From 50f80f44a844b876362438be019f8daffe10ca32 Mon Sep 17 00:00:00 2001 From: Brian Seeders Date: Tue, 5 Apr 2022 11:05:11 -0400 Subject: [PATCH 01/47] [CI] Add SSH info to agent debug logs (#129413) --- .buildkite/scripts/lifecycle/post_command.sh | 1 + .buildkite/scripts/lifecycle/pre_command.sh | 9 +++++++++ .buildkite/scripts/lifecycle/print_agent_links.js | 1 - 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.buildkite/scripts/lifecycle/post_command.sh b/.buildkite/scripts/lifecycle/post_command.sh index a77798345695e..df728b6ee67d8 100755 --- a/.buildkite/scripts/lifecycle/post_command.sh +++ b/.buildkite/scripts/lifecycle/post_command.sh @@ -2,6 +2,7 @@ set -euo pipefail +echo '--- Agent Debug Info' node .buildkite/scripts/lifecycle/print_agent_links.js || true IS_TEST_EXECUTION_STEP="$(buildkite-agent meta-data get "${BUILDKITE_JOB_ID}_is_test_execution_step" --default '')" diff --git a/.buildkite/scripts/lifecycle/pre_command.sh b/.buildkite/scripts/lifecycle/pre_command.sh index 7adae7ff74904..8b2f1f65a52f4 100755 --- a/.buildkite/scripts/lifecycle/pre_command.sh +++ b/.buildkite/scripts/lifecycle/pre_command.sh @@ -26,8 +26,17 @@ retry 5 15 install_deps cd .. +echo '--- Agent Debug/SSH Info' node .buildkite/scripts/lifecycle/print_agent_links.js || true +if [[ "$(curl -is metadata.google.internal || true)" ]]; then + echo "" + echo "To SSH into this agent, run:" + echo "gcloud compute ssh --tunnel-through-iap --project elastic-kibana-ci --zone \"$(curl -sH Metadata-Flavor:Google http://metadata.google.internal/computeMetadata/v1/instance/zone)\" \"$(curl -sH Metadata-Flavor:Google http://metadata.google.internal/computeMetadata/v1/instance/name)\"" + echo "" +fi + + echo '--- Job Environment Setup' # Set up a custom ES Snapshot Manifest if one has been specified for this build diff --git a/.buildkite/scripts/lifecycle/print_agent_links.js b/.buildkite/scripts/lifecycle/print_agent_links.js index a4acf1b8f222b..d720fcc82bbcd 100644 --- a/.buildkite/scripts/lifecycle/print_agent_links.js +++ b/.buildkite/scripts/lifecycle/print_agent_links.js @@ -30,7 +30,6 @@ const { BuildkiteClient } = require('kibana-buildkite-library'); `?time=${startTime.getTime()}`, ].join(''); - console.log('--- Agent Debug Links'); console.log('Agent Metrics:'); console.log('\u001b]1339;' + `url='${METRICS_URL}'\u0007`); console.log('Agent Logs:'); From a9e6f0aed0c03d55839dda611bdd75b133f24435 Mon Sep 17 00:00:00 2001 From: Candace Park <56409205+parkiino@users.noreply.github.com> Date: Tue, 5 Apr 2022 11:20:14 -0400 Subject: [PATCH 02/47] [Security Solution][Admin][Policy] Clean up Policy list (#129139) --- .../components/management_empty_state.tsx | 9 ++--- .../use_bulk_delete_artifact.test.tsx | 2 +- .../use_bulk_update_artifact.test.tsx | 2 +- .../artifacts/use_create_artifact.test.tsx | 2 +- .../artifacts/use_delete_artifact.test.tsx | 2 +- .../hooks/artifacts/use_get_artifact.test.tsx | 2 +- .../artifacts/use_list_artifact.test.tsx | 2 +- .../artifacts/use_summary_artifact.test.tsx | 2 +- .../artifacts/use_update_artifact.test.tsx | 2 +- .../hooks/{artifacts => }/test_utils.tsx | 4 +-- .../store/endpoint_pagination.test.ts | 2 +- .../endpoint_hosts/store/middleware.test.ts | 2 +- .../pages/endpoint_hosts/store/middleware.ts | 2 +- .../store/mock_endpoint_result_list.ts | 2 +- .../pages/endpoint_hosts/view/index.test.tsx | 4 +-- .../pages/endpoint_hosts/view/index.tsx | 5 ++- .../view/components/flyout/index.test.tsx | 2 +- .../view/components/form/index.test.tsx | 2 +- .../view/event_filters_list_page.test.tsx | 2 +- .../view/components/form.test.tsx | 2 +- .../view/components/form_flyout.test.tsx | 2 +- .../host_isolation_exceptions_list.test.tsx | 2 +- .../middleware/policy_settings_middleware.ts | 2 +- .../pages/policy/store/test_mock_utils.ts | 5 ++- .../pages/policy/view/policy_list.test.tsx | 36 +++++++++++++++++-- .../pages/policy/view/policy_list.tsx | 21 ++++++----- .../validate_trusted_app_http_request_body.ts | 2 +- .../services/policies/hooks.test.ts | 2 +- .../management/services/policies/hooks.ts | 5 +-- .../policies}/ingest.test.ts | 6 ++-- .../services => services/policies}/ingest.ts | 6 ++-- .../management/services/policies/policies.ts | 2 +- ...test_mock_utilts.ts => test_mock_utils.ts} | 0 33 files changed, 88 insertions(+), 57 deletions(-) rename x-pack/plugins/security_solution/public/management/hooks/{artifacts => }/test_utils.tsx (92%) rename x-pack/plugins/security_solution/public/management/{pages/policy/store/services => services/policies}/ingest.test.ts (90%) rename x-pack/plugins/security_solution/public/management/{pages/policy/store/services => services/policies}/ingest.ts (95%) rename x-pack/plugins/security_solution/public/management/services/policies/{test_mock_utilts.ts => test_mock_utils.ts} (100%) diff --git a/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx b/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx index b659cdd118837..80dd9e9563bb5 100644 --- a/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx +++ b/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx @@ -23,7 +23,6 @@ import { } from '@elastic/eui'; import { i18n } from '@kbn/i18n'; import { FormattedMessage } from '@kbn/i18n-react'; -import styled from 'styled-components'; import onboardingLogo from '../images/security_administration_onboarding.svg'; import { useKibana } from '../../common/lib/kibana'; @@ -41,10 +40,6 @@ interface ManagementStep { children: JSX.Element; } -const StyledDiv = styled.div` - padding-left: 20%; -`; - const PolicyEmptyState = React.memo<{ loading: boolean; onActionClick: (event: MouseEvent) => void; @@ -53,7 +48,7 @@ const PolicyEmptyState = React.memo<{ }>(({ loading, onActionClick, actionDisabled, policyEntryPoint = false }) => { const docLinks = useKibana().services.docLinks; return ( - +
{loading ? ( @@ -128,7 +123,7 @@ const PolicyEmptyState = React.memo<{ )} - +
); }); diff --git a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_bulk_delete_artifact.test.tsx b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_bulk_delete_artifact.test.tsx index 152b2c3f0d690..a27a0e949835a 100644 --- a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_bulk_delete_artifact.test.tsx +++ b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_bulk_delete_artifact.test.tsx @@ -13,7 +13,7 @@ import { getFakeListDefinition, getFakeHttpService, renderMutation, -} from './test_utils'; +} from '../test_utils'; import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock'; import { act } from '@testing-library/react-hooks'; diff --git a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_bulk_update_artifact.test.tsx b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_bulk_update_artifact.test.tsx index a622eedb99f1e..7309979266e2c 100644 --- a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_bulk_update_artifact.test.tsx +++ b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_bulk_update_artifact.test.tsx @@ -13,7 +13,7 @@ import { getFakeListDefinition, getFakeHttpService, renderMutation, -} from './test_utils'; +} from '../test_utils'; import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock'; import { act } from '@testing-library/react-hooks'; diff --git a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_create_artifact.test.tsx b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_create_artifact.test.tsx index 89ce9ece8fa13..6bc703939bdf7 100644 --- a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_create_artifact.test.tsx +++ b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_create_artifact.test.tsx @@ -13,7 +13,7 @@ import { getFakeListDefinition, getFakeHttpService, renderMutation, -} from './test_utils'; +} from '../test_utils'; import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock'; import { act } from '@testing-library/react-hooks'; diff --git a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_delete_artifact.test.tsx b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_delete_artifact.test.tsx index bed3faf237b9f..c4195c3a63886 100644 --- a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_delete_artifact.test.tsx +++ b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_delete_artifact.test.tsx @@ -13,7 +13,7 @@ import { getFakeListDefinition, getFakeHttpService, renderMutation, -} from './test_utils'; +} from '../test_utils'; import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock'; import { act } from '@testing-library/react-hooks'; diff --git a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_get_artifact.test.tsx b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_get_artifact.test.tsx index 470f29b563f67..ad66381c8185a 100644 --- a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_get_artifact.test.tsx +++ b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_get_artifact.test.tsx @@ -13,7 +13,7 @@ import { getFakeListDefinition, getFakeHttpService, renderQuery, -} from './test_utils'; +} from '../test_utils'; import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock'; describe('Get artifact hook', () => { diff --git a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_list_artifact.test.tsx b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_list_artifact.test.tsx index 9ba0760961d7f..75387e3d01b1b 100644 --- a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_list_artifact.test.tsx +++ b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_list_artifact.test.tsx @@ -14,7 +14,7 @@ import { getFakeListDefinition, getFakeHttpService, renderQuery, -} from './test_utils'; +} from '../test_utils'; describe('List artifact hook', () => { let result: ReturnType; diff --git a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_summary_artifact.test.tsx b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_summary_artifact.test.tsx index 18c8f928660d9..32c14ece79a78 100644 --- a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_summary_artifact.test.tsx +++ b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_summary_artifact.test.tsx @@ -14,7 +14,7 @@ import { getFakeListDefinition, getFakeHttpService, renderQuery, -} from './test_utils'; +} from '../test_utils'; describe('Summary artifact hook', () => { let result: ReturnType; diff --git a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_update_artifact.test.tsx b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_update_artifact.test.tsx index c850648e3160a..3673114041552 100644 --- a/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_update_artifact.test.tsx +++ b/x-pack/plugins/security_solution/public/management/hooks/artifacts/use_update_artifact.test.tsx @@ -13,7 +13,7 @@ import { getFakeListDefinition, getFakeHttpService, renderMutation, -} from './test_utils'; +} from '../test_utils'; import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock'; import { act } from '@testing-library/react-hooks'; diff --git a/x-pack/plugins/security_solution/public/management/hooks/artifacts/test_utils.tsx b/x-pack/plugins/security_solution/public/management/hooks/test_utils.tsx similarity index 92% rename from x-pack/plugins/security_solution/public/management/hooks/artifacts/test_utils.tsx rename to x-pack/plugins/security_solution/public/management/hooks/test_utils.tsx index 2680d1a0ddd8e..7d7f999831363 100644 --- a/x-pack/plugins/security_solution/public/management/hooks/artifacts/test_utils.tsx +++ b/x-pack/plugins/security_solution/public/management/hooks/test_utils.tsx @@ -8,8 +8,8 @@ import React from 'react'; import { renderHook } from '@testing-library/react-hooks'; import { HttpSetup } from 'kibana/public'; import { CreateExceptionListSchema } from '@kbn/securitysolution-io-ts-list-types'; -import { coreMock } from '../../../../../../../src/core/public/mocks'; -import { ReactQueryClientProvider } from '../../../common/containers/query_client/query_client_provider'; +import { coreMock } from '../../../../../../src/core/public/mocks'; +import { ReactQueryClientProvider } from '../../common/containers/query_client/query_client_provider'; export const getFakeListId: () => string = () => 'FAKE_LIST_ID'; export const getFakeListDefinition: () => CreateExceptionListSchema = () => ({ diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/endpoint_pagination.test.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/endpoint_pagination.test.ts index 214fc220e04fb..969bac811e632 100644 --- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/endpoint_pagination.test.ts +++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/endpoint_pagination.test.ts @@ -31,7 +31,7 @@ import { import { getEndpointListPath } from '../../../common/routing'; import { HOST_METADATA_LIST_ROUTE } from '../../../../../common/endpoint/constants'; -jest.mock('../../policy/store/services/ingest', () => ({ +jest.mock('../../../services/policies/ingest', () => ({ sendGetAgentPolicyList: () => Promise.resolve({ items: [] }), sendGetEndpointSecurityPackage: () => Promise.resolve({}), })); diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts index 7fc80bffd7c04..ab24e2a41a64e 100644 --- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts +++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts @@ -49,7 +49,7 @@ import { HOST_METADATA_LIST_ROUTE, } from '../../../../../common/endpoint/constants'; -jest.mock('../../policy/store/services/ingest', () => ({ +jest.mock('../../../services/policies/ingest', () => ({ sendGetAgentConfigList: () => Promise.resolve({ items: [] }), sendGetAgentPolicyList: () => Promise.resolve({ items: [] }), sendGetEndpointSecurityPackage: () => Promise.resolve({ version: '1.1.1' }), diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts index 9d839be623920..2d433a4cdf8c5 100644 --- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts +++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts @@ -46,7 +46,7 @@ import { sendGetAgentPolicyList, sendGetEndpointSecurityPackage, sendGetFleetAgentsWithEndpoint, -} from '../../policy/store/services/ingest'; +} from '../../../services/policies/ingest'; import { GetPolicyListResponse } from '../../policy/types'; import { AgentIdsPendingActions, diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts index 6a18bf5e16759..3c0d7163ef723 100644 --- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts +++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/mock_endpoint_result_list.ts @@ -20,7 +20,7 @@ import { INGEST_API_EPM_PACKAGES, INGEST_API_PACKAGE_POLICIES, INGEST_API_FLEET_AGENTS, -} from '../../policy/store/services/ingest'; +} from '../../../services/policies/ingest'; import { GetAgentPoliciesResponse, GetAgentPoliciesResponseItem, diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx index 07a766f3fd768..9e86b0389c19d 100644 --- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx @@ -69,8 +69,8 @@ jest.mock('@kbn/i18n-react', () => { }; }); jest.mock('../../../../common/components/link_to'); -jest.mock('../../policy/store/services/ingest', () => { - const originalModule = jest.requireActual('../../policy/store/services/ingest'); +jest.mock('../../../services/policies/ingest', () => { + const originalModule = jest.requireActual('../../../services/policies/ingest'); return { ...originalModule, sendGetEndpointSecurityPackage: () => Promise.resolve({}), diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx index c43c20a4bcae1..441f2502fa3f7 100644 --- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx @@ -69,6 +69,7 @@ import { BackToExternalAppButtonProps, } from '../../../components/back_to_external_app_button/back_to_external_app_button'; import { DevConsole } from './dev_console'; +import { ManagementEmptyStateWrapper } from '../../../components/management_empty_state_wrapper'; const MAX_PAGINATED_ITEM = 9999; const TRANSFORM_URL = '/data/transform'; @@ -551,7 +552,9 @@ export const EndpointList = () => { ); } else { return ( - + + + ); } }, [ diff --git a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/flyout/index.test.tsx b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/flyout/index.test.tsx index 5145e78bbd397..8ff68d266031a 100644 --- a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/flyout/index.test.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/flyout/index.test.tsx @@ -14,7 +14,7 @@ import { } from '../../../../../../common/mock/endpoint'; import { MiddlewareActionSpyHelper } from '../../../../../../common/store/test_utils'; import { sendGetEndpointSpecificPackagePolicies } from '../../../../../services/policies/policies'; -import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../../../services/policies/test_mock_utilts'; +import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../../../services/policies/test_mock_utils'; import type { CreateExceptionListItemSchema, ExceptionListItemSchema, diff --git a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/form/index.test.tsx b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/form/index.test.tsx index 96cdef21244d0..dc1721d2580e8 100644 --- a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/form/index.test.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/form/index.test.tsx @@ -20,7 +20,7 @@ import { createAppRootMockRenderer, } from '../../../../../../common/mock/endpoint'; import { EventFiltersListPageState } from '../../../types'; -import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../../../services/policies/test_mock_utilts'; +import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../../../services/policies/test_mock_utils'; import { GetPolicyListResponse } from '../../../../policy/types'; import userEvent from '@testing-library/user-event'; import { ExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types'; diff --git a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.test.tsx b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.test.tsx index 5833c12be879f..ec0adf0c10a23 100644 --- a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.test.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.test.tsx @@ -13,7 +13,7 @@ import { EventFiltersListPage } from './event_filters_list_page'; import { eventFiltersListQueryHttpMock } from '../test_utils'; import { isFailedResourceState, isLoadedResourceState } from '../../../state'; import { sendGetEndpointSpecificPackagePolicies } from '../../../services/policies/policies'; -import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../services/policies/test_mock_utilts'; +import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../services/policies/test_mock_utils'; // Needed to mock the data services used by the ExceptionItem component jest.mock('../../../../common/lib/kibana'); diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.test.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.test.tsx index 0d04ee83a56e5..b9ffec3c8bc39 100644 --- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.test.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form.test.tsx @@ -16,7 +16,7 @@ import { AppContextTestRender, createAppRootMockRenderer, } from '../../../../../common/mock/endpoint'; -import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../../services/policies/test_mock_utilts'; +import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../../services/policies/test_mock_utils'; import { GetPolicyListResponse } from '../../../policy/types'; import { createEmptyHostIsolationException } from '../../utils'; import { HostIsolationExceptionsForm } from './form'; diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.test.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.test.tsx index e9735c6bad5ef..46ea59a802c49 100644 --- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.test.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/components/form_flyout.test.tsx @@ -15,7 +15,7 @@ import { } from '../../../../../common/mock/endpoint'; import { getHostIsolationExceptionsListPath } from '../../../../common/routing'; import { sendGetEndpointSpecificPackagePolicies } from '../../../../services/policies/policies'; -import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../../services/policies/test_mock_utilts'; +import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../../services/policies/test_mock_utils'; import { createHostIsolationExceptionItem, getOneHostIsolationExceptionItem, diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx index 57c8485c0eda6..e84dfeb336f1f 100644 --- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx @@ -14,7 +14,7 @@ import { EndpointPrivileges } from '../../../../../common/endpoint/types'; import { useUserPrivileges as _useUserPrivileges } from '../../../../common/components/user_privileges'; import { AppContextTestRender, createAppRootMockRenderer } from '../../../../common/mock/endpoint'; import { sendGetEndpointSpecificPackagePolicies } from '../../../services/policies/policies'; -import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../services/policies/test_mock_utilts'; +import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../services/policies/test_mock_utils'; import { getHostIsolationExceptionItems } from '../service'; import { HostIsolationExceptionsList } from './host_isolation_exceptions_list'; diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_settings_middleware.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_settings_middleware.ts index 784565b5d8e1d..f90fdf1213581 100644 --- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_settings_middleware.ts +++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware/policy_settings_middleware.ts @@ -22,7 +22,7 @@ import { sendGetPackagePolicy, sendGetFleetAgentStatusForPolicy, sendPutPackagePolicy, -} from '../../services/ingest'; +} from '../../../../../services/policies/ingest'; import { NewPolicyData, PolicyData } from '../../../../../../../common/endpoint/types'; import { getPolicyDataForUpdate } from '../../../../../../../common/endpoint/service/policy'; diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/test_mock_utils.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/test_mock_utils.ts index 785ba6f066ffb..bfd4637a1f416 100644 --- a/x-pack/plugins/security_solution/public/management/pages/policy/store/test_mock_utils.ts +++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/test_mock_utils.ts @@ -5,7 +5,10 @@ * 2.0. */ -import { INGEST_API_EPM_PACKAGES, INGEST_API_PACKAGE_POLICIES } from './services/ingest'; +import { + INGEST_API_EPM_PACKAGES, + INGEST_API_PACKAGE_POLICIES, +} from '../../../services/policies/ingest'; import { EndpointDocGenerator } from '../../../../../common/endpoint/generate_data'; import { GetPolicyListResponse } from '../types'; import { GetPackagesResponse } from '../../../../../../fleet/common'; diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.test.tsx index 025c36261d120..482fe0ba064bd 100644 --- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.test.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.test.tsx @@ -9,15 +9,15 @@ import React from 'react'; import { act, waitFor, fireEvent } from '@testing-library/react'; import { AppContextTestRender, createAppRootMockRenderer } from '../../../../common/mock/endpoint'; import { sendGetEndpointSpecificPackagePolicies } from '../../../services/policies/policies'; -import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../services/policies/test_mock_utilts'; +import { sendGetEndpointSpecificPackagePoliciesMock } from '../../../services/policies/test_mock_utils'; import { PolicyList } from './policy_list'; -import { sendGetAgentPolicyList } from '../store/services/ingest'; +import { sendGetAgentPolicyList } from '../../../services/policies/ingest'; import { GetPolicyListResponse } from '../types'; import { getEndpointListPath, getPoliciesPath } from '../../../common/routing'; import { APP_UI_ID } from '../../../../../common/constants'; jest.mock('../../../services/policies/policies'); -jest.mock('../store/services/ingest'); +jest.mock('../../../services/policies/ingest'); const getPackagePolicies = sendGetEndpointSpecificPackagePolicies as jest.Mock; @@ -39,6 +39,36 @@ describe('When on the policy list page', () => { jest.clearAllMocks(); }); + describe('and there are no policies', () => { + beforeEach(async () => { + getPackagePolicies.mockImplementation(() => + sendGetEndpointSpecificPackagePoliciesMock({ + page: 1, + perPage: 20, + count: 0, + }) + ); + render(); + await waitFor(() => { + expect(getPackagePolicies).toHaveBeenCalled(); + }); + }); + afterEach(() => { + getPackagePolicies.mockReset(); + }); + it('should show the empty page', () => { + expect(renderResult.getByTestId('emptyPolicyTable')).toBeTruthy(); + }); + it('should show instruction text and a button to add the Endpoint Security integration', () => { + expect( + renderResult.findByText( + 'From this page, you’ll be able to view and manage the Endpoint Security Integration policies in your environment running Endpoint Security.' + ) + ).toBeTruthy(); + expect(renderResult.getByTestId('onboardingStartButton')).toBeTruthy(); + }); + }); + describe('and data exists', () => { let policies: GetPolicyListResponse; beforeEach(async () => { diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx index ad0c7fb287976..44649936c490a 100644 --- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx @@ -32,11 +32,12 @@ import { import { AgentPolicy } from '../../../../../../fleet/common'; import { PolicyEmptyState } from '../../../components/management_empty_state'; import { useNavigateToAppEventHandler } from '../../../../common/hooks/endpoint/use_navigate_to_app_event_handler'; -import { CreatePackagePolicyRouteState } from '../../../../../../fleet/public'; +import { CreatePackagePolicyRouteState, pagePathGetters } from '../../../../../../fleet/public'; import { APP_UI_ID } from '../../../../../common/constants'; import { getPoliciesPath } from '../../../common/routing'; import { useAppUrl, useToasts } from '../../../../common/lib/kibana'; import { PolicyEndpointCount } from './components/policy_endpoint_count'; +import { ManagementEmptyStateWrapper } from '../../../components/management_empty_state_wrapper'; export const PolicyList = memo(() => { const { pagination, pageSizeOptions, setPagination } = useUrlPagination(); @@ -122,9 +123,9 @@ export const PolicyList = memo(() => { const handleCreatePolicyClick = useNavigateToAppEventHandler( 'fleet', { - path: `/integrations/${ - endpointPackageInfo ? `/endpoint-${endpointPackageInfo?.version}` : '' - }/add-integration`, + path: pagePathGetters.add_integration_to_policy({ + pkgkey: endpointPackageInfo ? `/endpoint-${endpointPackageInfo?.version}` : '', + })[1], state: { onCancelNavigateTo: [ APP_UI_ID, @@ -316,11 +317,13 @@ export const PolicyList = memo(() => { /> ) : ( - + + + )} ); diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/validate_trusted_app_http_request_body.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/validate_trusted_app_http_request_body.ts index e0a5adac67494..60568594c7784 100644 --- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/validate_trusted_app_http_request_body.ts +++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/service/validate_trusted_app_http_request_body.ts @@ -11,7 +11,7 @@ import { PutTrustedAppUpdateRequest, } from '../../../../../common/endpoint/types'; import { HttpRequestValidationError } from './errors'; -import { sendGetAgentPolicyList } from '../../policy/store/services/ingest'; +import { sendGetAgentPolicyList } from '../../../services/policies/ingest'; import { AGENT_POLICY_SAVED_OBJECT_TYPE } from '../../../../../../fleet/common'; /** diff --git a/x-pack/plugins/security_solution/public/management/services/policies/hooks.test.ts b/x-pack/plugins/security_solution/public/management/services/policies/hooks.test.ts index 2b01366d8306e..aa7b50c69ed56 100644 --- a/x-pack/plugins/security_solution/public/management/services/policies/hooks.test.ts +++ b/x-pack/plugins/security_solution/public/management/services/policies/hooks.test.ts @@ -7,7 +7,7 @@ import { useGetEndpointSecurityPackage } from './hooks'; import { HttpFetchError, HttpSetup } from 'kibana/public'; -import { getFakeHttpService, renderQuery } from '../../hooks/artifacts/test_utils'; +import { getFakeHttpService, renderQuery } from '../../hooks/test_utils'; import { EndpointDocGenerator } from '../../../../common/endpoint/generate_data'; import { UseQueryOptions } from 'react-query'; import { GetPackagesResponse } from '../../../../../fleet/common'; diff --git a/x-pack/plugins/security_solution/public/management/services/policies/hooks.ts b/x-pack/plugins/security_solution/public/management/services/policies/hooks.ts index 7b8ce6a86b148..649dd39e38da6 100644 --- a/x-pack/plugins/security_solution/public/management/services/policies/hooks.ts +++ b/x-pack/plugins/security_solution/public/management/services/policies/hooks.ts @@ -13,10 +13,7 @@ import { } from '../../../../../fleet/common'; import { useHttp } from '../../../common/lib/kibana'; import { MANAGEMENT_DEFAULT_PAGE_SIZE } from '../../common/constants'; -import { - sendGetAgentPolicyList, - sendGetEndpointSecurityPackage, -} from '../../pages/policy/store/services/ingest'; +import { sendGetAgentPolicyList, sendGetEndpointSecurityPackage } from './ingest'; import { GetPolicyListResponse } from '../../pages/policy/types'; import { sendGetEndpointSpecificPackagePolicies } from './policies'; import { ServerApiError } from '../../../common/types'; diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/services/ingest.test.ts b/x-pack/plugins/security_solution/public/management/services/policies/ingest.test.ts similarity index 90% rename from x-pack/plugins/security_solution/public/management/pages/policy/store/services/ingest.test.ts rename to x-pack/plugins/security_solution/public/management/services/policies/ingest.test.ts index ef66c948e1127..bd34f7c14e22a 100644 --- a/x-pack/plugins/security_solution/public/management/pages/policy/store/services/ingest.test.ts +++ b/x-pack/plugins/security_solution/public/management/services/policies/ingest.test.ts @@ -10,9 +10,9 @@ import { sendGetPackagePolicy, sendGetEndpointSecurityPackage, } from './ingest'; -import { httpServiceMock } from '../../../../../../../../../src/core/public/mocks'; -import { EPM_API_ROUTES, PACKAGE_POLICY_API_ROOT } from '../../../../../../../fleet/common'; -import { policyListApiPathHandlers } from '../test_mock_utils'; +import { httpServiceMock } from '../../../../../../../src/core/public/mocks'; +import { EPM_API_ROUTES, PACKAGE_POLICY_API_ROOT } from '../../../../../fleet/common'; +import { policyListApiPathHandlers } from '../../pages/policy/store/test_mock_utils'; describe('ingest service', () => { let http: ReturnType; diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/services/ingest.ts b/x-pack/plugins/security_solution/public/management/services/policies/ingest.ts similarity index 95% rename from x-pack/plugins/security_solution/public/management/pages/policy/store/services/ingest.ts rename to x-pack/plugins/security_solution/public/management/services/policies/ingest.ts index 651d5840116f0..0863682357aca 100644 --- a/x-pack/plugins/security_solution/public/management/pages/policy/store/services/ingest.ts +++ b/x-pack/plugins/security_solution/public/management/services/policies/ingest.ts @@ -14,9 +14,9 @@ import { GetPackagesResponse, GetAgentPoliciesRequest, GetAgentPoliciesResponse, -} from '../../../../../../../fleet/common'; -import { GetPolicyResponse, UpdatePolicyResponse } from '../../types'; -import { NewPolicyData } from '../../../../../../common/endpoint/types'; +} from '../../../../../fleet/common'; +import { NewPolicyData } from '../../../../common/endpoint/types'; +import { GetPolicyResponse, UpdatePolicyResponse } from '../../pages/policy/types'; const INGEST_API_ROOT = `/api/fleet`; export const INGEST_API_PACKAGE_POLICIES = `${INGEST_API_ROOT}/package_policies`; diff --git a/x-pack/plugins/security_solution/public/management/services/policies/policies.ts b/x-pack/plugins/security_solution/public/management/services/policies/policies.ts index 2cd71fb26655a..219bf7698baaa 100644 --- a/x-pack/plugins/security_solution/public/management/services/policies/policies.ts +++ b/x-pack/plugins/security_solution/public/management/services/policies/policies.ts @@ -10,8 +10,8 @@ import { GetPackagePoliciesRequest, PACKAGE_POLICY_SAVED_OBJECT_TYPE, } from '../../../../../fleet/common'; -import { INGEST_API_PACKAGE_POLICIES } from '../../pages/policy/store/services/ingest'; import { GetPolicyListResponse } from '../../pages/policy/types'; +import { INGEST_API_PACKAGE_POLICIES } from './ingest'; /** * Retrieves a list of endpoint specific package policies (those created with a `package.name` of diff --git a/x-pack/plugins/security_solution/public/management/services/policies/test_mock_utilts.ts b/x-pack/plugins/security_solution/public/management/services/policies/test_mock_utils.ts similarity index 100% rename from x-pack/plugins/security_solution/public/management/services/policies/test_mock_utilts.ts rename to x-pack/plugins/security_solution/public/management/services/policies/test_mock_utils.ts From fcf862220bce2d66668008cd7e18d08fe0a826b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20Haro?= Date: Tue, 5 Apr 2022 17:21:57 +0200 Subject: [PATCH 03/47] Create `@elastic/analytics` package (#128407) Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> --- .buildkite/scripts/build_kibana_plugins.sh | 1 + .../scripts/steps/functional/oss_misc.sh | 8 + .github/CODEOWNERS | 1 + api_docs/actions.devdocs.json | 2 +- api_docs/actions.mdx | 2 +- api_docs/advanced_settings.mdx | 2 +- api_docs/alerting.devdocs.json | 3675 +++++++++-------- api_docs/alerting.mdx | 4 +- api_docs/apm.devdocs.json | 2 +- api_docs/apm.mdx | 2 +- api_docs/banners.mdx | 2 +- api_docs/bfetch.mdx | 2 +- api_docs/canvas.mdx | 2 +- api_docs/cases.devdocs.json | 60 +- api_docs/cases.mdx | 2 +- api_docs/charts.mdx | 2 +- api_docs/cloud.mdx | 2 +- api_docs/cloud_security_posture.mdx | 2 +- api_docs/console.mdx | 2 +- api_docs/controls.devdocs.json | 54 +- api_docs/controls.mdx | 4 +- api_docs/core.devdocs.json | 2713 ++++++++++-- api_docs/core.mdx | 7 +- api_docs/core_application.devdocs.json | 93 +- api_docs/core_application.mdx | 4 +- api_docs/core_chrome.devdocs.json | 4 +- api_docs/core_chrome.mdx | 4 +- api_docs/core_http.devdocs.json | 24 +- api_docs/core_http.mdx | 4 +- api_docs/core_saved_objects.devdocs.json | 4 +- api_docs/core_saved_objects.mdx | 4 +- api_docs/custom_integrations.mdx | 2 +- api_docs/dashboard.mdx | 2 +- api_docs/dashboard_enhanced.mdx | 2 +- api_docs/data.devdocs.json | 1224 ++++-- api_docs/data.mdx | 4 +- api_docs/data_autocomplete.mdx | 4 +- api_docs/data_enhanced.mdx | 2 +- api_docs/data_query.devdocs.json | 517 ++- api_docs/data_query.mdx | 4 +- api_docs/data_search.devdocs.json | 16 +- api_docs/data_search.mdx | 4 +- api_docs/data_ui.mdx | 33 - api_docs/data_view_editor.mdx | 2 +- api_docs/data_view_field_editor.mdx | 2 +- api_docs/data_view_management.mdx | 2 +- api_docs/data_views.devdocs.json | 534 ++- api_docs/data_views.mdx | 4 +- api_docs/data_visualizer.mdx | 2 +- api_docs/deprecations_by_api.mdx | 55 +- api_docs/deprecations_by_plugin.mdx | 56 +- api_docs/deprecations_by_team.mdx | 34 +- api_docs/dev_tools.mdx | 2 +- api_docs/discover.mdx | 2 +- api_docs/discover_enhanced.mdx | 2 +- api_docs/elastic_analytics.devdocs.json | 1726 ++++++++ api_docs/elastic_analytics.mdx | 36 + api_docs/elastic_apm_synthtrace.devdocs.json | 2 +- api_docs/elastic_apm_synthtrace.mdx | 2 +- api_docs/elastic_datemath.mdx | 2 +- api_docs/embeddable.devdocs.json | 48 + api_docs/embeddable.mdx | 4 +- api_docs/embeddable_enhanced.mdx | 2 +- api_docs/encrypted_saved_objects.mdx | 2 +- api_docs/enterprise_search.mdx | 2 +- api_docs/es_ui_shared.mdx | 2 +- api_docs/event_annotation.mdx | 2 +- api_docs/event_log.devdocs.json | 6 +- api_docs/event_log.mdx | 2 +- api_docs/expression_error.mdx | 2 +- api_docs/expression_gauge.devdocs.json | 103 +- api_docs/expression_gauge.mdx | 4 +- api_docs/expression_heatmap.mdx | 2 +- api_docs/expression_image.mdx | 2 +- api_docs/expression_metric.mdx | 2 +- api_docs/expression_metric_vis.mdx | 2 +- api_docs/expression_partition_vis.mdx | 2 +- api_docs/expression_repeat_image.mdx | 2 +- api_docs/expression_reveal_image.mdx | 2 +- api_docs/expression_shape.mdx | 2 +- api_docs/expression_tagcloud.mdx | 2 +- api_docs/expression_x_y.mdx | 2 +- api_docs/expressions.devdocs.json | 10 +- api_docs/expressions.mdx | 2 +- api_docs/features.mdx | 2 +- api_docs/field_formats.devdocs.json | 6 +- api_docs/field_formats.mdx | 2 +- api_docs/file_upload.mdx | 2 +- api_docs/fleet.devdocs.json | 2 +- api_docs/fleet.mdx | 2 +- api_docs/global_search.mdx | 2 +- api_docs/home.mdx | 2 +- api_docs/index_lifecycle_management.mdx | 2 +- api_docs/index_management.devdocs.json | 2 +- api_docs/index_management.mdx | 2 +- api_docs/infra.devdocs.json | 56 +- api_docs/infra.mdx | 7 +- api_docs/inspector.mdx | 2 +- api_docs/interactive_setup.mdx | 2 +- api_docs/kbn_ace.mdx | 2 +- api_docs/kbn_alerts.mdx | 2 +- api_docs/kbn_analytics.mdx | 2 +- api_docs/kbn_apm_config_loader.mdx | 2 +- api_docs/kbn_apm_utils.mdx | 2 +- api_docs/kbn_axe_config.mdx | 2 +- api_docs/kbn_bazel_packages.mdx | 2 +- api_docs/kbn_cli_dev_mode.mdx | 2 +- api_docs/kbn_config.mdx | 2 +- api_docs/kbn_config_schema.mdx | 2 +- api_docs/kbn_crypto.mdx | 2 +- api_docs/kbn_dev_utils.devdocs.json | 2 +- api_docs/kbn_dev_utils.mdx | 2 +- api_docs/kbn_doc_links.mdx | 2 +- api_docs/kbn_docs_utils.mdx | 2 +- api_docs/kbn_es_archiver.mdx | 2 +- api_docs/kbn_es_query.devdocs.json | 2 +- api_docs/kbn_es_query.mdx | 2 +- .../kbn_eslint_plugin_imports.devdocs.json | 244 ++ api_docs/kbn_eslint_plugin_imports.mdx | 33 + api_docs/kbn_field_types.mdx | 2 +- api_docs/kbn_generate.mdx | 2 +- api_docs/kbn_i18n.mdx | 2 +- api_docs/kbn_interpreter.mdx | 2 +- api_docs/kbn_io_ts_utils.mdx | 2 +- api_docs/kbn_logging.devdocs.json | 2 +- api_docs/kbn_logging.mdx | 2 +- api_docs/kbn_logging_mocks.mdx | 2 +- api_docs/kbn_mapbox_gl.mdx | 2 +- api_docs/kbn_monaco.mdx | 2 +- api_docs/kbn_optimizer.mdx | 2 +- api_docs/kbn_plugin_discovery.mdx | 2 +- api_docs/kbn_plugin_generator.mdx | 2 +- api_docs/kbn_plugin_helpers.mdx | 2 +- api_docs/kbn_pm.mdx | 2 +- api_docs/kbn_react_field.mdx | 2 +- api_docs/kbn_rule_data_utils.devdocs.json | 2 +- api_docs/kbn_rule_data_utils.mdx | 2 +- ...securitysolution_autocomplete.devdocs.json | 6 +- .../kbn_securitysolution_autocomplete.mdx | 2 +- ...kbn_securitysolution_es_utils.devdocs.json | 132 +- api_docs/kbn_securitysolution_es_utils.mdx | 2 +- api_docs/kbn_securitysolution_hook_utils.mdx | 2 +- ...solution_io_ts_alerting_types.devdocs.json | 10 +- ..._securitysolution_io_ts_alerting_types.mdx | 2 +- ...ritysolution_io_ts_list_types.devdocs.json | 86 +- .../kbn_securitysolution_io_ts_list_types.mdx | 2 +- api_docs/kbn_securitysolution_io_ts_types.mdx | 2 +- api_docs/kbn_securitysolution_io_ts_utils.mdx | 2 +- ...kbn_securitysolution_list_api.devdocs.json | 18 +- api_docs/kbn_securitysolution_list_api.mdx | 2 +- .../kbn_securitysolution_list_constants.mdx | 2 +- ...n_securitysolution_list_hooks.devdocs.json | 40 +- api_docs/kbn_securitysolution_list_hooks.mdx | 2 +- ...n_securitysolution_list_utils.devdocs.json | 26 +- api_docs/kbn_securitysolution_list_utils.mdx | 2 +- api_docs/kbn_securitysolution_rules.mdx | 2 +- api_docs/kbn_securitysolution_t_grid.mdx | 2 +- .../kbn_securitysolution_utils.devdocs.json | 15 +- api_docs/kbn_securitysolution_utils.mdx | 2 +- api_docs/kbn_server_http_tools.mdx | 2 +- api_docs/kbn_server_route_repository.mdx | 2 +- .../kbn_shared_ux_components.devdocs.json | 92 +- api_docs/kbn_shared_ux_components.mdx | 4 +- api_docs/kbn_shared_ux_services.mdx | 2 +- api_docs/kbn_shared_ux_storybook.mdx | 2 +- api_docs/kbn_shared_ux_utility.mdx | 2 +- api_docs/kbn_std.mdx | 2 +- api_docs/kbn_storybook.mdx | 2 +- api_docs/kbn_telemetry_tools.mdx | 2 +- api_docs/kbn_test.mdx | 2 +- api_docs/kbn_test_jest_helpers.mdx | 2 +- api_docs/kbn_type_summarizer.mdx | 2 +- api_docs/kbn_typed_react_router_config.mdx | 2 +- api_docs/kbn_ui_theme.mdx | 2 +- api_docs/kbn_utility_types.mdx | 2 +- api_docs/kbn_utils.mdx | 2 +- api_docs/kibana_overview.mdx | 2 +- api_docs/kibana_react.devdocs.json | 10 +- api_docs/kibana_react.mdx | 2 +- api_docs/kibana_utils.mdx | 2 +- api_docs/lens.devdocs.json | 4 +- api_docs/lens.mdx | 2 +- api_docs/license_api_guard.mdx | 2 +- api_docs/license_management.mdx | 2 +- api_docs/licensing.mdx | 2 +- api_docs/lists.devdocs.json | 130 +- api_docs/lists.mdx | 2 +- api_docs/management.mdx | 2 +- api_docs/maps.mdx | 2 +- api_docs/maps_ems.mdx | 2 +- api_docs/metrics_entities.devdocs.json | 66 +- api_docs/metrics_entities.mdx | 2 +- api_docs/ml.mdx | 2 +- api_docs/monitoring.mdx | 2 +- api_docs/monitoring_collection.mdx | 2 +- api_docs/navigation.devdocs.json | 20 +- api_docs/navigation.mdx | 2 +- api_docs/newsfeed.mdx | 2 +- api_docs/observability.devdocs.json | 86 +- api_docs/observability.mdx | 2 +- api_docs/osquery.mdx | 2 +- api_docs/plugin_directory.mdx | 31 +- api_docs/presentation_util.mdx | 2 +- api_docs/remote_clusters.mdx | 2 +- api_docs/reporting.mdx | 2 +- api_docs/rollup.mdx | 2 +- api_docs/rule_registry.devdocs.json | 62 +- api_docs/rule_registry.mdx | 2 +- api_docs/runtime_fields.mdx | 2 +- api_docs/saved_objects.mdx | 2 +- .../saved_objects_management.devdocs.json | 4 +- api_docs/saved_objects_management.mdx | 2 +- api_docs/saved_objects_tagging.mdx | 2 +- api_docs/saved_objects_tagging_oss.mdx | 2 +- api_docs/screenshot_mode.mdx | 2 +- api_docs/screenshotting.mdx | 2 +- api_docs/security.mdx | 2 +- api_docs/security_solution.mdx | 2 +- api_docs/session_view.mdx | 2 +- api_docs/share.mdx | 2 +- api_docs/shared_u_x.mdx | 2 +- api_docs/snapshot_restore.mdx | 2 +- api_docs/spaces.devdocs.json | 15 + api_docs/spaces.mdx | 4 +- api_docs/stack_alerts.mdx | 2 +- api_docs/task_manager.mdx | 2 +- api_docs/telemetry.devdocs.json | 2 +- api_docs/telemetry.mdx | 2 +- .../telemetry_collection_manager.devdocs.json | 66 +- api_docs/telemetry_collection_manager.mdx | 2 +- api_docs/telemetry_collection_xpack.mdx | 2 +- api_docs/telemetry_management_section.mdx | 2 +- api_docs/timelines.devdocs.json | 22 +- api_docs/timelines.mdx | 2 +- api_docs/transform.mdx | 2 +- api_docs/triggers_actions_ui.devdocs.json | 214 +- api_docs/triggers_actions_ui.mdx | 4 +- api_docs/ui_actions.mdx | 2 +- api_docs/ui_actions_enhanced.mdx | 2 +- ...vdocs.json => unified_search.devdocs.json} | 295 +- api_docs/unified_search.mdx | 36 + api_docs/url_forwarding.mdx | 2 +- api_docs/usage_collection.devdocs.json | 70 +- api_docs/usage_collection.mdx | 2 +- api_docs/ux.mdx | 2 +- api_docs/vis_default_editor.mdx | 2 +- api_docs/vis_type_gauge.mdx | 2 +- api_docs/vis_type_heatmap.mdx | 2 +- api_docs/vis_type_pie.mdx | 2 +- api_docs/vis_type_table.mdx | 2 +- api_docs/vis_type_timelion.mdx | 2 +- api_docs/vis_type_timeseries.mdx | 2 +- api_docs/vis_type_vega.mdx | 2 +- api_docs/vis_type_vislib.mdx | 2 +- api_docs/vis_type_xy.mdx | 2 +- api_docs/visualizations.devdocs.json | 2 +- api_docs/visualizations.mdx | 2 +- ...lugin-core-public.analyticsservicesetup.md | 13 + ...lugin-core-public.analyticsservicestart.md | 13 + ...ana-plugin-core-public.applicationstart.md | 2 +- ...e-public.applicationstart.navigatetourl.md | 2 +- ...-plugin-core-public.coresetup.analytics.md | 13 + .../kibana-plugin-core-public.coresetup.md | 1 + ...-plugin-core-public.corestart.analytics.md | 13 + .../kibana-plugin-core-public.corestart.md | 1 + .../core/public/kibana-plugin-core-public.md | 2 + ...blic.navigatetourloptions.forceredirect.md | 2 +- ...plugin-core-public.navigatetourloptions.md | 2 +- ...gin-core-server.analyticsservicepreboot.md | 13 + ...lugin-core-server.analyticsservicesetup.md | 13 + ...lugin-core-server.analyticsservicestart.md | 13 + ...lugin-core-server.corepreboot.analytics.md | 13 + .../kibana-plugin-core-server.corepreboot.md | 1 + ...-plugin-core-server.coresetup.analytics.md | 13 + .../kibana-plugin-core-server.coresetup.md | 1 + ...