Skip to content

Commit

Permalink
[SIEM][Detection Engine] critical blocker with the UI crashing
Browse files Browse the repository at this point in the history
## Summary

If you have filters which do not have a $app and state it blows up which isn't what we want to happen. This adds a function which default adds it on the UI if it does not exist

<img width="915" alt="Screen Shot 2020-01-28 at 10 07 39 AM" src="https://user-images.githubusercontent.com/1151048/73296325-bd17b900-41c6-11ea-9ba4-30715224829c.png">

Test:

Post query with everything

```ts
./post_rule.sh ./rules/queries/query_with_everything.json
```

Then visit in the details section of the UI and it should no longer blow up.

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~

~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~

~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~

### For maintainers

~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

- [x] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)
  • Loading branch information
FrankHassanabad committed Jan 28, 2020
1 parent 85b02e2 commit 5649a04
Show file tree
Hide file tree
Showing 2 changed files with 196 additions and 1 deletion.
Original file line number Diff line number Diff line change
@@ -0,0 +1,185 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License;
* you may not use this file except in compliance with the Elastic License.
*/

import { addFilterStateIfNotThere } from './';

import { esFilters } from '../../../../../../../../../../src/plugins/data/public';

describe('description_step', () => {
describe('addFilterStateIfNotThere', () => {
test('it does not change the state if it is global', () => {
const filters: esFilters.Filter[] = [
{
$state: {
store: esFilters.FilterStateStore.GLOBAL_STATE,
},
meta: {
alias: null,
disabled: false,
key: 'event.category',
negate: false,
params: {
query: 'file',
},
type: 'phrase',
},
query: {
match_phrase: {
'event.category': 'file',
},
},
},
{
$state: {
store: esFilters.FilterStateStore.GLOBAL_STATE,
},
meta: {
alias: null,
disabled: false,
key: 'event.category',
negate: false,
params: {
query: 'file',
},
type: 'phrase',
},
query: {
match_phrase: {
'event.category': 'file',
},
},
},
];
const output = addFilterStateIfNotThere(filters);
const expected: esFilters.Filter[] = [
{
$state: {
store: esFilters.FilterStateStore.GLOBAL_STATE,
},
meta: {
alias: null,
disabled: false,
key: 'event.category',
negate: false,
params: {
query: 'file',
},
type: 'phrase',
},
query: {
match_phrase: {
'event.category': 'file',
},
},
},
{
$state: {
store: esFilters.FilterStateStore.GLOBAL_STATE,
},
meta: {
alias: null,
disabled: false,
key: 'event.category',
negate: false,
params: {
query: 'file',
},
type: 'phrase',
},
query: {
match_phrase: {
'event.category': 'file',
},
},
},
];
expect(output).toEqual(expected);
});

test('it adds the state if it does not exist as local', () => {
const filters: esFilters.Filter[] = [
{
meta: {
alias: null,
disabled: false,
key: 'event.category',
negate: false,
params: {
query: 'file',
},
type: 'phrase',
},
query: {
match_phrase: {
'event.category': 'file',
},
},
},
{
meta: {
alias: null,
disabled: false,
key: 'event.category',
negate: false,
params: {
query: 'file',
},
type: 'phrase',
},
query: {
match_phrase: {
'event.category': 'file',
},
},
},
];
const output = addFilterStateIfNotThere(filters);
const expected: esFilters.Filter[] = [
{
$state: {
store: esFilters.FilterStateStore.APP_STATE,
},
meta: {
alias: null,
disabled: false,
key: 'event.category',
negate: false,
params: {
query: 'file',
},
type: 'phrase',
},
query: {
match_phrase: {
'event.category': 'file',
},
},
},
{
$state: {
store: esFilters.FilterStateStore.APP_STATE,
},
meta: {
alias: null,
disabled: false,
key: 'event.category',
negate: false,
params: {
query: 'file',
},
type: 'phrase',
},
query: {
match_phrase: {
'event.category': 'file',
},
},
},
];
expect(output).toEqual(expected);
});
});
});
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,16 @@ const buildListItems = (
[]
);

export const addFilterStateIfNotThere = (filters: esFilters.Filter[]): esFilters.Filter[] => {
return filters.map(filter => {
if (filter.$state == null) {
return { $state: { store: esFilters.FilterStateStore.APP_STATE }, ...filter };
} else {
return filter;
}
});
};

const getDescriptionItem = (
field: string,
label: string,
Expand All @@ -105,7 +115,7 @@ const getDescriptionItem = (
indexPatterns?: IIndexPattern
): ListItems[] => {
if (field === 'queryBar') {
const filters = get('queryBar.filters', value) as esFilters.Filter[];
const filters = addFilterStateIfNotThere(get('queryBar.filters', value));
const query = get('queryBar.query', value) as Query;
const savedId = get('queryBar.saved_id', value);
return buildQueryBarDescription({
Expand Down

0 comments on commit 5649a04

Please sign in to comment.