exception-list-components/src/list_header/index.tsx

@@ -29,9 +29,10 @@ interface ExceptionListHeaderComponentProps {
   canUserEditList?: boolean;
   securityLinkAnchorComponent: React.ElementType; // This property needs to be removed to avoid the Prop Drilling, once we move all the common components from x-pack/security-solution/common
   onEditListDetails: (listDetails: ListDetails) => void;
-  onExportList: () => void;
+  onExportList: (includeExpiredExceptions: boolean) => void;
   onDeleteList: () => void;
   onManageRules: () => void;
+  onExportModalOpen: () => void;
 }
 
 export interface BackOptions {
@@ -54,6 +55,7 @@ const ExceptionListHeaderComponent: FC<ExceptionListHeaderComponentProps> = ({
   onExportList,
   onDeleteList,
   onManageRules,
+  onExportModalOpen,
 }) => {
   const { isModalVisible, listDetails, onEdit, onSave, onCancel } = useExceptionListHeader({
     name,
@@ -100,6 +102,7 @@ const ExceptionListHeaderComponent: FC<ExceptionListHeaderComponentProps> = ({
             onExportList={onExportList}
             onDeleteList={onDeleteList}
             onManageRules={onManageRules}
+            onExportModalOpen={onExportModalOpen}
           />,
         ]}
         breadcrumbs={[

packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/index.tsx

@@ -18,9 +18,10 @@ interface MenuItemsProps {
   linkedRules: Rule[];
   canUserEditList?: boolean;
   securityLinkAnchorComponent: React.ElementType; // This property needs to be removed to avoid the Prop Drilling, once we move all the common components from x-pack/security-solution/common
-  onExportList: () => void;
+  onExportList: (includeExpiredExceptions: boolean) => void;
   onDeleteList: () => void;
   onManageRules: () => void;
+  onExportModalOpen: () => void;
 }
 
 const MenuItemsComponent: FC<MenuItemsProps> = ({
@@ -32,6 +33,7 @@ const MenuItemsComponent: FC<MenuItemsProps> = ({
   onExportList,
   onDeleteList,
   onManageRules,
+  onExportModalOpen,
 }) => {
   const referencedLinks = useMemo(
     () =>
@@ -95,7 +97,7 @@ const MenuItemsComponent: FC<MenuItemsProps> = ({
               icon: 'exportAction',
               label: i18n.EXCEPTION_LIST_HEADER_EXPORT_ACTION,
               onClick: () => {
-                if (typeof onExportList === 'function') onExportList();
+                if (typeof onExportList === 'function') onExportModalOpen();
               },
             },
             {

packages/kbn-securitysolution-io-ts-list-types/src/common/include_expired_exceptions/index.ts

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+/* eslint-disable @typescript-eslint/naming-convention */
+
+import * as t from 'io-ts';
+
+export const include_expired_exceptions = t.keyof({ true: null, false: null });

packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.mock.ts

@@ -14,4 +14,5 @@ export const getExportExceptionListQuerySchemaMock = (): ExportExceptionListQuer
   id: ID,
   list_id: LIST_ID,
   namespace_type: NAMESPACE_TYPE,
+  include_expired_exceptions: 'true',
 });

packages/kbn-securitysolution-io-ts-list-types/src/request/export_exception_list_query_schema/index.ts

@@ -9,6 +9,7 @@
 import * as t from 'io-ts';
 
 import { id } from '../../common/id';
+import { include_expired_exceptions } from '../../common/include_expired_exceptions';
 import { list_id } from '../../common/list_id';
 import { namespace_type } from '../../common/namespace_type';
 
@@ -17,6 +18,7 @@ export const exportExceptionListQuerySchema = t.exact(
     id,
     list_id,
     namespace_type,
+    include_expired_exceptions,
     // TODO: Add file_name here with a default value
   })
 );

packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts

@@ -77,6 +77,7 @@ export interface ApiCallMemoProps {
 // remove unnecessary validation checks
 export interface ApiListExportProps {
   id: string;
+  includeExpiredExceptions: boolean;
   listId: string;
   namespaceType: NamespaceType;
   onError: (err: Error) => void;
@@ -133,6 +134,7 @@ export interface ExportExceptionListProps {
   id: string;
   listId: string;
   namespaceType: NamespaceType;
+  includeExpiredExceptions: boolean;
   signal: AbortSignal;
 }
 

packages/kbn-securitysolution-list-api/src/api/index.ts

@@ -532,10 +532,11 @@ const addEndpointExceptionListWithValidation = async ({
 export { addEndpointExceptionListWithValidation as addEndpointExceptionList };
 