-plugin-core-server.corestart.analytics.md | 13 + .../kibana-plugin-core-server.corestart.md | 1 + .../core/server/kibana-plugin-core-server.md | 3 + package.json | 2 + packages/BUILD.bazel | 2 + packages/elastic-analytics/BUILD.bazel | 118 + packages/elastic-analytics/README.md | 331 ++ packages/elastic-analytics/jest.config.js | 13 + packages/elastic-analytics/package.json | 7 + .../analytics_client/analytics_client.test.ts | 1283 ++++++ .../src/analytics_client/analytics_client.ts | 300 ++ .../src/analytics_client/context_service.ts | 77 + .../src/analytics_client/index.ts | 26 + .../src/analytics_client/mocks.ts | 26 + .../analytics_client/opt_in_config.test.ts | 329 ++ .../src/analytics_client/opt_in_config.ts | 71 + .../shippers_registry.test.ts | 123 + .../src/analytics_client/shippers_registry.ts | 73 + .../src/analytics_client/types.ts | 214 + .../elastic-analytics/src/events/index.ts | 10 + .../elastic-analytics/src/events/types.ts | 95 + packages/elastic-analytics/src/index.ts | 55 + packages/elastic-analytics/src/mocks.ts | 10 + .../elastic-analytics/src/schema/index.ts | 22 + .../src/schema/types.test.ts | 548 +++ .../elastic-analytics/src/schema/types.ts | 166 + .../elastic-analytics/src/shippers/index.ts | 9 + .../elastic-analytics/src/shippers/mocks.ts | 31 + .../elastic-analytics/src/shippers/types.ts | 35 + packages/elastic-analytics/tsconfig.json | 18 + .../analytics/analytics_service.mock.ts | 50 + .../public/analytics/analytics_service.ts | 61 + src/core/public/analytics/index.ts | 25 + src/core/public/analytics/logger.ts | 37 + src/core/public/core_system.test.ts | 12 +- src/core/public/core_system.ts | 9 + src/core/public/index.ts | 21 + src/core/public/mocks.ts | 4 + src/core/public/plugins/plugin_context.ts | 2 + .../public/plugins/plugins_service.test.ts | 3 + src/core/public/public.api.md | 49 +- .../analytics/analytics_service.mock.ts | 65 + .../server/analytics/analytics_service.ts | 77 + src/core/server/analytics/index.ts | 29 + src/core/server/index.ts | 28 + src/core/server/internal_types.ts | 8 + src/core/server/mocks.ts | 13 +- src/core/server/plugins/plugin_context.ts | 23 + src/core/server/server.api.md | 54 + src/core/server/server.ts | 11 + .../server/collector/types.ts | 40 +- test/analytics/README.md | 21 + .../plugins/analytics_ftr_helpers/kibana.json | 8 + .../analytics_ftr_helpers/package.json | 14 + .../public/custom_shipper.ts | 23 + .../analytics_ftr_helpers/public/index.ts | 13 + .../analytics_ftr_helpers/public/plugin.ts | 42 + .../analytics_ftr_helpers/public/types.ts | 18 + .../server/custom_shipper.ts | 23 + .../analytics_ftr_helpers/server/index.ts | 11 + .../analytics_ftr_helpers/server/plugin.ts | 76 + .../analytics_ftr_helpers/tsconfig.json | 16 + .../plugins/analytics_plugin_a/kibana.json | 8 + .../plugins/analytics_plugin_a/package.json | 14 + .../public/custom_shipper.ts | 43 + .../analytics_plugin_a/public/index.ts | 13 + .../analytics_plugin_a/public/plugin.ts | 85 + .../analytics_plugin_a/public/types.ts | 20 + .../server/custom_shipper.ts | 43 + .../analytics_plugin_a/server/index.ts | 11 + .../analytics_plugin_a/server/plugin.ts | 114 + .../plugins/analytics_plugin_a/tsconfig.json | 16 + test/analytics/config.ts | 42 + test/analytics/services/index.ts | 23 + test/analytics/services/kibana_ebt.ts | 74 + .../tests/analytics_from_the_browser.ts | 137 + .../tests/analytics_from_the_server.ts | 136 + test/analytics/tests/index.ts | 24 + .../from_the_browser/index.ts | 20 + .../from_the_server/index.ts | 20 + test/tsconfig.json | 3 + .../fleet/.storybook/context/index.tsx | 8 + yarn.lock | 8 + 358 files changed, 15485 insertions(+), 3783 deletions(-) delete mode 100644 api_docs/data_ui.mdx create mode 100644 api_docs/elastic_analytics.devdocs.json create mode 100644 api_docs/elastic_analytics.mdx create mode 100644 api_docs/kbn_eslint_plugin_imports.devdocs.json create mode 100644 api_docs/kbn_eslint_plugin_imports.mdx rename api_docs/{data_ui.devdocs.json => unified_search.devdocs.json} (61%) create mode 100644 api_docs/unified_search.mdx create mode 100644 docs/development/core/public/kibana-plugin-core-public.analyticsservicesetup.md create mode 100644 docs/development/core/public/kibana-plugin-core-public.analyticsservicestart.md create mode 100644 docs/development/core/public/kibana-plugin-core-public.coresetup.analytics.md create mode 100644 docs/development/core/public/kibana-plugin-core-public.corestart.analytics.md create mode 100644 docs/development/core/server/kibana-plugin-core-server.analyticsservicepreboot.md create mode 100644 docs/development/core/server/kibana-plugin-core-server.analyticsservicesetup.md create mode 100644 docs/development/core/server/kibana-plugin-core-server.analyticsservicestart.md create mode 100644 docs/development/core/server/kibana-plugin-core-server.corepreboot.analytics.md create mode 100644 docs/development/core/server/kibana-plugin-core-server.coresetup.analytics.md create mode 100644 docs/development/core/server/kibana-plugin-core-server.corestart.analytics.md create mode 100644 packages/elastic-analytics/BUILD.bazel create mode 100644 packages/elastic-analytics/README.md create mode 100644 packages/elastic-analytics/jest.config.js create mode 100644 packages/elastic-analytics/package.json create mode 100644 packages/elastic-analytics/src/analytics_client/analytics_client.test.ts create mode 100644 packages/elastic-analytics/src/analytics_client/analytics_client.ts create mode 100644 packages/elastic-analytics/src/analytics_client/context_service.ts create mode 100644 packages/elastic-analytics/src/analytics_client/index.ts create mode 100644 packages/elastic-analytics/src/analytics_client/mocks.ts create mode 100644 packages/elastic-analytics/src/analytics_client/opt_in_config.test.ts create mode 100644 packages/elastic-analytics/src/analytics_client/opt_in_config.ts create mode 100644 packages/elastic-analytics/src/analytics_client/shippers_registry.test.ts create mode 100644 packages/elastic-analytics/src/analytics_client/shippers_registry.ts create mode 100644 packages/elastic-analytics/src/analytics_client/types.ts create mode 100644 packages/elastic-analytics/src/events/index.ts create mode 100644 packages/elastic-analytics/src/events/types.ts create mode 100644 packages/elastic-analytics/src/index.ts create mode 100644 packages/elastic-analytics/src/mocks.ts create mode 100644 packages/elastic-analytics/src/schema/index.ts create mode 100644 packages/elastic-analytics/src/schema/types.test.ts create mode 100644 packages/elastic-analytics/src/schema/types.ts create mode 100644 packages/elastic-analytics/src/shippers/index.ts create mode 100644 packages/elastic-analytics/src/shippers/mocks.ts create mode 100644 packages/elastic-analytics/src/shippers/types.ts create mode 100644 packages/elastic-analytics/tsconfig.json create mode 100644 src/core/public/analytics/analytics_service.mock.ts create mode 100644 src/core/public/analytics/analytics_service.ts create mode 100644 src/core/public/analytics/index.ts create mode 100644 src/core/public/analytics/logger.ts create mode 100644 src/core/server/analytics/analytics_service.mock.ts create mode 100644 src/core/server/analytics/analytics_service.ts create mode 100644 src/core/server/analytics/index.ts create mode 100644 test/analytics/README.md create mode 100644 test/analytics/__fixtures__/plugins/analytics_ftr_helpers/kibana.json create mode 100644 test/analytics/__fixtures__/plugins/analytics_ftr_helpers/package.json create mode 100644 test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/custom_shipper.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/index.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/plugin.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/types.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/custom_shipper.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/index.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/plugin.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_ftr_helpers/tsconfig.json create mode 100644 test/analytics/__fixtures__/plugins/analytics_plugin_a/kibana.json create mode 100644 test/analytics/__fixtures__/plugins/analytics_plugin_a/package.json create mode 100644 test/analytics/__fixtures__/plugins/analytics_plugin_a/public/custom_shipper.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_plugin_a/public/index.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_plugin_a/public/plugin.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_plugin_a/public/types.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_plugin_a/server/custom_shipper.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_plugin_a/server/index.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_plugin_a/server/plugin.ts create mode 100644 test/analytics/__fixtures__/plugins/analytics_plugin_a/tsconfig.json create mode 100644 test/analytics/config.ts create mode 100644 test/analytics/services/index.ts create mode 100644 test/analytics/services/kibana_ebt.ts create mode 100644 test/analytics/tests/analytics_from_the_browser.ts create mode 100644 test/analytics/tests/analytics_from_the_server.ts create mode 100644 test/analytics/tests/index.ts create mode 100644 test/analytics/tests/instrumented_events/from_the_browser/index.ts create mode 100644 test/analytics/tests/instrumented_events/from_the_server/index.ts diff --git a/.buildkite/scripts/build_kibana_plugins.sh b/.buildkite/scripts/build_kibana_plugins.sh index 1bd99a72933f4..94366d9524346 100755 --- a/.buildkite/scripts/build_kibana_plugins.sh +++ b/.buildkite/scripts/build_kibana_plugins.sh @@ -4,6 +4,7 @@ set -euo pipefail echo "--- Build Platform Plugins" node scripts/build_kibana_platform_plugins \ + --scan-dir "$KIBANA_DIR/test/analytics/__fixtures__/plugins" \ --scan-dir "$KIBANA_DIR/test/plugin_functional/plugins" \ --scan-dir "$KIBANA_DIR/test/interpreter_functional/plugins" \ --scan-dir "$KIBANA_DIR/test/common/fixtures/plugins" \ diff --git a/.buildkite/scripts/steps/functional/oss_misc.sh b/.buildkite/scripts/steps/functional/oss_misc.sh index 48be6669f321b..22d4eda608cc2 100755 --- a/.buildkite/scripts/steps/functional/oss_misc.sh +++ b/.buildkite/scripts/steps/functional/oss_misc.sh @@ -41,3 +41,11 @@ checks-reporter-with-killswitch "Status Integration Tests" \ --config test/server_integration/http/platform/config.status.ts \ --bail \ --debug + +# Tests that must be run against source in order to build test plugins +echo --- Analytics Integration Tests +checks-reporter-with-killswitch "Analytics Integration Tests" \ + node scripts/functional_tests \ + --config test/analytics/config.ts \ + --bail \ + --debug diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 405972b4f919e..11488ea7613b3 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -269,6 +269,7 @@ /x-pack/plugins/saved_objects_tagging/ @elastic/kibana-core /x-pack/test/saved_objects_field_count/ @elastic/kibana-core /x-pack/test/saved_object_tagging/ @elastic/kibana-core +/packages/elastic-analytics/ @elastic/kibana-core /packages/kbn-config-schema/ @elastic/kibana-core /packages/kbn-std/ @elastic/kibana-core /packages/kbn-config/ @elastic/kibana-core diff --git a/api_docs/actions.devdocs.json b/api_docs/actions.devdocs.json index 0afe38f88e46b..227bba7d93599 100644 --- a/api_docs/actions.devdocs.json +++ b/api_docs/actions.devdocs.json @@ -710,7 +710,7 @@ "label": "ActionParamsType", "description": [], "signature": [ - "{ readonly message: string; readonly to: string[]; readonly subject: string; readonly cc: string[]; readonly bcc: string[]; readonly kibanaFooterLink: Readonly<{} & { path: string; text: string; }>; }" + "{ readonly message: string; readonly to: string[]; readonly subject: string; readonly cc: string[]; readonly bcc: string[]; readonly kibanaFooterLink: Readonly<{} & { text: string; path: string; }>; }" ], "path": "x-pack/plugins/actions/server/builtin_action_types/email.ts", "deprecated": false, diff --git a/api_docs/actions.mdx b/api_docs/actions.mdx index c329da6cfaa1c..72bb9168e149d 100644 --- a/api_docs/actions.mdx +++ b/api_docs/actions.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/actions title: "actions" image: https://source.unsplash.com/400x175/?github summary: API docs for the actions plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'actions'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/advanced_settings.mdx b/api_docs/advanced_settings.mdx index 7e8b1d0e40130..ae965957eacb7 100644 --- a/api_docs/advanced_settings.mdx +++ b/api_docs/advanced_settings.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/advancedSettings title: "advancedSettings" image: https://source.unsplash.com/400x175/?github summary: API docs for the advancedSettings plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'advancedSettings'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/alerting.devdocs.json b/api_docs/alerting.devdocs.json index 7f02f9bf4dae0..dcaed350c4882 100644 --- a/api_docs/alerting.devdocs.json +++ b/api_docs/alerting.devdocs.json @@ -16,13 +16,13 @@ "\nReturns information that can be used to navigate to a specific page to view the given rule.\n" ], "signature": [ - "(alert: ", + "(rule: ", { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.SanitizedAlert", - "text": "SanitizedAlert" + "section": "def-common.SanitizedRule", + "text": "SanitizedRule" }, ") => string | ", "JsonObject" @@ -38,8 +38,10 @@ "id": "def-public.AlertNavigationHandler.$1", "type": "Object", "tags": [], - "label": "alert", - "description": [], + "label": "rule", + "description": [ + "The rule to view" + ], "signature": [ "{ id: string; monitoring?: ", { @@ -54,8 +56,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertAction", - "text": "AlertAction" + "section": "def-common.RuleAction", + "text": "RuleAction" }, "[]; throttle: string | null; consumer: string; alertTypeId: string; schedule: ", { @@ -78,8 +80,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertExecutionStatus", - "text": "AlertExecutionStatus" + "section": "def-common.RuleExecutionStatus", + "text": "RuleExecutionStatus" }, "; snoozeEndTime?: Date | null | undefined; }" ], @@ -133,7 +135,7 @@ "tags": [], "label": "applicationId", "description": [ - "The application id that the user should be navigated to, to view a particular alert in a custom way." + "The application id that the user should be navigated to, to view a particular rule in a custom way." ], "signature": [ "string" @@ -213,7 +215,7 @@ "tags": [], "label": "applicationId", "description": [ - "The application id that the user should be navigated to, to view a particular alert in a custom way." + "The application id that the user should be navigated to, to view a particular rule in a custom way." ], "signature": [ "string" @@ -269,13 +271,13 @@ "label": "getNavigation", "description": [], "signature": [ - "(alertId: string) => Promise<", + "(ruleId: string) => Promise<", { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertNavigation", - "text": "AlertNavigation" + "section": "def-common.RuleNavigation", + "text": "RuleNavigation" }, " | undefined>" ], @@ -287,7 +289,7 @@ "id": "def-public.PluginStartContract.getNavigation.$1", "type": "string", "tags": [], - "label": "alertId", + "label": "ruleId", "description": [], "signature": [ "string" @@ -898,214 +900,6 @@ ], "initialIsOpen": false }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions", - "type": "Interface", - "tags": [], - "label": "AlertExecutorOptions", - "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "server", - "docId": "kibAlertingPluginApi", - "section": "def-server.AlertExecutorOptions", - "text": "AlertExecutorOptions" - }, - "" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.alertId", - "type": "string", - "tags": [], - "label": "alertId", - "description": [], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.executionId", - "type": "string", - "tags": [], - "label": "executionId", - "description": [], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.startedAt", - "type": "Object", - "tags": [], - "label": "startedAt", - "description": [], - "signature": [ - "Date" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.previousStartedAt", - "type": "CompoundType", - "tags": [], - "label": "previousStartedAt", - "description": [], - "signature": [ - "Date | null" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.services", - "type": "Object", - "tags": [], - "label": "services", - "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "server", - "docId": "kibAlertingPluginApi", - "section": "def-server.AlertServices", - "text": "AlertServices" - }, - "" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.params", - "type": "Uncategorized", - "tags": [], - "label": "params", - "description": [], - "signature": [ - "Params" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.state", - "type": "Uncategorized", - "tags": [], - "label": "state", - "description": [], - "signature": [ - "State" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.rule", - "type": "CompoundType", - "tags": [], - "label": "rule", - "description": [], - "signature": [ - "Pick<", - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.SanitizedAlert", - "text": "SanitizedAlert" - }, - ", \"name\" | \"tags\" | \"enabled\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"notifyWhen\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.spaceId", - "type": "string", - "tags": [], - "label": "spaceId", - "description": [], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.namespace", - "type": "string", - "tags": [], - "label": "namespace", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.name", - "type": "string", - "tags": [], - "label": "name", - "description": [], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.tags", - "type": "Array", - "tags": [], - "label": "tags", - "description": [], - "signature": [ - "string[]" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.createdBy", - "type": "CompoundType", - "tags": [], - "label": "createdBy", - "description": [], - "signature": [ - "string | null" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertExecutorOptions.updatedBy", - "type": "CompoundType", - "tags": [], - "label": "updatedBy", - "description": [], - "signature": [ - "string | null" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - } - ], - "initialIsOpen": false - }, { "parentPluginId": "alerting", "id": "def-server.AlertingApiRequestHandlerContext", @@ -1249,55 +1043,665 @@ }, { "parentPluginId": "alerting", - "id": "def-server.AlertServices", + "id": "def-server.FindResult", "type": "Interface", "tags": [], - "label": "AlertServices", + "label": "FindResult", "description": [], "signature": [ { "pluginId": "alerting", "scope": "server", "docId": "kibAlertingPluginApi", - "section": "def-server.AlertServices", - "text": "AlertServices" + "section": "def-server.FindResult", + "text": "FindResult" }, - "" + "" ], - "path": "x-pack/plugins/alerting/server/types.ts", + "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-server.AlertServices.savedObjectsClient", - "type": "Object", + "id": "def-server.FindResult.page", + "type": "number", "tags": [], - "label": "savedObjectsClient", + "label": "page", + "description": [], + "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.FindResult.perPage", + "type": "number", + "tags": [], + "label": "perPage", + "description": [], + "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.FindResult.total", + "type": "number", + "tags": [], + "label": "total", + "description": [], + "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.FindResult.data", + "type": "Array", + "tags": [], + "label": "data", "description": [], "signature": [ - "{ create: (type: string, attributes: T, options?: ", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.SavedObjectsCreateOptions", - "text": "SavedObjectsCreateOptions" - }, - " | undefined) => Promise<", - "SavedObject", - ">; bulkCreate: (objects: ", { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.SavedObjectsBulkCreateObject", - "text": "SavedObjectsBulkCreateObject" + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.SanitizedRule", + "text": "SanitizedRule" }, - "[], options?: ", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", + "[]" + ], + "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.PluginSetupContract", + "type": "Interface", + "tags": [], + "label": "PluginSetupContract", + "description": [], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-server.PluginSetupContract.registerType", + "type": "Function", + "tags": [], + "label": "registerType", + "description": [], + "signature": [ + "(ruleType: ", + { + "pluginId": "alerting", + "scope": "server", + "docId": "kibAlertingPluginApi", + "section": "def-server.RuleType", + "text": "RuleType" + }, + ") => void" + ], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-server.PluginSetupContract.registerType.$1", + "type": "Object", + "tags": [], + "label": "ruleType", + "description": [], + "signature": [ + { + "pluginId": "alerting", + "scope": "server", + "docId": "kibAlertingPluginApi", + "section": "def-server.RuleType", + "text": "RuleType" + }, + "" + ], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "alerting", + "id": "def-server.PluginSetupContract.getSecurityHealth", + "type": "Function", + "tags": [], + "label": "getSecurityHealth", + "description": [], + "signature": [ + "() => Promise<", + "SecurityHealth", + ">" + ], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "children": [], + "returnComment": [] + }, + { + "parentPluginId": "alerting", + "id": "def-server.PluginSetupContract.getConfig", + "type": "Function", + "tags": [], + "label": "getConfig", + "description": [], + "signature": [ + "() => ", + { + "pluginId": "alerting", + "scope": "server", + "docId": "kibAlertingPluginApi", + "section": "def-server.AlertingRulesConfig", + "text": "AlertingRulesConfig" + } + ], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "children": [], + "returnComment": [] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.PluginStartContract", + "type": "Interface", + "tags": [], + "label": "PluginStartContract", + "description": [], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-server.PluginStartContract.listTypes", + "type": "Function", + "tags": [], + "label": "listTypes", + "description": [], + "signature": [ + "() => Set<", + "RegistryRuleType", + ">" + ], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "returnComment": [], + "children": [] + }, + { + "parentPluginId": "alerting", + "id": "def-server.PluginStartContract.getRulesClientWithRequest", + "type": "Function", + "tags": [], + "label": "getRulesClientWithRequest", + "description": [], + "signature": [ + "(request: ", + { + "pluginId": "core", + "scope": "server", + "docId": "kibCoreHttpPluginApi", + "section": "def-server.KibanaRequest", + "text": "KibanaRequest" + }, + ") => ", + "PublicMethodsOf", + "<", + { + "pluginId": "alerting", + "scope": "server", + "docId": "kibAlertingPluginApi", + "section": "def-server.RulesClient", + "text": "RulesClient" + }, + ">" + ], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-server.PluginStartContract.getRulesClientWithRequest.$1", + "type": "Object", + "tags": [], + "label": "request", + "description": [], + "signature": [ + { + "pluginId": "core", + "scope": "server", + "docId": "kibCoreHttpPluginApi", + "section": "def-server.KibanaRequest", + "text": "KibanaRequest" + }, + "" + ], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "alerting", + "id": "def-server.PluginStartContract.getAlertingAuthorizationWithRequest", + "type": "Function", + "tags": [], + "label": "getAlertingAuthorizationWithRequest", + "description": [], + "signature": [ + "(request: ", + { + "pluginId": "core", + "scope": "server", + "docId": "kibCoreHttpPluginApi", + "section": "def-server.KibanaRequest", + "text": "KibanaRequest" + }, + ") => ", + "PublicMethodsOf", + "<", + { + "pluginId": "alerting", + "scope": "server", + "docId": "kibAlertingPluginApi", + "section": "def-server.AlertingAuthorization", + "text": "AlertingAuthorization" + }, + ">" + ], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-server.PluginStartContract.getAlertingAuthorizationWithRequest.$1", + "type": "Object", + "tags": [], + "label": "request", + "description": [], + "signature": [ + { + "pluginId": "core", + "scope": "server", + "docId": "kibCoreHttpPluginApi", + "section": "def-server.KibanaRequest", + "text": "KibanaRequest" + }, + "" + ], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "alerting", + "id": "def-server.PluginStartContract.getFrameworkHealth", + "type": "Function", + "tags": [], + "label": "getFrameworkHealth", + "description": [], + "signature": [ + "() => Promise<", + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.AlertsHealth", + "text": "AlertsHealth" + }, + ">" + ], + "path": "x-pack/plugins/alerting/server/plugin.ts", + "deprecated": false, + "children": [], + "returnComment": [] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions", + "type": "Interface", + "tags": [], + "label": "RuleExecutorOptions", + "description": [], + "signature": [ + { + "pluginId": "alerting", + "scope": "server", + "docId": "kibAlertingPluginApi", + "section": "def-server.RuleExecutorOptions", + "text": "RuleExecutorOptions" + }, + "" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.alertId", + "type": "string", + "tags": [], + "label": "alertId", + "description": [], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.executionId", + "type": "string", + "tags": [], + "label": "executionId", + "description": [], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.startedAt", + "type": "Object", + "tags": [], + "label": "startedAt", + "description": [], + "signature": [ + "Date" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.previousStartedAt", + "type": "CompoundType", + "tags": [], + "label": "previousStartedAt", + "description": [], + "signature": [ + "Date | null" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.services", + "type": "Object", + "tags": [], + "label": "services", + "description": [], + "signature": [ + { + "pluginId": "alerting", + "scope": "server", + "docId": "kibAlertingPluginApi", + "section": "def-server.RuleExecutorServices", + "text": "RuleExecutorServices" + }, + "" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.params", + "type": "Uncategorized", + "tags": [], + "label": "params", + "description": [], + "signature": [ + "Params" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.state", + "type": "Uncategorized", + "tags": [], + "label": "state", + "description": [], + "signature": [ + "State" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.rule", + "type": "CompoundType", + "tags": [], + "label": "rule", + "description": [], + "signature": [ + "Pick<", + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.SanitizedRule", + "text": "SanitizedRule" + }, + ", \"name\" | \"tags\" | \"enabled\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"notifyWhen\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.spaceId", + "type": "string", + "tags": [], + "label": "spaceId", + "description": [], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.namespace", + "type": "string", + "tags": [], + "label": "namespace", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.tags", + "type": "Array", + "tags": [], + "label": "tags", + "description": [], + "signature": [ + "string[]" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.createdBy", + "type": "CompoundType", + "tags": [], + "label": "createdBy", + "description": [], + "signature": [ + "string | null" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorOptions.updatedBy", + "type": "CompoundType", + "tags": [], + "label": "updatedBy", + "description": [], + "signature": [ + "string | null" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorServices", + "type": "Interface", + "tags": [], + "label": "RuleExecutorServices", + "description": [], + "signature": [ + { + "pluginId": "alerting", + "scope": "server", + "docId": "kibAlertingPluginApi", + "section": "def-server.RuleExecutorServices", + "text": "RuleExecutorServices" + }, + "" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorServices.searchSourceClient", + "type": "Object", + "tags": [], + "label": "searchSourceClient", + "description": [], + "signature": [ + "Promise<", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.ISearchStartSearchSource", + "text": "ISearchStartSearchSource" + }, + ">" + ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorServices.savedObjectsClient", + "type": "Object", + "tags": [], + "label": "savedObjectsClient", + "description": [], + "signature": [ + "{ create: (type: string, attributes: T, options?: ", + { + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.SavedObjectsCreateOptions", + "text": "SavedObjectsCreateOptions" + }, + " | undefined) => Promise<", + "SavedObject", + ">; bulkCreate: (objects: ", + { + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.SavedObjectsBulkCreateObject", + "text": "SavedObjectsBulkCreateObject" + }, + "[], options?: ", + { + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", "section": "def-server.SavedObjectsCreateOptions", "text": "SavedObjectsCreateOptions" }, @@ -1526,552 +1930,171 @@ "docId": "kibCoreSavedObjectsPluginApi", "section": "def-server.SavedObjectsRemoveReferencesToOptions", "text": "SavedObjectsRemoveReferencesToOptions" - }, - " | undefined) => Promise<", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.SavedObjectsRemoveReferencesToResponse", - "text": "SavedObjectsRemoveReferencesToResponse" - }, - ">; openPointInTimeForType: (type: string | string[], options?: ", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.SavedObjectsOpenPointInTimeOptions", - "text": "SavedObjectsOpenPointInTimeOptions" - }, - ") => Promise<", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.SavedObjectsOpenPointInTimeResponse", - "text": "SavedObjectsOpenPointInTimeResponse" - }, - ">; closePointInTime: (id: string, options?: ", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.SavedObjectsBaseOptions", - "text": "SavedObjectsBaseOptions" - }, - " | undefined) => Promise<", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.SavedObjectsClosePointInTimeResponse", - "text": "SavedObjectsClosePointInTimeResponse" - }, - ">; createPointInTimeFinder: (findOptions: ", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.SavedObjectsCreatePointInTimeFinderOptions", - "text": "SavedObjectsCreatePointInTimeFinderOptions" - }, - ", dependencies?: ", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.SavedObjectsCreatePointInTimeFinderDependencies", - "text": "SavedObjectsCreatePointInTimeFinderDependencies" - }, - " | undefined) => ", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.ISavedObjectsPointInTimeFinder", - "text": "ISavedObjectsPointInTimeFinder" - }, - "; errors: typeof ", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreSavedObjectsPluginApi", - "section": "def-server.SavedObjectsErrorHelpers", - "text": "SavedObjectsErrorHelpers" - }, - "; }" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertServices.uiSettingsClient", - "type": "Object", - "tags": [], - "label": "uiSettingsClient", - "description": [], - "signature": [ - { - "pluginId": "core", - "scope": "server", - "docId": "kibCorePluginApi", - "section": "def-server.IUiSettingsClient", - "text": "IUiSettingsClient" - } - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertServices.scopedClusterClient", - "type": "Object", - "tags": [], - "label": "scopedClusterClient", - "description": [], - "signature": [ - { - "pluginId": "core", - "scope": "server", - "docId": "kibCorePluginApi", - "section": "def-server.IScopedClusterClient", - "text": "IScopedClusterClient" - } - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertServices.alertFactory", - "type": "Object", - "tags": [], - "label": "alertFactory", - "description": [], - "signature": [ - "{ create: (id: string) => ", - { - "pluginId": "alerting", - "scope": "server", - "docId": "kibAlertingPluginApi", - "section": "def-server.PublicAlert", - "text": "PublicAlert" - }, - "; done: () => ", - "AlertFactoryDoneUtils", - "; }" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertServices.shouldWriteAlerts", - "type": "Function", - "tags": [], - "label": "shouldWriteAlerts", - "description": [], - "signature": [ - "() => boolean" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertServices.shouldStopExecution", - "type": "Function", - "tags": [], - "label": "shouldStopExecution", - "description": [], - "signature": [ - "() => boolean" - ], - "path": "x-pack/plugins/alerting/server/types.ts", - "deprecated": false, - "children": [], - "returnComment": [] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.FindResult", - "type": "Interface", - "tags": [], - "label": "FindResult", - "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "server", - "docId": "kibAlertingPluginApi", - "section": "def-server.FindResult", - "text": "FindResult" - }, - "" - ], - "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "alerting", - "id": "def-server.FindResult.page", - "type": "number", - "tags": [], - "label": "page", - "description": [], - "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.FindResult.perPage", - "type": "number", - "tags": [], - "label": "perPage", - "description": [], - "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.FindResult.total", - "type": "number", - "tags": [], - "label": "total", - "description": [], - "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.FindResult.data", - "type": "Array", - "tags": [], - "label": "data", - "description": [], - "signature": [ + }, + " | undefined) => Promise<", { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.SanitizedAlert", - "text": "SanitizedAlert" + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.SavedObjectsRemoveReferencesToResponse", + "text": "SavedObjectsRemoveReferencesToResponse" }, - "[]" - ], - "path": "x-pack/plugins/alerting/server/rules_client/rules_client.ts", - "deprecated": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.PluginSetupContract", - "type": "Interface", - "tags": [], - "label": "PluginSetupContract", - "description": [], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "alerting", - "id": "def-server.PluginSetupContract.registerType", - "type": "Function", - "tags": [], - "label": "registerType", - "description": [], - "signature": [ - "; openPointInTimeForType: (type: string | string[], options?: ", { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.SavedObjectsOpenPointInTimeOptions", + "text": "SavedObjectsOpenPointInTimeOptions" }, - " = ", + ") => Promise<", { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.SavedObjectsOpenPointInTimeResponse", + "text": "SavedObjectsOpenPointInTimeResponse" }, - ", ExtractedParams extends ", + ">; closePointInTime: (id: string, options?: ", { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.SavedObjectsBaseOptions", + "text": "SavedObjectsBaseOptions" }, - " = ", + " | undefined) => Promise<", { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.SavedObjectsClosePointInTimeResponse", + "text": "SavedObjectsClosePointInTimeResponse" }, - ", State extends ", + ">; createPointInTimeFinder: (findOptions: ", { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeState", - "text": "AlertTypeState" + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.SavedObjectsCreatePointInTimeFinderOptions", + "text": "SavedObjectsCreatePointInTimeFinderOptions" }, - " = ", + ", dependencies?: ", { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeState", - "text": "AlertTypeState" + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.SavedObjectsCreatePointInTimeFinderDependencies", + "text": "SavedObjectsCreatePointInTimeFinderDependencies" }, - ", InstanceState extends { [x: string]: unknown; } = { [x: string]: unknown; }, InstanceContext extends { [x: string]: unknown; } = { [x: string]: unknown; }, ActionGroupIds extends string = never, RecoveryActionGroupId extends string = never>(ruleType: ", + " | undefined) => ", { - "pluginId": "alerting", + "pluginId": "core", "scope": "server", - "docId": "kibAlertingPluginApi", - "section": "def-server.RuleType", - "text": "RuleType" + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.ISavedObjectsPointInTimeFinder", + "text": "ISavedObjectsPointInTimeFinder" }, - ") => void" - ], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "children": [ + "; errors: typeof ", { - "parentPluginId": "alerting", - "id": "def-server.PluginSetupContract.registerType.$1", - "type": "Object", - "tags": [], - "label": "ruleType", - "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "server", - "docId": "kibAlertingPluginApi", - "section": "def-server.RuleType", - "text": "RuleType" - }, - "" - ], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "alerting", - "id": "def-server.PluginSetupContract.getSecurityHealth", - "type": "Function", - "tags": [], - "label": "getSecurityHealth", - "description": [], - "signature": [ - "() => Promise<", - "SecurityHealth", - ">" + "pluginId": "core", + "scope": "server", + "docId": "kibCoreSavedObjectsPluginApi", + "section": "def-server.SavedObjectsErrorHelpers", + "text": "SavedObjectsErrorHelpers" + }, + "; }" ], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "children": [], - "returnComment": [] + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-server.PluginSetupContract.getConfig", - "type": "Function", + "id": "def-server.RuleExecutorServices.uiSettingsClient", + "type": "Object", "tags": [], - "label": "getConfig", + "label": "uiSettingsClient", "description": [], "signature": [ - "() => ", { - "pluginId": "alerting", + "pluginId": "core", "scope": "server", - "docId": "kibAlertingPluginApi", - "section": "def-server.AlertingRulesConfig", - "text": "AlertingRulesConfig" + "docId": "kibCorePluginApi", + "section": "def-server.IUiSettingsClient", + "text": "IUiSettingsClient" } ], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "children": [], - "returnComment": [] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.PluginStartContract", - "type": "Interface", - "tags": [], - "label": "PluginStartContract", - "description": [], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "alerting", - "id": "def-server.PluginStartContract.listTypes", - "type": "Function", - "tags": [], - "label": "listTypes", - "description": [], - "signature": [ - "() => Set<", - "RegistryRuleType", - ">" - ], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "returnComment": [], - "children": [] + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-server.PluginStartContract.getRulesClientWithRequest", - "type": "Function", + "id": "def-server.RuleExecutorServices.scopedClusterClient", + "type": "Object", "tags": [], - "label": "getRulesClientWithRequest", + "label": "scopedClusterClient", "description": [], "signature": [ - "(request: ", { "pluginId": "core", "scope": "server", - "docId": "kibCoreHttpPluginApi", - "section": "def-server.KibanaRequest", - "text": "KibanaRequest" - }, - ") => ", - "PublicMethodsOf", - "<", - { - "pluginId": "alerting", - "scope": "server", - "docId": "kibAlertingPluginApi", - "section": "def-server.RulesClient", - "text": "RulesClient" - }, - ">" - ], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "alerting", - "id": "def-server.PluginStartContract.getRulesClientWithRequest.$1", - "type": "Object", - "tags": [], - "label": "request", - "description": [], - "signature": [ - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreHttpPluginApi", - "section": "def-server.KibanaRequest", - "text": "KibanaRequest" - }, - "" - ], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "isRequired": true + "docId": "kibCorePluginApi", + "section": "def-server.IScopedClusterClient", + "text": "IScopedClusterClient" } ], - "returnComment": [] + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-server.PluginStartContract.getAlertingAuthorizationWithRequest", - "type": "Function", + "id": "def-server.RuleExecutorServices.alertFactory", + "type": "Object", "tags": [], - "label": "getAlertingAuthorizationWithRequest", + "label": "alertFactory", "description": [], "signature": [ - "(request: ", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreHttpPluginApi", - "section": "def-server.KibanaRequest", - "text": "KibanaRequest" - }, - ") => ", - "PublicMethodsOf", - "<", + "{ create: (id: string) => ", { "pluginId": "alerting", "scope": "server", "docId": "kibAlertingPluginApi", - "section": "def-server.AlertingAuthorization", - "text": "AlertingAuthorization" + "section": "def-server.PublicAlert", + "text": "PublicAlert" }, - ">" + "; done: () => ", + "AlertFactoryDoneUtils", + "; }" ], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "alerting", - "id": "def-server.PluginStartContract.getAlertingAuthorizationWithRequest.$1", - "type": "Object", - "tags": [], - "label": "request", - "description": [], - "signature": [ - { - "pluginId": "core", - "scope": "server", - "docId": "kibCoreHttpPluginApi", - "section": "def-server.KibanaRequest", - "text": "KibanaRequest" - }, - "" - ], - "path": "x-pack/plugins/alerting/server/plugin.ts", - "deprecated": false, - "isRequired": true - } + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleExecutorServices.shouldWriteAlerts", + "type": "Function", + "tags": [], + "label": "shouldWriteAlerts", + "description": [], + "signature": [ + "() => boolean" ], + "path": "x-pack/plugins/alerting/server/types.ts", + "deprecated": false, + "children": [], "returnComment": [] }, { "parentPluginId": "alerting", - "id": "def-server.PluginStartContract.getFrameworkHealth", + "id": "def-server.RuleExecutorServices.shouldStopExecution", "type": "Function", "tags": [], - "label": "getFrameworkHealth", + "label": "shouldStopExecution", "description": [], "signature": [ - "() => Promise<", - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertsHealth", - "text": "AlertsHealth" - }, - ">" + "() => boolean" ], - "path": "x-pack/plugins/alerting/server/plugin.ts", + "path": "x-pack/plugins/alerting/server/types.ts", "deprecated": false, "children": [], "returnComment": [] @@ -2178,7 +2201,7 @@ "description": [], "signature": [ "{ params?: ", - "AlertTypeParamsValidator", + "RuleTypeParamsValidator", " | undefined; } | undefined" ], "path": "x-pack/plugins/alerting/server/types.ts", @@ -2250,8 +2273,8 @@ "pluginId": "alerting", "scope": "server", "docId": "kibAlertingPluginApi", - "section": "def-server.AlertExecutorOptions", - "text": "AlertExecutorOptions" + "section": "def-server.RuleExecutorOptions", + "text": "RuleExecutorOptions" }, "" ], @@ -2529,20 +2552,6 @@ "deprecated": false, "initialIsOpen": false }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertActionParams", - "type": "Type", - "tags": [], - "label": "AlertActionParams", - "description": [], - "signature": [ - "SavedObjectAttributes" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, { "parentPluginId": "alerting", "id": "def-server.AlertingRulesConfig", @@ -2585,34 +2594,6 @@ "deprecated": false, "initialIsOpen": false }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertTypeParams", - "type": "Type", - "tags": [], - "label": "AlertTypeParams", - "description": [], - "signature": [ - "{ [x: string]: unknown; }" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-server.AlertTypeState", - "type": "Type", - "tags": [], - "label": "AlertTypeState", - "description": [], - "signature": [ - "{ [x: string]: unknown; }" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, { "parentPluginId": "alerting", "id": "def-server.DEFAULT_MAX_EPHEMERAL_ACTIONS_PER_ALERT", @@ -2629,10 +2610,10 @@ }, { "parentPluginId": "alerting", - "id": "def-server.PartialAlert", + "id": "def-server.PartialRule", "type": "Type", "tags": [], - "label": "PartialAlert", + "label": "PartialRule", "description": [], "signature": [ "Pick<", @@ -2640,16 +2621,16 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.Alert", - "text": "Alert" + "section": "def-common.Rule", + "text": "Rule" }, ", \"id\"> & Partial, \"id\">>" ], @@ -2679,6 +2660,20 @@ "deprecated": false, "initialIsOpen": false }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleActionParams", + "type": "Type", + "tags": [], + "label": "RuleActionParams", + "description": [], + "signature": [ + "SavedObjectAttributes" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false + }, { "parentPluginId": "alerting", "id": "def-server.RulesClient", @@ -2696,8 +2691,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, " = never>({ data, options, }: ", "CreateOptions", @@ -2706,16 +2701,16 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.SanitizedAlert", - "text": "SanitizedAlert" + "section": "def-common.SanitizedRule", + "text": "SanitizedRule" }, ">; delete: ({ id }: { id: string; }) => Promise<{}>; find: ({ options: { fields, ...options }, excludeFromPublicApi, }?: { options?: ", "FindOptions", @@ -2732,16 +2727,16 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, " = never>({ id, includeLegacyId, excludeFromPublicApi, }: { id: string; includeLegacyId?: boolean | undefined; excludeFromPublicApi?: boolean | undefined; }) => Promise<", { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.SanitizedAlert", - "text": "SanitizedAlert" + "section": "def-common.SanitizedRule", + "text": "SanitizedRule" }, " | ", "SanitizedRuleWithLegacyId", @@ -2750,8 +2745,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, " = never>({ id, includeLegacyId, }: { id: string; includeLegacyId?: boolean | undefined; }) => Promise<", { @@ -2766,8 +2761,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, " = never>({ id, data, }: ", "UpdateOptions", @@ -2776,8 +2771,8 @@ "pluginId": "alerting", "scope": "server", "docId": "kibAlertingPluginApi", - "section": "def-server.PartialAlert", - "text": "PartialAlert" + "section": "def-server.PartialRule", + "text": "PartialRule" }, ">; enable: ({ id }: { id: string; }) => Promise; disable: ({ id }: { id: string; }) => Promise; muteAll: ({ id }: { id: string; }) => Promise; getAlertState: ({ id }: { id: string; }) => Promise; getAlertSummary: ({ id, dateStart, numberOfExecutions, }: ", "GetAlertSummaryParams", @@ -2792,7 +2787,13 @@ ">; getExecutionLogForRule: ({ id, dateStart, dateEnd, filter, page, perPage, sort, }: ", "GetExecutionLogByIdParams", ") => Promise<", - "IExecutionLogWithErrorsResult", + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.IExecutionLogWithErrorsResult", + "text": "IExecutionLogWithErrorsResult" + }, ">; updateApiKey: ({ id }: { id: string; }) => Promise; snooze: ({ id, snoozeEndTime, }: { id: string; snoozeEndTime: string | -1; }) => Promise; unsnooze: ({ id }: { id: string; }) => Promise; unmuteAll: ({ id }: { id: string; }) => Promise; muteInstance: ({ alertId, alertInstanceId }: ", "MuteOptions", ") => Promise; unmuteInstance: ({ alertId, alertInstanceId }: ", @@ -2804,6 +2805,34 @@ "path": "x-pack/plugins/alerting/server/index.ts", "deprecated": false, "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleTypeParams", + "type": "Type", + "tags": [], + "label": "RuleTypeParams", + "description": [], + "signature": [ + "{ [x: string]: unknown; }" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-server.RuleTypeState", + "type": "Type", + "tags": [], + "label": "RuleTypeState", + "description": [], + "signature": [ + "{ [x: string]: unknown; }" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false } ], "objects": [] @@ -3097,7 +3126,7 @@ "signature": [ "(notifyWhen: string) => string | undefined" ], - "path": "x-pack/plugins/alerting/common/alert_notify_when_type.ts", + "path": "x-pack/plugins/alerting/common/rule_notify_when_type.ts", "deprecated": false, "children": [ { @@ -3110,7 +3139,7 @@ "signature": [ "string" ], - "path": "x-pack/plugins/alerting/common/alert_notify_when_type.ts", + "path": "x-pack/plugins/alerting/common/rule_notify_when_type.ts", "deprecated": false, "isRequired": true } @@ -3168,58 +3197,186 @@ }, { "parentPluginId": "alerting", - "id": "def-common.ActionVariable", + "id": "def-common.ActionVariable", + "type": "Interface", + "tags": [], + "label": "ActionVariable", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-common.ActionVariable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.ActionVariable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.ActionVariable.deprecated", + "type": "CompoundType", + "tags": [], + "label": "deprecated", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.ActionVariable.useWithTripleBracesInTemplates", + "type": "CompoundType", + "tags": [], + "label": "useWithTripleBracesInTemplates", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.AlertingFrameworkHealth", + "type": "Interface", + "tags": [], + "label": "AlertingFrameworkHealth", + "description": [], + "path": "x-pack/plugins/alerting/common/index.