[Security Solution] Saving is not working if hitting "favorites butto…

…n" beforehand (#88642) (#90132) * fix favorites for templates * fix integration test * fix integration test * fix event details request * handle data when searchstrategy is still running Co-authored-by: Kibana Machine <[email protected]> Co-authored-by: Kibana Machine <[email protected]>
elastic · Feb 3, 2021 · ca3fe07 · ca3fe07
1 parent cc3eb8e
commit ca3fe07
Show file tree

Hide file tree

Showing 11 changed files with 290 additions and 11 deletions.
diff --git a/x-pack/plugins/security_solution/public/graphql/introspection.json b/x-pack/plugins/security_solution/public/graphql/introspection.json
@@ -3365,6 +3365,24 @@
                 "description": "",
                 "type": { "kind": "SCALAR", "name": "ID", "ofType": null },
                 "defaultValue": null
+              },
+              {
+                "name": "templateTimelineId",
+                "description": "",
+                "type": { "kind": "SCALAR", "name": "String", "ofType": null },
+                "defaultValue": null
+              },
+              {
+                "name": "templateTimelineVersion",
+                "description": "",
+                "type": { "kind": "SCALAR", "name": "Int", "ofType": null },
+                "defaultValue": null
+              },
+              {
+                "name": "timelineType",
+                "description": "",
+                "type": { "kind": "ENUM", "name": "TimelineType", "ofType": null },
+                "defaultValue": null
               }
             ],
             "type": {
@@ -4149,6 +4167,30 @@
             "isDeprecated": false,
             "deprecationReason": null
           },
+          {
+            "name": "templateTimelineId",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "String", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "templateTimelineVersion",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "Int", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "timelineType",
+            "description": "",
+            "args": [],
+            "type": { "kind": "ENUM", "name": "TimelineType", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
           {
             "name": "version",
             "description": "",

diff --git a/x-pack/plugins/security_solution/public/graphql/types.ts b/x-pack/plugins/security_solution/public/graphql/types.ts
@@ -835,6 +835,12 @@ export interface ResponseFavoriteTimeline {
 
   savedObjectId: string;
 
+  templateTimelineId?: Maybe<string>;
+
+  templateTimelineVersion?: Maybe<number>;
+
+  timelineType?: Maybe<TimelineType>;
+
   version: string;
 
   favorite?: Maybe<FavoriteTimelineResult[]>;
@@ -1691,6 +1697,12 @@ export interface PersistTimelineMutationArgs {
 }
 export interface PersistFavoriteMutationArgs {
   timelineId?: Maybe<string>;
+
+  templateTimelineId?: Maybe<string>;
+
+  templateTimelineVersion?: Maybe<number>;
+
+  timelineType?: Maybe<TimelineType>;
 }
 export interface DeleteTimelineMutationArgs {
   id: string[];
@@ -2096,6 +2108,9 @@ export namespace DeleteTimelineMutation {
 export namespace PersistTimelineFavoriteMutation {
   export type Variables = {
     timelineId?: Maybe<string>;
+    templateTimelineId?: Maybe<string>;
+    templateTimelineVersion?: Maybe<number>;
+    timelineType: TimelineType;
   };
 
   export type Mutation = {
@@ -2112,6 +2127,12 @@ export namespace PersistTimelineFavoriteMutation {
     version: string;
 
     favorite: Maybe<Favorite[]>;
+
+    templateTimelineId: Maybe<string>;
+
+    templateTimelineVersion: Maybe<number>;
+
+    timelineType: Maybe<TimelineType>;
   };
 
   export type Favorite = {

diff --git a/...ugins/security_solution/public/timelines/components/open_timeline/note_previews/index.tsx b/...ugins/security_solution/public/timelines/components/open_timeline/note_previews/index.tsx
@@ -18,6 +18,8 @@ import { timelineActions } from '../../../store/timeline';
 import { NOTE_CONTENT_CLASS_NAME } from '../../timeline/body/helpers';
 import * as i18n from './translations';
 import { TimelineTabs } from '../../../../../common/types/timeline';
+import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
+import { sourcererSelectors } from '../../../../common/store';
 