 /**
- * Fetch an ExceptionList by providing a ExceptionList ID
+ * Export an ExceptionList by providing a ExceptionList ID
  *
  * @param http Kibana http service
  * @param id ExceptionList ID (not list_id)
+ * @param includeExpiredExceptions boolean for including expired exceptions
  * @param listId ExceptionList LIST_ID (not id)
  * @param namespaceType ExceptionList namespace_type
  * @param signal to cancel request
@@ -545,13 +546,19 @@ export { addEndpointExceptionListWithValidation as addEndpointExceptionList };
 export const exportExceptionList = async ({
   http,
   id,
+  includeExpiredExceptions,
   listId,
   namespaceType,
   signal,
 }: ExportExceptionListProps): Promise<Blob> =>
   http.fetch<Blob>(`${EXCEPTION_LIST_URL}/_export`, {
     method: 'POST',
-    query: { id, list_id: listId, namespace_type: namespaceType },
+    query: {
+      id,
+      list_id: listId,
+      namespace_type: namespaceType,
+      include_expired_exceptions: includeExpiredExceptions,
+    },
     signal,
   });
 

packages/kbn-securitysolution-list-hooks/src/use_api/index.ts

@@ -112,6 +112,7 @@ export const useApi = (http: HttpStart): ExceptionsApi => {
       },
       async exportExceptionList({
         id,
+        includeExpiredExceptions,
         listId,
         namespaceType,
         onError,
@@ -123,6 +124,7 @@ export const useApi = (http: HttpStart): ExceptionsApi => {
           const blob = await Api.exportExceptionList({
             http,
             id,
+            includeExpiredExceptions,
             listId,
             namespaceType,
             signal: abortCtrl.signal,

x-pack/plugins/lists/public/exceptions/api.test.ts

@@ -698,6 +698,7 @@ describe('Exceptions Lists API', () => {
       await exportExceptionList({
         http: httpMock,
         id: 'some-id',
+        includeExpiredExceptions: true,
         listId: 'list-id',
         namespaceType: 'single',
         signal: abortCtrl.signal,
@@ -718,6 +719,7 @@ describe('Exceptions Lists API', () => {
       const exceptionResponse = await exportExceptionList({
         http: httpMock,
         id: 'some-id',
+        includeExpiredExceptions: true,
         listId: 'list-id',
         namespaceType: 'single',
         signal: abortCtrl.signal,

x-pack/plugins/lists/server/routes/export_exception_list_route.ts

@@ -28,11 +28,17 @@ export const exportExceptionsRoute = (router: ListsPluginRouter): void => {
       const siemResponse = buildSiemResponse(response);
 
       try {
-        const { id, list_id: listId, namespace_type: namespaceType } = request.query;
+        const {
+          id,
+          list_id: listId,
+          namespace_type: namespaceType,
+          include_expired_exceptions: includeExpiredExceptionsString,
+        } = request.query;
         const exceptionListsClient = await getExceptionListClient(context);
-
+        const includeExpiredExceptions = includeExpiredExceptionsString === 'true';
         const exportContent = await exceptionListsClient.exportExceptionListAndItems({
           id,
+          includeExpiredExceptions,
           listId,
           namespaceType,
         });

x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts

@@ -978,6 +978,7 @@ export class ExceptionListClient {
     listId,
     id,
     namespaceType,
+    includeExpiredExceptions,
   }: ExportExceptionListAndItemsOptions): Promise<ExportExceptionListAndItemsReturn | null> => {
     const { savedObjectsClient } = this;
 
@@ -986,6 +987,7 @@ export class ExceptionListClient {
         'exceptionsListPreExport',
         {
           id,
+          includeExpiredExceptions,
           listId,
           namespaceType,
         },
@@ -995,6 +997,7 @@ export class ExceptionListClient {
 
     return exportExceptionListAndItems({
       id,
+      includeExpiredExceptions,
       listId,
       namespaceType,
       savedObjectsClient,

x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts

@@ -499,6 +499,8 @@ export interface ExportExceptionListAndItemsOptions {
   id: IdOrUndefined;
   /** saved object namespace (single | agnostic) */
   namespaceType: NamespaceType;
+  /** whether or not to include expired exceptions */
+  includeExpiredExceptions: boolean;
 }
 
 /**

x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.ts

@@ -15,6 +15,7 @@ import type {
 } from '@kbn/securitysolution-io-ts-list-types';
 import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 import type { SavedObjectsClientContract } from '@kbn/core/server';
+import { getSavedObjectType } from '@kbn/securitysolution-list-utils';
 
 import { findExceptionListItemPointInTimeFinder } from './find_exception_list_item_point_in_time_finder';
 import { getExceptionList } from './get_exception_list';
@@ -24,6 +25,7 @@ interface ExportExceptionListAndItemsOptions {
   listId: ListIdOrUndefined;
   savedObjectsClient: SavedObjectsClientContract;
   namespaceType: NamespaceType;
+  includeExpiredExceptions: boolean;
 }
 