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-common.AlertingFrameworkHealth.isSufficientlySecure", + "type": "boolean", + "tags": [], + "label": "isSufficientlySecure", + "description": [], + "path": "x-pack/plugins/alerting/common/index.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.AlertingFrameworkHealth.hasPermanentEncryptionKey", + "type": "boolean", + "tags": [], + "label": "hasPermanentEncryptionKey", + "description": [], + "path": "x-pack/plugins/alerting/common/index.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.AlertingFrameworkHealth.alertingFrameworkHealth", + "type": "Object", + "tags": [], + "label": "alertingFrameworkHealth", + "description": [], + "signature": [ + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.AlertsHealth", + "text": "AlertsHealth" + } + ], + "path": "x-pack/plugins/alerting/common/index.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.AlertsHealth", "type": "Interface", "tags": [], - "label": "ActionVariable", + "label": "AlertsHealth", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-common.ActionVariable.name", - "type": "string", - "tags": [], - "label": "name", - "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.ActionVariable.description", - "type": "string", + "id": "def-common.AlertsHealth.decryptionHealth", + "type": "Object", "tags": [], - "label": "description", + "label": "decryptionHealth", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "signature": [ + "{ status: ", + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.HealthStatus", + "text": "HealthStatus" + }, + "; timestamp: string; }" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.ActionVariable.deprecated", - "type": "CompoundType", + "id": "def-common.AlertsHealth.executionHealth", + "type": "Object", "tags": [], - "label": "deprecated", + "label": "executionHealth", "description": [], "signature": [ - "boolean | undefined" + "{ status: ", + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.HealthStatus", + "text": "HealthStatus" + }, + "; timestamp: string; }" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.ActionVariable.useWithTripleBracesInTemplates", - "type": "CompoundType", + "id": "def-common.AlertsHealth.readHealth", + "type": "Object", "tags": [], - "label": "useWithTripleBracesInTemplates", + "label": "readHealth", "description": [], "signature": [ - "boolean | undefined" + "{ status: ", + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.HealthStatus", + "text": "HealthStatus" + }, + "; timestamp: string; }" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false } ], @@ -3227,349 +3384,308 @@ }, { "parentPluginId": "alerting", - "id": "def-common.Alert", + "id": "def-common.AlertStatus", "type": "Interface", "tags": [], - "label": "Alert", + "label": "AlertStatus", "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.Alert", - "text": "Alert" - }, - "" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-common.Alert.id", - "type": "string", + "id": "def-common.AlertStatus.status", + "type": "CompoundType", "tags": [], - "label": "id", + "label": "status", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "signature": [ + "\"OK\" | \"Active\"" + ], + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.enabled", + "id": "def-common.AlertStatus.muted", "type": "boolean", "tags": [], - "label": "enabled", + "label": "muted", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.name", + "id": "def-common.AlertStatus.actionGroupId", "type": "string", "tags": [], - "label": "name", + "label": "actionGroupId", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "signature": [ + "string | undefined" + ], + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.tags", - "type": "Array", + "id": "def-common.AlertStatus.actionSubgroup", + "type": "string", "tags": [], - "label": "tags", + "label": "actionSubgroup", "description": [], "signature": [ - "string[]" + "string | undefined" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.alertTypeId", + "id": "def-common.AlertStatus.activeStartDate", "type": "string", "tags": [], - "label": "alertTypeId", + "label": "activeStartDate", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "signature": [ + "string | undefined" + ], + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false - }, + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.AlertSummary", + "type": "Interface", + "tags": [], + "label": "AlertSummary", + "description": [], + "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "deprecated": false, + "children": [ { "parentPluginId": "alerting", - "id": "def-common.Alert.consumer", + "id": "def-common.AlertSummary.id", "type": "string", "tags": [], - "label": "consumer", + "label": "id", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.schedule", - "type": "Object", + "id": "def-common.AlertSummary.name", + "type": "string", "tags": [], - "label": "schedule", + "label": "name", "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.IntervalSchedule", - "text": "IntervalSchedule" - } - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.actions", + "id": "def-common.AlertSummary.tags", "type": "Array", "tags": [], - "label": "actions", - "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertAction", - "text": "AlertAction" - }, - "[]" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.Alert.params", - "type": "Uncategorized", - "tags": [], - "label": "params", + "label": "tags", "description": [], "signature": [ - "Params" + "string[]" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.mapped_params", - "type": "CompoundType", + "id": "def-common.AlertSummary.ruleTypeId", + "type": "string", "tags": [], - "label": "mapped_params", + "label": "ruleTypeId", "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.MappedParams", - "text": "MappedParams" - }, - " | undefined" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.scheduledTaskId", + "id": "def-common.AlertSummary.consumer", "type": "string", "tags": [], - "label": "scheduledTaskId", + "label": "consumer", "description": [], - "signature": [ - "string | undefined" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.createdBy", - "type": "CompoundType", + "id": "def-common.AlertSummary.muteAll", + "type": "boolean", "tags": [], - "label": "createdBy", + "label": "muteAll", "description": [], - "signature": [ - "string | null" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.updatedBy", + "id": "def-common.AlertSummary.throttle", "type": "CompoundType", "tags": [], - "label": "updatedBy", + "label": "throttle", "description": [], "signature": [ "string | null" ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.Alert.createdAt", - "type": "Object", - "tags": [], - "label": "createdAt", - "description": [], - "signature": [ - "Date" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.Alert.updatedAt", - "type": "Object", - "tags": [], - "label": "updatedAt", - "description": [], - "signature": [ - "Date" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.apiKey", - "type": "CompoundType", + "id": "def-common.AlertSummary.enabled", + "type": "boolean", "tags": [], - "label": "apiKey", + "label": "enabled", "description": [], - "signature": [ - "string | null" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.apiKeyOwner", - "type": "CompoundType", + "id": "def-common.AlertSummary.statusStartDate", + "type": "string", "tags": [], - "label": "apiKeyOwner", + "label": "statusStartDate", "description": [], - "signature": [ - "string | null" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.throttle", - "type": "CompoundType", + "id": "def-common.AlertSummary.statusEndDate", + "type": "string", "tags": [], - "label": "throttle", + "label": "statusEndDate", "description": [], - "signature": [ - "string | null" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.notifyWhen", + "id": "def-common.AlertSummary.status", "type": "CompoundType", "tags": [], - "label": "notifyWhen", + "label": "status", "description": [], "signature": [ - "\"onActionGroupChange\" | \"onActiveAlert\" | \"onThrottleInterval\" | null" + "\"OK\" | \"Active\" | \"Error\"" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.muteAll", - "type": "boolean", + "id": "def-common.AlertSummary.lastRun", + "type": "string", "tags": [], - "label": "muteAll", + "label": "lastRun", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "signature": [ + "string | undefined" + ], + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.mutedInstanceIds", + "id": "def-common.AlertSummary.errorMessages", "type": "Array", "tags": [], - "label": "mutedInstanceIds", + "label": "errorMessages", "description": [], "signature": [ - "string[]" + "{ date: string; message: string; }[]" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.executionStatus", + "id": "def-common.AlertSummary.alerts", "type": "Object", "tags": [], - "label": "executionStatus", + "label": "alerts", "description": [], "signature": [ + "{ [x: string]: ", { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertExecutionStatus", - "text": "AlertExecutionStatus" - } + "section": "def-common.AlertStatus", + "text": "AlertStatus" + }, + "; }" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.monitoring", + "id": "def-common.AlertSummary.executionDuration", "type": "Object", "tags": [], - "label": "monitoring", + "label": "executionDuration", "description": [], "signature": [ { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.RuleMonitoring", - "text": "RuleMonitoring" - }, - " | undefined" + "section": "def-common.ExecutionDuration", + "text": "ExecutionDuration" + } ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.ExecutionDuration", + "type": "Interface", + "tags": [], + "label": "ExecutionDuration", + "description": [], + "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-common.ExecutionDuration.average", + "type": "number", + "tags": [], + "label": "average", + "description": [], + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.Alert.snoozeEndTime", - "type": "CompoundType", + "id": "def-common.ExecutionDuration.valuesWithTimestamp", + "type": "Object", "tags": [], - "label": "snoozeEndTime", + "label": "valuesWithTimestamp", "description": [], "signature": [ - "Date | null | undefined" + "{ [x: string]: number; }" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/alert_summary.ts", "deprecated": false } ], @@ -3577,55 +3693,52 @@ }, { "parentPluginId": "alerting", - "id": "def-common.AlertAction", + "id": "def-common.IExecutionErrors", "type": "Interface", "tags": [], - "label": "AlertAction", + "label": "IExecutionErrors", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-common.AlertAction.group", + "id": "def-common.IExecutionErrors.id", "type": "string", "tags": [], - "label": "group", + "label": "id", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertAction.id", + "id": "def-common.IExecutionErrors.timestamp", "type": "string", "tags": [], - "label": "id", + "label": "timestamp", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertAction.actionTypeId", + "id": "def-common.IExecutionErrors.type", "type": "string", "tags": [], - "label": "actionTypeId", + "label": "type", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertAction.params", - "type": "Object", + "id": "def-common.IExecutionErrors.message", + "type": "string", "tags": [], - "label": "params", + "label": "message", "description": [], - "signature": [ - "SavedObjectAttributes" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false } ], @@ -3633,249 +3746,215 @@ }, { "parentPluginId": "alerting", - "id": "def-common.AlertAggregations", + "id": "def-common.IExecutionErrorsResult", "type": "Interface", "tags": [], - "label": "AlertAggregations", + "label": "IExecutionErrorsResult", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-common.AlertAggregations.alertExecutionStatus", - "type": "Object", + "id": "def-common.IExecutionErrorsResult.totalErrors", + "type": "number", "tags": [], - "label": "alertExecutionStatus", + "label": "totalErrors", "description": [], - "signature": [ - "{ [status: string]: number; }" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertAggregations.ruleEnabledStatus", - "type": "Object", + "id": "def-common.IExecutionErrorsResult.errors", + "type": "Array", "tags": [], - "label": "ruleEnabledStatus", + "label": "errors", "description": [], "signature": [ - "{ enabled: number; disabled: number; }" + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.IExecutionErrors", + "text": "IExecutionErrors" + }, + "[]" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.IExecutionLog", + "type": "Interface", + "tags": [], + "label": "IExecutionLog", + "description": [], + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-common.IExecutionLog.id", + "type": "string", + "tags": [], + "label": "id", + "description": [], + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertAggregations.ruleMutedStatus", - "type": "Object", + "id": "def-common.IExecutionLog.timestamp", + "type": "string", "tags": [], - "label": "ruleMutedStatus", + "label": "timestamp", "description": [], - "signature": [ - "{ muted: number; unmuted: number; }" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertAggregations.ruleSnoozedStatus", - "type": "Object", + "id": "def-common.IExecutionLog.duration_ms", + "type": "number", "tags": [], - "label": "ruleSnoozedStatus", + "label": "duration_ms", "description": [], - "signature": [ - "{ snoozed: number; }" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatus", - "type": "Interface", - "tags": [], - "label": "AlertExecutionStatus", - "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "children": [ + }, { "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatus.status", - "type": "CompoundType", + "id": "def-common.IExecutionLog.status", + "type": "string", "tags": [], "label": "status", "description": [], - "signature": [ - "\"error\" | \"unknown\" | \"warning\" | \"pending\" | \"ok\" | \"active\"" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.IExecutionLog.message", + "type": "string", + "tags": [], + "label": "message", + "description": [], + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatus.numberOfTriggeredActions", + "id": "def-common.IExecutionLog.num_active_alerts", "type": "number", "tags": [], - "label": "numberOfTriggeredActions", + "label": "num_active_alerts", "description": [], - "signature": [ - "number | undefined" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatus.numberOfScheduledActions", + "id": "def-common.IExecutionLog.num_new_alerts", "type": "number", "tags": [], - "label": "numberOfScheduledActions", + "label": "num_new_alerts", "description": [], - "signature": [ - "number | undefined" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatus.metrics", - "type": "Object", + "id": "def-common.IExecutionLog.num_recovered_alerts", + "type": "number", "tags": [], - "label": "metrics", + "label": "num_recovered_alerts", "description": [], - "signature": [ - "{ numSearches?: number | undefined; totalSearchDurationMs?: number | undefined; esSearchDurationMs?: number | undefined; } | undefined" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatus.lastExecutionDate", - "type": "Object", + "id": "def-common.IExecutionLog.num_triggered_actions", + "type": "number", "tags": [], - "label": "lastExecutionDate", + "label": "num_triggered_actions", "description": [], - "signature": [ - "Date" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatus.lastDuration", + "id": "def-common.IExecutionLog.num_scheduled_actions", "type": "number", "tags": [], - "label": "lastDuration", + "label": "num_scheduled_actions", "description": [], - "signature": [ - "number | undefined" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatus.error", - "type": "Object", + "id": "def-common.IExecutionLog.num_succeeded_actions", + "type": "number", "tags": [], - "label": "error", + "label": "num_succeeded_actions", "description": [], - "signature": [ - "{ reason: ", - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertExecutionStatusErrorReasons", - "text": "AlertExecutionStatusErrorReasons" - }, - "; message: string; } | undefined" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatus.warning", - "type": "Object", + "id": "def-common.IExecutionLog.num_errored_actions", + "type": "number", "tags": [], - "label": "warning", + "label": "num_errored_actions", "description": [], - "signature": [ - "{ reason: ", - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertExecutionStatusWarningReasons", - "text": "AlertExecutionStatusWarningReasons" - }, - "; message: string; } | undefined" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertingFrameworkHealth", - "type": "Interface", - "tags": [], - "label": "AlertingFrameworkHealth", - "description": [], - "path": "x-pack/plugins/alerting/common/index.ts", - "deprecated": false, - "children": [ + }, { "parentPluginId": "alerting", - "id": "def-common.AlertingFrameworkHealth.isSufficientlySecure", - "type": "boolean", + "id": "def-common.IExecutionLog.total_search_duration_ms", + "type": "number", "tags": [], - "label": "isSufficientlySecure", + "label": "total_search_duration_ms", "description": [], - "path": "x-pack/plugins/alerting/common/index.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertingFrameworkHealth.hasPermanentEncryptionKey", - "type": "boolean", + "id": "def-common.IExecutionLog.es_search_duration_ms", + "type": "number", "tags": [], - "label": "hasPermanentEncryptionKey", + "label": "es_search_duration_ms", "description": [], - "path": "x-pack/plugins/alerting/common/index.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertingFrameworkHealth.alertingFrameworkHealth", - "type": "Object", + "id": "def-common.IExecutionLog.schedule_delay_ms", + "type": "number", "tags": [], - "label": "alertingFrameworkHealth", + "label": "schedule_delay_ms", "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertsHealth", - "text": "AlertsHealth" - } - ], - "path": "x-pack/plugins/alerting/common/index.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.IExecutionLog.timed_out", + "type": "boolean", + "tags": [], + "label": "timed_out", + "description": [], + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false } ], @@ -3883,75 +3962,76 @@ }, { "parentPluginId": "alerting", - "id": "def-common.AlertsHealth", + "id": "def-common.IExecutionLogResult", "type": "Interface", "tags": [], - "label": "AlertsHealth", + "label": "IExecutionLogResult", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-common.AlertsHealth.decryptionHealth", - "type": "Object", + "id": "def-common.IExecutionLogResult.total", + "type": "number", "tags": [], - "label": "decryptionHealth", + "label": "total", "description": [], - "signature": [ - "{ status: ", - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.HealthStatus", - "text": "HealthStatus" - }, - "; timestamp: string; }" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertsHealth.executionHealth", - "type": "Object", + "id": "def-common.IExecutionLogResult.data", + "type": "Array", "tags": [], - "label": "executionHealth", + "label": "data", "description": [], "signature": [ - "{ status: ", { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.HealthStatus", - "text": "HealthStatus" + "section": "def-common.IExecutionLog", + "text": "IExecutionLog" }, - "; timestamp: string; }" + "[]" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.IntervalSchedule", + "type": "Interface", + "tags": [], + "label": "IntervalSchedule", + "description": [], + "signature": [ + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.IntervalSchedule", + "text": "IntervalSchedule" }, + " extends ", + "SavedObjectAttributes" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "children": [ { "parentPluginId": "alerting", - "id": "def-common.AlertsHealth.readHealth", - "type": "Object", + "id": "def-common.IntervalSchedule.interval", + "type": "string", "tags": [], - "label": "readHealth", + "label": "interval", "description": [], - "signature": [ - "{ status: ", - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.HealthStatus", - "text": "HealthStatus" - }, - "; timestamp: string; }" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false } ], @@ -3959,25 +4039,38 @@ }, { "parentPluginId": "alerting", - "id": "def-common.AlertStateNavigation", + "id": "def-common.MappedParamsProperties", "type": "Interface", "tags": [], - "label": "AlertStateNavigation", + "label": "MappedParamsProperties", "description": [], - "path": "x-pack/plugins/alerting/common/alert_navigation.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-common.AlertStateNavigation.state", - "type": "Object", + "id": "def-common.MappedParamsProperties.risk_score", + "type": "number", "tags": [], - "label": "state", + "label": "risk_score", "description": [], "signature": [ - "JsonObject" + "number | undefined" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.MappedParamsProperties.severity", + "type": "string", + "tags": [], + "label": "severity", + "description": [], + "signature": [ + "string | undefined" ], - "path": "x-pack/plugins/alerting/common/alert_navigation.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false } ], @@ -3985,331 +4078,349 @@ }, { "parentPluginId": "alerting", - "id": "def-common.AlertStatus", + "id": "def-common.Rule", "type": "Interface", "tags": [], - "label": "AlertStatus", + "label": "Rule", "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "signature": [ + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.Rule", + "text": "Rule" + }, + "" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-common.AlertStatus.status", - "type": "CompoundType", + "id": "def-common.Rule.id", + "type": "string", "tags": [], - "label": "status", + "label": "id", "description": [], - "signature": [ - "\"OK\" | \"Active\"" - ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertStatus.muted", + "id": "def-common.Rule.enabled", "type": "boolean", "tags": [], - "label": "muted", + "label": "enabled", "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertStatus.actionGroupId", + "id": "def-common.Rule.name", "type": "string", "tags": [], - "label": "actionGroupId", + "label": "name", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.Rule.tags", + "type": "Array", + "tags": [], + "label": "tags", "description": [], "signature": [ - "string | undefined" + "string[]" ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertStatus.actionSubgroup", + "id": "def-common.Rule.alertTypeId", "type": "string", "tags": [], - "label": "actionSubgroup", + "label": "alertTypeId", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.Rule.consumer", + "type": "string", + "tags": [], + "label": "consumer", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.Rule.schedule", + "type": "Object", + "tags": [], + "label": "schedule", "description": [], "signature": [ - "string | undefined" + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.IntervalSchedule", + "text": "IntervalSchedule" + } ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertStatus.activeStartDate", - "type": "string", + "id": "def-common.Rule.actions", + "type": "Array", "tags": [], - "label": "activeStartDate", + "label": "actions", "description": [], "signature": [ - "string | undefined" + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.RuleAction", + "text": "RuleAction" + }, + "[]" ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertSummary", - "type": "Interface", - "tags": [], - "label": "AlertSummary", - "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", - "deprecated": false, - "children": [ + }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.id", - "type": "string", + "id": "def-common.Rule.params", + "type": "Uncategorized", "tags": [], - "label": "id", + "label": "params", "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "signature": [ + "Params" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.Rule.mapped_params", + "type": "CompoundType", + "tags": [], + "label": "mapped_params", + "description": [], + "signature": [ + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.MappedParams", + "text": "MappedParams" + }, + " | undefined" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.name", + "id": "def-common.Rule.scheduledTaskId", "type": "string", "tags": [], - "label": "name", + "label": "scheduledTaskId", "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "signature": [ + "string | undefined" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.tags", - "type": "Array", + "id": "def-common.Rule.createdBy", + "type": "CompoundType", "tags": [], - "label": "tags", + "label": "createdBy", "description": [], "signature": [ - "string[]" + "string | null" ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.ruleTypeId", - "type": "string", + "id": "def-common.Rule.updatedBy", + "type": "CompoundType", "tags": [], - "label": "ruleTypeId", + "label": "updatedBy", "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "signature": [ + "string | null" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.consumer", - "type": "string", + "id": "def-common.Rule.createdAt", + "type": "Object", "tags": [], - "label": "consumer", + "label": "createdAt", "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "signature": [ + "Date" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.muteAll", - "type": "boolean", + "id": "def-common.Rule.updatedAt", + "type": "Object", "tags": [], - "label": "muteAll", + "label": "updatedAt", "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "signature": [ + "Date" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.throttle", + "id": "def-common.Rule.apiKey", "type": "CompoundType", "tags": [], - "label": "throttle", + "label": "apiKey", "description": [], "signature": [ "string | null" ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertSummary.enabled", - "type": "boolean", - "tags": [], - "label": "enabled", - "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.statusStartDate", - "type": "string", + "id": "def-common.Rule.apiKeyOwner", + "type": "CompoundType", "tags": [], - "label": "statusStartDate", + "label": "apiKeyOwner", "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "signature": [ + "string | null" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.statusEndDate", - "type": "string", + "id": "def-common.Rule.throttle", + "type": "CompoundType", "tags": [], - "label": "statusEndDate", + "label": "throttle", "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "signature": [ + "string | null" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.status", + "id": "def-common.Rule.notifyWhen", "type": "CompoundType", "tags": [], - "label": "status", + "label": "notifyWhen", "description": [], "signature": [ - "\"OK\" | \"Active\" | \"Error\"" + "\"onActionGroupChange\" | \"onActiveAlert\" | \"onThrottleInterval\" | null" ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.lastRun", - "type": "string", + "id": "def-common.Rule.muteAll", + "type": "boolean", "tags": [], - "label": "lastRun", + "label": "muteAll", "description": [], - "signature": [ - "string | undefined" - ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.errorMessages", + "id": "def-common.Rule.mutedInstanceIds", "type": "Array", "tags": [], - "label": "errorMessages", + "label": "mutedInstanceIds", "description": [], "signature": [ - "{ date: string; message: string; }[]" + "string[]" ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.alerts", + "id": "def-common.Rule.executionStatus", "type": "Object", "tags": [], - "label": "alerts", + "label": "executionStatus", "description": [], "signature": [ - "{ [x: string]: ", { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertStatus", - "text": "AlertStatus" - }, - "; }" + "section": "def-common.RuleExecutionStatus", + "text": "RuleExecutionStatus" + } ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.AlertSummary.executionDuration", + "id": "def-common.Rule.monitoring", "type": "Object", "tags": [], - "label": "executionDuration", + "label": "monitoring", "description": [], "signature": [ { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.ExecutionDuration", - "text": "ExecutionDuration" - } + "section": "def-common.RuleMonitoring", + "text": "RuleMonitoring" + }, + " | undefined" ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", - "deprecated": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertUrlNavigation", - "type": "Interface", - "tags": [], - "label": "AlertUrlNavigation", - "description": [], - "path": "x-pack/plugins/alerting/common/alert_navigation.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "alerting", - "id": "def-common.AlertUrlNavigation.path", - "type": "string", - "tags": [], - "label": "path", - "description": [], - "path": "x-pack/plugins/alerting/common/alert_navigation.ts", - "deprecated": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.ExecutionDuration", - "type": "Interface", - "tags": [], - "label": "ExecutionDuration", - "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "alerting", - "id": "def-common.ExecutionDuration.average", - "type": "number", - "tags": [], - "label": "average", - "description": [], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.ExecutionDuration.valuesWithTimestamp", - "type": "Object", + "id": "def-common.Rule.snoozeEndTime", + "type": "CompoundType", "tags": [], - "label": "valuesWithTimestamp", + "label": "snoozeEndTime", "description": [], "signature": [ - "{ [x: string]: number; }" + "Date | null | undefined" ], - "path": "x-pack/plugins/alerting/common/alert_summary.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false } ], @@ -4317,162 +4428,120 @@ }, { "parentPluginId": "alerting", - "id": "def-common.IExecutionLog", + "id": "def-common.RuleAction", "type": "Interface", "tags": [], - "label": "IExecutionLog", + "label": "RuleAction", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.id", - "type": "string", - "tags": [], - "label": "id", - "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.timestamp", + "id": "def-common.RuleAction.group", "type": "string", "tags": [], - "label": "timestamp", - "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.duration_ms", - "type": "number", - "tags": [], - "label": "duration_ms", + "label": "group", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.status", + "id": "def-common.RuleAction.id", "type": "string", "tags": [], - "label": "status", + "label": "id", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.message", + "id": "def-common.RuleAction.actionTypeId", "type": "string", "tags": [], - "label": "message", - "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.num_active_alerts", - "type": "number", - "tags": [], - "label": "num_active_alerts", - "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.num_new_alerts", - "type": "number", - "tags": [], - "label": "num_new_alerts", - "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.num_recovered_alerts", - "type": "number", - "tags": [], - "label": "num_recovered_alerts", - "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.num_triggered_actions", - "type": "number", - "tags": [], - "label": "num_triggered_actions", - "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", - "deprecated": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.num_succeeded_actions", - "type": "number", - "tags": [], - "label": "num_succeeded_actions", + "label": "actionTypeId", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.num_errored_actions", - "type": "number", + "id": "def-common.RuleAction.params", + "type": "Object", "tags": [], - "label": "num_errored_actions", + "label": "params", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "signature": [ + "SavedObjectAttributes" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false - }, + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleAggregations", + "type": "Interface", + "tags": [], + "label": "RuleAggregations", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "children": [ { "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.total_search_duration_ms", - "type": "number", + "id": "def-common.RuleAggregations.alertExecutionStatus", + "type": "Object", "tags": [], - "label": "total_search_duration_ms", + "label": "alertExecutionStatus", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "signature": [ + "{ [status: string]: number; }" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.es_search_duration_ms", - "type": "number", + "id": "def-common.RuleAggregations.ruleEnabledStatus", + "type": "Object", "tags": [], - "label": "es_search_duration_ms", + "label": "ruleEnabledStatus", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "signature": [ + "{ enabled: number; disabled: number; }" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.schedule_delay_ms", - "type": "number", + "id": "def-common.RuleAggregations.ruleMutedStatus", + "type": "Object", "tags": [], - "label": "schedule_delay_ms", + "label": "ruleMutedStatus", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "signature": [ + "{ muted: number; unmuted: number; }" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.IExecutionLog.timed_out", - "type": "boolean", + "id": "def-common.RuleAggregations.ruleSnoozedStatus", + "type": "Object", "tags": [], - "label": "timed_out", + "label": "ruleSnoozedStatus", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "signature": [ + "{ snoozed: number; }" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false } ], @@ -4480,76 +4549,65 @@ }, { "parentPluginId": "alerting", - "id": "def-common.IExecutionLogResult", + "id": "def-common.RuleExecutionRunResult", "type": "Interface", "tags": [], - "label": "IExecutionLogResult", + "label": "RuleExecutionRunResult", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "path": "x-pack/plugins/alerting/common/rule_task_instance.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-common.IExecutionLogResult.total", - "type": "number", + "id": "def-common.RuleExecutionRunResult.state", + "type": "CompoundType", "tags": [], - "label": "total", + "label": "state", "description": [], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "signature": [ + "{ alertTypeState?: { [x: string]: unknown; } | undefined; alertInstances?: { [x: string]: { state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; }) | undefined; } | undefined; }; } | undefined; previousStartedAt?: Date | null | undefined; } & { metrics: { numSearches?: number | undefined; totalSearchDurationMs?: number | undefined; esSearchDurationMs?: number | undefined; }; alertExecutionStore: { numberOfTriggeredActions?: number | undefined; numberOfScheduledActions?: number | undefined; triggeredActionsStatus?: string | undefined; }; }" + ], + "path": "x-pack/plugins/alerting/common/rule_task_instance.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.IExecutionLogResult.data", - "type": "Array", + "id": "def-common.RuleExecutionRunResult.monitoring", + "type": "Object", "tags": [], - "label": "data", + "label": "monitoring", "description": [], "signature": [ { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.IExecutionLog", - "text": "IExecutionLog" + "section": "def-common.RuleMonitoring", + "text": "RuleMonitoring" }, - "[]" + " | undefined" ], - "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "path": "x-pack/plugins/alerting/common/rule_task_instance.ts", "deprecated": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.IntervalSchedule", - "type": "Interface", - "tags": [], - "label": "IntervalSchedule", - "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.IntervalSchedule", - "text": "IntervalSchedule" }, - " extends ", - "SavedObjectAttributes" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "children": [ { "parentPluginId": "alerting", - "id": "def-common.IntervalSchedule.interval", - "type": "string", + "id": "def-common.RuleExecutionRunResult.schedule", + "type": "Object", "tags": [], - "label": "interval", + "label": "schedule", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "signature": [ + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.IntervalSchedule", + "text": "IntervalSchedule" + }, + " | undefined" + ], + "path": "x-pack/plugins/alerting/common/rule_task_instance.ts", "deprecated": false } ], @@ -4557,104 +4615,132 @@ }, { "parentPluginId": "alerting", - "id": "def-common.MappedParamsProperties", + "id": "def-common.RuleExecutionStatus", "type": "Interface", "tags": [], - "label": "MappedParamsProperties", + "label": "RuleExecutionStatus", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "children": [ { "parentPluginId": "alerting", - "id": "def-common.MappedParamsProperties.risk_score", + "id": "def-common.RuleExecutionStatus.status", + "type": "CompoundType", + "tags": [], + "label": "status", + "description": [], + "signature": [ + "\"error\" | \"unknown\" | \"warning\" | \"pending\" | \"ok\" | \"active\"" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleExecutionStatus.numberOfTriggeredActions", "type": "number", "tags": [], - "label": "risk_score", + "label": "numberOfTriggeredActions", "description": [], "signature": [ "number | undefined" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.MappedParamsProperties.severity", - "type": "string", + "id": "def-common.RuleExecutionStatus.numberOfScheduledActions", + "type": "number", "tags": [], - "label": "severity", + "label": "numberOfScheduledActions", "description": [], "signature": [ - "string | undefined" + "number | undefined" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.RuleExecutionRunResult", - "type": "Interface", - "tags": [], - "label": "RuleExecutionRunResult", - "description": [], - "path": "x-pack/plugins/alerting/common/rule_task_instance.ts", - "deprecated": false, - "children": [ + }, { "parentPluginId": "alerting", - "id": "def-common.RuleExecutionRunResult.state", - "type": "CompoundType", + "id": "def-common.RuleExecutionStatus.metrics", + "type": "Object", "tags": [], - "label": "state", + "label": "metrics", "description": [], "signature": [ - "{ alertTypeState?: { [x: string]: unknown; } | undefined; alertInstances?: { [x: string]: { state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; }) | undefined; } | undefined; }; } | undefined; previousStartedAt?: Date | null | undefined; } & { metrics: { numSearches?: number | undefined; totalSearchDurationMs?: number | undefined; esSearchDurationMs?: number | undefined; }; alertExecutionStore: { numberOfTriggeredActions?: number | undefined; numberOfScheduledActions?: number | undefined; triggeredActionsStatus?: string | undefined; }; }" + "{ numSearches?: number | undefined; totalSearchDurationMs?: number | undefined; esSearchDurationMs?: number | undefined; } | undefined" ], - "path": "x-pack/plugins/alerting/common/rule_task_instance.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.RuleExecutionRunResult.monitoring", + "id": "def-common.RuleExecutionStatus.lastExecutionDate", "type": "Object", "tags": [], - "label": "monitoring", + "label": "lastExecutionDate", + "description": [], + "signature": [ + "Date" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleExecutionStatus.lastDuration", + "type": "number", + "tags": [], + "label": "lastDuration", + "description": [], + "signature": [ + "number | undefined" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleExecutionStatus.error", + "type": "Object", + "tags": [], + "label": "error", "description": [], "signature": [ + "{ reason: ", { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.RuleMonitoring", - "text": "RuleMonitoring" + "section": "def-common.RuleExecutionStatusErrorReasons", + "text": "RuleExecutionStatusErrorReasons" }, - " | undefined" + "; message: string; } | undefined" ], - "path": "x-pack/plugins/alerting/common/rule_task_instance.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { "parentPluginId": "alerting", - "id": "def-common.RuleExecutionRunResult.schedule", + "id": "def-common.RuleExecutionStatus.warning", "type": "Object", "tags": [], - "label": "schedule", + "label": "warning", "description": [], "signature": [ + "{ reason: ", { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.IntervalSchedule", - "text": "IntervalSchedule" + "section": "def-common.RuleExecutionStatusWarningReasons", + "text": "RuleExecutionStatusWarningReasons" }, - " | undefined" + "; message: string; } | undefined" ], - "path": "x-pack/plugins/alerting/common/rule_task_instance.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false } ], @@ -4678,7 +4764,7 @@ " extends ", "SavedObjectAttributes" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "children": [ { @@ -4699,7 +4785,7 @@ }, "[]; calculated_metrics: { p50?: number | undefined; p95?: number | undefined; p99?: number | undefined; success_ratio: number; }; }" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false } ], @@ -4723,7 +4809,7 @@ " extends ", "SavedObjectAttributes" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "children": [ { @@ -4733,7 +4819,7 @@ "tags": [], "label": "success", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { @@ -4743,7 +4829,7 @@ "tags": [], "label": "timestamp", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false }, { @@ -4756,7 +4842,33 @@ "signature": [ "number | undefined" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleStateNavigation", + "type": "Interface", + "tags": [], + "label": "RuleStateNavigation", + "description": [], + "path": "x-pack/plugins/alerting/common/rule_navigation.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-common.RuleStateNavigation.state", + "type": "Object", + "tags": [], + "label": "state", + "description": [], + "signature": [ + "JsonObject" + ], + "path": "x-pack/plugins/alerting/common/rule_navigation.ts", "deprecated": false } ], @@ -4952,15 +5064,38 @@ }, { "parentPluginId": "alerting", - "id": "def-common.RuleType.authorizedConsumers", - "type": "Object", + "id": "def-common.RuleType.authorizedConsumers", + "type": "Object", + "tags": [], + "label": "authorizedConsumers", + "description": [], + "signature": [ + "{ [x: string]: ConsumerPrivileges; }" + ], + "path": "x-pack/plugins/alerting/common/rule_type.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleUrlNavigation", + "type": "Interface", + "tags": [], + "label": "RuleUrlNavigation", + "description": [], + "path": "x-pack/plugins/alerting/common/rule_navigation.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "alerting", + "id": "def-common.RuleUrlNavigation.path", + "type": "string", "tags": [], - "label": "authorizedConsumers", + "label": "path", "description": [], - "signature": [ - "{ [x: string]: ConsumerPrivileges; }" - ], - "path": "x-pack/plugins/alerting/common/rule_type.ts", + "path": "x-pack/plugins/alerting/common/rule_navigation.ts", "deprecated": false } ], @@ -4970,23 +5105,23 @@ "enums": [ { "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatusErrorReasons", + "id": "def-common.HealthStatus", "type": "Enum", "tags": [], - "label": "AlertExecutionStatusErrorReasons", + "label": "HealthStatus", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "initialIsOpen": false }, { "parentPluginId": "alerting", - "id": "def-common.HealthStatus", + "id": "def-common.RuleExecutionStatusErrorReasons", "type": "Enum", "tags": [], - "label": "HealthStatus", + "label": "RuleExecutionStatusErrorReasons", "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "initialIsOpen": false } @@ -5022,62 +5157,6 @@ "deprecated": false, "initialIsOpen": false }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertActionParam", - "type": "Type", - "tags": [], - "label": "AlertActionParam", - "description": [], - "signature": [ - "SavedObjectAttributeSingle", - " | ", - "SavedObjectAttributeSingle", - "[]" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertActionParams", - "type": "Type", - "tags": [], - "label": "AlertActionParams", - "description": [], - "signature": [ - "SavedObjectAttributes" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatuses", - "type": "Type", - "tags": [], - "label": "AlertExecutionStatuses", - "description": [], - "signature": [ - "\"error\" | \"unknown\" | \"warning\" | \"pending\" | \"ok\" | \"active\"" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatusWarningReasons", - "type": "string", - "tags": [], - "label": "AlertExecutionStatusWarningReasons", - "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, { "parentPluginId": "alerting", "id": "def-common.AlertInstanceContext", @@ -5120,48 +5199,6 @@ "deprecated": false, "initialIsOpen": false }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertNavigation", - "type": "Type", - "tags": [], - "label": "AlertNavigation", - "description": [], - "signature": [ - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertUrlNavigation", - "text": "AlertUrlNavigation" - }, - " | ", - { - "pluginId": "alerting", - "scope": "common", - "docId": "kibAlertingPluginApi", - "section": "def-common.AlertStateNavigation", - "text": "AlertStateNavigation" - } - ], - "path": "x-pack/plugins/alerting/common/alert_navigation.ts", - "deprecated": false, - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertNotifyWhenType", - "type": "Type", - "tags": [], - "label": "AlertNotifyWhenType", - "description": [], - "signature": [ - "\"onActionGroupChange\" | \"onActiveAlert\" | \"onThrottleInterval\"" - ], - "path": "x-pack/plugins/alerting/common/alert_notify_when_type.ts", - "deprecated": false, - "initialIsOpen": false - }, { "parentPluginId": "alerting", "id": "def-common.ALERTS_FEATURE_ID", @@ -5190,34 +5227,6 @@ "deprecated": false, "initialIsOpen": false }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertTypeParams", - "type": "Type", - "tags": [], - "label": "AlertTypeParams", - "description": [], - "signature": [ - "{ [x: string]: unknown; }" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, - { - "parentPluginId": "alerting", - "id": "def-common.AlertTypeState", - "type": "Type", - "tags": [], - "label": "AlertTypeState", - "description": [], - "signature": [ - "{ [x: string]: unknown; }" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, { "parentPluginId": "alerting", "id": "def-common.BASE_ALERTING_API_PATH", @@ -5254,7 +5263,35 @@ "label": "ExecutionLogSortFields", "description": [], "signature": [ - "\"timestamp\" | \"execution_duration\" | \"total_search_duration\" | \"es_search_duration\" | \"schedule_delay\" | \"num_triggered_actions\"" + "\"timestamp\" | \"execution_duration\" | \"total_search_duration\" | \"es_search_duration\" | \"schedule_delay\" | \"num_triggered_actions\" | \"num_scheduled_actions\"" + ], + "path": "x-pack/plugins/alerting/common/execution_log_types.