[Security Solution] Adds diff algorithm and unit tests for scalar arr…

…ay values (#186323)

## Summary

Related ticket: #180162

Adds the diff algorithm for arrays of scalar values (right now we only
have fields of strings) and unit tests to cover all the base cases of
what the algorithm can return.


### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Elastic Machine <[email protected]>

x-pack/plugins/security_solution/common/api/detection_engine/prebuilt_rules/model/diff/three_way_diff/three_way_diff_outcome.ts

@@ -38,7 +38,51 @@ export const determineDiffOutcome = <TValue>(
   const baseEqlTarget = isEqual(baseVersion, targetVersion);
   const currentEqlTarget = isEqual(currentVersion, targetVersion);
 
-  if (baseVersion === MissingVersion) {
+  return getThreeWayDiffOutcome({
+    baseEqlCurrent,
+    baseEqlTarget,
+    currentEqlTarget,
+    hasBaseVersion: baseVersion !== MissingVersion,
+  });
+};
+
+/**
+ * Determines diff outcomes of array fields that do not care about order (e.g. `[1, 2 , 3] === [3, 2, 1]`)
+ */
+export const determineOrderAgnosticDiffOutcome = <TValue>(
+  baseVersion: TValue[] | MissingVersion,
+  currentVersion: TValue[],
+  targetVersion: TValue[]
+): ThreeWayDiffOutcome => {
+  const baseSet = baseVersion === MissingVersion ? MissingVersion : new Set<TValue>(baseVersion);
+  const currentSet = new Set<TValue>(currentVersion);
+  const targetSet = new Set<TValue>(targetVersion);
+  const baseEqlCurrent = isEqual(baseSet, currentSet);
+  const baseEqlTarget = isEqual(baseSet, targetSet);
+  const currentEqlTarget = isEqual(currentSet, targetSet);
+
+  return getThreeWayDiffOutcome({
+    baseEqlCurrent,
+    baseEqlTarget,
+    currentEqlTarget,
+    hasBaseVersion: baseVersion !== MissingVersion,
+  });
+};
+
+interface DetermineDiffOutcomeProps {
+  baseEqlCurrent: boolean;
+  baseEqlTarget: boolean;
+  currentEqlTarget: boolean;
+  hasBaseVersion: boolean;
+}
+
+const getThreeWayDiffOutcome = ({
+  baseEqlCurrent,
+  baseEqlTarget,
+  currentEqlTarget,
+  hasBaseVersion,
+}: DetermineDiffOutcomeProps): ThreeWayDiffOutcome => {
+  if (!hasBaseVersion) {
     /**
      * We couldn't find the base version of the rule in the package so further
      * version comparison is not possible. We assume that the rule is not

x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/index.ts

@@ -7,4 +7,5 @@
 
 export { numberDiffAlgorithm } from './number_diff_algorithm';
 export { singleLineStringDiffAlgorithm } from './single_line_string_diff_algorithm';
+export { scalarArrayDiffAlgorithm } from './scalar_array_diff_algorithm';
 export { simpleDiffAlgorithm } from './simple_diff_algorithm';

x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/number_diff_algorithm.test.ts

@@ -14,7 +14,7 @@ import {
 import { numberDiffAlgorithm } from './number_diff_algorithm';
 
 describe('numberDiffAlgorithm', () => {
-  it('returns current_version as merged output if there is no update', () => {
+  it('returns current_version as merged output if there is no update - scenario AAA', () => {
     const mockVersions: ThreeVersionsOf<number> = {
       base_version: 1,
       current_version: 1,
@@ -33,7 +33,7 @@ describe('numberDiffAlgorithm', () => {
     );
   });
 
-  it('returns current_version as merged output if current_version is different and there is no update', () => {
+  it('returns current_version as merged output if current_version is different and there is no update - scenario ABA', () => {
     const mockVersions: ThreeVersionsOf<number> = {
       base_version: 1,
       current_version: 2,
@@ -52,7 +52,7 @@ describe('numberDiffAlgorithm', () => {
     );
   });
 
-  it('returns target_version as merged output if current_version is the same and there is an update', () => {
+  it('returns target_version as merged output if current_version is the same and there is an update - scenario AAB', () => {
     const mockVersions: ThreeVersionsOf<number> = {
       base_version: 1,
       current_version: 1,
@@ -71,7 +71,7 @@ describe('numberDiffAlgorithm', () => {
     );
   });
 
-  it('returns current_version as merged output if current version is different but it matches the update', () => {
+  it('returns current_version as merged output if current version is different but it matches the update - scenario ABB', () => {
     const mockVersions: ThreeVersionsOf<number> = {
       base_version: 1,
       current_version: 2,
@@ -90,7 +90,7 @@ describe('numberDiffAlgorithm', () => {
     );
   });
 
-  it('returns current_version as merged output if all three versions are different', () => {
+  it('returns current_version as merged output if all three versions are different - scenario ABC', () => {
     const mockVersions: ThreeVersionsOf<number> = {
       base_version: 1,
       current_version: 2,
@@ -110,7 +110,7 @@ describe('numberDiffAlgorithm', () => {
   });
 
   describe('if base_version is missing', () => {
-    it('returns current_version as merged output if current_version and target_version are the same', () => {
+    it('returns current_version as merged output if current_version and target_version are the same - scenario -AA', () => {
       const mockVersions: ThreeVersionsOf<number> = {
         base_version: MissingVersion,
         current_version: 1,
@@ -129,7 +129,7 @@ describe('numberDiffAlgorithm', () => {
       );
     });
 
-    it('returns target_version as merged output if current_version and target_version are different', () => {
+    it('returns target_version as merged output if current_version and target_version are different - scenario -AB', () => {
       const mockVersions: ThreeVersionsOf<number> = {
         base_version: MissingVersion,
         current_version: 1,