diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx index bf336c00f94d2..662a3ee770547 100644 --- a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx +++ b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx @@ -43,8 +43,8 @@ describe('useAddOrUpdateException', () => { let addExceptionListItem: jest.SpyInstance>; let updateExceptionListItem: jest.SpyInstance>; let getQueryFilter: jest.SpyInstance>; - let buildAlertStatusFilter: jest.SpyInstance< - ReturnType + let buildAlertStatusesFilter: jest.SpyInstance< + ReturnType >; let buildAlertsRuleIdFilter: jest.SpyInstance< ReturnType @@ -128,7 +128,7 @@ describe('useAddOrUpdateException', () => { getQueryFilter = jest.spyOn(getQueryFilterHelper, 'getQueryFilter'); - buildAlertStatusFilter = jest.spyOn(buildFilterHelpers, 'buildAlertStatusFilter'); + buildAlertStatusesFilter = jest.spyOn(buildFilterHelpers, 'buildAlertStatusesFilter'); buildAlertsRuleIdFilter = jest.spyOn(buildFilterHelpers, 'buildAlertsRuleIdFilter'); @@ -328,8 +328,12 @@ describe('useAddOrUpdateException', () => { addOrUpdateItems(...addOrUpdateItemsArgs); } await waitForNextUpdate(); - expect(buildAlertStatusFilter).toHaveBeenCalledTimes(1); - expect(buildAlertStatusFilter.mock.calls[0][0]).toEqual('open'); + expect(buildAlertStatusesFilter).toHaveBeenCalledTimes(1); + expect(buildAlertStatusesFilter.mock.calls[0][0]).toEqual([ + 'open', + 'acknowledged', + 'in-progress', + ]); }); }); it('should update the status of only alerts generated by the provided rule', async () => { diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx index 722632e88377d..18fce44646909 100644 --- a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx +++ b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx @@ -17,9 +17,9 @@ import { HttpStart } from '../../../../../../../src/core/public'; import { updateAlertStatus } from '../../../detections/containers/detection_engine/alerts/api'; import { getUpdateAlertsQuery } from '../../../detections/components/alerts_table/actions'; import { - buildAlertStatusFilter, buildAlertsRuleIdFilter, - buildAlertStatusFilterRuleRegistry, + buildAlertStatusesFilter, + buildAlertStatusesFilterRuleRegistry, } from '../../../detections/components/alerts_table/default_config'; import { getQueryFilter } from '../../../../common/detection_engine/get_query_filter'; import { Index } from '../../../../common/detection_engine/schemas/common/schemas'; @@ -133,8 +133,8 @@ export const useAddOrUpdateException = ({ if (bulkCloseIndex != null) { // TODO: Once we are past experimental phase this code should be removed const alertStatusFilter = ruleRegistryEnabled - ? buildAlertStatusFilterRuleRegistry('open') - : buildAlertStatusFilter('open'); + ? buildAlertStatusesFilterRuleRegistry(['open', 'acknowledged', 'in-progress']) + : buildAlertStatusesFilter(['open', 'acknowledged', 'in-progress']); const filter = getQueryFilter( '', diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.test.tsx index 1ef57a3499922..9c6954a6898a6 100644 --- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.test.tsx +++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.test.tsx @@ -8,6 +8,7 @@ import { ExistsFilter, Filter } from '@kbn/es-query'; import { buildAlertsRuleIdFilter, + buildAlertStatusesFilter, buildAlertStatusFilter, buildThreatMatchFilter, } from './default_config'; @@ -124,6 +125,42 @@ describe('alerts default_config', () => { }); }); + describe('buildAlertStatusesFilter', () => { + test('builds filter containing all statuses passed into function', () => { + const filters = buildAlertStatusesFilter(['open', 'acknowledged', 'in-progress']); + const expected = { + meta: { + alias: null, + disabled: false, + negate: false, + }, + query: { + bool: { + should: [ + { + term: { + 'signal.status': 'open', + }, + }, + { + term: { + 'signal.status': 'acknowledged', + }, + }, + { + term: { + 'signal.status': 'in-progress', + }, + }, + ], + }, + }, + }; + expect(filters).toHaveLength(1); + expect(filters[0]).toEqual(expected); + }); + }); + // TODO: move these tests to ../timelines/components/timeline/body/events/event_column_view.tsx // describe.skip('getAlertActions', () => { // let setEventsLoading: ({ eventIds, isLoading }: SetEventsLoadingProps) => void; diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx index fce0903f2e2f3..72c24cb659cef 100644 --- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx +++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx @@ -69,6 +69,32 @@ export const buildAlertStatusFilter = (status: Status): Filter[] => { ]; }; +/** + * For backwards compatability issues, if `acknowledged` is a status prop, `in-progress` will likely have to be too + */ +export const buildAlertStatusesFilter = (statuses: Status[]): Filter[] => { + const combinedQuery = { + bool: { + should: statuses.map((status) => ({ + term: { + 'signal.status': status, + }, + })), + }, + }; + + return [ + { + meta: { + alias: null, + negate: false, + disabled: false, + }, + query: combinedQuery, + }, + ]; +}; + export const buildAlertsRuleIdFilter = (ruleId: string | null): Filter[] => ruleId ? [ @@ -204,6 +230,30 @@ export const buildAlertStatusFilterRuleRegistry = (status: Status): Filter[] => ]; }; +// TODO: Once we are past experimental phase this code should be removed +export const buildAlertStatusesFilterRuleRegistry = (statuses: Status[]): Filter[] => { + const combinedQuery = { + bool: { + should: statuses.map((status) => ({ + term: { + [ALERT_STATUS]: status, + }, + })), + }, + }; + + return [ + { + meta: { + alias: null, + negate: false, + disabled: false, + }, + query: combinedQuery, + }, + ]; +}; + export const buildShowBuildingBlockFilterRuleRegistry = ( showBuildingBlockAlerts: boolean ): Filter[] =>