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.IExecutionLogWithErrorsResult", + "type": "Type", + "tags": [], + "label": "IExecutionLogWithErrorsResult", + "description": [], + "signature": [ + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.IExecutionLogResult", + "text": "IExecutionLogResult" + }, + " & ", + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.IExecutionErrorsResult", + "text": "IExecutionErrorsResult" + } ], "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false, @@ -5306,7 +5343,7 @@ "text": "MappedParamsProperties" } ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "initialIsOpen": false }, @@ -5378,8 +5415,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.SanitizedAlert", - "text": "SanitizedAlert" + "section": "def-common.SanitizedRule", + "text": "SanitizedRule" }, " & Omit<", { @@ -5391,7 +5428,38 @@ }, ", \"saved_object\">" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleActionParam", + "type": "Type", + "tags": [], + "label": "RuleActionParam", + "description": [], + "signature": [ + "SavedObjectAttributeSingle", + " | ", + "SavedObjectAttributeSingle", + "[]" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleActionParams", + "type": "Type", + "tags": [], + "label": "RuleActionParams", + "description": [], + "signature": [ + "SavedObjectAttributes" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "initialIsOpen": false }, @@ -5423,6 +5491,73 @@ "deprecated": false, "initialIsOpen": false }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleExecutionStatuses", + "type": "Type", + "tags": [], + "label": "RuleExecutionStatuses", + "description": [], + "signature": [ + "\"error\" | \"unknown\" | \"warning\" | \"pending\" | \"ok\" | \"active\"" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleExecutionStatusWarningReasons", + "type": "string", + "tags": [], + "label": "RuleExecutionStatusWarningReasons", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleNavigation", + "type": "Type", + "tags": [], + "label": "RuleNavigation", + "description": [], + "signature": [ + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.RuleUrlNavigation", + "text": "RuleUrlNavigation" + }, + " | ", + { + "pluginId": "alerting", + "scope": "common", + "docId": "kibAlertingPluginApi", + "section": "def-common.RuleStateNavigation", + "text": "RuleStateNavigation" + } + ], + "path": "x-pack/plugins/alerting/common/rule_navigation.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleNotifyWhenType", + "type": "Type", + "tags": [], + "label": "RuleNotifyWhenType", + "description": [], + "signature": [ + "\"onActionGroupChange\" | \"onActiveAlert\" | \"onThrottleInterval\"" + ], + "path": "x-pack/plugins/alerting/common/rule_notify_when_type.ts", + "deprecated": false, + "initialIsOpen": false + }, { "parentPluginId": "alerting", "id": "def-common.RuleStatusValues", @@ -5467,10 +5602,38 @@ }, { "parentPluginId": "alerting", - "id": "def-common.SanitizedAlert", + "id": "def-common.RuleTypeParams", + "type": "Type", + "tags": [], + "label": "RuleTypeParams", + "description": [], + "signature": [ + "{ [x: string]: unknown; }" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleTypeState", + "type": "Type", + "tags": [], + "label": "RuleTypeState", + "description": [], + "signature": [ + "{ [x: string]: unknown; }" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "alerting", + "id": "def-common.SanitizedRule", "type": "Type", "tags": [], - "label": "SanitizedAlert", + "label": "SanitizedRule", "description": [], "signature": [ "{ id: string; monitoring?: ", @@ -5486,8 +5649,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertAction", - "text": "AlertAction" + "section": "def-common.RuleAction", + "text": "RuleAction" }, "[]; throttle: string | null; consumer: string; alertTypeId: string; schedule: ", { @@ -5510,12 +5673,12 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertExecutionStatus", - "text": "AlertExecutionStatus" + "section": "def-common.RuleExecutionStatus", + "text": "RuleExecutionStatus" }, "; snoozeEndTime?: Date | null | undefined; }" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "initialIsOpen": false }, @@ -5532,12 +5695,12 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.SanitizedAlert", - "text": "SanitizedAlert" + "section": "def-common.SanitizedRule", + "text": "SanitizedRule" }, ", \"name\" | \"tags\" | \"enabled\" | \"actions\" | \"throttle\" | \"consumer\" | \"schedule\" | \"createdBy\" | \"updatedBy\" | \"createdAt\" | \"updatedAt\" | \"notifyWhen\"> & { producer: string; ruleTypeId: string; ruleTypeName: string; }" ], - "path": "x-pack/plugins/alerting/common/alert.ts", + "path": "x-pack/plugins/alerting/common/rule.ts", "deprecated": false, "initialIsOpen": false }, @@ -5565,20 +5728,6 @@ } ], "objects": [ - { - "parentPluginId": "alerting", - "id": "def-common.AlertExecutionStatusValues", - "type": "Object", - "tags": [], - "label": "AlertExecutionStatusValues", - "description": [], - "signature": [ - "readonly [\"ok\", \"active\", \"error\", \"pending\", \"unknown\", \"warning\"]" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, { "parentPluginId": "alerting", "id": "def-common.DisabledActionTypeIdsForActionGroup", @@ -5601,7 +5750,7 @@ "label": "executionLogSortableColumns", "description": [], "signature": [ - "readonly [\"timestamp\", \"execution_duration\", \"total_search_duration\", \"es_search_duration\", \"schedule_delay\", \"num_triggered_actions\"]" + "readonly [\"timestamp\", \"execution_duration\", \"total_search_duration\", \"es_search_duration\", \"schedule_delay\", \"num_triggered_actions\", \"num_scheduled_actions\"]" ], "path": "x-pack/plugins/alerting/common/execution_log_types.ts", "deprecated": false, @@ -5656,6 +5805,20 @@ "deprecated": false, "initialIsOpen": false }, + { + "parentPluginId": "alerting", + "id": "def-common.RuleExecutionStatusValues", + "type": "Object", + "tags": [], + "label": "RuleExecutionStatusValues", + "description": [], + "signature": [ + "readonly [\"ok\", \"active\", \"error\", \"pending\", \"unknown\", \"warning\"]" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false + }, { "parentPluginId": "alerting", "id": "def-common.ruleParamsSchema", diff --git a/api_docs/alerting.mdx b/api_docs/alerting.mdx index 75b6f8351c829..8ed04bc845f1a 100644 --- a/api_docs/alerting.mdx +++ b/api_docs/alerting.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/alerting title: "alerting" image: https://source.unsplash.com/400x175/?github summary: API docs for the alerting plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'alerting'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Response Ops](https://github.com/orgs/elastic/teams/response-ops) for q | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 323 | 0 | 315 | 21 | +| 334 | 0 | 325 | 20 | ## Client diff --git a/api_docs/apm.devdocs.json b/api_docs/apm.devdocs.json index 83b6db6d99ee0..bd88217f34fc3 100644 --- a/api_docs/apm.devdocs.json +++ b/api_docs/apm.devdocs.json @@ -512,7 +512,7 @@ "; }>; getById: (getByIdParams: { id: string; }) => Promise<", "GetResponse", ">; delete: (deleteParams: { id: string; }) => Promise<", - "DeleteResponse", + "WriteResponseBase", ">; } | undefined>; }; start: () => Promise; }; ruleRegistry: { setup: ", { "pluginId": "ruleRegistry", diff --git a/api_docs/apm.mdx b/api_docs/apm.mdx index 9fd26c77abba1..2337384644551 100644 --- a/api_docs/apm.mdx +++ b/api_docs/apm.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/apm title: "apm" image: https://source.unsplash.com/400x175/?github summary: API docs for the apm plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apm'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/banners.mdx b/api_docs/banners.mdx index ce939ff44c1fc..732a3f841f0c3 100644 --- a/api_docs/banners.mdx +++ b/api_docs/banners.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/banners title: "banners" image: https://source.unsplash.com/400x175/?github summary: API docs for the banners plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'banners'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/bfetch.mdx b/api_docs/bfetch.mdx index 1a53912eb6619..c19e0fecea759 100644 --- a/api_docs/bfetch.mdx +++ b/api_docs/bfetch.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/bfetch title: "bfetch" image: https://source.unsplash.com/400x175/?github summary: API docs for the bfetch plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'bfetch'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/canvas.mdx b/api_docs/canvas.mdx index 361e9bab39175..623e6529ac3f4 100644 --- a/api_docs/canvas.mdx +++ b/api_docs/canvas.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/canvas title: "canvas" image: https://source.unsplash.com/400x175/?github summary: API docs for the canvas plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'canvas'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/cases.devdocs.json b/api_docs/cases.devdocs.json index 853012159e20d..76d0d7ae642cc 100644 --- a/api_docs/cases.devdocs.json +++ b/api_docs/cases.devdocs.json @@ -565,7 +565,7 @@ "label": "SupportedCaseAttachment", "description": [], "signature": [ - "{ type: ", + "{ comment: string; type: ", { "pluginId": "cases", "scope": "common", @@ -573,7 +573,7 @@ "section": "def-common.CommentType", "text": "CommentType" }, - ".alert; alertId: string | string[]; index: string | string[]; rule: { id: string | null; name: string | null; }; owner: string; } | { comment: string; type: ", + ".user; owner: string; } | { type: ", { "pluginId": "cases", "scope": "common", @@ -581,7 +581,7 @@ "section": "def-common.CommentType", "text": "CommentType" }, - ".user; owner: string; }" + ".alert; alertId: string | string[]; index: string | string[]; rule: { id: string | null; name: string | null; }; owner: string; }" ], "path": "x-pack/plugins/cases/public/types.ts", "deprecated": false, @@ -622,7 +622,59 @@ "label": "api", "description": [], "signature": [ - "{ getRelatedCases: (alertId: string, query: { owner?: string | string[] | undefined; }) => Promise<{ id: string; title: string; }[]>; }" + "{ getRelatedCases: (alertId: string, query: { owner?: string | string[] | undefined; }) => Promise<{ id: string; title: string; }[]>; cases: { find: (query: { tags?: string | string[] | undefined; status?: ", + { + "pluginId": "cases", + "scope": "common", + "docId": "kibCasesPluginApi", + "section": "def-common.CaseStatuses", + "text": "CaseStatuses" + }, + " | undefined; reporters?: string | string[] | undefined; defaultSearchOperator?: \"AND\" | \"OR\" | undefined; fields?: string | string[] | undefined; from?: string | undefined; page?: number | undefined; perPage?: number | undefined; search?: string | undefined; searchFields?: string | string[] | undefined; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; to?: string | undefined; owner?: string | string[] | undefined; }) => Promise<({ description: string; status: ", + { + "pluginId": "cases", + "scope": "common", + "docId": "kibCasesPluginApi", + "section": "def-common.CaseStatuses", + "text": "CaseStatuses" + }, + "; tags: string[]; title: string; connector: { id: string; } & (({ type: ", + "ConnectorTypes", + ".jira; fields: { issueType: string | null; priority: string | null; parent: string | null; } | null; } & { name: string; }) | ({ type: ", + "ConnectorTypes", + ".none; fields: null; } & { name: string; }) | ({ type: ", + "ConnectorTypes", + ".resilient; fields: { incidentTypes: string[] | null; severityCode: string | null; } | null; } & { name: string; }) | ({ type: ", + "ConnectorTypes", + ".serviceNowITSM; fields: { impact: string | null; severity: string | null; urgency: string | null; category: string | null; subcategory: string | null; } | null; } & { name: string; }) | ({ type: ", + "ConnectorTypes", + ".serviceNowSIR; fields: { category: string | null; destIp: boolean | null; malwareHash: boolean | null; malwareUrl: boolean | null; priority: string | null; sourceIp: boolean | null; subcategory: string | null; } | null; } & { name: string; }) | ({ type: ", + "ConnectorTypes", + ".swimlane; fields: { caseId: string | null; } | null; } & { name: string; })); settings: { syncAlerts: boolean; }; owner: string; } & { closed_at: string | null; closed_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; } | null; created_at: string; created_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; external_service: ({ connector_id: string; } & { connector_name: string; external_id: string; external_title: string; external_url: string; pushed_at: string; pushed_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; }) | null; updated_at: string | null; updated_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; } | null; } & { id: string; totalComment: number; totalAlerts: number; version: string; } & { comments?: ((({ comment: string; type: ", + { + "pluginId": "cases", + "scope": "common", + "docId": "kibCasesPluginApi", + "section": "def-common.CommentType", + "text": "CommentType" + }, + ".user; owner: string; } & { created_at: string; created_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; owner: string; pushed_at: string | null; pushed_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; } | null; updated_at: string | null; updated_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; } | null; }) | ({ type: ", + { + "pluginId": "cases", + "scope": "common", + "docId": "kibCasesPluginApi", + "section": "def-common.CommentType", + "text": "CommentType" + }, + ".alert; alertId: string | string[]; index: string | string[]; rule: { id: string | null; name: string | null; }; owner: string; } & { created_at: string; created_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; owner: string; pushed_at: string | null; pushed_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; } | null; updated_at: string | null; updated_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; } | null; }) | ({ type: ", + { + "pluginId": "cases", + "scope": "common", + "docId": "kibCasesPluginApi", + "section": "def-common.CommentType", + "text": "CommentType" + }, + ".actions; comment: string; actions: { targets: { hostname: string; endpointId: string; }[]; type: string; }; owner: string; } & { created_at: string; created_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; }; owner: string; pushed_at: string | null; pushed_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; } | null; updated_at: string | null; updated_by: { email: string | null | undefined; full_name: string | null | undefined; username: string | null | undefined; } | null; })) & { id: string; version: string; })[] | undefined; })[]>; getAllCasesMetrics: (query: { from?: string | undefined; to?: string | undefined; owner?: string | string[] | undefined; }) => Promise<{ count_open_cases: number; count_in_progress_cases: number; count_closed_cases: number; }>; }; }" ], "path": "x-pack/plugins/cases/public/types.ts", "deprecated": false diff --git a/api_docs/cases.mdx b/api_docs/cases.mdx index 70347370f1943..9ec7594d975cd 100644 --- a/api_docs/cases.mdx +++ b/api_docs/cases.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/cases title: "cases" image: https://source.unsplash.com/400x175/?github summary: API docs for the cases plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cases'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/charts.mdx b/api_docs/charts.mdx index 95308b8ba0f11..dc22287d352d0 100644 --- a/api_docs/charts.mdx +++ b/api_docs/charts.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/charts title: "charts" image: https://source.unsplash.com/400x175/?github summary: API docs for the charts plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'charts'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/cloud.mdx b/api_docs/cloud.mdx index e8a84efdfec23..378879307a9d0 100644 --- a/api_docs/cloud.mdx +++ b/api_docs/cloud.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/cloud title: "cloud" image: https://source.unsplash.com/400x175/?github summary: API docs for the cloud plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloud'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/cloud_security_posture.mdx b/api_docs/cloud_security_posture.mdx index 799eac9d1ef47..d9a6b1d20909c 100644 --- a/api_docs/cloud_security_posture.mdx +++ b/api_docs/cloud_security_posture.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/cloudSecurityPosture title: "cloudSecurityPosture" image: https://source.unsplash.com/400x175/?github summary: API docs for the cloudSecurityPosture plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudSecurityPosture'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/console.mdx b/api_docs/console.mdx index a8e8b042e932c..343ada2ae4109 100644 --- a/api_docs/console.mdx +++ b/api_docs/console.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/console title: "console" image: https://source.unsplash.com/400x175/?github summary: API docs for the console plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'console'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/controls.devdocs.json b/api_docs/controls.devdocs.json index f115f513fad2c..7cd89434ad64f 100644 --- a/api_docs/controls.devdocs.json +++ b/api_docs/controls.devdocs.json @@ -136,6 +136,21 @@ "children": [], "returnComment": [] }, + { + "parentPluginId": "controls", + "id": "def-public.ControlGroupContainer.closeAllFlyouts", + "type": "Function", + "tags": [], + "label": "closeAllFlyouts", + "description": [], + "signature": [ + "() => void" + ], + "path": "src/plugins/controls/public/control_group/embeddable/control_group_container.tsx", + "deprecated": false, + "children": [], + "returnComment": [] + }, { "parentPluginId": "controls", "id": "def-public.ControlGroupContainer.getCreateControlButton", @@ -432,6 +447,43 @@ ], "returnComment": [] }, + { + "parentPluginId": "controls", + "id": "def-public.ControlGroupContainer.onRemoveEmbeddable", + "type": "Function", + "tags": [], + "label": "onRemoveEmbeddable", + "description": [], + "signature": [ + "(idToRemove: string) => ", + { + "pluginId": "controls", + "scope": "common", + "docId": "kibControlsPluginApi", + "section": "def-common.ControlsPanels", + "text": "ControlsPanels" + } + ], + "path": "src/plugins/controls/public/control_group/embeddable/control_group_container.tsx", + "deprecated": false, + "children": [ + { + "parentPluginId": "controls", + "id": "def-public.ControlGroupContainer.onRemoveEmbeddable.$1", + "type": "string", + "tags": [], + "label": "idToRemove", + "description": [], + "signature": [ + "string" + ], + "path": "src/plugins/controls/public/control_group/embeddable/control_group_container.tsx", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, { "parentPluginId": "controls", "id": "def-public.ControlGroupContainer.getInheritedInput", @@ -2326,7 +2378,7 @@ "label": "controlEditorComponent", "description": [], "signature": [ - "({ onChange, initialInput, setValidState, setDefaultTitle, }: ", + "({ onChange, initialInput, setValidState, setDefaultTitle, getRelevantDataViewId, setLastUsedDataViewId, }: ", { "pluginId": "controls", "scope": "public", diff --git a/api_docs/controls.mdx b/api_docs/controls.mdx index da58bbe0f9871..7a59f3a0a5120 100644 --- a/api_docs/controls.mdx +++ b/api_docs/controls.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/controls title: "controls" image: https://source.unsplash.com/400x175/?github summary: API docs for the controls plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'controls'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-prese | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 185 | 0 | 179 | 4 | +| 188 | 0 | 182 | 4 | ## Client diff --git a/api_docs/core.devdocs.json b/api_docs/core.devdocs.json index 6a39eb50a7f3f..7568da42bdc95 100644 --- a/api_docs/core.devdocs.json +++ b/api_docs/core.devdocs.json @@ -642,6 +642,305 @@ ], "functions": [], "interfaces": [ + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient", + "type": "Interface", + "tags": [], + "label": "AnalyticsClient", + "description": [ + "\r\nAnalytics client's public APIs" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.reportEvent", + "type": "Function", + "tags": [], + "label": "reportEvent", + "description": [ + "\r\nReports a telemetry event." + ], + "signature": [ + ">(eventType: string, eventData: EventTypeData) => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.reportEvent.$1", + "type": "string", + "tags": [], + "label": "eventType", + "description": [ + "The event type registered via the `registerEventType` API." + ], + "signature": [ + "string" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.reportEvent.$2", + "type": "Uncategorized", + "tags": [], + "label": "eventData", + "description": [ + "The properties matching the schema declared in the `registerEventType` API." + ], + "signature": [ + "EventTypeData" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.registerEventType", + "type": "Function", + "tags": [], + "label": "registerEventType", + "description": [ + "\r\nRegisters the event type that will be emitted via the reportEvent API." + ], + "signature": [ + "(eventTypeOps: ", + "EventTypeOpts", + ") => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.registerEventType.$1", + "type": "Object", + "tags": [], + "label": "eventTypeOps", + "description": [], + "signature": [ + "EventTypeOpts", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.registerShipper", + "type": "Function", + "tags": [], + "label": "registerShipper", + "description": [ + "\r\nSet up the shipper that will be used to report the telemetry events." + ], + "signature": [ + "(Shipper: ", + "ShipperClassConstructor", + ", shipperConfig: ShipperConfig, opts?: ", + "RegisterShipperOpts", + " | undefined) => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.registerShipper.$1", + "type": "Object", + "tags": [], + "label": "Shipper", + "description": [ + "The {@link IShipper } class to instantiate the shipper." + ], + "signature": [ + "ShipperClassConstructor", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.registerShipper.$2", + "type": "Uncategorized", + "tags": [], + "label": "shipperConfig", + "description": [ + "The config specific to the Shipper to instantiate." + ], + "signature": [ + "ShipperConfig" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.registerShipper.$3", + "type": "Object", + "tags": [], + "label": "opts", + "description": [ + "Additional options to register the shipper {@link RegisterShipperOpts }." + ], + "signature": [ + "RegisterShipperOpts", + " | undefined" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": false + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.optIn", + "type": "Function", + "tags": [], + "label": "optIn", + "description": [ + "\r\nUsed to control the user's consent to report the data.\r\nIn the advanced mode, it allows to \"cherry-pick\" which events and shippers are enabled/disabled." + ], + "signature": [ + "(optInConfig: ", + "OptInConfig", + ") => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.optIn.$1", + "type": "Object", + "tags": [], + "label": "optInConfig", + "description": [ + "{@link OptInConfig }" + ], + "signature": [ + "OptInConfig" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.registerContextProvider", + "type": "Function", + "tags": [], + "label": "registerContextProvider", + "description": [ + "\r\nRegisters the context provider to enrich the any reported events." + ], + "signature": [ + "(contextProviderOpts: ", + "ContextProviderOpts", + ") => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.registerContextProvider.$1", + "type": "Object", + "tags": [], + "label": "contextProviderOpts", + "description": [ + "{@link ContextProviderOpts }" + ], + "signature": [ + "ContextProviderOpts", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.removeContextProvider", + "type": "Function", + "tags": [], + "label": "removeContextProvider", + "description": [ + "\r\nRemoves the context provider and stop enriching the events from its context." + ], + "signature": [ + "(contextProviderName: string) => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.removeContextProvider.$1", + "type": "string", + "tags": [], + "label": "contextProviderName", + "description": [ + "The name of the context provider to remove." + ], + "signature": [ + "string" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-public.AnalyticsClient.telemetryCounter$", + "type": "Object", + "tags": [], + "label": "telemetryCounter$", + "description": [ + "\r\nObservable to emit the stats of the processed events." + ], + "signature": [ + "Observable", + "<", + "TelemetryCounter", + ">" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-public.AppCategory", @@ -803,85 +1102,164 @@ }, { "parentPluginId": "core", - "id": "def-public.CoreSetup", + "id": "def-public.ContextProviderOpts", "type": "Interface", "tags": [], - "label": "CoreSetup", + "label": "ContextProviderOpts", "description": [ - "\nCore services exposed to the `Plugin` setup lifecycle\n" + "\r\nDefinition of a context provider" ], "signature": [ - { - "pluginId": "core", - "scope": "public", - "docId": "kibCorePluginApi", - "section": "def-public.CoreSetup", - "text": "CoreSetup" - }, - "" + "ContextProviderOpts", + "" ], - "path": "src/core/public/index.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false, "children": [ { "parentPluginId": "core", - "id": "def-public.CoreSetup.application", - "type": "Object", + "id": "def-public.ContextProviderOpts.name", + "type": "string", "tags": [], - "label": "application", + "label": "name", "description": [ - "{@link ApplicationSetup}" - ], - "signature": [ - { - "pluginId": "core", - "scope": "public", - "docId": "kibCoreApplicationPluginApi", - "section": "def-public.ApplicationSetup", - "text": "ApplicationSetup" - } + "\r\nThe name of the provider." ], - "path": "src/core/public/index.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false }, { "parentPluginId": "core", - "id": "def-public.CoreSetup.fatalErrors", + "id": "def-public.ContextProviderOpts.context$", "type": "Object", "tags": [], - "label": "fatalErrors", + "label": "context$", "description": [ - "{@link FatalErrorsSetup}" + "\r\nObservable that emits the custom context." ], "signature": [ - { - "pluginId": "core", - "scope": "public", - "docId": "kibCorePluginApi", - "section": "def-public.FatalErrorsSetup", - "text": "FatalErrorsSetup" - } + "Observable", + "" ], - "path": "src/core/public/index.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false }, { "parentPluginId": "core", - "id": "def-public.CoreSetup.http", + "id": "def-public.ContextProviderOpts.schema", "type": "Object", "tags": [], - "label": "http", + "label": "schema", "description": [ - "{@link HttpSetup}" + "\r\nSchema declaring and documenting the expected output in the context$\r\n" ], "signature": [ - { - "pluginId": "core", - "scope": "public", - "docId": "kibCoreHttpPluginApi", - "section": "def-public.HttpSetup", - "text": "HttpSetup" - } + "{ [Key in keyof Required]: ", + "SchemaValue", + "; }" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-public.CoreSetup", + "type": "Interface", + "tags": [], + "label": "CoreSetup", + "description": [ + "\nCore services exposed to the `Plugin` setup lifecycle\n" + ], + "signature": [ + { + "pluginId": "core", + "scope": "public", + "docId": "kibCorePluginApi", + "section": "def-public.CoreSetup", + "text": "CoreSetup" + }, + "" + ], + "path": "src/core/public/index.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.CoreSetup.analytics", + "type": "Object", + "tags": [], + "label": "analytics", + "description": [ + "{@link AnalyticsServiceSetup}" + ], + "signature": [ + "AnalyticsClient" + ], + "path": "src/core/public/index.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.CoreSetup.application", + "type": "Object", + "tags": [], + "label": "application", + "description": [ + "{@link ApplicationSetup}" + ], + "signature": [ + { + "pluginId": "core", + "scope": "public", + "docId": "kibCoreApplicationPluginApi", + "section": "def-public.ApplicationSetup", + "text": "ApplicationSetup" + } + ], + "path": "src/core/public/index.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.CoreSetup.fatalErrors", + "type": "Object", + "tags": [], + "label": "fatalErrors", + "description": [ + "{@link FatalErrorsSetup}" + ], + "signature": [ + { + "pluginId": "core", + "scope": "public", + "docId": "kibCorePluginApi", + "section": "def-public.FatalErrorsSetup", + "text": "FatalErrorsSetup" + } + ], + "path": "src/core/public/index.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.CoreSetup.http", + "type": "Object", + "tags": [], + "label": "http", + "description": [ + "{@link HttpSetup}" + ], + "signature": [ + { + "pluginId": "core", + "scope": "public", + "docId": "kibCoreHttpPluginApi", + "section": "def-public.HttpSetup", + "text": "HttpSetup" + } ], "path": "src/core/public/index.ts", "deprecated": false @@ -1034,6 +1412,27 @@ "path": "src/core/public/index.ts", "deprecated": false, "children": [ + { + "parentPluginId": "core", + "id": "def-public.CoreStart.analytics", + "type": "Object", + "tags": [], + "label": "analytics", + "description": [ + "{@link AnalyticsServiceStart}" + ], + "signature": [ + "{ optIn: (optInConfig: ", + "OptInConfig", + ") => void; reportEvent: >(eventType: string, eventData: EventTypeData) => void; readonly telemetryCounter$: ", + "Observable", + "<", + "TelemetryCounter", + ">; }" + ], + "path": "src/core/public/index.ts", + "deprecated": false + }, { "parentPluginId": "core", "id": "def-public.CoreStart.application", @@ -1664,6 +2063,152 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-public.Event_2", + "type": "Interface", + "tags": [], + "label": "Event_2", + "description": [ + "\r\nDefinition of the full event structure" + ], + "signature": [ + "Event" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.Event_2.timestamp", + "type": "string", + "tags": [], + "label": "timestamp", + "description": [ + "\r\nThe time the event was generated in ISO format." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.Event_2.event_type", + "type": "string", + "tags": [], + "label": "event_type", + "description": [ + "\r\nThe event type." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.Event_2.properties", + "type": "Object", + "tags": [], + "label": "properties", + "description": [ + "\r\nThe specific properties of the event type." + ], + "signature": [ + "{ [x: string]: unknown; }" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.Event_2.context", + "type": "Object", + "tags": [], + "label": "context", + "description": [ + "\r\nThe {@link EventContext} enriched during the processing pipeline." + ], + "signature": [ + "EventContext" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-public.EventContext", + "type": "Interface", + "tags": [], + "label": "EventContext", + "description": [], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.EventContext.Unnamed", + "type": "IndexSignature", + "tags": [], + "label": "[key: string]: unknown", + "description": [], + "signature": [ + "[key: string]: unknown" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-public.EventTypeOpts", + "type": "Interface", + "tags": [], + "label": "EventTypeOpts", + "description": [ + "\r\nDefinition of an Event Type." + ], + "signature": [ + "EventTypeOpts", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.EventTypeOpts.eventType", + "type": "string", + "tags": [], + "label": "eventType", + "description": [ + "\r\nThe event type's unique name." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.EventTypeOpts.schema", + "type": "Object", + "tags": [], + "label": "schema", + "description": [ + "\r\nSchema declaring and documenting the expected structure of this event type.\r\n" + ], + "signature": [ + "{ [Key in keyof Required]: ", + "SchemaValue", + "; }" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-public.ExecutionContextSetup", @@ -2067,86 +2612,224 @@ }, { "parentPluginId": "core", - "id": "def-public.IUiSettingsClient", + "id": "def-public.IShipper", "type": "Interface", "tags": [], - "label": "IUiSettingsClient", + "label": "IShipper", "description": [ - "\nClient-side client that provides access to the advanced settings stored in elasticsearch.\nThe settings provide control over the behavior of the Kibana application.\nFor example, a user can specify how to display numeric or date fields.\nUsers can adjust the settings via Management UI.\n{@link IUiSettingsClient}\n" + "\r\nBasic structure of a Shipper" ], - "path": "src/core/public/ui_settings/types.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false, "children": [ { "parentPluginId": "core", - "id": "def-public.IUiSettingsClient.get", + "id": "def-public.IShipper.reportEvents", "type": "Function", "tags": [], - "label": "get", + "label": "reportEvents", "description": [ - "\nGets the value for a specific uiSetting. If this setting has no user-defined value\nthen the `defaultOverride` parameter is returned (and parsed if setting is of type\n\"json\" or \"number). If the parameter is not defined and the key is not registered\nby any plugin then an error is thrown, otherwise reads the default value defined by a plugin." + "\r\nAdapts and ships the event to the persisting/analytics solution." ], "signature": [ - "(key: string, defaultOverride?: T | undefined) => T" + "(events: ", + "Event", + "[]) => void" ], - "path": "src/core/public/ui_settings/types.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false, "children": [ { "parentPluginId": "core", - "id": "def-public.IUiSettingsClient.get.$1", - "type": "string", + "id": "def-public.IShipper.reportEvents.$1", + "type": "Array", "tags": [], - "label": "key", - "description": [], - "signature": [ - "string" + "label": "events", + "description": [ + "batched events {@link Event }" ], - "path": "src/core/public/ui_settings/types.ts", - "deprecated": false, - "isRequired": true - }, - { - "parentPluginId": "core", - "id": "def-public.IUiSettingsClient.get.$2", - "type": "Uncategorized", - "tags": [], - "label": "defaultOverride", - "description": [], "signature": [ - "T | undefined" + "Event", + "[]" ], - "path": "src/core/public/ui_settings/types.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false, - "isRequired": false + "isRequired": true } ], "returnComment": [] }, { "parentPluginId": "core", - "id": "def-public.IUiSettingsClient.get$", + "id": "def-public.IShipper.optIn", "type": "Function", "tags": [], - "label": "get$", + "label": "optIn", "description": [ - "\nGets an observable of the current value for a config key, and all updates to that config\nkey in the future. Providing a `defaultOverride` argument behaves the same as it does in #get()" + "\r\nStops/restarts the shipping mechanism based on the value of isOptedIn" ], "signature": [ - "(key: string, defaultOverride?: T | undefined) => ", - "Observable", - "" + "(isOptedIn: boolean) => void" ], - "path": "src/core/public/ui_settings/types.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false, "children": [ { "parentPluginId": "core", - "id": "def-public.IUiSettingsClient.get$.$1", - "type": "string", + "id": "def-public.IShipper.optIn.$1", + "type": "boolean", "tags": [], - "label": "key", - "description": [], + "label": "isOptedIn", + "description": [ + "`true` for resume sending events. `false` to stop." + ], + "signature": [ + "boolean" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-public.IShipper.extendContext", + "type": "Function", + "tags": [], + "label": "extendContext", + "description": [ + "\r\nPerform any necessary calls to the persisting/analytics solution to set the event's context." + ], + "signature": [ + "((newContext: ", + "EventContext", + ") => void) | undefined" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.IShipper.extendContext.$1", + "type": "Object", + "tags": [], + "label": "newContext", + "description": [], + "signature": [ + "EventContext" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-public.IShipper.telemetryCounter$", + "type": "Object", + "tags": [], + "label": "telemetryCounter$", + "description": [ + "\r\nObservable to emit the stats of the processed events." + ], + "signature": [ + "Observable", + "<", + "TelemetryCounter", + "> | undefined" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-public.IUiSettingsClient", + "type": "Interface", + "tags": [], + "label": "IUiSettingsClient", + "description": [ + "\nClient-side client that provides access to the advanced settings stored in elasticsearch.\nThe settings provide control over the behavior of the Kibana application.\nFor example, a user can specify how to display numeric or date fields.\nUsers can adjust the settings via Management UI.\n{@link IUiSettingsClient}\n" + ], + "path": "src/core/public/ui_settings/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.IUiSettingsClient.get", + "type": "Function", + "tags": [], + "label": "get", + "description": [ + "\nGets the value for a specific uiSetting. If this setting has no user-defined value\nthen the `defaultOverride` parameter is returned (and parsed if setting is of type\n\"json\" or \"number). If the parameter is not defined and the key is not registered\nby any plugin then an error is thrown, otherwise reads the default value defined by a plugin." + ], + "signature": [ + "(key: string, defaultOverride?: T | undefined) => T" + ], + "path": "src/core/public/ui_settings/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.IUiSettingsClient.get.$1", + "type": "string", + "tags": [], + "label": "key", + "description": [], + "signature": [ + "string" + ], + "path": "src/core/public/ui_settings/types.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "core", + "id": "def-public.IUiSettingsClient.get.$2", + "type": "Uncategorized", + "tags": [], + "label": "defaultOverride", + "description": [], + "signature": [ + "T | undefined" + ], + "path": "src/core/public/ui_settings/types.ts", + "deprecated": false, + "isRequired": false + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-public.IUiSettingsClient.get$", + "type": "Function", + "tags": [], + "label": "get$", + "description": [ + "\nGets an observable of the current value for a config key, and all updates to that config\nkey in the future. Providing a `defaultOverride` argument behaves the same as it does in #get()" + ], + "signature": [ + "(key: string, defaultOverride?: T | undefined) => ", + "Observable", + "" + ], + "path": "src/core/public/ui_settings/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.IUiSettingsClient.get$.$1", + "type": "string", + "tags": [], + "label": "key", + "description": [], "signature": [ "string" ], @@ -2787,6 +3470,53 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-public.OptInConfig", + "type": "Interface", + "tags": [], + "label": "OptInConfig", + "description": [ + "\r\n" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.OptInConfig.global", + "type": "Object", + "tags": [], + "label": "global", + "description": [ + "\r\nControls the global enabled/disabled behaviour of the client and shippers." + ], + "signature": [ + "OptInConfigPerType" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.OptInConfig.event_types", + "type": "Object", + "tags": [], + "label": "event_types", + "description": [ + "\r\nControls if an event type should be disabled for a specific type of shipper." + ], + "signature": [ + "Record | undefined" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-public.OverlayBannersStart", @@ -6050,6 +6780,130 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-public.ShipperClassConstructor", + "type": "Interface", + "tags": [], + "label": "ShipperClassConstructor", + "description": [ + "\r\nConstructor of a {@link IShipper}" + ], + "signature": [ + "ShipperClassConstructor", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.ShipperClassConstructor.shipperName", + "type": "string", + "tags": [], + "label": "shipperName", + "description": [ + "\r\nThe shipper's unique name" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.ShipperClassConstructor.Unnamed", + "type": "Any", + "tags": [], + "label": "Unnamed", + "description": [ + "\r\nThe constructor" + ], + "signature": [ + "any" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-public.TelemetryCounter", + "type": "Interface", + "tags": [], + "label": "TelemetryCounter", + "description": [ + "\r\nShape of the events emitted by the telemetryCounter$ observable" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.TelemetryCounter.type", + "type": "Enum", + "tags": [], + "label": "type", + "description": [ + "\r\nIndicates if the event contains data about succeeded, failed or dropped events." + ], + "signature": [ + "TelemetryCounterType" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.TelemetryCounter.source", + "type": "string", + "tags": [], + "label": "source", + "description": [ + "\r\nWho emitted the event? It can be \"client\" or the name of the shipper." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.TelemetryCounter.event_type", + "type": "string", + "tags": [], + "label": "event_type", + "description": [ + "\r\nThe event type the success/failure/drop event refers to." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.TelemetryCounter.code", + "type": "string", + "tags": [], + "label": "code", + "description": [ + "\r\nCode to provide additional information about the success or failure. Examples are 200/400/504/ValidationError/UnknownError" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.TelemetryCounter.count", + "type": "number", + "tags": [], + "label": "count", + "description": [ + "\r\nThe number of events that this counter refers to." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-public.ThemeServiceSetup", @@ -6476,12 +7330,64 @@ "initialIsOpen": false } ], - "enums": [], - "misc": [ + "enums": [ { "parentPluginId": "core", - "id": "def-public.APP_WRAPPER_CLASS", - "type": "string", + "id": "def-public.TelemetryCounterType", + "type": "Enum", + "tags": [], + "label": "TelemetryCounterType", + "description": [ + "\r\nTypes of the Telemetry Counter: It allows to differentiate what happened to the events" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "initialIsOpen": false + } + ], + "misc": [ + { + "parentPluginId": "core", + "id": "def-public.AnalyticsServiceSetup", + "type": "Type", + "tags": [], + "label": "AnalyticsServiceSetup", + "description": [ + "\nExposes the public APIs of the AnalyticsClient during the setup phase.\n{@link AnalyticsClient}" + ], + "signature": [ + "AnalyticsClient" + ], + "path": "src/core/public/analytics/analytics_service.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-public.AnalyticsServiceStart", + "type": "Type", + "tags": [], + "label": "AnalyticsServiceStart", + "description": [ + "\nExposes the public APIs of the AnalyticsClient during the start phase\n{@link AnalyticsClient}" + ], + "signature": [ + "{ optIn: (optInConfig: ", + "OptInConfig", + ") => void; reportEvent: >(eventType: string, eventData: EventTypeData) => void; readonly telemetryCounter$: ", + "Observable", + "<", + "TelemetryCounter", + ">; }" + ], + "path": "src/core/public/analytics/analytics_service.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-public.APP_WRAPPER_CLASS", + "type": "string", "tags": [], "label": "APP_WRAPPER_CLASS", "description": [ @@ -6494,6 +7400,22 @@ "deprecated": false, "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-public.EventType", + "type": "Type", + "tags": [], + "label": "EventType", + "description": [ + "\r\nEvent Type used for indexed structures. Only used to improve the readability of the types" + ], + "signature": [ + "string" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-public.ExecutionContextStart", @@ -6981,7 +7903,7 @@ "signature": [ "Pick<", "Toast", - ", \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"className\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"data-test-subj\" | \"iconType\" | \"toastLifeTimeMs\" | \"onClose\"> & { title?: string | ", + ", \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"className\" | \"security\" | \"defaultValue\" | \"hidden\" | \"defaultChecked\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"toastLifeTimeMs\" | \"iconType\" | \"onClose\" | \"data-test-subj\"> & { title?: string | ", { "pluginId": "core", "scope": "public", @@ -7038,7 +7960,7 @@ "signature": [ "Pick<", "Toast", - ", \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"className\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"data-test-subj\" | \"iconType\" | \"toastLifeTimeMs\" | \"onClose\"> & { title?: string | ", + ", \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"className\" | \"security\" | \"defaultValue\" | \"hidden\" | \"defaultChecked\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"toastLifeTimeMs\" | \"iconType\" | \"onClose\" | \"data-test-subj\"> & { title?: string | ", { "pluginId": "core", "scope": "public", @@ -7789,204 +8711,503 @@ "signature": [ "Pick; truststore: Readonly<{ path?: string | undefined; password?: string | undefined; } & {}>; alwaysPresentCertificate: boolean; }>, \"key\" | \"verificationMode\" | \"certificate\" | \"keyPassphrase\" | \"alwaysPresentCertificate\"> & { certificateAuthorities?: string[] | undefined; }" ], - "path": "src/core/server/elasticsearch/elasticsearch_config.ts", - "deprecated": false + "path": "src/core/server/elasticsearch/elasticsearch_config.