 export interface ExportExceptionListAndItemsReturn {
@@ -35,6 +37,7 @@ export const exportExceptionListAndItems = async ({
   id,
   listId,
   namespaceType,
+  includeExpiredExceptions,
   savedObjectsClient,
 }: ExportExceptionListAndItemsOptions): Promise<ExportExceptionListAndItemsReturn | null> => {
   const exceptionList = await getExceptionList({
@@ -52,10 +55,14 @@ export const exportExceptionListAndItems = async ({
     const executeFunctionOnStream = (response: FoundExceptionListItemSchema): void => {
       exceptionItems = [...exceptionItems, ...response.data];
     };
+    const savedObjectPrefix = getSavedObjectType({ namespaceType });
+    const filter = includeExpiredExceptions
+      ? undefined
+      : `(${savedObjectPrefix}.attributes.expire_time > "${new Date().toISOString()}" OR NOT ${savedObjectPrefix}.attributes.expire_time: *)`;
 
     await findExceptionListItemPointInTimeFinder({
       executeFunctionOnStream,
-      filter: undefined,
+      filter,
       listId: exceptionList.list_id,
       maxSize: undefined, // NOTE: This is unbounded when it is "undefined"
       namespaceType: exceptionList.namespace_type,

x-pack/plugins/security_solution/public/exceptions/components/exceptions_list_card/index.tsx

@@ -33,6 +33,7 @@ import { ListExceptionItems } from '../list_exception_items';
 import { useListDetailsView } from '../../hooks';
 import { useExceptionsListCard } from '../../hooks/use_exceptions_list.card';
 import { ManageRules } from '../manage_rules';
+import { ExportExceptionsListModal } from '../export_exceptions_list_modal';
 
 interface ExceptionsListCardProps {
   exceptionsList: ExceptionListInfo;
@@ -47,10 +48,12 @@ interface ExceptionsListCardProps {
   }) => () => Promise<void>;
   handleExport: ({
     id,
+    includeExpiredExceptions,
     listId,
     namespaceType,
   }: {
     id: string;
+    includeExpiredExceptions: boolean;
     listId: string;
     namespaceType: NamespaceType;
   }) => () => Promise<void>;
@@ -115,6 +118,9 @@ export const ExceptionsListCard = memo<ExceptionsListCardProps>(
       emptyViewerTitle,
       emptyViewerBody,
       emptyViewerButtonText,
+      handleCancelExportModal,
+      handleConfirmExportModal,
+      showExportModal,
     } = useExceptionsListCard({
       exceptionsList,
       handleExport,
@@ -246,6 +252,12 @@ export const ExceptionsListCard = memo<ExceptionsListCardProps>(
             onSave={onSaveManageRules}
             onCancel={onCancelManageRules}
             onRuleSelectionChange={onRuleSelectionChange}
+            />
+        ) : null}
+        {showExportModal ? (
+          <ExportExceptionsListModal
+            handleCloseModal={handleCancelExportModal}
+            onModalConfirm={handleConfirmExportModal}
           />
         ) : null}
       </EuiFlexGroup>

x-pack/plugins/security_solution/public/exceptions/components/export_exceptions_list_modal/index.tsx

@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { memo, useCallback, useState } from 'react';
+
+import { EuiConfirmModal, EuiSwitch } from '@elastic/eui';
+import * as i18n from '../../translations';
+
+interface ExportExceptionsListModalProps {
+  handleCloseModal: () => void;
+  onModalConfirm: (includeExpired: boolean) => void;
+}
+
+export const ExportExceptionsListModal = memo<ExportExceptionsListModalProps>(
+  ({ handleCloseModal, onModalConfirm }) => {
+    const [exportExpired, setExportExpired] = useState(true);
+
+    const handleSwitchChange = useCallback(() => {
+      setExportExpired(!exportExpired);
+    }, [setExportExpired, exportExpired]);
+
+    const handleConfirm = useCallback(() => {
+      onModalConfirm(exportExpired);
+      handleCloseModal();
+    }, [exportExpired, handleCloseModal, onModalConfirm]);
+
+    return (
+      <EuiConfirmModal
+        title={i18n.EXPORT_MODAL_TITLE}
+        onCancel={handleCloseModal}
+        onConfirm={handleConfirm}
+        cancelButtonText={i18n.EXPORT_MODAL_CANCEL_BUTTON}
+        confirmButtonText={i18n.EXPORT_MODAL_CONFIRM_BUTTON}
+        defaultFocusedButton="confirm"
+      >
+        <EuiSwitch
+          label={i18n.EXPORT_MODAL_INCLUDE_SWITCH_LABEL}
+          checked={exportExpired}
+          onChange={handleSwitchChange}
+        />
+      </EuiConfirmModal>
+    );
+  }
+);
+
+ExportExceptionsListModal.displayName = 'ExportExceptionsListModal';