-
Notifications
You must be signed in to change notification settings - Fork 8.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[SIEM] [Detection Engine] Add edit on rule creation (#51670)
* Add creation rule on Detection Engine * review + bug fixes * review II + clean up * fix persistence saved query * fix eui prop + add type security to add rule * fix more bug from review III * review IV * add edit on creation on rule * review * fix status icon color * fix filter label translation
- Loading branch information
Showing
18 changed files
with
634 additions
and
127 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
93 changes: 93 additions & 0 deletions
93
...em/public/pages/detection_engine/create_rule/components/description_step/filter_label.tsx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import React, { memo } from 'react'; | ||
| import { EuiTextColor } from '@elastic/eui'; | ||
| import { i18n } from '@kbn/i18n'; | ||
|
|
||
| import { esFilters } from '../../../../../../../../../../src/plugins/data/public'; | ||
| import { existsOperator, isOneOfOperator } from './filter_operator'; | ||
|
|
||
| interface Props { | ||
| filter: esFilters.Filter; | ||
| valueLabel?: string; | ||
| } | ||
|
|
||
| export const FilterLabel = memo<Props>(({ filter, valueLabel }) => { | ||
| const prefixText = filter.meta.negate | ||
| ? ` ${i18n.translate('xpack.siem.detectionEngine.createRule.filterLabel.negatedFilterPrefix', { | ||
| defaultMessage: 'NOT ', | ||
| })}` | ||
| : ''; | ||
| const prefix = | ||
| filter.meta.negate && !filter.meta.disabled ? ( | ||
| <EuiTextColor color="danger">{prefixText}</EuiTextColor> | ||
| ) : ( | ||
| prefixText | ||
| ); | ||
|
|
||
| if (filter.meta.alias !== null) { | ||
| return ( | ||
| <> | ||
| {prefix} | ||
| {filter.meta.alias} | ||
| </> | ||
| ); | ||
| } | ||
|
|
||
| switch (filter.meta.type) { | ||
| case esFilters.FILTERS.EXISTS: | ||
| return ( | ||
| <> | ||
| {prefix} | ||
| {`${filter.meta.key}: ${existsOperator.message}`} | ||
| </> | ||
| ); | ||
| case esFilters.FILTERS.GEO_BOUNDING_BOX: | ||
| return ( | ||
| <> | ||
| {prefix} | ||
| {`${filter.meta.key}: ${valueLabel}`} | ||
| </> | ||
| ); | ||
| case esFilters.FILTERS.GEO_POLYGON: | ||
| return ( | ||
| <> | ||
| {prefix} | ||
| {`${filter.meta.key}: ${valueLabel}`} | ||
| </> | ||
| ); | ||
| case esFilters.FILTERS.PHRASES: | ||
| return ( | ||
| <> | ||
| {prefix} | ||
| {filter.meta.key} {isOneOfOperator.message} {valueLabel} | ||
| </> | ||
| ); | ||
| case esFilters.FILTERS.QUERY_STRING: | ||
| return ( | ||
| <> | ||
| {prefix} | ||
| {valueLabel} | ||
| </> | ||
| ); | ||
| case esFilters.FILTERS.PHRASE: | ||
| case esFilters.FILTERS.RANGE: | ||
| return ( | ||
| <> | ||
| {prefix} | ||
| {`${filter.meta.key}: ${valueLabel}`} | ||
| </> | ||
| ); | ||
| default: | ||
| return ( | ||
| <> | ||
| {prefix} | ||
| {JSON.stringify(filter.query)} | ||
| </> | ||
| ); | ||
| } | ||
| }); |
119 changes: 119 additions & 0 deletions
119
...public/pages/detection_engine/create_rule/components/description_step/filter_operator.tsx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,119 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { i18n } from '@kbn/i18n'; | ||