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.ElasticsearchConfig.customHeaders", + "type": "Object", + "tags": [], + "label": "customHeaders", + "description": [ + "\nHeader names and values to send to Elasticsearch with every request. These\nheaders cannot be overwritten by client-side headers and aren't affected by\n`requestHeadersWhitelist` configuration." + ], + "signature": [ + "{ [x: string]: string; }" + ], + "path": "src/core/server/elasticsearch/elasticsearch_config.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.ElasticsearchConfig.Unnamed", + "type": "Function", + "tags": [], + "label": "Constructor", + "description": [], + "signature": [ + "any" + ], + "path": "src/core/server/elasticsearch/elasticsearch_config.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.ElasticsearchConfig.Unnamed.$1", + "type": "Object", + "tags": [], + "label": "rawConfig", + "description": [], + "signature": [ + "Readonly<{ username?: string | undefined; password?: string | undefined; serviceAccountToken?: string | undefined; } & { ssl: Readonly<{ key?: string | undefined; certificateAuthorities?: string | string[] | undefined; certificate?: string | undefined; keyPassphrase?: string | undefined; } & { verificationMode: \"none\" | \"full\" | \"certificate\"; keystore: Readonly<{ path?: string | undefined; password?: string | undefined; } & {}>; truststore: Readonly<{ path?: string | undefined; password?: string | undefined; } & {}>; alwaysPresentCertificate: boolean; }>; healthCheck: Readonly<{} & { delay: moment.Duration; }>; hosts: string | string[]; sniffOnStart: boolean; sniffInterval: false | moment.Duration; sniffOnConnectionFault: boolean; maxSockets: number; compression: boolean; requestHeadersWhitelist: string | string[]; customHeaders: Record; shardTimeout: moment.Duration; requestTimeout: moment.Duration; pingTimeout: moment.Duration; logQueries: boolean; apiVersion: string; ignoreVersionMismatch: boolean; skipStartupConnectionCheck: boolean; }>" + ], + "path": "src/core/server/elasticsearch/elasticsearch_config.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-server.EventLoopDelaysMonitor", + "type": "Class", + "tags": [], + "label": "EventLoopDelaysMonitor", + "description": [], + "path": "src/core/server/metrics/event_loop_delays/event_loop_delays_monitor.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.EventLoopDelaysMonitor.Unnamed", + "type": "Function", + "tags": [], + "label": "Constructor", + "description": [ + "\nCreating a new instance from EventLoopDelaysMonitor will\nautomatically start tracking event loop delays." + ], + "signature": [ + "any" + ], + "path": "src/core/server/metrics/event_loop_delays/event_loop_delays_monitor.ts", + "deprecated": false, + "children": [], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-server.EventLoopDelaysMonitor.collect", + "type": "Function", + "tags": [], + "label": "collect", + "description": [ + "\nCollect gathers event loop delays metrics from nodejs perf_hooks.monitorEventLoopDelay\nthe histogram calculations start from the last time `reset` was called or this\nEventLoopDelaysMonitor instance was created.\n\nReturns metrics in milliseconds." + ], + "signature": [ + "() => ", + { + "pluginId": "core", + "scope": "server", + "docId": "kibCorePluginApi", + "section": "def-server.IntervalHistogram", + "text": "IntervalHistogram" + } + ], + "path": "src/core/server/metrics/event_loop_delays/event_loop_delays_monitor.ts", + "deprecated": false, + "children": [], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-server.EventLoopDelaysMonitor.reset", + "type": "Function", + "tags": [], + "label": "reset", + "description": [ + "\nResets the collected histogram data." + ], + "signature": [ + "() => void" + ], + "path": "src/core/server/metrics/event_loop_delays/event_loop_delays_monitor.ts", + "deprecated": false, + "children": [], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-server.EventLoopDelaysMonitor.stop", + "type": "Function", + "tags": [], + "label": "stop", + "description": [ + "\nDisables updating the interval timer for collecting new data points." + ], + "signature": [ + "() => void" + ], + "path": "src/core/server/metrics/event_loop_delays/event_loop_delays_monitor.ts", + "deprecated": false, + "children": [], + "returnComment": [] + } + ], + "initialIsOpen": false + } + ], + "functions": [ + { + "parentPluginId": "core", + "id": "def-server.pollEsNodesVersion", + "type": "Function", + "tags": [], + "label": "pollEsNodesVersion", + "description": [], + "signature": [ + "({ internalClient, log, kibanaVersion, ignoreVersionMismatch, esVersionCheckInterval: healthCheckInterval, }: ", + { + "pluginId": "core", + "scope": "server", + "docId": "kibCorePluginApi", + "section": "def-server.PollEsNodesVersionOptions", + "text": "PollEsNodesVersionOptions" + }, + ") => ", + "Observable", + "<", + { + "pluginId": "core", + "scope": "server", + "docId": "kibCorePluginApi", + "section": "def-server.NodesVersionCompatibility", + "text": "NodesVersionCompatibility" + }, + ">" + ], + "path": "src/core/server/elasticsearch/version_check/ensure_es_version.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.pollEsNodesVersion.$1", + "type": "Object", + "tags": [], + "label": "{\n internalClient,\n log,\n kibanaVersion,\n ignoreVersionMismatch,\n esVersionCheckInterval: healthCheckInterval,\n}", + "description": [], + "signature": [ + { + "pluginId": "core", + "scope": "server", + "docId": "kibCorePluginApi", + "section": "def-server.PollEsNodesVersionOptions", + "text": "PollEsNodesVersionOptions" + } + ], + "path": "src/core/server/elasticsearch/version_check/ensure_es_version.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + } + ], + "interfaces": [ + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient", + "type": "Interface", + "tags": [], + "label": "AnalyticsClient", + "description": [ + "\r\nAnalytics client's public APIs" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.reportEvent", + "type": "Function", + "tags": [], + "label": "reportEvent", + "description": [ + "\r\nReports a telemetry event." + ], + "signature": [ + ">(eventType: string, eventData: EventTypeData) => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.reportEvent.$1", + "type": "string", + "tags": [], + "label": "eventType", + "description": [ + "The event type registered via the `registerEventType` API." + ], + "signature": [ + "string" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.reportEvent.$2", + "type": "Uncategorized", + "tags": [], + "label": "eventData", + "description": [ + "The properties matching the schema declared in the `registerEventType` API." + ], + "signature": [ + "EventTypeData" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.registerEventType", + "type": "Function", + "tags": [], + "label": "registerEventType", + "description": [ + "\r\nRegisters the event type that will be emitted via the reportEvent API." + ], + "signature": [ + "(eventTypeOps: ", + "EventTypeOpts", + ") => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.registerEventType.$1", + "type": "Object", + "tags": [], + "label": "eventTypeOps", + "description": [], + "signature": [ + "EventTypeOpts", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.registerShipper", + "type": "Function", + "tags": [], + "label": "registerShipper", + "description": [ + "\r\nSet up the shipper that will be used to report the telemetry events." + ], + "signature": [ + "(Shipper: ", + "ShipperClassConstructor", + ", shipperConfig: ShipperConfig, opts?: ", + "RegisterShipperOpts", + " | undefined) => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.registerShipper.$1", + "type": "Object", + "tags": [], + "label": "Shipper", + "description": [ + "The {@link IShipper } class to instantiate the shipper." + ], + "signature": [ + "ShipperClassConstructor", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.registerShipper.$2", + "type": "Uncategorized", + "tags": [], + "label": "shipperConfig", + "description": [ + "The config specific to the Shipper to instantiate." + ], + "signature": [ + "ShipperConfig" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.registerShipper.$3", + "type": "Object", + "tags": [], + "label": "opts", + "description": [ + "Additional options to register the shipper {@link RegisterShipperOpts }." + ], + "signature": [ + "RegisterShipperOpts", + " | undefined" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": false + } + ], + "returnComment": [] }, { "parentPluginId": "core", - "id": "def-server.ElasticsearchConfig.customHeaders", - "type": "Object", + "id": "def-server.AnalyticsClient.optIn", + "type": "Function", "tags": [], - "label": "customHeaders", + "label": "optIn", "description": [ - "\nHeader names and values to send to Elasticsearch with every request. These\nheaders cannot be overwritten by client-side headers and aren't affected by\n`requestHeadersWhitelist` configuration." - ], - "signature": [ - "{ [x: string]: string; }" + "\r\nUsed to control the user's consent to report the data.\r\nIn the advanced mode, it allows to \"cherry-pick\" which events and shippers are enabled/disabled." ], - "path": "src/core/server/elasticsearch/elasticsearch_config.ts", - "deprecated": false - }, - { - "parentPluginId": "core", - "id": "def-server.ElasticsearchConfig.Unnamed", - "type": "Function", - "tags": [], - "label": "Constructor", - "description": [], "signature": [ - "any" + "(optInConfig: ", + "OptInConfig", + ") => void" ], - "path": "src/core/server/elasticsearch/elasticsearch_config.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false, "children": [ { "parentPluginId": "core", - "id": "def-server.ElasticsearchConfig.Unnamed.$1", + "id": "def-server.AnalyticsClient.optIn.$1", "type": "Object", "tags": [], - "label": "rawConfig", - "description": [], + "label": "optInConfig", + "description": [ + "{@link OptInConfig }" + ], "signature": [ - "Readonly<{ username?: string | undefined; password?: string | undefined; serviceAccountToken?: string | undefined; } & { ssl: Readonly<{ key?: string | undefined; certificateAuthorities?: string | string[] | undefined; certificate?: string | undefined; keyPassphrase?: string | undefined; } & { verificationMode: \"none\" | \"full\" | \"certificate\"; keystore: Readonly<{ path?: string | undefined; password?: string | undefined; } & {}>; truststore: Readonly<{ path?: string | undefined; password?: string | undefined; } & {}>; alwaysPresentCertificate: boolean; }>; healthCheck: Readonly<{} & { delay: moment.Duration; }>; hosts: string | string[]; sniffOnStart: boolean; sniffInterval: false | moment.Duration; sniffOnConnectionFault: boolean; maxSockets: number; compression: boolean; requestHeadersWhitelist: string | string[]; customHeaders: Record; shardTimeout: moment.Duration; requestTimeout: moment.Duration; pingTimeout: moment.Duration; logQueries: boolean; apiVersion: string; ignoreVersionMismatch: boolean; skipStartupConnectionCheck: boolean; }>" + "OptInConfig" ], - "path": "src/core/server/elasticsearch/elasticsearch_config.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false, "isRequired": true } ], "returnComment": [] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "core", - "id": "def-server.EventLoopDelaysMonitor", - "type": "Class", - "tags": [], - "label": "EventLoopDelaysMonitor", - "description": [], - "path": "src/core/server/metrics/event_loop_delays/event_loop_delays_monitor.ts", - "deprecated": false, - "children": [ + }, { "parentPluginId": "core", - "id": "def-server.EventLoopDelaysMonitor.Unnamed", + "id": "def-server.AnalyticsClient.registerContextProvider", "type": "Function", "tags": [], - "label": "Constructor", + "label": "registerContextProvider", "description": [ - "\nCreating a new instance from EventLoopDelaysMonitor will\nautomatically start tracking event loop delays." + "\r\nRegisters the context provider to enrich the any reported events." ], "signature": [ - "any" + "(contextProviderOpts: ", + "ContextProviderOpts", + ") => void" ], - "path": "src/core/server/metrics/event_loop_delays/event_loop_delays_monitor.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "core", - "id": "def-server.EventLoopDelaysMonitor.collect", - "type": "Function", - "tags": [], - "label": "collect", - "description": [ - "\nCollect gathers event loop delays metrics from nodejs perf_hooks.monitorEventLoopDelay\nthe histogram calculations start from the last time `reset` was called or this\nEventLoopDelaysMonitor instance was created.\n\nReturns metrics in milliseconds." - ], - "signature": [ - "() => ", + "children": [ { - "pluginId": "core", - "scope": "server", - "docId": "kibCorePluginApi", - "section": "def-server.IntervalHistogram", - "text": "IntervalHistogram" + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.registerContextProvider.$1", + "type": "Object", + "tags": [], + "label": "contextProviderOpts", + "description": [ + "{@link ContextProviderOpts }" + ], + "signature": [ + "ContextProviderOpts", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true } ], - "path": "src/core/server/metrics/event_loop_delays/event_loop_delays_monitor.ts", - "deprecated": false, - "children": [], "returnComment": [] }, { "parentPluginId": "core", - "id": "def-server.EventLoopDelaysMonitor.reset", + "id": "def-server.AnalyticsClient.removeContextProvider", "type": "Function", "tags": [], - "label": "reset", + "label": "removeContextProvider", "description": [ - "\nResets the collected histogram data." + "\r\nRemoves the context provider and stop enriching the events from its context." ], "signature": [ - "() => void" + "(contextProviderName: string) => void" ], - "path": "src/core/server/metrics/event_loop_delays/event_loop_delays_monitor.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "core", - "id": "def-server.EventLoopDelaysMonitor.stop", - "type": "Function", - "tags": [], - "label": "stop", - "description": [ - "\nDisables updating the interval timer for collecting new data points." - ], - "signature": [ - "() => void" + "children": [ + { + "parentPluginId": "core", + "id": "def-server.AnalyticsClient.removeContextProvider.$1", + "type": "string", + "tags": [], + "label": "contextProviderName", + "description": [ + "The name of the context provider to remove." + ], + "signature": [ + "string" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } ], - "path": "src/core/server/metrics/event_loop_delays/event_loop_delays_monitor.ts", - "deprecated": false, - "children": [], "returnComment": [] - } - ], - "initialIsOpen": false - } - ], - "functions": [ - { - "parentPluginId": "core", - "id": "def-server.pollEsNodesVersion", - "type": "Function", - "tags": [], - "label": "pollEsNodesVersion", - "description": [], - "signature": [ - "({ internalClient, log, kibanaVersion, ignoreVersionMismatch, esVersionCheckInterval: healthCheckInterval, }: ", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCorePluginApi", - "section": "def-server.PollEsNodesVersionOptions", - "text": "PollEsNodesVersionOptions" - }, - ") => ", - "Observable", - "<", - { - "pluginId": "core", - "scope": "server", - "docId": "kibCorePluginApi", - "section": "def-server.NodesVersionCompatibility", - "text": "NodesVersionCompatibility" }, - ">" - ], - "path": "src/core/server/elasticsearch/version_check/ensure_es_version.ts", - "deprecated": false, - "children": [ { "parentPluginId": "core", - "id": "def-server.pollEsNodesVersion.$1", + "id": "def-server.AnalyticsClient.telemetryCounter$", "type": "Object", "tags": [], - "label": "{\n internalClient,\n log,\n kibanaVersion,\n ignoreVersionMismatch,\n esVersionCheckInterval: healthCheckInterval,\n}", - "description": [], + "label": "telemetryCounter$", + "description": [ + "\r\nObservable to emit the stats of the processed events." + ], "signature": [ - { - "pluginId": "core", - "scope": "server", - "docId": "kibCorePluginApi", - "section": "def-server.PollEsNodesVersionOptions", - "text": "PollEsNodesVersionOptions" - } + "Observable", + "<", + "TelemetryCounter", + ">" ], - "path": "src/core/server/elasticsearch/version_check/ensure_es_version.ts", - "deprecated": false, - "isRequired": true + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false } ], - "returnComment": [], "initialIsOpen": false - } - ], - "interfaces": [ + }, { "parentPluginId": "core", "id": "def-server.AppCategory", @@ -9066,6 +10287,70 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-server.ContextProviderOpts", + "type": "Interface", + "tags": [], + "label": "ContextProviderOpts", + "description": [ + "\r\nDefinition of a context provider" + ], + "signature": [ + "ContextProviderOpts", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.ContextProviderOpts.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\r\nThe name of the provider." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.ContextProviderOpts.context$", + "type": "Object", + "tags": [], + "label": "context$", + "description": [ + "\r\nObservable that emits the custom context." + ], + "signature": [ + "Observable", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.ContextProviderOpts.schema", + "type": "Object", + "tags": [], + "label": "schema", + "description": [ + "\r\nSchema declaring and documenting the expected output in the context$\r\n" + ], + "signature": [ + "{ [Key in keyof Required]: ", + "SchemaValue", + "; }" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-server.ContextSetup", @@ -9117,6 +10402,21 @@ "path": "src/core/server/index.ts", "deprecated": false, "children": [ + { + "parentPluginId": "core", + "id": "def-server.CorePreboot.analytics", + "type": "Object", + "tags": [], + "label": "analytics", + "description": [ + "{@link AnalyticsServicePreboot}" + ], + "signature": [ + "AnalyticsClient" + ], + "path": "src/core/server/index.ts", + "deprecated": false + }, { "parentPluginId": "core", "id": "def-server.CorePreboot.elasticsearch", @@ -9205,6 +10505,21 @@ "path": "src/core/server/index.ts", "deprecated": false, "children": [ + { + "parentPluginId": "core", + "id": "def-server.CoreSetup.analytics", + "type": "Object", + "tags": [], + "label": "analytics", + "description": [ + "{@link AnalyticsServiceSetup}" + ], + "signature": [ + "AnalyticsClient" + ], + "path": "src/core/server/index.ts", + "deprecated": false + }, { "parentPluginId": "core", "id": "def-server.CoreSetup.capabilities", @@ -9527,6 +10842,27 @@ "path": "src/core/server/index.ts", "deprecated": false, "children": [ + { + "parentPluginId": "core", + "id": "def-server.CoreStart.analytics", + "type": "Object", + "tags": [], + "label": "analytics", + "description": [ + "{@link AnalyticsServiceStart}" + ], + "signature": [ + "{ optIn: (optInConfig: ", + "OptInConfig", + ") => void; reportEvent: >(eventType: string, eventData: EventTypeData) => void; readonly telemetryCounter$: ", + "Observable", + "<", + "TelemetryCounter", + ">; }" + ], + "path": "src/core/server/index.ts", + "deprecated": false + }, { "parentPluginId": "core", "id": "def-server.CoreStart.capabilities", @@ -10654,6 +11990,152 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-server.Event_2", + "type": "Interface", + "tags": [], + "label": "Event_2", + "description": [ + "\r\nDefinition of the full event structure" + ], + "signature": [ + "Event" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.Event_2.timestamp", + "type": "string", + "tags": [], + "label": "timestamp", + "description": [ + "\r\nThe time the event was generated in ISO format." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.Event_2.event_type", + "type": "string", + "tags": [], + "label": "event_type", + "description": [ + "\r\nThe event type." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.Event_2.properties", + "type": "Object", + "tags": [], + "label": "properties", + "description": [ + "\r\nThe specific properties of the event type." + ], + "signature": [ + "{ [x: string]: unknown; }" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.Event_2.context", + "type": "Object", + "tags": [], + "label": "context", + "description": [ + "\r\nThe {@link EventContext} enriched during the processing pipeline." + ], + "signature": [ + "EventContext" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-server.EventContext", + "type": "Interface", + "tags": [], + "label": "EventContext", + "description": [], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.EventContext.Unnamed", + "type": "IndexSignature", + "tags": [], + "label": "[key: string]: unknown", + "description": [], + "signature": [ + "[key: string]: unknown" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-server.EventTypeOpts", + "type": "Interface", + "tags": [], + "label": "EventTypeOpts", + "description": [ + "\r\nDefinition of an Event Type." + ], + "signature": [ + "EventTypeOpts", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.EventTypeOpts.eventType", + "type": "string", + "tags": [], + "label": "eventType", + "description": [ + "\r\nThe event type's unique name." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.EventTypeOpts.schema", + "type": "Object", + "tags": [], + "label": "schema", + "description": [ + "\r\nSchema declaring and documenting the expected structure of this event type.\r\n" + ], + "signature": [ + "{ [Key in keyof Required]: ", + "SchemaValue", + "; }" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-server.ExecutionContextSetup", @@ -10754,7 +12236,7 @@ "Headers used for authentication against Elasticsearch" ], "signature": [ - "{ from?: string | string[] | undefined; date?: string | string[] | undefined; origin?: string | string[] | undefined; range?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; allow?: string | string[] | undefined; accept?: string | string[] | undefined; host?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; etag?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }" + "{ from?: string | string[] | undefined; date?: string | string[] | undefined; range?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; origin?: string | string[] | undefined; allow?: string | string[] | undefined; accept?: string | string[] | undefined; host?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; etag?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }" ], "path": "src/core/server/elasticsearch/types.ts", "deprecated": false @@ -11780,7 +13262,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -11790,7 +13272,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -11798,7 +13280,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -11810,7 +13292,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -11820,7 +13302,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -11828,7 +13310,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -11836,7 +13318,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -11846,7 +13328,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -11854,7 +13336,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -11933,9 +13415,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -12068,7 +13548,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -12078,7 +13558,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -12086,7 +13566,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -12094,7 +13574,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -12104,7 +13584,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -12112,7 +13592,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -12183,29 +13663,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -12548,7 +14028,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -12558,7 +14038,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -12566,7 +14046,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -12593,29 +14073,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -12871,6 +14351,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", @@ -14179,7 +15661,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -14189,7 +15671,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -14197,7 +15679,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -14209,7 +15691,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -14219,7 +15701,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -14227,7 +15709,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -14235,7 +15717,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -14245,7 +15727,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -14253,7 +15735,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -14332,9 +15814,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -14467,7 +15947,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -14477,7 +15957,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -14485,7 +15965,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -14493,7 +15973,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -14503,7 +15983,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -14511,7 +15991,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -14582,29 +16062,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -14947,7 +16427,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -14957,7 +16437,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -14965,7 +16445,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -14992,29 +16472,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -15270,6 +16750,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", @@ -15382,7 +16864,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -15392,7 +16874,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -15400,7 +16882,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -15412,7 +16894,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -15422,7 +16904,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -15430,7 +16912,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -15438,7 +16920,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -15448,7 +16930,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -15456,7 +16938,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -15535,9 +17017,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -15670,7 +17150,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -15680,7 +17160,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -15688,7 +17168,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -15696,7 +17176,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -15706,7 +17186,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -15714,7 +17194,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -15785,29 +17265,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -16150,7 +17630,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -16160,7 +17640,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -16168,7 +17648,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -16195,29 +17675,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -16473,6 +17953,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", @@ -16531,7 +18013,145 @@ "default", "; }" ], - "path": "src/core/server/elasticsearch/client/scoped_cluster_client.ts", + "path": "src/core/server/elasticsearch/client/scoped_cluster_client.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-server.IShipper", + "type": "Interface", + "tags": [], + "label": "IShipper", + "description": [ + "\r\nBasic structure of a Shipper" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.IShipper.reportEvents", + "type": "Function", + "tags": [], + "label": "reportEvents", + "description": [ + "\r\nAdapts and ships the event to the persisting/analytics solution." + ], + "signature": [ + "(events: ", + "Event", + "[]) => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.IShipper.reportEvents.$1", + "type": "Array", + "tags": [], + "label": "events", + "description": [ + "batched events {@link Event }" + ], + "signature": [ + "Event", + "[]" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-server.IShipper.optIn", + "type": "Function", + "tags": [], + "label": "optIn", + "description": [ + "\r\nStops/restarts the shipping mechanism based on the value of isOptedIn" + ], + "signature": [ + "(isOptedIn: boolean) => void" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.IShipper.optIn.$1", + "type": "boolean", + "tags": [], + "label": "isOptedIn", + "description": [ + "`true` for resume sending events. `false` to stop." + ], + "signature": [ + "boolean" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-server.IShipper.extendContext", + "type": "Function", + "tags": [], + "label": "extendContext", + "description": [ + "\r\nPerform any necessary calls to the persisting/analytics solution to set the event's context." + ], + "signature": [ + "((newContext: ", + "EventContext", + ") => void) | undefined" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.IShipper.extendContext.$1", + "type": "Object", + "tags": [], + "label": "newContext", + "description": [], + "signature": [ + "EventContext" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "core", + "id": "def-server.IShipper.telemetryCounter$", + "type": "Object", + "tags": [], + "label": "telemetryCounter$", + "description": [ + "\r\nObservable to emit the stats of the processed events." + ], + "signature": [ + "Observable", + "<", + "TelemetryCounter", + "> | undefined" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false } ], @@ -17964,6 +19584,53 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-server.OptInConfig", + "type": "Interface", + "tags": [], + "label": "OptInConfig", + "description": [ + "\r\n" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.OptInConfig.global", + "type": "Object", + "tags": [], + "label": "global", + "description": [ + "\r\nControls the global enabled/disabled behaviour of the client and shippers." + ], + "signature": [ + "OptInConfigPerType" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.OptInConfig.event_types", + "type": "Object", + "tags": [], + "label": "event_types", + "description": [ + "\r\nControls if an event type should be disabled for a specific type of shipper." + ], + "signature": [ + "Record | undefined" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-server.PackageInfo", @@ -18232,7 +19899,14 @@ "\nList of configuration properties that will be available on the client-side plugin." ], "signature": [ - "{ [P in keyof T]?: boolean | undefined; } | undefined" + { + "pluginId": "core", + "scope": "server", + "docId": "kibCorePluginApi", + "section": "def-server.ExposedToBrowserDescriptor", + "text": "ExposedToBrowserDescriptor" + }, + " | undefined" ], "path": "src/core/server/plugins/types.ts", "deprecated": false @@ -18655,7 +20329,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -18665,7 +20339,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -18673,7 +20347,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -18685,7 +20359,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -18695,7 +20369,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -18703,7 +20377,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -18711,7 +20385,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -18721,7 +20395,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -18729,7 +20403,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -18808,9 +20482,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -18943,7 +20615,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -18953,7 +20625,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -18961,7 +20633,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -18969,7 +20641,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -18979,7 +20651,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -18987,7 +20659,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -19058,29 +20730,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -19423,7 +21095,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -19433,7 +21105,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -19441,7 +21113,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -19468,29 +21140,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -19746,6 +21418,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", @@ -20843,6 +22517,52 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-server.ShipperClassConstructor", + "type": "Interface", + "tags": [], + "label": "ShipperClassConstructor", + "description": [ + "\r\nConstructor of a {@link IShipper}" + ], + "signature": [ + "ShipperClassConstructor", + "" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.ShipperClassConstructor.shipperName", + "type": "string", + "tags": [], + "label": "shipperName", + "description": [ + "\r\nThe shipper's unique name" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.ShipperClassConstructor.Unnamed", + "type": "Any", + "tags": [], + "label": "Unnamed", + "description": [ + "\r\nThe constructor" + ], + "signature": [ + "any" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-server.StatusServiceSetup", @@ -21022,6 +22742,84 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-server.TelemetryCounter", + "type": "Interface", + "tags": [], + "label": "TelemetryCounter", + "description": [ + "\r\nShape of the events emitted by the telemetryCounter$ observable" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.TelemetryCounter.type", + "type": "Enum", + "tags": [], + "label": "type", + "description": [ + "\r\nIndicates if the event contains data about succeeded, failed or dropped events." + ], + "signature": [ + "TelemetryCounterType" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.TelemetryCounter.source", + "type": "string", + "tags": [], + "label": "source", + "description": [ + "\r\nWho emitted the event? It can be \"client\" or the name of the shipper." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.TelemetryCounter.event_type", + "type": "string", + "tags": [], + "label": "event_type", + "description": [ + "\r\nThe event type the success/failure/drop event refers to." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.TelemetryCounter.code", + "type": "string", + "tags": [], + "label": "code", + "description": [ + "\r\nCode to provide additional information about the success or failure. Examples are 200/400/504/ValidationError/UnknownError" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-server.TelemetryCounter.count", + "type": "number", + "tags": [], + "label": "count", + "description": [ + "\r\nThe number of events that this counter refers to." + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-server.UiSettingsParams", @@ -21678,6 +23476,19 @@ "path": "src/core/server/plugins/types.ts", "deprecated": false, "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-server.TelemetryCounterType", + "type": "Enum", + "tags": [], + "label": "TelemetryCounterType", + "description": [ + "\r\nTypes of the Telemetry Counter: It allows to differentiate what happened to the events" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "initialIsOpen": false } ], "misc": [ @@ -21713,6 +23524,60 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-server.AnalyticsServicePreboot", + "type": "Type", + "tags": [], + "label": "AnalyticsServicePreboot", + "description": [ + "\nExposes the public APIs of the AnalyticsClient during the preboot phase\n{@link AnalyticsClient}" + ], + "signature": [ + "AnalyticsClient" + ], + "path": "src/core/server/analytics/analytics_service.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-server.AnalyticsServiceSetup", + "type": "Type", + "tags": [], + "label": "AnalyticsServiceSetup", + "description": [ + "\nExposes the public APIs of the AnalyticsClient during the setup phase.\n{@link AnalyticsClient}" + ], + "signature": [ + "AnalyticsClient" + ], + "path": "src/core/server/analytics/analytics_service.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-server.AnalyticsServiceStart", + "type": "Type", + "tags": [], + "label": "AnalyticsServiceStart", + "description": [ + "\nExposes the public APIs of the AnalyticsClient during the start phase\n{@link AnalyticsClient}" + ], + "signature": [ + "{ optIn: (optInConfig: ", + "OptInConfig", + ") => void; reportEvent: >(eventType: string, eventData: EventTypeData) => void; readonly telemetryCounter$: ", + "Observable", + "<", + "TelemetryCounter", + ">; }" + ], + "path": "src/core/server/analytics/analytics_service.ts", + "deprecated": false, + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-server.APP_WRAPPER_CLASS", @@ -22100,7 +23965,7 @@ "label": "EcsEventType", "description": [], "signature": [ - "\"start\" | \"user\" | \"error\" | \"end\" | \"info\" | \"group\" | \"protocol\" | \"connection\" | \"access\" | \"admin\" | \"allowed\" | \"change\" | \"creation\" | \"deletion\" | \"denied\" | \"installation\"" + "\"start\" | \"user\" | \"error\" | \"info\" | \"group\" | \"end\" | \"protocol\" | \"connection\" | \"access\" | \"admin\" | \"allowed\" | \"change\" | \"creation\" | \"deletion\" | \"denied\" | \"installation\"" ], "path": "node_modules/@types/kbn__logging/index.d.ts", "deprecated": false, @@ -22157,7 +24022,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -22167,7 +24032,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -22175,7 +24040,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -22187,7 +24052,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -22197,7 +24062,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -22205,7 +24070,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -22213,7 +24078,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -22223,7 +24088,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -22231,7 +24096,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -22310,9 +24175,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -22445,7 +24308,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -22455,7 +24318,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -22463,7 +24326,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -22471,7 +24334,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -22481,7 +24344,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -22489,7 +24352,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -22560,29 +24423,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -22925,7 +24788,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -22935,7 +24798,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -22943,7 +24806,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -22970,29 +24833,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -23248,6 +25111,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", @@ -23334,6 +25199,22 @@ "deprecated": false, "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-server.EventType", + "type": "Type", + "tags": [], + "label": "EventType", + "description": [ + "\r\nEvent Type used for indexed structures. Only used to improve the readability of the types" + ], + "signature": [ + "string" + ], + "path": "node_modules/@types/elastic__analytics/index.d.ts", + "deprecated": false, + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-server.ExecutionContextStart", @@ -23354,6 +25235,30 @@ "deprecated": false, "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-server.ExposedToBrowserDescriptor", + "type": "Type", + "tags": [], + "label": "ExposedToBrowserDescriptor", + "description": [ + "\nType defining the list of configuration properties that will be exposed on the client-side\nObject properties can either be fully exposed\n" + ], + "signature": [ + "{ [Key in keyof T]?: (T[Key] extends Maybe ? boolean : T[Key] extends Maybe ? boolean | ", + { + "pluginId": "core", + "scope": "server", + "docId": "kibCorePluginApi", + "section": "def-server.ExposedToBrowserDescriptor", + "text": "ExposedToBrowserDescriptor" + }, + " : boolean) | undefined; }" + ], + "path": "src/core/server/plugins/types.ts", + "deprecated": false, + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-server.HandlerContextType", diff --git a/api_docs/core.mdx b/api_docs/core.mdx index 2d7eb4254e5fc..0290b6009ea42 100644 --- a/api_docs/core.mdx +++ b/api_docs/core.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/core title: "core" image: https://source.unsplash.com/400x175/?github summary: API docs for the core plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'core'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 2375 | 15 | 970 | 33 | +| 2497 | 15 | 971 | 33 | ## Client @@ -28,6 +28,9 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que ### Interfaces +### Enums + + ### Consts, variables and types diff --git a/api_docs/core_application.devdocs.json b/api_docs/core_application.devdocs.json index 49b38022421a7..cc3cb0a2d1dd2 100644 --- a/api_docs/core_application.devdocs.json +++ b/api_docs/core_application.devdocs.json @@ -1172,10 +1172,18 @@ "tags": [], "label": "navigateToUrl", "description": [ - "\nNavigate to given URL in a SPA friendly way when possible (when the URL will redirect to a valid application\nwithin the current basePath).\n\nThe method resolves pathnames the same way browsers do when resolving a `` value. The provided `url` can be:\n- an absolute URL\n- an absolute path\n- a path relative to the current URL (window.location.href)\n\nIf all these criteria are true for the given URL:\n- (only for absolute URLs) The origin of the URL matches the origin of the browser's current location\n- The resolved pathname of the provided URL/path starts with the current basePath (eg. /mybasepath/s/my-space)\n- The pathname segment after the basePath matches any known application route (eg. /app// or any application's `appRoute` configuration)\n\nThen a SPA navigation will be performed using `navigateToApp` using the corresponding application and path.\nOtherwise, fallback to a full page reload to navigate to the url using `window.location.assign`\n" + "\nNavigate to given URL in a SPA friendly way when possible (when the URL will redirect to a valid application\nwithin the current basePath).\n\nThe method resolves pathnames the same way browsers do when resolving a `` value. The provided `url` can be:\n- an absolute URL\n- an absolute path\n- a path relative to the current URL (window.location.href)\n\nIf all these criteria are true for the given URL:\n- (only for absolute URLs) The origin of the URL matches the origin of the browser's current location\n- The resolved pathname of the provided URL/path starts with the current basePath (eg. /mybasepath/s/my-space)\n- The pathname segment after the basePath matches any known application route (eg. /app// or any application's `appRoute` configuration)\n\nThen a SPA navigation will be performed using `navigateToApp` using the corresponding application and path.\nOtherwise, fallback to a full page reload to navigate to the url using `window.location.assign`.\n" ], "signature": [ - "(url: string) => Promise" + "(url: string, options?: ", + { + "pluginId": "core", + "scope": "public", + "docId": "kibCoreApplicationPluginApi", + "section": "def-public.NavigateToUrlOptions", + "text": "NavigateToUrlOptions" + }, + " | undefined) => Promise" ], "path": "src/core/public/application/types.ts", "deprecated": false, @@ -1195,6 +1203,27 @@ "path": "src/core/public/application/types.ts", "deprecated": false, "isRequired": true + }, + { + "parentPluginId": "core", + "id": "def-public.ApplicationStart.navigateToUrl.$2", + "type": "Object", + "tags": [], + "label": "options", + "description": [], + "signature": [ + { + "pluginId": "core", + "scope": "public", + "docId": "kibCoreApplicationPluginApi", + "section": "def-public.NavigateToUrlOptions", + "text": "NavigateToUrlOptions" + }, + " | undefined" + ], + "path": "src/core/public/application/types.ts", + "deprecated": false, + "isRequired": false } ], "returnComment": [] @@ -1741,6 +1770,66 @@ ], "path": "src/core/public/application/types.ts", "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.NavigateToAppOptions.skipAppLeave", + "type": "CompoundType", + "tags": [], + "label": "skipAppLeave", + "description": [ + "\nif true, will bypass the default onAppLeave behavior" + ], + "signature": [ + "boolean | undefined" + ], + "path": "src/core/public/application/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "core", + "id": "def-public.NavigateToUrlOptions", + "type": "Interface", + "tags": [], + "label": "NavigateToUrlOptions", + "description": [ + "\nOptions for the {@link ApplicationStart.navigateToUrl | navigateToUrl API}" + ], + "path": "src/core/public/application/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-public.NavigateToUrlOptions.skipAppLeave", + "type": "CompoundType", + "tags": [], + "label": "skipAppLeave", + "description": [ + "\nif true, will bypass the default onAppLeave behavior" + ], + "signature": [ + "boolean | undefined" + ], + "path": "src/core/public/application/types.ts", + "deprecated": false + }, + { + "parentPluginId": "core", + "id": "def-public.NavigateToUrlOptions.forceRedirect", + "type": "CompoundType", + "tags": [], + "label": "forceRedirect", + "description": [ + "\nif true will force a full page reload/refresh/assign, overriding the outcome of other url checks against current the location (effectively using `window.location.assign` instead of `push`)" + ], + "signature": [ + "boolean | undefined" + ], + "path": "src/core/public/application/types.ts", + "deprecated": false } ], "initialIsOpen": false diff --git a/api_docs/core_application.mdx b/api_docs/core_application.mdx index a42c54aefe66c..ad976a37aa5db 100644 --- a/api_docs/core_application.mdx +++ b/api_docs/core_application.