 export const NotePreviewsContainer = styled.section`
   padding-top: ${({ theme }) => `${theme.eui.euiSizeS}`};
@@ -35,19 +37,24 @@ const ToggleEventDetailsButtonComponent: React.FC<ToggleEventDetailsButtonProps>
   timelineId,
 }) => {
   const dispatch = useDispatch();
+  const existingIndexNamesSelector = useMemo(
+    () => sourcererSelectors.getAllExistingIndexNamesSelector(),
+    []
+  );
+  const existingIndexNames = useDeepEqualSelector<string[]>(existingIndexNamesSelector);
+
   const handleClick = useCallback(() => {
     dispatch(
       timelineActions.toggleExpandedEvent({
         tabType: TimelineTabs.notes,
         timelineId,
         event: {
           eventId,
-          // we don't store yet info about event index name in note
-          indexName: '',
+          indexName: existingIndexNames.join(','),
         },
       })
     );
-  }, [dispatch, eventId, timelineId]);
+  }, [dispatch, eventId, existingIndexNames, timelineId]);
 
   return (
     <EuiButtonIcon

diff --git a/x-pack/plugins/security_solution/public/timelines/containers/favorite/persist.gql_query.ts b/x-pack/plugins/security_solution/public/timelines/containers/favorite/persist.gql_query.ts
@@ -7,15 +7,28 @@
 import gql from 'graphql-tag';
 
 export const persistTimelineFavoriteMutation = gql`
-  mutation PersistTimelineFavoriteMutation($timelineId: ID) {
-    persistFavorite(timelineId: $timelineId) {
+  mutation PersistTimelineFavoriteMutation(
+    $timelineId: ID
+    $templateTimelineId: String
+    $templateTimelineVersion: Int
+    $timelineType: TimelineType!
+  ) {
+    persistFavorite(
+      timelineId: $timelineId
+      templateTimelineId: $templateTimelineId
+      templateTimelineVersion: $templateTimelineVersion
+      timelineType: $timelineType
+    ) {
       savedObjectId
       version
       favorite {
         fullName
         userName
         favoriteDate
       }
+      templateTimelineId
+      templateTimelineVersion
+      timelineType
     }
   }
 `;
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_favorite.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_favorite.ts
@@ -27,6 +27,7 @@ import { refetchQueries } from './refetch_queries';
 import { myEpicTimelineId } from './my_epic_timeline_id';
 import { ActionTimeline, TimelineById } from './types';
 import { inputsModel } from '../../../common/store/inputs';
+import { TimelineType } from '../../../../common/types/timeline';
 
 export const timelineFavoriteActionsType = [updateIsFavorite.type];
 
@@ -48,6 +49,9 @@ export const epicPersistTimelineFavorite = (
       fetchPolicy: 'no-cache',
       variables: {
         timelineId: myEpicTimelineId.getTimelineId(),
+        templateTimelineId: timeline[action.payload.id].templateTimelineId,
+        templateTimelineVersion: timeline[action.payload.id].templateTimelineVersion,
+        timelineType: timeline[action.payload.id].timelineType ?? TimelineType.default,
       },
       refetchQueries,
     })
@@ -96,6 +100,12 @@ export const epicPersistTimelineFavorite = (
             myEpicTimelineId.setTimelineVersion(
               updatedTimeline[get('payload.id', checkAction)].version
             );
+            myEpicTimelineId.setTemplateTimelineId(
+              updatedTimeline[get('payload.id', checkAction)].templateTimelineId
+            );
+            myEpicTimelineId.setTemplateTimelineVersion(
+              updatedTimeline[get('payload.id', checkAction)].templateTimelineVersion
+            );
             return true;
           }
           return false;