|
|
||
| import { esFilters } from '../../../../../../../../../../src/plugins/data/public'; | ||
|
|
||
| export interface Operator { | ||
| message: string; | ||
| type: esFilters.FILTERS; | ||
| negate: boolean; | ||
| fieldTypes?: string[]; | ||
| } | ||
|
|
||
| export const isOperator = { | ||
| message: i18n.translate( | ||
| 'xpack.siem.detectionEngine.createRule.filterLabel.isOperatorOptionLabel', | ||
| { | ||
| defaultMessage: 'is', | ||
| } | ||
| ), | ||
| type: esFilters.FILTERS.PHRASE, | ||
| negate: false, | ||
| }; | ||
|
|
||
| export const isNotOperator = { | ||
| message: i18n.translate( | ||
| 'xpack.siem.detectionEngine.createRule.filterLabel.isNotOperatorOptionLabel', | ||
| { | ||
| defaultMessage: 'is not', | ||
| } | ||
| ), | ||
| type: esFilters.FILTERS.PHRASE, | ||
| negate: true, | ||
| }; | ||
|
|
||
| export const isOneOfOperator = { | ||
| message: i18n.translate( | ||
| 'xpack.siem.detectionEngine.createRule.filterLabel.isOneOfOperatorOptionLabel', | ||
| { | ||
| defaultMessage: 'is one of', | ||
| } | ||
| ), | ||
| type: esFilters.FILTERS.PHRASES, | ||
| negate: false, | ||
| fieldTypes: ['string', 'number', 'date', 'ip', 'geo_point', 'geo_shape'], | ||
| }; | ||
|
|
||
| export const isNotOneOfOperator = { | ||
| message: i18n.translate( | ||
| 'xpack.siem.detectionEngine.createRule.filterLabel.isNotOneOfOperatorOptionLabel', | ||
| { | ||
| defaultMessage: 'is not one of', | ||
| } | ||
| ), | ||
| type: esFilters.FILTERS.PHRASES, | ||
| negate: true, | ||
| fieldTypes: ['string', 'number', 'date', 'ip', 'geo_point', 'geo_shape'], | ||
| }; | ||
|
|
||
| export const isBetweenOperator = { | ||
| message: i18n.translate( | ||
| 'xpack.siem.detectionEngine.createRule.filterLabel.isBetweenOperatorOptionLabel', | ||
| { | ||
| defaultMessage: 'is between', | ||
| } | ||
| ), | ||
| type: esFilters.FILTERS.RANGE, | ||
| negate: false, | ||
| fieldTypes: ['number', 'date', 'ip'], | ||
| }; | ||
|
|
||
| export const isNotBetweenOperator = { | ||
| message: i18n.translate( | ||
| 'xpack.siem.detectionEngine.createRule.filterLabel.isNotBetweenOperatorOptionLabel', | ||
| { | ||
| defaultMessage: 'is not between', | ||
| } | ||
| ), | ||
| type: esFilters.FILTERS.RANGE, | ||
| negate: true, | ||
| fieldTypes: ['number', 'date', 'ip'], | ||
| }; | ||
|
|
||
| export const existsOperator = { | ||
| message: i18n.translate( | ||
| 'xpack.siem.detectionEngine.createRule.filterLabel.existsOperatorOptionLabel', | ||
| { | ||
| defaultMessage: 'exists', | ||
| } | ||
| ), | ||
| type: esFilters.FILTERS.EXISTS, | ||
| negate: false, | ||
| }; | ||
|
|
||
| export const doesNotExistOperator = { | ||
| message: i18n.translate( | ||
| 'xpack.siem.detectionEngine.createRule.filterLabel.doesNotExistOperatorOptionLabel', | ||
| { | ||
| defaultMessage: 'does not exist', | ||
| } | ||
| ), | ||
| type: esFilters.FILTERS.EXISTS, | ||
| negate: true, | ||
| }; | ||
|
|
||
| export const FILTER_OPERATORS: Operator[] = [ | ||
| isOperator, | ||
| isNotOperator, | ||
| isOneOfOperator, | ||
| isNotOneOfOperator, | ||
| isBetweenOperator, | ||
| isNotBetweenOperator, | ||
| existsOperator, | ||
| doesNotExistOperator, | ||
| ]; |
Oops, something went wrong.