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/core-application title: "core.application" image: https://source.unsplash.com/400x175/?github summary: API docs for the core.application plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'core.application'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 2375 | 15 | 970 | 33 | +| 2497 | 15 | 971 | 33 | ## Client diff --git a/api_docs/core_chrome.devdocs.json b/api_docs/core_chrome.devdocs.json index 6d9e4df9f856b..2cfff911cd3a3 100644 --- a/api_docs/core_chrome.devdocs.json +++ b/api_docs/core_chrome.devdocs.json @@ -1884,9 +1884,9 @@ "label": "ChromeHelpExtensionLinkBase", "description": [], "signature": [ - "{ 'data-test-subj'?: string | undefined; target?: string | undefined; iconType?: ", + "{ iconType?: ", "IconType", - " | undefined; rel?: string | undefined; }" + " | undefined; 'data-test-subj'?: string | undefined; rel?: string | undefined; target?: string | undefined; }" ], "path": "src/core/public/chrome/ui/header/header_help_menu.tsx", "deprecated": false, diff --git a/api_docs/core_chrome.mdx b/api_docs/core_chrome.mdx index e0c9186af9b80..09e098a7bf1ba 100644 --- a/api_docs/core_chrome.mdx +++ b/api_docs/core_chrome.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/core-chrome title: "core.chrome" image: https://source.unsplash.com/400x175/?github summary: API docs for the core.chrome plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'core.chrome'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 2375 | 15 | 970 | 33 | +| 2497 | 15 | 971 | 33 | ## Client diff --git a/api_docs/core_http.devdocs.json b/api_docs/core_http.devdocs.json index 561de33cab4a3..1f99d8f6e9bc1 100644 --- a/api_docs/core_http.devdocs.json +++ b/api_docs/core_http.devdocs.json @@ -2345,7 +2345,7 @@ "\nReadonly copy of incoming request headers." ], "signature": [ - "{ from?: string | string[] | undefined; date?: string | string[] | undefined; origin?: string | string[] | undefined; range?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; allow?: string | string[] | undefined; accept?: string | string[] | undefined; host?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; etag?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }" + "{ from?: string | string[] | undefined; date?: string | string[] | undefined; range?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; origin?: string | string[] | undefined; allow?: string | string[] | undefined; accept?: string | string[] | undefined; host?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; etag?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }" ], "path": "src/core/server/http/router/request.ts", "deprecated": false @@ -3486,7 +3486,7 @@ "section": "def-server.KibanaRequest", "text": "KibanaRequest" }, - ") => string; prepend: (path: string) => string; set: (request: ", + ") => string; set: (request: ", { "pluginId": "core", "scope": "server", @@ -3494,7 +3494,7 @@ "section": "def-server.KibanaRequest", "text": "KibanaRequest" }, - ", requestSpecificBasePath: string) => void; readonly serverBasePath: string; readonly publicBaseUrl?: string | undefined; }" + ", requestSpecificBasePath: string) => void; prepend: (path: string) => string; readonly serverBasePath: string; readonly publicBaseUrl?: string | undefined; }" ], "path": "src/core/server/http/types.ts", "deprecated": false @@ -3853,7 +3853,7 @@ "section": "def-server.KibanaRequest", "text": "KibanaRequest" }, - ") => string; prepend: (path: string) => string; set: (request: ", + ") => string; set: (request: ", { "pluginId": "core", "scope": "server", @@ -3861,7 +3861,7 @@ "section": "def-server.KibanaRequest", "text": "KibanaRequest" }, - ", requestSpecificBasePath: string) => void; readonly serverBasePath: string; readonly publicBaseUrl?: string | undefined; }" + ", requestSpecificBasePath: string) => void; prepend: (path: string) => string; readonly serverBasePath: string; readonly publicBaseUrl?: string | undefined; }" ], "path": "src/core/server/http/types.ts", "deprecated": false @@ -4059,7 +4059,7 @@ "section": "def-server.KibanaRequest", "text": "KibanaRequest" }, - ") => string; prepend: (path: string) => string; set: (request: ", + ") => string; set: (request: ", { "pluginId": "core", "scope": "server", @@ -4067,7 +4067,7 @@ "section": "def-server.KibanaRequest", "text": "KibanaRequest" }, - ", requestSpecificBasePath: string) => void; readonly serverBasePath: string; readonly publicBaseUrl?: string | undefined; }" + ", requestSpecificBasePath: string) => void; prepend: (path: string) => string; readonly serverBasePath: string; readonly publicBaseUrl?: string | undefined; }" ], "path": "src/core/server/http/types.ts", "deprecated": false @@ -9397,7 +9397,7 @@ "\nHttp request headers to read." ], "signature": [ - "{ from?: string | string[] | undefined; date?: string | string[] | undefined; origin?: string | string[] | undefined; range?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; allow?: string | string[] | undefined; accept?: string | string[] | undefined; host?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; etag?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }" + "{ from?: string | string[] | undefined; date?: string | string[] | undefined; range?: string | string[] | undefined; warning?: string | string[] | undefined; location?: string | string[] | undefined; origin?: string | string[] | undefined; allow?: string | string[] | undefined; accept?: string | string[] | undefined; host?: string | string[] | undefined; \"accept-language\"?: string | string[] | undefined; \"accept-patch\"?: string | string[] | undefined; \"accept-ranges\"?: string | string[] | undefined; \"access-control-allow-credentials\"?: string | string[] | undefined; \"access-control-allow-headers\"?: string | string[] | undefined; \"access-control-allow-methods\"?: string | string[] | undefined; \"access-control-allow-origin\"?: string | string[] | undefined; \"access-control-expose-headers\"?: string | string[] | undefined; \"access-control-max-age\"?: string | string[] | undefined; \"access-control-request-headers\"?: string | string[] | undefined; \"access-control-request-method\"?: string | string[] | undefined; age?: string | string[] | undefined; \"alt-svc\"?: string | string[] | undefined; authorization?: string | string[] | undefined; \"cache-control\"?: string | string[] | undefined; connection?: string | string[] | undefined; \"content-disposition\"?: string | string[] | undefined; \"content-encoding\"?: string | string[] | undefined; \"content-language\"?: string | string[] | undefined; \"content-length\"?: string | string[] | undefined; \"content-location\"?: string | string[] | undefined; \"content-range\"?: string | string[] | undefined; \"content-type\"?: string | string[] | undefined; cookie?: string | string[] | undefined; etag?: string | string[] | undefined; expect?: string | string[] | undefined; expires?: string | string[] | undefined; forwarded?: string | string[] | undefined; \"if-match\"?: string | string[] | undefined; \"if-modified-since\"?: string | string[] | undefined; \"if-none-match\"?: string | string[] | undefined; \"if-unmodified-since\"?: string | string[] | undefined; \"last-modified\"?: string | string[] | undefined; pragma?: string | string[] | undefined; \"proxy-authenticate\"?: string | string[] | undefined; \"proxy-authorization\"?: string | string[] | undefined; \"public-key-pins\"?: string | string[] | undefined; referer?: string | string[] | undefined; \"retry-after\"?: string | string[] | undefined; \"sec-websocket-accept\"?: string | string[] | undefined; \"sec-websocket-extensions\"?: string | string[] | undefined; \"sec-websocket-key\"?: string | string[] | undefined; \"sec-websocket-protocol\"?: string | string[] | undefined; \"sec-websocket-version\"?: string | string[] | undefined; \"set-cookie\"?: string | string[] | undefined; \"strict-transport-security\"?: string | string[] | undefined; tk?: string | string[] | undefined; trailer?: string | string[] | undefined; \"transfer-encoding\"?: string | string[] | undefined; upgrade?: string | string[] | undefined; \"user-agent\"?: string | string[] | undefined; vary?: string | string[] | undefined; via?: string | string[] | undefined; \"www-authenticate\"?: string | string[] | undefined; } & { [header: string]: string | string[] | undefined; }" ], "path": "src/core/server/http/router/headers.ts", "deprecated": false, @@ -9439,7 +9439,7 @@ "section": "def-server.KibanaRequest", "text": "KibanaRequest" }, - ") => string; prepend: (path: string) => string; set: (request: ", + ") => string; set: (request: ", { "pluginId": "core", "scope": "server", @@ -9447,7 +9447,7 @@ "section": "def-server.KibanaRequest", "text": "KibanaRequest" }, - ", requestSpecificBasePath: string) => void; readonly serverBasePath: string; readonly publicBaseUrl?: string | undefined; }" + ", requestSpecificBasePath: string) => void; prepend: (path: string) => string; readonly serverBasePath: string; readonly publicBaseUrl?: string | undefined; }" ], "path": "src/core/server/http/base_path_service.ts", "deprecated": false, @@ -9742,7 +9742,7 @@ "\nSet of well-known HTTP headers." ], "signature": [ - "\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"host\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"etag\" | \"expect\" | \"expires\" | \"forwarded\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\"" + "\"from\" | \"date\" | \"range\" | \"warning\" | \"location\" | \"origin\" | \"allow\" | \"accept\" | \"host\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"etag\" | \"expect\" | \"expires\" | \"forwarded\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\"" ], "path": "src/core/server/http/router/headers.ts", "deprecated": false, @@ -12158,7 +12158,7 @@ "\nHttp response headers to set." ], "signature": [ - "Record<\"from\" | \"date\" | \"origin\" | \"range\" | \"warning\" | \"location\" | \"allow\" | \"accept\" | \"host\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"etag\" | \"expect\" | \"expires\" | \"forwarded\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]> | Record" + "Record<\"from\" | \"date\" | \"range\" | \"warning\" | \"location\" | \"origin\" | \"allow\" | \"accept\" | \"host\" | \"accept-language\" | \"accept-patch\" | \"accept-ranges\" | \"access-control-allow-credentials\" | \"access-control-allow-headers\" | \"access-control-allow-methods\" | \"access-control-allow-origin\" | \"access-control-expose-headers\" | \"access-control-max-age\" | \"access-control-request-headers\" | \"access-control-request-method\" | \"age\" | \"alt-svc\" | \"authorization\" | \"cache-control\" | \"connection\" | \"content-disposition\" | \"content-encoding\" | \"content-language\" | \"content-length\" | \"content-location\" | \"content-range\" | \"content-type\" | \"cookie\" | \"etag\" | \"expect\" | \"expires\" | \"forwarded\" | \"if-match\" | \"if-modified-since\" | \"if-none-match\" | \"if-unmodified-since\" | \"last-modified\" | \"pragma\" | \"proxy-authenticate\" | \"proxy-authorization\" | \"public-key-pins\" | \"referer\" | \"retry-after\" | \"sec-websocket-accept\" | \"sec-websocket-extensions\" | \"sec-websocket-key\" | \"sec-websocket-protocol\" | \"sec-websocket-version\" | \"set-cookie\" | \"strict-transport-security\" | \"tk\" | \"trailer\" | \"transfer-encoding\" | \"upgrade\" | \"user-agent\" | \"vary\" | \"via\" | \"www-authenticate\", string | string[]> | Record" ], "path": "src/core/server/http/router/headers.ts", "deprecated": false, diff --git a/api_docs/core_http.mdx b/api_docs/core_http.mdx index 52432373b5fbe..394a7c613118c 100644 --- a/api_docs/core_http.mdx +++ b/api_docs/core_http.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/core-http title: "core.http" image: https://source.unsplash.com/400x175/?github summary: API docs for the core.http plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'core.http'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 2375 | 15 | 970 | 33 | +| 2497 | 15 | 971 | 33 | ## Client diff --git a/api_docs/core_saved_objects.devdocs.json b/api_docs/core_saved_objects.devdocs.json index e84daeb0b7d4b..08b910c7268f8 100644 --- a/api_docs/core_saved_objects.devdocs.json +++ b/api_docs/core_saved_objects.devdocs.json @@ -16956,7 +16956,9 @@ ], "signature": [ "MappingProperty", - " & { dynamic?: false | \"strict\" | undefined; }" + " & { dynamic?: false | \"strict\" | undefined; properties?: Record | undefined; }" ], "path": "src/core/server/saved_objects/mappings/types.ts", "deprecated": false, diff --git a/api_docs/core_saved_objects.mdx b/api_docs/core_saved_objects.mdx index b6cb35d2f1dd6..43c89a9e03e2f 100644 --- a/api_docs/core_saved_objects.mdx +++ b/api_docs/core_saved_objects.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/core-savedObjects title: "core.savedObjects" image: https://source.unsplash.com/400x175/?github summary: API docs for the core.savedObjects plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'core.savedObjects'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 2375 | 15 | 970 | 33 | +| 2497 | 15 | 971 | 33 | ## Client diff --git a/api_docs/custom_integrations.mdx b/api_docs/custom_integrations.mdx index be6de7f17ddcf..d100081f7b272 100644 --- a/api_docs/custom_integrations.mdx +++ b/api_docs/custom_integrations.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/customIntegrations title: "customIntegrations" image: https://source.unsplash.com/400x175/?github summary: API docs for the customIntegrations plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'customIntegrations'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/dashboard.mdx b/api_docs/dashboard.mdx index 165112486e57f..d0f5a00bab677 100644 --- a/api_docs/dashboard.mdx +++ b/api_docs/dashboard.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/dashboard title: "dashboard" image: https://source.unsplash.com/400x175/?github summary: API docs for the dashboard plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboard'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/dashboard_enhanced.mdx b/api_docs/dashboard_enhanced.mdx index c9a328ba8dbc2..532dc65f407b6 100644 --- a/api_docs/dashboard_enhanced.mdx +++ b/api_docs/dashboard_enhanced.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/dashboardEnhanced title: "dashboardEnhanced" image: https://source.unsplash.com/400x175/?github summary: API docs for the dashboardEnhanced plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboardEnhanced'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/data.devdocs.json b/api_docs/data.devdocs.json index d5954d1d1dc76..75239e090a139 100644 --- a/api_docs/data.devdocs.json +++ b/api_docs/data.devdocs.json @@ -2663,6 +2663,14 @@ "plugin": "dataViews", "path": "src/plugins/data_views/common/index.ts" }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, { "plugin": "ux", "path": "x-pack/plugins/ux/public/components/app/rum_dashboard/local_uifilters/selected_filters.tsx" @@ -4082,16 +4090,16 @@ "path": "src/plugins/discover/public/application/context/utils/fetch_hits_in_interval.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts" + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/server/alert_types/es_query/lib/fetch_search_source_query.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx" + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx" + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts" }, { "plugin": "inputControlVis", @@ -7048,72 +7056,6 @@ ], "initialIsOpen": false }, - { - "parentPluginId": "data", - "id": "def-public.ApplyGlobalFilterActionContext", - "type": "Interface", - "tags": [], - "label": "ApplyGlobalFilterActionContext", - "description": [], - "path": "src/plugins/data/public/actions/apply_filter_action.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-public.ApplyGlobalFilterActionContext.filters", - "type": "Array", - "tags": [], - "label": "filters", - "description": [], - "signature": [ - "Filter", - "[]" - ], - "path": "src/plugins/data/public/actions/apply_filter_action.ts", - "deprecated": false - }, - { - "parentPluginId": "data", - "id": "def-public.ApplyGlobalFilterActionContext.timeFieldName", - "type": "string", - "tags": [], - "label": "timeFieldName", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data/public/actions/apply_filter_action.ts", - "deprecated": false - }, - { - "parentPluginId": "data", - "id": "def-public.ApplyGlobalFilterActionContext.embeddable", - "type": "Unknown", - "tags": [], - "label": "embeddable", - "description": [], - "signature": [ - "unknown" - ], - "path": "src/plugins/data/public/actions/apply_filter_action.ts", - "deprecated": false - }, - { - "parentPluginId": "data", - "id": "def-public.ApplyGlobalFilterActionContext.controlledBy", - "type": "string", - "tags": [], - "label": "controlledBy", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data/public/actions/apply_filter_action.ts", - "deprecated": false - } - ], - "initialIsOpen": false - }, { "parentPluginId": "data", "id": "def-public.DataPublicPluginStartActions", @@ -7191,79 +7133,6 @@ ], "initialIsOpen": false }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStartUi", - "type": "Interface", - "tags": [], - "label": "DataPublicPluginStartUi", - "description": [ - "\nData plugin prewired UI components" - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStartUi.IndexPatternSelect", - "type": "CompoundType", - "tags": [], - "label": "IndexPatternSelect", - "description": [], - "signature": [ - "React.ComponentClass<", - { - "pluginId": "data", - "scope": "public", - "docId": "kibDataUiPluginApi", - "section": "def-public.IndexPatternSelectProps", - "text": "IndexPatternSelectProps" - }, - ", any> | React.FunctionComponent<", - { - "pluginId": "data", - "scope": "public", - "docId": "kibDataUiPluginApi", - "section": "def-public.IndexPatternSelectProps", - "text": "IndexPatternSelectProps" - }, - ">" - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false - }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStartUi.SearchBar", - "type": "CompoundType", - "tags": [], - "label": "SearchBar", - "description": [], - "signature": [ - "React.ComponentClass<", - { - "pluginId": "data", - "scope": "public", - "docId": "kibDataUiPluginApi", - "section": "def-public.StatefulSearchBarProps", - "text": "StatefulSearchBarProps" - }, - ", any> | React.FunctionComponent<", - { - "pluginId": "data", - "scope": "public", - "docId": "kibDataUiPluginApi", - "section": "def-public.StatefulSearchBarProps", - "text": "StatefulSearchBarProps" - }, - ">" - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false - } - ], - "initialIsOpen": false - }, { "parentPluginId": "data", "id": "def-public.DataViewListItem", @@ -7757,6 +7626,54 @@ "plugin": "dataViews", "path": "src/plugins/data_views/common/data_views/data_view.ts" }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, { "plugin": "dataViews", "path": "src/plugins/data_views/server/utils.ts" @@ -7769,6 +7686,30 @@ "plugin": "dataViews", "path": "src/plugins/data_views/server/utils.ts" }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx" + }, { "plugin": "dataViews", "path": "src/plugins/data_views/common/utils.test.ts" @@ -8085,6 +8026,34 @@ "plugin": "dataViews", "path": "src/plugins/data_views/common/data_views/data_view.ts" }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_bar_top_row.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_bar_top_row.tsx" + }, { "plugin": "monitoring", "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx" @@ -8116,6 +8085,98 @@ { "plugin": "monitoring", "path": "x-pack/plugins/monitoring/public/lib/kuery.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_item.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_item.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" } ], "children": [ @@ -9512,20 +9573,6 @@ } ], "misc": [ - { - "parentPluginId": "data", - "id": "def-public.ACTION_GLOBAL_APPLY_FILTER", - "type": "string", - "tags": [], - "label": "ACTION_GLOBAL_APPLY_FILTER", - "description": [], - "signature": [ - "\"ACTION_GLOBAL_APPLY_FILTER\"" - ], - "path": "src/plugins/data/public/actions/apply_filter_action.ts", - "deprecated": false, - "initialIsOpen": false - }, { "parentPluginId": "data", "id": "def-public.AggConfigOptions", @@ -10045,6 +10092,42 @@ "deprecated": true, "removeBy": "8.1", "references": [ + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, { "plugin": "dashboard", "path": "src/plugins/dashboard/public/application/lib/filter_utils.ts" @@ -10130,20 +10213,72 @@ "path": "x-pack/plugins/drilldowns/url_drilldown/public/lib/test/data.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/test_helpers/get_stub_filter.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/test_helpers/get_stub_filter.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/create_search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/create_search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx" } ], "initialIsOpen": false @@ -10592,6 +10727,30 @@ "plugin": "dataViews", "path": "src/plugins/data_views/public/index.ts" }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx" + }, { "plugin": "maps", "path": "x-pack/plugins/maps/public/lazy_load_bundle/index.ts" @@ -11275,77 +11434,19 @@ "removeBy": "8.1", "references": [ { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/locators.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/locators.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" } ], "children": [ - { - "parentPluginId": "data", - "id": "def-public.esFilters.FilterLabel", - "type": "Function", - "tags": [], - "label": "FilterLabel", - "description": [], - "signature": [ - "(props: ", - "FilterLabelProps", - ") => JSX.Element" - ], - "path": "src/plugins/data/public/deprecated.ts", - "deprecated": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.esFilters.FilterLabel.$1", - "type": "Object", - "tags": [], - "label": "props", - "description": [], - "signature": [ - "FilterLabelProps" - ], - "path": "src/plugins/data/public/ui/filter_bar/index.tsx", - "deprecated": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.esFilters.FilterItem", - "type": "Function", - "tags": [], - "label": "FilterItem", - "description": [], - "signature": [ - "(props: ", - "FilterItemProps", - ") => JSX.Element" - ], - "path": "src/plugins/data/public/deprecated.ts", - "deprecated": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.esFilters.FilterItem.$1", - "type": "Object", - "tags": [], - "label": "props", - "description": [], - "signature": [ - "FilterItemProps" - ], - "path": "src/plugins/data/public/ui/filter_bar/index.tsx", - "deprecated": false - } - ] - }, { "parentPluginId": "data", "id": "def-public.esFilters.FILTERS", @@ -12455,7 +12556,7 @@ "label": "timeFilter", "description": [], "signature": [ - "{ isTimeRangeSelectorEnabled: () => boolean; isAutoRefreshSelectorEnabled: () => boolean; isTimeTouched: () => boolean; getEnabledUpdated$: () => ", + "{ isTimeRangeSelectorEnabled: () => boolean; isAutoRefreshSelectorEnabled: () => boolean; isTimeTouched: () => boolean; isRefreshIntervalTouched: () => boolean; getEnabledUpdated$: () => ", "Observable", "; getTimeUpdate$: () => ", "Observable", @@ -14683,7 +14784,13 @@ "; timefilter: ", "TimefilterSetup", "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; state$: ", "Observable", "<{ changes: ", @@ -14822,6 +14929,10 @@ "path": "src/plugins/data/public/types.ts", "deprecated": true, "references": [ + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, { "plugin": "discover", "path": "src/plugins/discover/public/plugin.tsx" @@ -14830,34 +14941,10 @@ "plugin": "maps", "path": "x-pack/plugins/maps/public/kibana_services.ts" }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/alerting/log_threshold/components/expression_editor/editor.tsx" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/components/log_stream/log_stream.tsx" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/components/log_stream/log_stream.tsx" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/utils/logs_overview_fetchers.ts" - }, { "plugin": "infra", "path": "x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.ts" }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/pages/logs/page_providers.tsx" - }, { "plugin": "graph", "path": "x-pack/plugins/graph/public/plugin.ts" @@ -14910,10 +14997,6 @@ "plugin": "inputControlVis", "path": "src/plugins/input_control_vis/public/components/editor/controls_tab.tsx" }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts" - }, { "plugin": "securitySolution", "path": "x-pack/plugins/security_solution/public/common/mock/endpoint/dependencies_start_mock.ts" @@ -15067,7 +15150,13 @@ "text": "FilterManager" }, "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; savedQueries: { createQuery: (attributes: ", { "pluginId": "data", @@ -15167,27 +15256,6 @@ "path": "src/plugins/data/public/types.ts", "deprecated": false }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStart.ui", - "type": "Object", - "tags": [], - "label": "ui", - "description": [ - "\nprewired UI components\n{@link DataPublicPluginStartUi}" - ], - "signature": [ - { - "pluginId": "data", - "scope": "public", - "docId": "kibDataPluginApi", - "section": "def-public.DataPublicPluginStartUi", - "text": "DataPublicPluginStartUi" - } - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false - }, { "parentPluginId": "data", "id": "def-public.DataPublicPluginStart.nowProvider", @@ -17021,6 +17089,14 @@ "plugin": "dataViews", "path": "src/plugins/data_views/common/index.ts" }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, { "plugin": "ux", "path": "x-pack/plugins/ux/public/components/app/rum_dashboard/local_uifilters/selected_filters.tsx" @@ -18469,6 +18545,54 @@ "plugin": "dataViews", "path": "src/plugins/data_views/common/data_views/data_view.ts" }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, { "plugin": "dataViews", "path": "src/plugins/data_views/server/utils.ts" @@ -18481,6 +18605,30 @@ "plugin": "dataViews", "path": "src/plugins/data_views/server/utils.ts" }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx" + }, { "plugin": "dataViews", "path": "src/plugins/data_views/common/utils.test.ts" @@ -19043,6 +19191,42 @@ "deprecated": true, "removeBy": "8.1", "references": [ + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, { "plugin": "dashboard", "path": "src/plugins/dashboard/public/application/lib/filter_utils.ts" @@ -19128,20 +19312,72 @@ "path": "x-pack/plugins/drilldowns/url_drilldown/public/lib/test/data.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/test_helpers/get_stub_filter.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/test_helpers/get_stub_filter.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/create_search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/create_search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx" } ], "initialIsOpen": false @@ -24740,6 +24976,14 @@ "plugin": "dataViews", "path": "src/plugins/data_views/common/index.ts" }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, { "plugin": "ux", "path": "x-pack/plugins/ux/public/components/app/rum_dashboard/local_uifilters/selected_filters.tsx" @@ -27779,7 +28023,28 @@ "path": "src/plugins/data/common/es_query/index.ts", "deprecated": true, "removeBy": "8.1", - "references": [], + "references": [ + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts" + } + ], "returnComment": [], "children": [ { @@ -29227,6 +29492,54 @@ "plugin": "dataViews", "path": "src/plugins/data_views/common/data_views/data_view.ts" }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, { "plugin": "dataViews", "path": "src/plugins/data_views/server/utils.ts" @@ -29239,6 +29552,30 @@ "plugin": "dataViews", "path": "src/plugins/data_views/server/utils.ts" }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx" + }, { "plugin": "dataViews", "path": "src/plugins/data_views/common/utils.test.ts" @@ -29555,6 +29892,34 @@ "plugin": "dataViews", "path": "src/plugins/data_views/common/data_views/data_view.ts" }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_bar_top_row.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_bar_top_row.tsx" + }, { "plugin": "monitoring", "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx" @@ -29586,6 +29951,98 @@ { "plugin": "monitoring", "path": "x-pack/plugins/monitoring/public/lib/kuery.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_item.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_item.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" } ], "children": [ @@ -31576,6 +32033,42 @@ "deprecated": true, "removeBy": "8.1", "references": [ + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, { "plugin": "dashboard", "path": "src/plugins/dashboard/public/application/lib/filter_utils.ts" @@ -31661,20 +32154,72 @@ "path": "x-pack/plugins/drilldowns/url_drilldown/public/lib/test/data.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/test_helpers/get_stub_filter.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/test_helpers/get_stub_filter.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/create_search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/create_search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx" } ], "initialIsOpen": false @@ -31739,28 +32284,6 @@ ], "initialIsOpen": false }, - { - "parentPluginId": "data", - "id": "def-common.INDEX_PATTERN_SAVED_OBJECT_TYPE", - "type": "string", - "tags": [ - "deprecated" - ], - "label": "INDEX_PATTERN_SAVED_OBJECT_TYPE", - "description": [], - "signature": [ - "\"index-pattern\"" - ], - "path": "src/plugins/data_views/common/constants.ts", - "deprecated": true, - "references": [ - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/index.ts" - } - ], - "initialIsOpen": false - }, { "parentPluginId": "data", "id": "def-common.IndexPatternAttributes", @@ -32063,6 +32586,30 @@ "plugin": "dataViews", "path": "src/plugins/data_views/public/index.ts" }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx" + }, { "plugin": "maps", "path": "x-pack/plugins/maps/public/lazy_load_bundle/index.ts" @@ -32268,7 +32815,7 @@ "signature": [ "Pick<", "Toast", - ", \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"className\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"data-test-subj\" | \"iconType\" | \"toastLifeTimeMs\" | \"onClose\"> & { title?: string | ", + ", \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"className\" | \"security\" | \"defaultValue\" | \"hidden\" | \"defaultChecked\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"toastLifeTimeMs\" | \"iconType\" | \"onClose\" | \"data-test-subj\"> & { title?: string | ", { "pluginId": "core", "scope": "public", @@ -32506,7 +33053,32 @@ "path": "src/plugins/data/common/es_query/index.ts", "deprecated": true, "removeBy": "8.1", - "references": [], + "references": [ + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx" + } + ], "initialIsOpen": false }, { diff --git a/api_docs/data.mdx b/api_docs/data.mdx index 770726e84a903..354f58d2afd80 100644 --- a/api_docs/data.mdx +++ b/api_docs/data.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/data title: "data" image: https://source.unsplash.com/400x175/?github summary: API docs for the data plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 3457 | 40 | 2844 | 27 | +| 3426 | 40 | 2816 | 20 | ## Client diff --git a/api_docs/data_autocomplete.mdx b/api_docs/data_autocomplete.mdx index b771bfd505eef..731ed5bb655e7 100644 --- a/api_docs/data_autocomplete.mdx +++ b/api_docs/data_autocomplete.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/data-autocomplete title: "data.autocomplete" image: https://source.unsplash.com/400x175/?github summary: API docs for the data.autocomplete plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.autocomplete'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 3457 | 40 | 2844 | 27 | +| 3426 | 40 | 2816 | 20 | ## Client diff --git a/api_docs/data_enhanced.mdx b/api_docs/data_enhanced.mdx index f49a0ee7dc602..03a5d056398c2 100644 --- a/api_docs/data_enhanced.mdx +++ b/api_docs/data_enhanced.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/dataEnhanced title: "dataEnhanced" image: https://source.unsplash.com/400x175/?github summary: API docs for the dataEnhanced plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataEnhanced'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/data_query.devdocs.json b/api_docs/data_query.devdocs.json index a268429f2d216..4cccb61a48547 100644 --- a/api_docs/data_query.devdocs.json +++ b/api_docs/data_query.devdocs.json @@ -602,6 +602,267 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog", + "type": "Class", + "tags": [], + "label": "PersistedLog", + "description": [], + "signature": [ + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.PersistedLog", + "text": "PersistedLog" + }, + "" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.maxLength", + "type": "number", + "tags": [], + "label": "maxLength", + "description": [], + "signature": [ + "number | undefined" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.filterDuplicates", + "type": "CompoundType", + "tags": [], + "label": "filterDuplicates", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.isDuplicate", + "type": "Function", + "tags": [], + "label": "isDuplicate", + "description": [], + "signature": [ + "(oldItem: T, newItem: T) => boolean" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.isDuplicate.$1", + "type": "Uncategorized", + "tags": [], + "label": "oldItem", + "description": [], + "signature": [ + "T" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.isDuplicate.$2", + "type": "Uncategorized", + "tags": [], + "label": "newItem", + "description": [], + "signature": [ + "T" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false + } + ] + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.storage", + "type": "Object", + "tags": [], + "label": "storage", + "description": [], + "signature": [ + { + "pluginId": "kibanaUtils", + "scope": "public", + "docId": "kibKibanaUtilsPluginApi", + "section": "def-public.IStorageWrapper", + "text": "IStorageWrapper" + }, + "" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.items", + "type": "Array", + "tags": [], + "label": "items", + "description": [], + "signature": [ + "T[]" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.Unnamed", + "type": "Function", + "tags": [], + "label": "Constructor", + "description": [], + "signature": [ + "any" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.Unnamed.$1", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "signature": [ + "string" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.Unnamed.$2", + "type": "Object", + "tags": [], + "label": "options", + "description": [], + "signature": [ + "PersistedLogOptions" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.Unnamed.$3", + "type": "Object", + "tags": [], + "label": "storage", + "description": [], + "signature": [ + { + "pluginId": "kibanaUtils", + "scope": "public", + "docId": "kibKibanaUtilsPluginApi", + "section": "def-public.IStorageWrapper", + "text": "IStorageWrapper" + }, + "" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.add", + "type": "Function", + "tags": [], + "label": "add", + "description": [], + "signature": [ + "(val: any) => T[]" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.add.$1", + "type": "Any", + "tags": [], + "label": "val", + "description": [], + "signature": [ + "any" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.get", + "type": "Function", + "tags": [], + "label": "get", + "description": [], + "signature": [ + "() => T[]" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false, + "children": [], + "returnComment": [] + }, + { + "parentPluginId": "data", + "id": "def-public.PersistedLog.get$", + "type": "Function", + "tags": [], + "label": "get$", + "description": [], + "signature": [ + "() => ", + "Observable", + "" + ], + "path": "src/plugins/data/public/query/persisted_log/persisted_log.ts", + "deprecated": false, + "children": [], + "returnComment": [] + } + ], + "initialIsOpen": false + }, { "parentPluginId": "data", "id": "def-public.TimeHistory", @@ -775,7 +1036,13 @@ "text": "FilterManager" }, "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; savedQueries: { createQuery: (attributes: ", { "pluginId": "data", @@ -881,7 +1148,13 @@ "; timefilter: ", "TimefilterSetup", "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; state$: ", "Observable", "<{ changes: ", @@ -934,7 +1207,13 @@ "text": "FilterManager" }, "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; savedQueries: { createQuery: (attributes: ", { "pluginId": "data", @@ -1040,7 +1319,13 @@ "; timefilter: ", "TimefilterSetup", "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; state$: ", "Observable", "<{ changes: ", @@ -1542,6 +1827,112 @@ "returnComment": [], "initialIsOpen": false }, + { + "parentPluginId": "data", + "id": "def-public.getIndexPatternFromFilter", + "type": "Function", + "tags": [], + "label": "getIndexPatternFromFilter", + "description": [], + "signature": [ + "(filter: ", + "Filter", + ", indexPatterns: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.IIndexPattern", + "text": "IIndexPattern" + }, + "[]) => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.IIndexPattern", + "text": "IIndexPattern" + }, + " | undefined" + ], + "path": "src/plugins/data/public/query/filter_manager/lib/get_index_pattern_from_filter.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-public.getIndexPatternFromFilter.$1", + "type": "Object", + "tags": [], + "label": "filter", + "description": [], + "signature": [ + "Filter" + ], + "path": "src/plugins/data/public/query/filter_manager/lib/get_index_pattern_from_filter.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-public.getIndexPatternFromFilter.$2", + "type": "Array", + "tags": [], + "label": "indexPatterns", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.IIndexPattern", + "text": "IIndexPattern" + }, + "[]" + ], + "path": "src/plugins/data/public/query/filter_manager/lib/get_index_pattern_from_filter.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-public.mapAndFlattenFilters", + "type": "Function", + "tags": [], + "label": "mapAndFlattenFilters", + "description": [], + "signature": [ + "(filters: ", + "Filter", + "[]) => ", + "Filter", + "[]" + ], + "path": "src/plugins/data/public/query/filter_manager/lib/map_and_flatten_filters.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-public.mapAndFlattenFilters.$1", + "type": "Array", + "tags": [], + "label": "filters", + "description": [], + "signature": [ + "Filter", + "[]" + ], + "path": "src/plugins/data/public/query/filter_manager/lib/map_and_flatten_filters.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, { "parentPluginId": "data", "id": "def-public.syncQueryStateWithUrl", @@ -1563,7 +1954,13 @@ "text": "FilterManager" }, "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; savedQueries: { createQuery: (attributes: ", { "pluginId": "data", @@ -1669,7 +2066,13 @@ "; timefilter: ", "TimefilterSetup", "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; state$: ", "Observable", "<{ changes: ", @@ -1720,7 +2123,13 @@ "text": "FilterManager" }, "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; savedQueries: { createQuery: (attributes: ", { "pluginId": "data", @@ -1826,7 +2235,13 @@ "; timefilter: ", "TimefilterSetup", "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; state$: ", "Observable", "<{ changes: ", @@ -2345,6 +2760,56 @@ "children": [], "initialIsOpen": false }, + { + "parentPluginId": "data", + "id": "def-public.QuerySetup", + "type": "Type", + "tags": [], + "label": "QuerySetup", + "description": [], + "signature": [ + "{ filterManager: ", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.FilterManager", + "text": "FilterManager" + }, + "; timefilter: ", + "TimefilterSetup", + "; queryString: ", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, + "; state$: ", + "Observable", + "<{ changes: ", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStateChange", + "text": "QueryStateChange" + }, + "; state: ", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryState", + "text": "QueryState" + }, + "; }>; }" + ], + "path": "src/plugins/data/public/query/query_service.ts", + "deprecated": false, + "initialIsOpen": false + }, { "parentPluginId": "data", "id": "def-public.QueryStart", @@ -2364,7 +2829,13 @@ "text": "FilterManager" }, "; queryString: ", - "QueryStringContract", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStringContract", + "text": "QueryStringContract" + }, "; savedQueries: { createQuery: (attributes: ", { "pluginId": "data", @@ -2465,6 +2936,32 @@ "deprecated": false, "initialIsOpen": false }, + { + "parentPluginId": "data", + "id": "def-public.QueryStringContract", + "type": "Type", + "tags": [], + "label": "QueryStringContract", + "description": [], + "signature": [ + "{ getDefaultQuery: () => { query: string; language: any; }; formatQuery: (query: string | ", + "Query", + " | undefined) => ", + "Query", + "; getUpdates$: () => ", + "Observable", + "<", + "Query", + ">; getQuery: () => ", + "Query", + "; setQuery: (query: ", + "Query", + ") => void; clearQuery: () => void; }" + ], + "path": "src/plugins/data/public/query/query_string/query_string_manager.ts", + "deprecated": false, + "initialIsOpen": false + }, { "parentPluginId": "data", "id": "def-public.SavedQueryTimeFilter", @@ -2502,7 +2999,7 @@ "label": "TimefilterContract", "description": [], "signature": [ - "{ isTimeRangeSelectorEnabled: () => boolean; isAutoRefreshSelectorEnabled: () => boolean; isTimeTouched: () => boolean; getEnabledUpdated$: () => ", + "{ isTimeRangeSelectorEnabled: () => boolean; isAutoRefreshSelectorEnabled: () => boolean; isTimeTouched: () => boolean; isRefreshIntervalTouched: () => boolean; getEnabledUpdated$: () => ", "Observable", "; getTimeUpdate$: () => ", "Observable", diff --git a/api_docs/data_query.mdx b/api_docs/data_query.mdx index 26894aa01c9f0..c4ef7a0a5710b 100644 --- a/api_docs/data_query.mdx +++ b/api_docs/data_query.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/data-query title: "data.query" image: https://source.unsplash.com/400x175/?github summary: API docs for the data.query plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.query'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 3457 | 40 | 2844 | 27 | +| 3426 | 40 | 2816 | 20 | ## Client diff --git a/api_docs/data_search.devdocs.json b/api_docs/data_search.devdocs.json index eda3eb1958e37..3519424309902 100644 --- a/api_docs/data_search.devdocs.json +++ b/api_docs/data_search.devdocs.json @@ -8534,16 +8534,16 @@ "path": "src/plugins/discover/public/application/context/utils/fetch_hits_in_interval.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts" + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/server/alert_types/es_query/lib/fetch_search_source_query.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx" + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts" }, { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx" + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts" }, { "plugin": "inputControlVis", @@ -18904,7 +18904,7 @@ "label": "aggregate", "description": [], "signature": [ - "\"concat\" | \"max\" | \"min\" | \"sum\" | \"average\"" + "\"concat\" | \"sum\" | \"max\" | \"min\" | \"average\"" ], "path": "src/plugins/data/common/search/aggs/metrics/top_hit.ts", "deprecated": false @@ -24065,7 +24065,7 @@ "label": "mode", "description": [], "signature": [ - "\"max\" | \"min\" | \"sum\" | \"avg\" | \"median\" | undefined" + "\"sum\" | \"avg\" | \"max\" | \"min\" | \"median\" | undefined" ], "path": "src/plugins/data/common/search/search_source/types.ts", "deprecated": false diff --git a/api_docs/data_search.mdx b/api_docs/data_search.mdx index 4f90b53517a83..608be3044f659 100644 --- a/api_docs/data_search.mdx +++ b/api_docs/data_search.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/data-search title: "data.search" image: https://source.unsplash.com/400x175/?github summary: API docs for the data.search plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.search'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 3457 | 40 | 2844 | 27 | +| 3426 | 40 | 2816 | 20 | ## Client diff --git a/api_docs/data_ui.mdx b/api_docs/data_ui.mdx deleted file mode 100644 index 117b512111038..0000000000000 --- a/api_docs/data_ui.mdx +++ /dev/null @@ -1,33 +0,0 @@ ---- -id: kibDataUiPluginApi -slug: /kibana-dev-docs/api/data-ui -title: "data.ui" -image: https://source.unsplash.com/400x175/?github -summary: API docs for the data.ui plugin -date: 2022-03-30 -tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.ui'] -warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. ---- -import dataUiObj from './data_ui.devdocs.json'; - -Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. - -Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) for questions regarding this plugin. - -**Code health stats** - -| Public API count | Any count | Items lacking comments | Missing exports | -|-------------------|-----------|------------------------|-----------------| -| 3457 | 40 | 2844 | 27 | - -## Client - -### Functions - - -### Interfaces - - -### Consts, variables and types - - diff --git a/api_docs/data_view_editor.mdx b/api_docs/data_view_editor.mdx index 3351beb7f082a..8a11bfeccdeab 100644 --- a/api_docs/data_view_editor.mdx +++ b/api_docs/data_view_editor.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/dataViewEditor title: "dataViewEditor" image: https://source.unsplash.com/400x175/?github summary: API docs for the dataViewEditor plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewEditor'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/data_view_field_editor.mdx b/api_docs/data_view_field_editor.mdx index 58c5db4568e42..7a72bfa2e79d6 100644 --- a/api_docs/data_view_field_editor.mdx +++ b/api_docs/data_view_field_editor.