diff --git a/x-pack/plugins/security_solution/server/graphql/timeline/resolvers.ts b/x-pack/plugins/security_solution/server/graphql/timeline/resolvers.ts
@@ -7,6 +7,7 @@
 import { AppResolverWithFields, AppResolverOf } from '../../lib/framework';
 import { MutationResolvers, QueryResolvers } from '../types';
 import { Timeline } from '../../lib/timeline/saved_object';
+import { TimelineType } from '../../../common/types/timeline';
 
 export type QueryTimelineResolver = AppResolverOf<QueryResolvers.GetOneTimelineResolver>;
 
@@ -63,7 +64,13 @@ export const createTimelineResolvers = (
       return true;
     },
     async persistFavorite(root, args, { req }) {
-      return libs.timeline.persistFavorite(req, args.timelineId || null);
+      return libs.timeline.persistFavorite(
+        req,
+        args.timelineId || null,
+        args.templateTimelineId || null,
+        args.templateTimelineVersion || null,
+        args.timelineType || TimelineType.default
+      );
     },
     async persistTimeline(root, args, { req }) {
       return libs.timeline.persistTimeline(

diff --git a/x-pack/plugins/security_solution/server/graphql/timeline/schema.gql.ts b/x-pack/plugins/security_solution/server/graphql/timeline/schema.gql.ts
@@ -294,6 +294,9 @@ export const timelineSchema = gql`
     code: Float
     message: String
     savedObjectId: String!
+    templateTimelineId: String
+    templateTimelineVersion: Int
+    timelineType: TimelineType
     version: String!
     favorite: [FavoriteTimelineResult!]
   }
@@ -320,7 +323,7 @@ export const timelineSchema = gql`
   extend type Mutation {
     "Persists a timeline"
     persistTimeline(id: ID, version: String, timeline: TimelineInput!): ResponseTimeline!
-    persistFavorite(timelineId: ID): ResponseFavoriteTimeline!
+    persistFavorite(timelineId: ID, templateTimelineId: String, templateTimelineVersion: Int, timelineType: TimelineType): ResponseFavoriteTimeline!
     deleteTimeline(id: [ID!]!): Boolean!
   }
 `;
diff --git a/x-pack/plugins/security_solution/server/graphql/types.ts b/x-pack/plugins/security_solution/server/graphql/types.ts
@@ -837,6 +837,12 @@ export interface ResponseFavoriteTimeline {
 
   savedObjectId: string;
 
+  templateTimelineId?: Maybe<string>;
+
+  templateTimelineVersion?: Maybe<number>;
+
+  timelineType?: Maybe<TimelineType>;
+
   version: string;
 
   favorite?: Maybe<FavoriteTimelineResult[]>;
@@ -1693,6 +1699,12 @@ export interface PersistTimelineMutationArgs {
 }
 export interface PersistFavoriteMutationArgs {
   timelineId?: Maybe<string>;
+
+  templateTimelineId?: Maybe<string>;
+
+  templateTimelineVersion?: Maybe<number>;
+
+  timelineType?: Maybe<TimelineType>;
 }
 export interface DeleteTimelineMutationArgs {
   id: string[];
@@ -3419,6 +3431,12 @@ export namespace MutationResolvers {
   > = Resolver<R, Parent, TContext, PersistFavoriteArgs>;
   export interface PersistFavoriteArgs {
     timelineId?: Maybe<string>;
+
+    templateTimelineId?: Maybe<string>;
+
+    templateTimelineVersion?: Maybe<number>;
+
+    timelineType?: Maybe<TimelineType>;
   }
 
   export type DeleteTimelineResolver<R = boolean, Parent = {}, TContext = SiemContext> = Resolver<
@@ -3492,6 +3510,12 @@ export namespace ResponseFavoriteTimelineResolvers {
 
     savedObjectId?: SavedObjectIdResolver<string, TypeParent, TContext>;
 