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/dataViewFieldEditor title: "dataViewFieldEditor" image: https://source.unsplash.com/400x175/?github summary: API docs for the dataViewFieldEditor plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewFieldEditor'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/data_view_management.mdx b/api_docs/data_view_management.mdx index cd712b59e9895..1d26cc3a65daa 100644 --- a/api_docs/data_view_management.mdx +++ b/api_docs/data_view_management.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/dataViewManagement title: "dataViewManagement" image: https://source.unsplash.com/400x175/?github summary: API docs for the dataViewManagement plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewManagement'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/data_views.devdocs.json b/api_docs/data_views.devdocs.json index c68539c65f84a..5ad402626c258 100644 --- a/api_docs/data_views.devdocs.json +++ b/api_docs/data_views.devdocs.json @@ -3779,6 +3779,14 @@ "plugin": "data", "path": "src/plugins/data/server/index.ts" }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, { "plugin": "ux", "path": "x-pack/plugins/ux/public/components/app/rum_dashboard/local_uifilters/selected_filters.tsx" @@ -7082,43 +7090,43 @@ }, { "plugin": "data", - "path": "src/plugins/data/public/ui/index_pattern_select/index_pattern_select.tsx" + "path": "src/plugins/data/public/search/aggs/aggs_service.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/index_pattern_select/index_pattern_select.tsx" + "path": "src/plugins/data/public/search/aggs/aggs_service.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/index_pattern_select/create_index_pattern_select.tsx" + "path": "src/plugins/data/public/search/search_service.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/index_pattern_select/create_index_pattern_select.tsx" + "path": "src/plugins/data/public/search/search_service.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/search/aggs/aggs_service.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/search/aggs/aggs_service.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/fetch_index_patterns.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/fetch_index_patterns.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/search/search_service.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/search/search_service.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx" }, { "plugin": "maps", @@ -9064,7 +9072,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -9074,7 +9082,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -9082,7 +9090,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -9094,7 +9102,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -9104,7 +9112,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -9112,7 +9120,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -9120,7 +9128,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -9130,7 +9138,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -9138,7 +9146,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -9217,9 +9225,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -9352,7 +9358,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -9362,7 +9368,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -9370,7 +9376,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -9378,7 +9384,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -9388,7 +9394,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -9396,7 +9402,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -9467,29 +9473,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -9832,7 +9838,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -9842,7 +9848,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -9850,7 +9856,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -9877,29 +9883,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -10155,6 +10161,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", @@ -10314,14 +10322,6 @@ "plugin": "infra", "path": "x-pack/plugins/infra/server/lib/adapters/framework/kibana_framework_adapter.ts" }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.ts" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.ts" - }, { "plugin": "maps", "path": "x-pack/plugins/maps/server/kibana_server_services.ts" @@ -10719,7 +10719,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -10729,7 +10729,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -10737,7 +10737,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -10749,7 +10749,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -10759,7 +10759,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -10767,7 +10767,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -10775,7 +10775,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -10785,7 +10785,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -10793,7 +10793,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -10872,9 +10872,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -11007,7 +11005,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -11017,7 +11015,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -11025,7 +11023,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -11033,7 +11031,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -11043,7 +11041,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -11051,7 +11049,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -11122,29 +11120,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -11487,7 +11485,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -11497,7 +11495,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -11505,7 +11503,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -11532,29 +11530,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -11810,6 +11808,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", @@ -15443,6 +15443,14 @@ "plugin": "data", "path": "src/plugins/data/server/index.ts" }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, + { + "plugin": "discover", + "path": "src/plugins/discover/public/application/view_alert/view_alert_route.tsx" + }, { "plugin": "ux", "path": "x-pack/plugins/ux/public/components/app/rum_dashboard/local_uifilters/selected_filters.tsx" @@ -18971,22 +18979,6 @@ "plugin": "data", "path": "src/plugins/data/common/search/aggs/buckets/date_histogram.ts" }, - { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts" - }, { "plugin": "data", "path": "src/plugins/data/public/query/filter_manager/lib/generate_filters.ts" @@ -19033,91 +19025,107 @@ }, { "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/phrase_suggestor.tsx" + "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/field.tsx" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/phrase_suggestor.tsx" + "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/field.tsx" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/range_value_input.tsx" + "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/field.tsx" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/range_value_input.tsx" + "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/value.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/field.tsx" + "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/value.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/field.tsx" + "path": "src/plugins/data/public/actions/filters/create_filters_from_range_select.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/field.tsx" + "path": "src/plugins/data/public/actions/filters/create_filters_from_range_select.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/value.ts" + "path": "src/plugins/data/server/autocomplete/terms_enum.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/value.ts" + "path": "src/plugins/data/server/autocomplete/terms_enum.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/actions/filters/create_filters_from_range_select.ts" + "path": "src/plugins/data/server/autocomplete/terms_agg.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/actions/filters/create_filters_from_range_select.ts" + "path": "src/plugins/data/server/autocomplete/terms_agg.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx" + "path": "src/plugins/data/server/autocomplete/terms_agg.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx" + "path": "src/plugins/data/server/autocomplete/terms_agg.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx" + "path": "src/plugins/data/server/index.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" }, { - "plugin": "data", - "path": "src/plugins/data/server/autocomplete/terms_enum.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" }, { - "plugin": "data", - "path": "src/plugins/data/server/autocomplete/terms_enum.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" }, { - "plugin": "data", - "path": "src/plugins/data/server/autocomplete/terms_agg.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" }, { - "plugin": "data", - "path": "src/plugins/data/server/autocomplete/terms_agg.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/server/autocomplete/terms_agg.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/server/autocomplete/terms_agg.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/server/index.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" }, { "plugin": "data", @@ -19144,28 +19152,28 @@ "path": "src/plugins/data/public/query/filter_manager/lib/mappers/map_exists.test.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_operators.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_operators.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_operators.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_operators.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_operators.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/value_input_type.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/value_input_type.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/value_input_type.tsx" } ], "children": [ @@ -19491,22 +19499,6 @@ "plugin": "data", "path": "src/plugins/data/common/search/search_source/search_source.ts" }, - { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts" - }, { "plugin": "data", "path": "src/plugins/data/public/query/filter_manager/lib/generate_filters.ts" @@ -19577,143 +19569,167 @@ }, { "plugin": "data", - "path": "src/plugins/data/public/ui/search_bar/search_bar.tsx" + "path": "src/plugins/data/public/index.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/search_bar/search_bar.tsx" + "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/value.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/index.ts" + "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/value.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/phrase_suggestor.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/phrase_suggestor.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/value.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/autocomplete/providers/kql_query_suggestion/value.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/apply_filters/apply_filter_popover_content.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/apply_filters/apply_filter_popover_content.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_bar_top_row.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/apply_filters/apply_filters_popover.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/query_bar_top_row.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/apply_filters/apply_filters_popover.tsx" + "plugin": "monitoring", + "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx" + "plugin": "monitoring", + "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx" + "plugin": "monitoring", + "path": "x-pack/plugins/monitoring/public/components/kuery_bar/with_kuery_autocompletion.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx" + "plugin": "monitoring", + "path": "x-pack/plugins/monitoring/public/components/kuery_bar/with_kuery_autocompletion.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx" + "plugin": "monitoring", + "path": "x-pack/plugins/monitoring/public/components/kuery_bar/index.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx" + "plugin": "monitoring", + "path": "x-pack/plugins/monitoring/public/components/kuery_bar/index.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_item.tsx" + "plugin": "monitoring", + "path": "x-pack/plugins/monitoring/public/lib/kuery.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_item.tsx" + "plugin": "monitoring", + "path": "x-pack/plugins/monitoring/public/lib/kuery.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/query_bar_top_row.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/query_bar_top_row.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_bar.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/filter_bar/filter_bar.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" }, { - "plugin": "monitoring", - "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" }, { - "plugin": "monitoring", - "path": "x-pack/plugins/monitoring/public/alerts/components/param_details_form/use_derived_index_pattern.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx" }, { - "plugin": "monitoring", - "path": "x-pack/plugins/monitoring/public/components/kuery_bar/with_kuery_autocompletion.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_item.tsx" }, { - "plugin": "monitoring", - "path": "x-pack/plugins/monitoring/public/components/kuery_bar/with_kuery_autocompletion.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_item.tsx" }, { - "plugin": "monitoring", - "path": "x-pack/plugins/monitoring/public/components/kuery_bar/index.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_bar.tsx" }, { - "plugin": "monitoring", - "path": "x-pack/plugins/monitoring/public/components/kuery_bar/index.tsx" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/filter_bar/filter_bar.tsx" }, { - "plugin": "monitoring", - "path": "x-pack/plugins/monitoring/public/lib/kuery.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/search_bar.tsx" }, { - "plugin": "monitoring", - "path": "x-pack/plugins/monitoring/public/lib/kuery.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/search_bar/search_bar.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filter_popover_content.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/apply_filters/apply_filters_popover.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx" }, { "plugin": "data", @@ -21714,28 +21730,6 @@ "deprecated": false, "initialIsOpen": false }, - { - "parentPluginId": "dataViews", - "id": "def-common.INDEX_PATTERN_SAVED_OBJECT_TYPE", - "type": "string", - "tags": [ - "deprecated" - ], - "label": "INDEX_PATTERN_SAVED_OBJECT_TYPE", - "description": [], - "signature": [ - "\"index-pattern\"" - ], - "path": "src/plugins/data_views/common/constants.ts", - "deprecated": true, - "references": [ - { - "plugin": "data", - "path": "src/plugins/data/common/index.ts" - } - ], - "initialIsOpen": false - }, { "parentPluginId": "dataViews", "id": "def-common.IndexPatternAttributes", @@ -22124,43 +22118,43 @@ }, { "plugin": "data", - "path": "src/plugins/data/public/ui/index_pattern_select/index_pattern_select.tsx" + "path": "src/plugins/data/public/search/aggs/aggs_service.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/index_pattern_select/index_pattern_select.tsx" + "path": "src/plugins/data/public/search/aggs/aggs_service.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/index_pattern_select/create_index_pattern_select.tsx" + "path": "src/plugins/data/public/search/search_service.ts" }, { "plugin": "data", - "path": "src/plugins/data/public/ui/index_pattern_select/create_index_pattern_select.tsx" + "path": "src/plugins/data/public/search/search_service.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/search/aggs/aggs_service.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/search/aggs/aggs_service.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/fetch_index_patterns.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/ui/query_string_input/fetch_index_patterns.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/search/search_service.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx" }, { - "plugin": "data", - "path": "src/plugins/data/public/search/search_service.ts" + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx" }, { "plugin": "maps", @@ -22292,7 +22286,7 @@ "signature": [ "Pick<", "Toast", - ", \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"className\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"data-test-subj\" | \"iconType\" | \"toastLifeTimeMs\" | \"onClose\"> & { title?: string | ", + ", \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"className\" | \"security\" | \"defaultValue\" | \"hidden\" | \"defaultChecked\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"toastLifeTimeMs\" | \"iconType\" | \"onClose\" | \"data-test-subj\"> & { title?: string | ", { "pluginId": "core", "scope": "public", diff --git a/api_docs/data_views.mdx b/api_docs/data_views.mdx index c9e3051f812bb..b595999839c2c 100644 --- a/api_docs/data_views.mdx +++ b/api_docs/data_views.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/dataViews title: "dataViews" image: https://source.unsplash.com/400x175/?github summary: API docs for the dataViews plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViews'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 863 | 3 | 711 | 15 | +| 862 | 3 | 710 | 15 | ## Client diff --git a/api_docs/data_visualizer.mdx b/api_docs/data_visualizer.mdx index 0a22c0738d2ea..7bc87154c95ff 100644 --- a/api_docs/data_visualizer.mdx +++ b/api_docs/data_visualizer.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/dataVisualizer title: "dataVisualizer" image: https://source.unsplash.com/400x175/?github summary: API docs for the dataVisualizer plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataVisualizer'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/deprecations_by_api.mdx b/api_docs/deprecations_by_api.mdx index ba50f7d222e9e..8db17bbe8bee3 100644 --- a/api_docs/deprecations_by_api.mdx +++ b/api_docs/deprecations_by_api.mdx @@ -3,7 +3,7 @@ id: kibDevDocsDeprecationsByApi slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-api title: Deprecated API usage by API summary: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by. -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. --- @@ -14,36 +14,41 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | Deprecated API | Referencing plugin(s) | Remove By | | ---------------|-----------|-----------| | | dataViews, maps, data | - | -| | dataViews, maps, data | - | -| | dataViews, ux, savedObjects, dataViewEditor, uptime, maps, visDefaultEditor, data | - | +| | dataViews, unifiedSearch, maps, data | - | +| | dataViews, discover, ux, savedObjects, dataViewEditor, uptime, maps, visDefaultEditor, data | - | | | dataViews, dataViewEditor, maps, visDefaultEditor, data | - | -| | dataViews, monitoring | - | +| | dataViews, unifiedSearch, monitoring, stackAlerts | - | | | dataViews, canvas | - | -| | dataViews, monitoring, data | - | +| | dataViews, unifiedSearch, monitoring, stackAlerts, data | - | | | dataViews, canvas, data | - | -| | dataViews, maps, data | - | -| | dataViews, data | - | +| | dataViews, unifiedSearch, maps, data | - | | | dataViews, dataViewEditor, maps, visDefaultEditor, data | - | | | dataViews, maps, data | - | | | dataViews | - | -| | dataViews, ux, savedObjects, dataViewEditor, uptime, maps, visDefaultEditor, data | - | +| | dataViews, discover, ux, savedObjects, dataViewEditor, uptime, maps, visDefaultEditor, data | - | | | dataViews, maps | - | | | dataViewManagement, dataViews | - | | | visTypeTimeseries, graph, dataViewManagement, dataViews | - | | | dataViews, dataViewManagement | - | | | dataViews, canvas | - | | | dataViews, dataViewEditor, maps, visDefaultEditor | - | -| | dataViews, ux, savedObjects, dataViewEditor, uptime, maps, visDefaultEditor | - | +| | dataViews, discover, ux, savedObjects, dataViewEditor, uptime, maps, visDefaultEditor | - | | | dataViews, maps | - | | | dataViews, maps | - | | | dataViewManagement, dataViews | - | | | visTypeTimeseries, graph, dataViewManagement, dataViews | - | | | dataViews, dataViewManagement | - | -| | discover, maps, infra, graph, monitoring, securitySolution, stackAlerts, uptime, inputControlVis, savedObjects | - | +| | unifiedSearch, discover, maps, infra, graph, monitoring, securitySolution, stackAlerts, uptime, inputControlVis, savedObjects | - | | | maps | - | | | data, infra, maps | - | | | dashboard, maps | - | +| | discover | - | +| | discover | - | +| | data, discover, embeddable | - | +| | advancedSettings, discover | - | +| | advancedSettings, discover | - | | | esUiShared, home, spaces, fleet, visualizations, lens, observability, dataEnhanced, ml, apm, cloudSecurityPosture, indexLifecycleManagement, upgradeAssistant, uptime, ux, kibanaOverview, savedObjectsManagement | - | +| | dashboard, lens, stackAlerts, visTypeTable, visTypeTimeseries, visTypeXy, visTypeVislib, expressionPartitionVis | - | | | canvas, visTypeXy | - | | | canvas | - | | | canvas | - | @@ -54,14 +59,8 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | canvas | - | | | canvas | - | | | canvas, visTypeXy | - | -| | discover | - | -| | discover | - | -| | data, discover, embeddable | - | -| | advancedSettings, discover | - | -| | advancedSettings, discover | - | | | visTypeTimeseries, graph, dataViewManagement | - | | | encryptedSavedObjects, actions, cloud, ml, dataEnhanced, logstash, securitySolution | - | -| | dashboard, lens, stackAlerts, visTypeTable, visTypeTimeseries, visTypeXy, visTypeVislib, expressionPartitionVis | - | | | visTypeTimeseries | - | | | dataViewManagement | - | | | dataViewManagement | - | @@ -73,26 +72,28 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | visTypePie | - | | | actions, alerting | - | | | console | - | -| | discover, maps, inputControlVis | 8.1 | -| | maps | 8.1 | -| | dashboard, urlDrilldown, maps | 8.1 | -| | dashboard, urlDrilldown, maps | 8.1 | -| | discover, maps, inputControlVis | 8.1 | -| | dashboard, urlDrilldown, maps | 8.1 | +| | unifiedSearch | 8.1 | +| | unifiedSearch, discover, dashboard, urlDrilldown, stackAlerts | 8.1 | +| | unifiedSearch | 8.1 | +| | unifiedSearch | 8.1 | +| | unifiedSearch, discover, dashboard, urlDrilldown, stackAlerts | 8.1 | +| | unifiedSearch, discover, dashboard, urlDrilldown, stackAlerts | 8.1 | +| | discover, stackAlerts, inputControlVis | 8.1 | +| | discover, stackAlerts, inputControlVis | 8.1 | | | dataEnhanced | 8.1 | | | dataEnhanced | 8.1 | | | dataEnhanced | 8.1 | | | dataEnhanced | 8.1 | | | apm | 8.1 | -| | dataViews | 8.2 | -| | dataViews, data | 8.2 | -| | dataViews | 8.2 | +| | dataViews, unifiedSearch | 8.2 | +| | dataViews, unifiedSearch, data | 8.2 | +| | dataViews, unifiedSearch | 8.2 | | | visualizations, dashboard, maps, graph | 8.8.0 | | | visualizations, dashboard, lens, maps, ml, securitySolution, security | 8.8.0 | | | lens, dashboard, maps | 8.8.0 | +| | embeddable, presentationUtil, discover, dashboard, graph | 8.8.0 | | | monitoring, visTypeVega | 8.8.0 | | | monitoring, kibanaUsageCollection | 8.8.0 | -| | embeddable, presentationUtil, discover, dashboard, graph | 8.8.0 | | | spaces, security, actions, alerting, ml, remoteClusters, graph, indexLifecycleManagement, mapsEms, painlessLab, rollup, searchprofiler, snapshotRestore, transform, upgradeAssistant | 8.8.0 | | | apm, security, securitySolution | 8.8.0 | | | apm, security, securitySolution | 8.8.0 | @@ -167,14 +168,12 @@ Safe to remove. | | data | | | data | | | data | -| | data | | | data | | | data | | | data | | | data | | | data | | | data | -| | data | | | data | | | data | | | data | diff --git a/api_docs/deprecations_by_plugin.mdx b/api_docs/deprecations_by_plugin.mdx index 314442fe4cab5..0005cd3853b72 100644 --- a/api_docs/deprecations_by_plugin.mdx +++ b/api_docs/deprecations_by_plugin.mdx @@ -3,7 +3,7 @@ id: kibDevDocsDeprecationsByPlugin slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-plugin title: Deprecated API usage by plugin summary: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by. -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. --- @@ -128,15 +128,14 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| | | [field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/param_types/field.ts#:~:text=IndexPatternField), [field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/param_types/field.ts#:~:text=IndexPatternField), [field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/param_types/field.ts#:~:text=IndexPatternField), [field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/param_types/field.ts#:~:text=IndexPatternField), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPatternField), [kibana_context_type.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/kibana_context_type.ts#:~:text=IndexPatternField), [kibana_context_type.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/kibana_context_type.ts#:~:text=IndexPatternField), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPatternField), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPatternField), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPatternField)+ 16 more | - | -| | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPatternsContract), [create_search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.ts#:~:text=IndexPatternsContract), [create_search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.ts#:~:text=IndexPatternsContract), [search_source_service.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source_service.ts#:~:text=IndexPatternsContract), [search_source_service.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source_service.ts#:~:text=IndexPatternsContract), [esaggs_fn.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/esaggs/esaggs_fn.ts#:~:text=IndexPatternsContract), [esaggs_fn.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/esaggs/esaggs_fn.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/search/types.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/search/types.ts#:~:text=IndexPatternsContract), [create_search_source.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.test.ts#:~:text=IndexPatternsContract)+ 25 more | - | +| | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPatternsContract), [create_search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.ts#:~:text=IndexPatternsContract), [create_search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.ts#:~:text=IndexPatternsContract), [search_source_service.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source_service.ts#:~:text=IndexPatternsContract), [search_source_service.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source_service.ts#:~:text=IndexPatternsContract), [esaggs_fn.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/esaggs/esaggs_fn.ts#:~:text=IndexPatternsContract), [esaggs_fn.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/esaggs/esaggs_fn.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/search/types.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/search/types.ts#:~:text=IndexPatternsContract), [create_search_source.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.test.ts#:~:text=IndexPatternsContract)+ 19 more | - | | | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPatternsService), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/server/index.ts#:~:text=IndexPatternsService), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/server/index.ts#:~:text=IndexPatternsService), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/server/index.ts#:~:text=IndexPatternsService), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/index.ts#:~:text=IndexPatternsService) | - | | | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/types.ts#:~:text=IndexPattern), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPattern), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPattern), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPattern), [tabify_docs.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/tabify/tabify_docs.ts#:~:text=IndexPattern), [tabify_docs.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/tabify/tabify_docs.ts#:~:text=IndexPattern)+ 89 more | - | -| | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE) | - | -| | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IFieldType), [date_histogram.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/buckets/date_histogram.ts#:~:text=IFieldType), [date_histogram.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/buckets/date_histogram.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/ui/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [generate_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/query/filter_manager/lib/generate_filters.ts#:~:text=IFieldType), [generate_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/query/filter_manager/lib/generate_filters.ts#:~:text=IFieldType), [generate_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/query/filter_manager/lib/generate_filters.ts#:~:text=IFieldType)+ 42 more | 8.2 | +| | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IFieldType), [date_histogram.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/buckets/date_histogram.ts#:~:text=IFieldType), [date_histogram.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/buckets/date_histogram.ts#:~:text=IFieldType), [generate_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/query/filter_manager/lib/generate_filters.ts#:~:text=IFieldType), [generate_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/query/filter_manager/lib/generate_filters.ts#:~:text=IFieldType), [generate_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/query/filter_manager/lib/generate_filters.ts#:~:text=IFieldType), [generate_filters.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/query/filter_manager/lib/generate_filters.ts#:~:text=IFieldType), [query_suggestion_provider.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/autocomplete/providers/query_suggestion_provider.ts#:~:text=IFieldType), [query_suggestion_provider.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/autocomplete/providers/query_suggestion_provider.ts#:~:text=IFieldType), [value_suggestion_provider.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/autocomplete/providers/value_suggestion_provider.ts#:~:text=IFieldType)+ 24 more | 8.2 | | | [field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/param_types/field.ts#:~:text=IndexPatternField), [field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/param_types/field.ts#:~:text=IndexPatternField), [field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/param_types/field.ts#:~:text=IndexPatternField), [field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/aggs/param_types/field.ts#:~:text=IndexPatternField), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPatternField), [kibana_context_type.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/kibana_context_type.ts#:~:text=IndexPatternField), [kibana_context_type.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/kibana_context_type.ts#:~:text=IndexPatternField), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPatternField), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPatternField), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPatternField)+ 16 more | - | -| | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IIndexPattern), [get_time.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/query/timefilter/get_time.ts#:~:text=IIndexPattern), [get_time.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/query/timefilter/get_time.ts#:~:text=IIndexPattern), [get_time.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/query/timefilter/get_time.ts#:~:text=IIndexPattern), [get_time.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/query/timefilter/get_time.ts#:~:text=IIndexPattern), [normalize_sort_request.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/normalize_sort_request.ts#:~:text=IIndexPattern), [normalize_sort_request.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/normalize_sort_request.ts#:~:text=IIndexPattern), [normalize_sort_request.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/normalize_sort_request.ts#:~:text=IIndexPattern), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IIndexPattern), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IIndexPattern)+ 64 more | - | +| | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IIndexPattern), [get_time.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/query/timefilter/get_time.ts#:~:text=IIndexPattern), [get_time.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/query/timefilter/get_time.ts#:~:text=IIndexPattern), [get_time.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/query/timefilter/get_time.ts#:~:text=IIndexPattern), [get_time.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/query/timefilter/get_time.ts#:~:text=IIndexPattern), [normalize_sort_request.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/normalize_sort_request.ts#:~:text=IIndexPattern), [normalize_sort_request.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/normalize_sort_request.ts#:~:text=IIndexPattern), [normalize_sort_request.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/normalize_sort_request.ts#:~:text=IIndexPattern), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IIndexPattern), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IIndexPattern)+ 36 more | - | | | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPatternAttributes), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/index.ts#:~:text=IndexPatternAttributes), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/server/index.ts#:~:text=IndexPatternAttributes) | - | -| | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPatternsContract), [create_search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.ts#:~:text=IndexPatternsContract), [create_search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.ts#:~:text=IndexPatternsContract), [search_source_service.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source_service.ts#:~:text=IndexPatternsContract), [search_source_service.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source_service.ts#:~:text=IndexPatternsContract), [esaggs_fn.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/esaggs/esaggs_fn.ts#:~:text=IndexPatternsContract), [esaggs_fn.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/esaggs/esaggs_fn.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/search/types.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/search/types.ts#:~:text=IndexPatternsContract), [create_search_source.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.test.ts#:~:text=IndexPatternsContract)+ 25 more | - | +| | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPatternsContract), [create_search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.ts#:~:text=IndexPatternsContract), [create_search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.ts#:~:text=IndexPatternsContract), [search_source_service.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source_service.ts#:~:text=IndexPatternsContract), [search_source_service.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source_service.ts#:~:text=IndexPatternsContract), [esaggs_fn.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/esaggs/esaggs_fn.ts#:~:text=IndexPatternsContract), [esaggs_fn.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/expressions/esaggs/esaggs_fn.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/search/types.ts#:~:text=IndexPatternsContract), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/search/types.ts#:~:text=IndexPatternsContract), [create_search_source.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/create_search_source.test.ts#:~:text=IndexPatternsContract)+ 19 more | - | | | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPatternsService), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/server/index.ts#:~:text=IndexPatternsService), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/server/index.ts#:~:text=IndexPatternsService), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/server/index.ts#:~:text=IndexPatternsService), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/public/index.ts#:~:text=IndexPatternsService) | - | | | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/index.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/types.ts#:~:text=IndexPattern), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/types.ts#:~:text=IndexPattern), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPattern), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPattern), [search_source.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/search_source/search_source.ts#:~:text=IndexPattern), [tabify_docs.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/tabify/tabify_docs.ts#:~:text=IndexPattern), [tabify_docs.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/common/search/tabify/tabify_docs.ts#:~:text=IndexPattern)+ 89 more | - | | | [aggs_service.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/server/search/aggs/aggs_service.ts#:~:text=indexPatternsServiceFactory), [esaggs.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/server/search/expressions/esaggs.ts#:~:text=indexPatternsServiceFactory), [search_service.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data/server/search/search_service.ts#:~:text=indexPatternsServiceFactory) | - | @@ -201,7 +200,6 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=IIndexPattern), [data_view.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.ts#:~:text=IIndexPattern), [data_view.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.ts#:~:text=IIndexPattern) | - | | | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=IndexPatternAttributes) | - | | | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=IndexPatternsContract), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/public/index.ts#:~:text=IndexPatternsContract) | - | -| | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=INDEX_PATTERN_SAVED_OBJECT_TYPE) | - | | | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=IndexPatternField), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/public/index.ts#:~:text=IndexPatternField), [data_view.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.test.ts#:~:text=IndexPatternField), [data_view.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.test.ts#:~:text=IndexPatternField), [data_view.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.test.ts#:~:text=IndexPatternField), [data_view.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.test.ts#:~:text=IndexPatternField), [data_view.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.test.ts#:~:text=IndexPatternField), [data_view.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_view.test.ts#:~:text=IndexPatternField), [data_view_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.test.ts#:~:text=IndexPatternField), [data_view_field.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.test.ts#:~:text=IndexPatternField)+ 2 more | - | | | [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/index.ts#:~:text=IndexPatternsService), [index.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/public/index.ts#:~:text=IndexPatternsService) | - | | | [data_views.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/data_views/data_views.ts#:~:text=ensureDefaultDataView) | - | @@ -226,11 +224,17 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| +| | [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=IndexPattern), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=IndexPattern), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=IndexPattern), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=IndexPattern) | - | | | [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=create), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=create) | - | | | [anchor.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/context/services/anchor.ts#:~:text=fetch), [fetch_hits_in_interval.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/context/utils/fetch_hits_in_interval.ts#:~:text=fetch) | 8.1 | | | [plugin.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/plugin.tsx#:~:text=indexPatterns) | - | +| | [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter) | 8.1 | +| | [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter) | 8.1 | +| | [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=IndexPattern), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=IndexPattern), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=IndexPattern), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=IndexPattern) | - | | | [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=create), [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=create) | - | | | [anchor.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/context/services/anchor.ts#:~:text=fetch), [fetch_hits_in_interval.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/context/utils/fetch_hits_in_interval.ts#:~:text=fetch) | 8.1 | +| | [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=IndexPattern), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=IndexPattern) | - | +| | [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter) | 8.1 | | | [on_save_search.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/main/components/top_nav/on_save_search.tsx#:~:text=SavedObjectSaveModal), [on_save_search.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/main/components/top_nav/on_save_search.tsx#:~:text=SavedObjectSaveModal) | 8.8.0 | | | [saved_search_embeddable.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx#:~:text=executeTriggerActions), [search_embeddable_factory.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/embeddable/search_embeddable_factory.ts#:~:text=executeTriggerActions), [plugin.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/plugin.tsx#:~:text=executeTriggerActions) | - | | | [ui_settings.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/server/ui_settings.ts#:~:text=metric), [ui_settings.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/server/ui_settings.ts#:~:text=metric), [ui_settings.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/server/ui_settings.ts#:~:text=metric) | - | @@ -326,8 +330,8 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [redirect_to_node_logs.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx#:~:text=indexPatterns), [editor.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/alerting/log_threshold/components/expression_editor/editor.tsx#:~:text=indexPatterns), [log_stream.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/log_stream/log_stream.tsx#:~:text=indexPatterns), [log_stream.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/components/log_stream/log_stream.tsx#:~:text=indexPatterns), [logs_overview_fetchers.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/logs_overview_fetchers.ts#:~:text=indexPatterns), [use_kibana_index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.ts#:~:text=indexPatterns), [page_providers.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/pages/logs/page_providers.tsx#:~:text=indexPatterns), [logs_overview_fetches.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts#:~:text=indexPatterns) | - | -| | [kibana_framework_adapter.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/lib/adapters/framework/kibana_framework_adapter.ts#:~:text=indexPatternsServiceFactory), [log_entries_search_strategy.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.ts#:~:text=indexPatternsServiceFactory), [log_entry_search_strategy.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.ts#:~:text=indexPatternsServiceFactory) | - | +| | [use_kibana_index_patterns.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.ts#:~:text=indexPatterns) | - | +| | [kibana_framework_adapter.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/infra/server/lib/adapters/framework/kibana_framework_adapter.ts#:~:text=indexPatternsServiceFactory) | - | @@ -403,22 +407,16 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | [index.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/lazy_load_bundle/index.ts#:~:text=IndexPatternsContract), [index.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/lazy_load_bundle/index.ts#:~:text=IndexPatternsContract), [index.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/lazy_load_bundle/index.ts#:~:text=IndexPatternsContract), [index.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/lazy_load_bundle/index.ts#:~:text=IndexPatternsContract) | - | | | [es_tooltip_property.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts#:~:text=IndexPattern), [es_tooltip_property.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts#:~:text=IndexPattern), [percentile_agg_field.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/fields/agg/percentile_agg_field.test.ts#:~:text=IndexPattern), [percentile_agg_field.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/fields/agg/percentile_agg_field.test.ts#:~:text=IndexPattern), [get_docvalue_source_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts#:~:text=IndexPattern), [get_docvalue_source_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts#:~:text=IndexPattern), [get_docvalue_source_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts#:~:text=IndexPattern), [es_tooltip_property.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts#:~:text=IndexPattern), [es_tooltip_property.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts#:~:text=IndexPattern), [percentile_agg_field.