+    templateTimelineId?: TemplateTimelineIdResolver<Maybe<string>, TypeParent, TContext>;
+
+    templateTimelineVersion?: TemplateTimelineVersionResolver<Maybe<number>, TypeParent, TContext>;
+
+    timelineType?: TimelineTypeResolver<Maybe<TimelineType>, TypeParent, TContext>;
+
     version?: VersionResolver<string, TypeParent, TContext>;
 
     favorite?: FavoriteResolver<Maybe<FavoriteTimelineResult[]>, TypeParent, TContext>;
@@ -3512,6 +3536,21 @@ export namespace ResponseFavoriteTimelineResolvers {
     Parent = ResponseFavoriteTimeline,
     TContext = SiemContext
   > = Resolver<R, Parent, TContext>;
+  export type TemplateTimelineIdResolver<
+    R = Maybe<string>,
+    Parent = ResponseFavoriteTimeline,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
+  export type TemplateTimelineVersionResolver<
+    R = Maybe<number>,
+    Parent = ResponseFavoriteTimeline,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
+  export type TimelineTypeResolver<
+    R = Maybe<TimelineType>,
+    Parent = ResponseFavoriteTimeline,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
   export type VersionResolver<
     R = string,
     Parent = ResponseFavoriteTimeline,

diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object.ts
@@ -76,7 +76,10 @@ export interface Timeline {
 
   persistFavorite: (
     request: FrameworkRequest,
-    timelineId: string | null
+    timelineId: string | null,
+    templateTimelineId: string | null,
+    templateTimelineVersion: number | null,
+    timelineType: TimelineType
   ) => Promise<ResponseFavoriteTimeline>;
 
   persistTimeline: (
@@ -281,7 +284,10 @@ export const getDraftTimeline = async (
 
 export const persistFavorite = async (
   request: FrameworkRequest,
-  timelineId: string | null
+  timelineId: string | null,
+  templateTimelineId: string | null,
+  templateTimelineVersion: number | null,
+  timelineType: TimelineType
 ): Promise<ResponseFavoriteTimeline> => {
   const userName = request.user?.username ?? UNAUTHENTICATED_USER;
   const fullName = request.user?.full_name ?? '';
@@ -324,14 +330,22 @@ export const persistFavorite = async (
       timeline.favorite = [userFavoriteTimeline];
     }
 
-    const persistResponse = await persistTimeline(request, timelineId, null, timeline);
+    const persistResponse = await persistTimeline(request, timelineId, null, {
+      ...timeline,
+      templateTimelineId,
+      templateTimelineVersion,
+      timelineType,
+    });
     return {
       savedObjectId: persistResponse.timeline.savedObjectId,
       version: persistResponse.timeline.version,
       favorite:
         persistResponse.timeline.favorite != null
           ? persistResponse.timeline.favorite.filter((fav) => fav.userName === userName)
           : [],
+      templateTimelineId,
+      templateTimelineVersion,
+      timelineType,
     };
   } catch (err) {
     if (getOr(null, 'output.statusCode', err) === 403) {

diff --git a/...plugins/security_solution/server/search_strategy/timeline/factory/events/details/index.ts b/...plugins/security_solution/server/search_strategy/timeline/factory/events/details/index.ts
@@ -32,11 +32,19 @@ export const timelineEventsDetails: SecuritySolutionTimelineFactory<TimelineEven
     const inspect = {
       dsl: [inspectStringifyObject(buildTimelineDetailsQuery(indexName, eventId, docValueFields))],
     };
+
+    if (response.isRunning) {
+      return {
+        ...response,
+        data: [],
+        inspect,
+      };
+    }
+
     const sourceData = getDataFromSourceHits(_source);
     const fieldsData = getDataFromFieldsHits(merge(fields, hitsData));
 
     const data = unionBy('field', fieldsData, sourceData);
-
     return {
       ...response,
       data,