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/fields/agg/percentile_agg_field.test.ts#:~:text=IndexPattern)+ 4 more | - | | | [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField)+ 84 more | - | -| | [es_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts#:~:text=fetch), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=fetch), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=fetch) | 8.1 | | | [kibana_services.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/kibana_services.ts#:~:text=indexPatterns) | - | -| | [locators.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/locators.test.ts#:~:text=esFilters), [locators.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/locators.test.ts#:~:text=esFilters) | 8.1 | -| | [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter) | 8.1 | -| | [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter) | 8.1 | | | [index.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/lazy_load_bundle/index.ts#:~:text=IndexPatternsContract), [index.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/lazy_load_bundle/index.ts#:~:text=IndexPatternsContract), [index.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/lazy_load_bundle/index.ts#:~:text=IndexPatternsContract), [index.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/lazy_load_bundle/index.ts#:~:text=IndexPatternsContract) | - | | | [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField)+ 84 more | - | | | [create_doc_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/data_indexing/create_doc_source.ts#:~:text=IndexPatternsService), [create_doc_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/data_indexing/create_doc_source.ts#:~:text=IndexPatternsService), [create_doc_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/data_indexing/create_doc_source.ts#:~:text=IndexPatternsService), [create_doc_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/data_indexing/create_doc_source.ts#:~:text=IndexPatternsService) | - | | | [es_tooltip_property.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts#:~:text=IndexPattern), [es_tooltip_property.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts#:~:text=IndexPattern), [percentile_agg_field.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/fields/agg/percentile_agg_field.test.ts#:~:text=IndexPattern), [percentile_agg_field.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/fields/agg/percentile_agg_field.test.ts#:~:text=IndexPattern), [get_docvalue_source_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts#:~:text=IndexPattern), [get_docvalue_source_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts#:~:text=IndexPattern), [get_docvalue_source_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts#:~:text=IndexPattern), [es_tooltip_property.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts#:~:text=IndexPattern), [es_tooltip_property.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts#:~:text=IndexPattern), [percentile_agg_field.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/fields/agg/percentile_agg_field.test.ts#:~:text=IndexPattern)+ 4 more | - | | | [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit) | - | -| | [es_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts#:~:text=fetch), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=fetch), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=fetch) | 8.1 | | | [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField), [single_field_select.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/components/single_field_select.tsx#:~:text=IndexPatternField)+ 37 more | - | | | [es_tooltip_property.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts#:~:text=IndexPattern), [es_tooltip_property.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts#:~:text=IndexPattern), [percentile_agg_field.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/fields/agg/percentile_agg_field.test.ts#:~:text=IndexPattern), [percentile_agg_field.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/fields/agg/percentile_agg_field.test.ts#:~:text=IndexPattern), [get_docvalue_source_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts#:~:text=IndexPattern), [get_docvalue_source_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts#:~:text=IndexPattern), [get_docvalue_source_fields.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/util/get_docvalue_source_fields.test.ts#:~:text=IndexPattern) | - | | | [create_doc_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/data_indexing/create_doc_source.ts#:~:text=IndexPatternsService), [create_doc_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/data_indexing/create_doc_source.ts#:~:text=IndexPatternsService), [create_doc_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/data_indexing/create_doc_source.ts#:~:text=IndexPatternsService), [create_doc_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/data_indexing/create_doc_source.ts#:~:text=IndexPatternsService) | - | | | [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit) | - | -| | [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter) | 8.1 | | | [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=flattenHit) | - | | | [kibana_server_services.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/kibana_server_services.ts#:~:text=indexPatternsServiceFactory), [indexing_routes.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/data_indexing/indexing_routes.ts#:~:text=indexPatternsServiceFactory) | - | | | [map_container.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/connected_components/map_container/map_container.tsx#:~:text=ExitFullScreenButton), [map_container.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/connected_components/map_container/map_container.tsx#:~:text=ExitFullScreenButton) | - | @@ -616,8 +614,15 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/ | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| +| | [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=IIndexPattern), [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=IIndexPattern) | - | +| | [fetch_search_source_query.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/lib/fetch_search_source_query.ts#:~:text=fetch), [alert_type.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts#:~:text=fetch), [alert_type.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts#:~:text=fetch) | 8.1 | | | [entity_index_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/geo_containment/query_builder/expressions/entity_index_expression.tsx#:~:text=indexPatterns), [boundary_index_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/geo_containment/query_builder/expressions/boundary_index_expression.tsx#:~:text=indexPatterns), [index.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/geo_containment/query_builder/index.tsx#:~:text=indexPatterns), [index.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/geo_containment/query_builder/index.tsx#:~:text=indexPatterns), [index.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/geo_containment/query_builder/index.tsx#:~:text=indexPatterns) | - | | | [expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/threshold/expression.tsx#:~:text=fieldFormats) | - | +| | [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter) | 8.1 | +| | [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter) | 8.1 | +| | [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=IIndexPattern), [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=IIndexPattern), [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=IIndexPattern), [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=IIndexPattern) | - | +| | [fetch_search_source_query.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/lib/fetch_search_source_query.ts#:~:text=fetch), [alert_type.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts#:~:text=fetch), [alert_type.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts#:~:text=fetch) | 8.1 | +| | [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter) | 8.1 | @@ -629,6 +634,27 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/ +## unifiedSearch + +| Deprecated API | Reference location(s) | Remove By | +| ---------------|-----------|-----------| +| | [fetch_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts#:~:text=IndexPatternsContract), [fetch_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts#:~:text=IndexPatternsContract), [index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx#:~:text=IndexPatternsContract), [index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx#:~:text=IndexPatternsContract), [create_index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx#:~:text=IndexPatternsContract), [create_index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx#:~:text=IndexPatternsContract), [fetch_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts#:~:text=IndexPatternsContract), [fetch_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts#:~:text=IndexPatternsContract), [index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx#:~:text=IndexPatternsContract), [index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx#:~:text=IndexPatternsContract)+ 2 more | - | +| | [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=IIndexPattern), [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=IIndexPattern), [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=IIndexPattern), [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=IIndexPattern), [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=IIndexPattern), [query_bar_top_row.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_bar_top_row.tsx#:~:text=IIndexPattern), [query_bar_top_row.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_bar_top_row.tsx#:~:text=IIndexPattern), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IIndexPattern), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IIndexPattern), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IIndexPattern)+ 18 more | - | +| | [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType)+ 8 more | 8.2 | +| | [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=indexPatterns) | - | +| | [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=esFilters), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=esFilters), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=esFilters) | 8.1 | +| | [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=Filter)+ 10 more | 8.1 | +| | [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS) | 8.1 | +| | [filter_editor_utils.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts#:~:text=toggleFilterNegated), [filter_editor_utils.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts#:~:text=toggleFilterNegated), [filter_editor_utils.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts#:~:text=toggleFilterNegated), [filter_editor_utils.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts#:~:text=toggleFilterNegated), [filter_editor_utils.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts#:~:text=toggleFilterNegated) | 8.1 | +| | [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=Filter)+ 10 more | 8.1 | +| | [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType)+ 26 more | 8.2 | +| | [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=IIndexPattern), [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=IIndexPattern), [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=IIndexPattern), [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=IIndexPattern), [query_string_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_string_input.tsx#:~:text=IIndexPattern), [query_bar_top_row.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_bar_top_row.tsx#:~:text=IIndexPattern), [query_bar_top_row.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/query_bar_top_row.tsx#:~:text=IIndexPattern), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IIndexPattern), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IIndexPattern), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IIndexPattern)+ 46 more | - | +| | [fetch_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts#:~:text=IndexPatternsContract), [fetch_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts#:~:text=IndexPatternsContract), [index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx#:~:text=IndexPatternsContract), [index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx#:~:text=IndexPatternsContract), [create_index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx#:~:text=IndexPatternsContract), [create_index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/create_index_pattern_select.tsx#:~:text=IndexPatternsContract), [fetch_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts#:~:text=IndexPatternsContract), [fetch_index_patterns.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts#:~:text=IndexPatternsContract), [index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx#:~:text=IndexPatternsContract), [index_pattern_select.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx#:~:text=IndexPatternsContract)+ 2 more | - | +| | [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType)+ 8 more | 8.2 | +| | [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=Filter)+ 10 more | 8.1 | + + + ## upgradeAssistant | Deprecated API | Reference location(s) | Remove By | diff --git a/api_docs/deprecations_by_team.mdx b/api_docs/deprecations_by_team.mdx index 5cebd18ea1cfb..43a36e5f1cf9d 100644 --- a/api_docs/deprecations_by_team.mdx +++ b/api_docs/deprecations_by_team.mdx @@ -3,7 +3,7 @@ id: kibDevDocsDeprecationsDueByTeam slug: /kibana-dev-docs/api-meta/deprecations-due-by-team title: Deprecated APIs due to be removed, by team summary: Lists the teams that are referencing deprecated APIs with a remove by date. -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. --- @@ -26,7 +26,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | Plugin | Deprecated API | Reference location(s) | Remove By | | --------|-------|-----------|-----------| | dataViews | | [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/utils.ts#:~:text=IFieldType), [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/utils.ts#:~:text=IFieldType), [data_view_field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.ts#:~:text=IFieldType), [data_view_field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/types.ts#:~:text=IFieldType), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/types.ts#:~:text=IFieldType)+ 13 more | 8.2 | -| dataViews | | [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/utils.ts#:~:text=IFieldType), [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/utils.ts#:~:text=IFieldType), [data_view_field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.ts#:~:text=IFieldType), [data_view_field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/types.ts#:~:text=IFieldType), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/types.ts#:~:text=IFieldType)+ 65 more | 8.2 | +| dataViews | | [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/utils.ts#:~:text=IFieldType), [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/utils.ts#:~:text=IFieldType), [data_view_field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.ts#:~:text=IFieldType), [data_view_field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/types.ts#:~:text=IFieldType), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/types.ts#:~:text=IFieldType)+ 47 more | 8.2 | | dataViews | | [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/utils.ts#:~:text=IFieldType), [utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/utils.ts#:~:text=IFieldType), [data_view_field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.ts#:~:text=IFieldType), [data_view_field.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/data_view_field.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [field_list.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/fields/field_list.ts#:~:text=IFieldType), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/types.ts#:~:text=IFieldType), [types.ts](https://github.com/elastic/kibana/tree/master/src/plugins/data_views/common/types.ts#:~:text=IFieldType)+ 13 more | 8.2 | | dataEnhanced | | [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/types.ts#:~:text=KueryNode), [types.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/types.ts#:~:text=KueryNode), [get_search_session_page.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/get_search_session_page.ts#:~:text=KueryNode), [get_search_session_page.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/get_search_session_page.ts#:~:text=KueryNode), [check_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/check_persisted_sessions.ts#:~:text=KueryNode), [check_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/check_persisted_sessions.ts#:~:text=KueryNode), [check_non_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/check_non_persisted_sessions.ts#:~:text=KueryNode), [check_non_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/check_non_persisted_sessions.ts#:~:text=KueryNode), [expire_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/expire_persisted_sessions.ts#:~:text=KueryNode), [expire_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/expire_persisted_sessions.ts#:~:text=KueryNode) | 8.1 | | dataEnhanced | | [check_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/check_persisted_sessions.ts#:~:text=nodeBuilder), [check_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/check_persisted_sessions.ts#:~:text=nodeBuilder), [check_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/check_persisted_sessions.ts#:~:text=nodeBuilder), [check_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/check_persisted_sessions.ts#:~:text=nodeBuilder), [check_non_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/check_non_persisted_sessions.ts#:~:text=nodeBuilder), [check_non_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/check_non_persisted_sessions.ts#:~:text=nodeBuilder), [expire_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/expire_persisted_sessions.ts#:~:text=nodeBuilder), [expire_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/expire_persisted_sessions.ts#:~:text=nodeBuilder), [expire_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/expire_persisted_sessions.ts#:~:text=nodeBuilder), [expire_persisted_sessions.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/data_enhanced/server/search/session/expire_persisted_sessions.ts#:~:text=nodeBuilder)+ 2 more | 8.1 | @@ -44,7 +44,10 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | Plugin | Deprecated API | Reference location(s) | Remove By | | --------|-------|-----------|-----------| | discover | | [anchor.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/context/services/anchor.ts#:~:text=fetch), [fetch_hits_in_interval.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/context/utils/fetch_hits_in_interval.ts#:~:text=fetch) | 8.1 | +| discover | | [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter) | 8.1 | +| discover | | [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter) | 8.1 | | discover | | [anchor.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/context/services/anchor.ts#:~:text=fetch), [fetch_hits_in_interval.ts](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/context/utils/fetch_hits_in_interval.ts#:~:text=fetch) | 8.1 | +| discover | | [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter), [view_alert_route.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/view_alert/view_alert_route.tsx#:~:text=Filter) | 8.1 | | discover | | [on_save_search.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/main/components/top_nav/on_save_search.tsx#:~:text=SavedObjectSaveModal), [on_save_search.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/discover/public/application/main/components/top_nav/on_save_search.tsx#:~:text=SavedObjectSaveModal), [save_modal.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/graph/public/components/save_modal.tsx#:~:text=SavedObjectSaveModal), [save_modal.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/graph/public/components/save_modal.tsx#:~:text=SavedObjectSaveModal) | 8.8.0 | | graph | | [listing_route.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/graph/public/apps/listing_route.tsx#:~:text=settings), [listing_route.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/graph/public/apps/listing_route.tsx#:~:text=settings) | 8.8.0 | | graph | | [plugin.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/graph/server/plugin.ts#:~:text=license%24) | 8.8.0 | @@ -66,12 +69,6 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | Plugin | Deprecated API | Reference location(s) | Remove By | | --------|-------|-----------|-----------| -| maps | | [es_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts#:~:text=fetch), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=fetch), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=fetch) | 8.1 | -| maps | | [locators.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/locators.test.ts#:~:text=esFilters), [locators.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/locators.test.ts#:~:text=esFilters) | 8.1 | -| maps | | [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter) | 8.1 | -| maps | | [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter) | 8.1 | -| maps | | [es_source.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_source/es_source.ts#:~:text=fetch), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=fetch), [es_search_source.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx#:~:text=fetch) | 8.1 | -| maps | | [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter), [can_skip_fetch.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/classes/util/can_skip_fetch.test.ts#:~:text=Filter) | 8.1 | | maps | | [maps_list_view.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/routes/list_page/maps_list_view.tsx#:~:text=settings), [maps_list_view.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/routes/list_page/maps_list_view.tsx#:~:text=settings), [maps_list_view.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/routes/list_page/maps_list_view.tsx#:~:text=settings) | 8.8.0 | | maps | | [render_app.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/render_app.tsx#:~:text=onAppLeave), [map_app.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/routes/map_page/map_app/map_app.tsx#:~:text=onAppLeave), [map_page.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/public/routes/map_page/map_page.tsx#:~:text=onAppLeave) | 8.8.0 | | maps | | [saved_object_migrations.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/maps/server/saved_objects/saved_object_migrations.ts#:~:text=warning) | 8.8.0 | @@ -168,6 +165,11 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/ | Plugin | Deprecated API | Reference location(s) | Remove By | | --------|-------|-----------|-----------| +| stackAlerts | | [fetch_search_source_query.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/lib/fetch_search_source_query.ts#:~:text=fetch), [alert_type.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts#:~:text=fetch), [alert_type.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts#:~:text=fetch) | 8.1 | +| stackAlerts | | [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter) | 8.1 | +| stackAlerts | | [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter) | 8.1 | +| stackAlerts | | [fetch_search_source_query.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/lib/fetch_search_source_query.ts#:~:text=fetch), [alert_type.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts#:~:text=fetch), [alert_type.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.test.ts#:~:text=fetch) | 8.1 | +| stackAlerts | | [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [read_only_filter_items.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/read_only_filter_items.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter), [search_source_expression.tsx](https://github.com/elastic/kibana/tree/master/x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx#:~:text=Filter) | 8.1 | | alerting | | [plugin.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/alerting/server/plugin.test.ts#:~:text=getKibanaFeatures) | 8.8.0 | | alerting | | [plugin.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/alerting/server/plugin.ts#:~:text=license%24), [license_state.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/alerting/server/lib/license_state.test.ts#:~:text=license%24), [license_state.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/alerting/server/lib/license_state.test.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/actions/server/plugin.ts#:~:text=license%24), [license_state.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/actions/server/lib/license_state.test.ts#:~:text=license%24), [license_state.test.ts](https://github.com/elastic/kibana/tree/master/x-pack/plugins/actions/server/lib/license_state.test.ts#:~:text=license%24) | 8.8.0 | @@ -202,6 +204,22 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/ +## Unified Search + +| Plugin | Deprecated API | Reference location(s) | Remove By | +| --------|-------|-----------|-----------| +| unifiedSearch | | [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType)+ 8 more | 8.2 | +| unifiedSearch | | [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=esFilters), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=esFilters), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=esFilters) | 8.1 | +| unifiedSearch | | [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=Filter)+ 10 more | 8.1 | +| unifiedSearch | | [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=FILTERS) | 8.1 | +| unifiedSearch | | [filter_editor_utils.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts#:~:text=toggleFilterNegated), [filter_editor_utils.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts#:~:text=toggleFilterNegated), [filter_editor_utils.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts#:~:text=toggleFilterNegated), [filter_editor_utils.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts#:~:text=toggleFilterNegated), [filter_editor_utils.test.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.test.ts#:~:text=toggleFilterNegated) | 8.1 | +| unifiedSearch | | [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=Filter)+ 10 more | 8.1 | +| unifiedSearch | | [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType)+ 26 more | 8.2 | +| unifiedSearch | | [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [filter_editor_utils.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_editor_utils.ts#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [phrase_suggestor.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/phrase_suggestor.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [range_value_input.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/range_value_input.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType), [index.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/index.tsx#:~:text=IFieldType)+ 8 more | 8.2 | +| unifiedSearch | | [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [use_filter_manager.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/search_bar/lib/use_filter_manager.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [apply_filter_action.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/actions/apply_filter_action.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [get_stub_filter.ts](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/test_helpers/get_stub_filter.ts#:~:text=Filter), [filter_label.tsx](https://github.com/elastic/kibana/tree/master/src/plugins/unified_search/public/filter_bar/filter_editor/lib/filter_label.tsx#:~:text=Filter)+ 10 more | 8.1 | + + + ## Vis Editors | Plugin | Deprecated API | Reference location(s) | Remove By | diff --git a/api_docs/dev_tools.mdx b/api_docs/dev_tools.mdx index 057a01b87b2af..fefa3a0c3391c 100644 --- a/api_docs/dev_tools.mdx +++ b/api_docs/dev_tools.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/devTools title: "devTools" image: https://source.unsplash.com/400x175/?github summary: API docs for the devTools plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'devTools'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/discover.mdx b/api_docs/discover.mdx index 454eed31db655..43970283258bf 100644 --- a/api_docs/discover.mdx +++ b/api_docs/discover.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/discover title: "discover" image: https://source.unsplash.com/400x175/?github summary: API docs for the discover plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discover'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/discover_enhanced.mdx b/api_docs/discover_enhanced.mdx index 1f365f7e3bf52..76d0262f5cfe8 100644 --- a/api_docs/discover_enhanced.mdx +++ b/api_docs/discover_enhanced.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/discoverEnhanced title: "discoverEnhanced" image: https://source.unsplash.com/400x175/?github summary: API docs for the discoverEnhanced plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discoverEnhanced'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/elastic_analytics.devdocs.json b/api_docs/elastic_analytics.devdocs.json new file mode 100644 index 0000000000000..0d1df6975ed2f --- /dev/null +++ b/api_docs/elastic_analytics.devdocs.json @@ -0,0 +1,1726 @@ +{ + "id": "@elastic/analytics", + "client": { + "classes": [], + "functions": [], + "interfaces": [], + "enums": [], + "misc": [], + "objects": [] + }, + "server": { + "classes": [], + "functions": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.createAnalytics", + "type": "Function", + "tags": [], + "label": "createAnalytics", + "description": [ + "\nCreates an {@link AnalyticsClient}." + ], + "signature": [ + "(initContext: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.AnalyticsClientInitContext", + "text": "AnalyticsClientInitContext" + }, + ") => ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.IAnalyticsClient", + "text": "IAnalyticsClient" + } + ], + "path": "packages/elastic-analytics/src/index.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.createAnalytics.$1", + "type": "Object", + "tags": [], + "label": "initContext", + "description": [ + "The initial context to create the client {@link AnalyticsClientInitContext }" + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.AnalyticsClientInitContext", + "text": "AnalyticsClientInitContext" + } + ], + "path": "packages/elastic-analytics/src/index.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + } + ], + "interfaces": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.AnalyticsClientInitContext", + "type": "Interface", + "tags": [], + "label": "AnalyticsClientInitContext", + "description": [ + "\nGeneral settings of the analytics client" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.AnalyticsClientInitContext.isDev", + "type": "boolean", + "tags": [], + "label": "isDev", + "description": [ + "\nBoolean indicating if it's running in developer mode." + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.AnalyticsClientInitContext.sendTo", + "type": "CompoundType", + "tags": [], + "label": "sendTo", + "description": [ + "\nSpecify if the shippers should send their data to the production or staging environments." + ], + "signature": [ + "\"staging\" | \"production\"" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.AnalyticsClientInitContext.logger", + "type": "Object", + "tags": [], + "label": "logger", + "description": [ + "\nApplication-provided logger." + ], + "signature": [ + "Logger" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.ContextProviderOpts", + "type": "Interface", + "tags": [], + "label": "ContextProviderOpts", + "description": [ + "\nDefinition of a context provider" + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.ContextProviderOpts", + "text": "ContextProviderOpts" + }, + "" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.ContextProviderOpts.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nThe name of the provider." + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.ContextProviderOpts.context$", + "type": "Object", + "tags": [], + "label": "context$", + "description": [ + "\nObservable that emits the custom context." + ], + "signature": [ + "Observable", + "" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.ContextProviderOpts.schema", + "type": "Object", + "tags": [], + "label": "schema", + "description": [ + "\nSchema declaring and documenting the expected output in the context$\n" + ], + "signature": [ + "{ [Key in keyof Required]: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaValue", + "text": "SchemaValue" + }, + "; }" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.Event", + "type": "Interface", + "tags": [], + "label": "Event", + "description": [ + "\nDefinition of the full event structure" + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.Event.timestamp", + "type": "string", + "tags": [], + "label": "timestamp", + "description": [ + "\nThe time the event was generated in ISO format." + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.Event.event_type", + "type": "string", + "tags": [], + "label": "event_type", + "description": [ + "\nThe event type." + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.Event.properties", + "type": "Object", + "tags": [], + "label": "properties", + "description": [ + "\nThe specific properties of the event type." + ], + "signature": [ + "{ [x: string]: unknown; }" + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.Event.context", + "type": "Object", + "tags": [], + "label": "context", + "description": [ + "\nThe {@link EventContext} enriched during the processing pipeline." + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.EventContext", + "text": "EventContext" + } + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.EventContext", + "type": "Interface", + "tags": [], + "label": "EventContext", + "description": [], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.EventContext.Unnamed", + "type": "IndexSignature", + "tags": [], + "label": "[key: string]: unknown", + "description": [], + "signature": [ + "[key: string]: unknown" + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.EventTypeOpts", + "type": "Interface", + "tags": [], + "label": "EventTypeOpts", + "description": [ + "\nDefinition of an Event Type." + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.EventTypeOpts", + "text": "EventTypeOpts" + }, + "" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.EventTypeOpts.eventType", + "type": "string", + "tags": [], + "label": "eventType", + "description": [ + "\nThe event type's unique name." + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.EventTypeOpts.schema", + "type": "Object", + "tags": [], + "label": "schema", + "description": [ + "\nSchema declaring and documenting the expected structure of this event type.\n" + ], + "signature": [ + "{ [Key in keyof Required]: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaValue", + "text": "SchemaValue" + }, + "; }" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient", + "type": "Interface", + "tags": [], + "label": "IAnalyticsClient", + "description": [ + "\nAnalytics client's public APIs" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.reportEvent", + "type": "Function", + "tags": [], + "label": "reportEvent", + "description": [ + "\nReports a telemetry event." + ], + "signature": [ + ">(eventType: string, eventData: EventTypeData) => void" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.reportEvent.$1", + "type": "string", + "tags": [], + "label": "eventType", + "description": [ + "The event type registered via the `registerEventType` API." + ], + "signature": [ + "string" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.reportEvent.$2", + "type": "Uncategorized", + "tags": [], + "label": "eventData", + "description": [ + "The properties matching the schema declared in the `registerEventType` API." + ], + "signature": [ + "EventTypeData" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.registerEventType", + "type": "Function", + "tags": [], + "label": "registerEventType", + "description": [ + "\nRegisters the event type that will be emitted via the reportEvent API." + ], + "signature": [ + "(eventTypeOps: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.EventTypeOpts", + "text": "EventTypeOpts" + }, + ") => void" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.registerEventType.$1", + "type": "Object", + "tags": [], + "label": "eventTypeOps", + "description": [], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.EventTypeOpts", + "text": "EventTypeOpts" + }, + "" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.registerShipper", + "type": "Function", + "tags": [], + "label": "registerShipper", + "description": [ + "\nSet up the shipper that will be used to report the telemetry events." + ], + "signature": [ + "(Shipper: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.ShipperClassConstructor", + "text": "ShipperClassConstructor" + }, + ", shipperConfig: ShipperConfig, opts?: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.RegisterShipperOpts", + "text": "RegisterShipperOpts" + }, + " | undefined) => void" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.registerShipper.$1", + "type": "Object", + "tags": [], + "label": "Shipper", + "description": [ + "The {@link IShipper } class to instantiate the shipper." + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.ShipperClassConstructor", + "text": "ShipperClassConstructor" + }, + "" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.registerShipper.$2", + "type": "Uncategorized", + "tags": [], + "label": "shipperConfig", + "description": [ + "The config specific to the Shipper to instantiate." + ], + "signature": [ + "ShipperConfig" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.registerShipper.$3", + "type": "Object", + "tags": [], + "label": "opts", + "description": [ + "Additional options to register the shipper {@link RegisterShipperOpts }." + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.RegisterShipperOpts", + "text": "RegisterShipperOpts" + }, + " | undefined" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "isRequired": false + } + ], + "returnComment": [] + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.optIn", + "type": "Function", + "tags": [], + "label": "optIn", + "description": [ + "\nUsed to control the user's consent to report the data.\nIn the advanced mode, it allows to \"cherry-pick\" which events and shippers are enabled/disabled." + ], + "signature": [ + "(optInConfig: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.OptInConfig", + "text": "OptInConfig" + }, + ") => void" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.optIn.$1", + "type": "Object", + "tags": [], + "label": "optInConfig", + "description": [ + "{@link OptInConfig }" + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.OptInConfig", + "text": "OptInConfig" + } + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.registerContextProvider", + "type": "Function", + "tags": [], + "label": "registerContextProvider", + "description": [ + "\nRegisters the context provider to enrich the any reported events." + ], + "signature": [ + "(contextProviderOpts: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.ContextProviderOpts", + "text": "ContextProviderOpts" + }, + ") => void" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.registerContextProvider.$1", + "type": "Object", + "tags": [], + "label": "contextProviderOpts", + "description": [ + "{@link ContextProviderOpts }" + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.ContextProviderOpts", + "text": "ContextProviderOpts" + }, + "" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.removeContextProvider", + "type": "Function", + "tags": [], + "label": "removeContextProvider", + "description": [ + "\nRemoves the context provider and stop enriching the events from its context." + ], + "signature": [ + "(contextProviderName: string) => void" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.removeContextProvider.$1", + "type": "string", + "tags": [], + "label": "contextProviderName", + "description": [ + "The name of the context provider to remove." + ], + "signature": [ + "string" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IAnalyticsClient.telemetryCounter$", + "type": "Object", + "tags": [], + "label": "telemetryCounter$", + "description": [ + "\nObservable to emit the stats of the processed events." + ], + "signature": [ + "Observable", + "<", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.TelemetryCounter", + "text": "TelemetryCounter" + }, + ">" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IShipper", + "type": "Interface", + "tags": [], + "label": "IShipper", + "description": [ + "\nBasic structure of a Shipper" + ], + "path": "packages/elastic-analytics/src/shippers/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IShipper.reportEvents", + "type": "Function", + "tags": [], + "label": "reportEvents", + "description": [ + "\nAdapts and ships the event to the persisting/analytics solution." + ], + "signature": [ + "(events: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.Event", + "text": "Event" + }, + "[]) => void" + ], + "path": "packages/elastic-analytics/src/shippers/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IShipper.reportEvents.$1", + "type": "Array", + "tags": [], + "label": "events", + "description": [ + "batched events {@link Event }" + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.Event", + "text": "Event" + }, + "[]" + ], + "path": "packages/elastic-analytics/src/shippers/types.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IShipper.optIn", + "type": "Function", + "tags": [], + "label": "optIn", + "description": [ + "\nStops/restarts the shipping mechanism based on the value of isOptedIn" + ], + "signature": [ + "(isOptedIn: boolean) => void" + ], + "path": "packages/elastic-analytics/src/shippers/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IShipper.optIn.$1", + "type": "boolean", + "tags": [], + "label": "isOptedIn", + "description": [ + "`true` for resume sending events. `false` to stop." + ], + "signature": [ + "boolean" + ], + "path": "packages/elastic-analytics/src/shippers/types.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IShipper.extendContext", + "type": "Function", + "tags": [], + "label": "extendContext", + "description": [ + "\nPerform any necessary calls to the persisting/analytics solution to set the event's context." + ], + "signature": [ + "((newContext: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.EventContext", + "text": "EventContext" + }, + ") => void) | undefined" + ], + "path": "packages/elastic-analytics/src/shippers/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IShipper.extendContext.$1", + "type": "Object", + "tags": [], + "label": "newContext", + "description": [], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.EventContext", + "text": "EventContext" + } + ], + "path": "packages/elastic-analytics/src/shippers/types.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.IShipper.telemetryCounter$", + "type": "Object", + "tags": [], + "label": "telemetryCounter$", + "description": [ + "\nObservable to emit the stats of the processed events." + ], + "signature": [ + "Observable", + "<", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.TelemetryCounter", + "text": "TelemetryCounter" + }, + "> | undefined" + ], + "path": "packages/elastic-analytics/src/shippers/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.OptInConfig", + "type": "Interface", + "tags": [], + "label": "OptInConfig", + "description": [ + "\n" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.OptInConfig.global", + "type": "Object", + "tags": [], + "label": "global", + "description": [ + "\nControls the global enabled/disabled behaviour of the client and shippers." + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.OptInConfigPerType", + "text": "OptInConfigPerType" + } + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.OptInConfig.event_types", + "type": "Object", + "tags": [], + "label": "event_types", + "description": [ + "\nControls if an event type should be disabled for a specific type of shipper." + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.OptInConfigPerType", + "type": "Interface", + "tags": [], + "label": "OptInConfigPerType", + "description": [ + "\nSets whether a type of event is enabled/disabled globally or per shipper." + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.OptInConfigPerType.enabled", + "type": "boolean", + "tags": [], + "label": "enabled", + "description": [ + "\nThe event type is globally enabled." + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.OptInConfigPerType.shippers", + "type": "Object", + "tags": [], + "label": "shippers", + "description": [ + "\nControls if an event type should be disabled for a specific type of shipper." + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.RegisterShipperOpts", + "type": "Interface", + "tags": [], + "label": "RegisterShipperOpts", + "description": [ + "\nOptional options to register a shipper" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaArray", + "type": "Interface", + "tags": [], + "label": "SchemaArray", + "description": [ + "\nSchema to represent an array" + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaArray", + "text": "SchemaArray" + }, + " extends ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaMeta", + "text": "SchemaMeta" + }, + "" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaArray.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "signature": [ + "\"array\"" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaArray.items", + "type": "CompoundType", + "tags": [], + "label": "items", + "description": [], + "signature": [ + "{ type: \"pass_through\"; _meta: { description: string; } & ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaMetaOptional", + "text": "SchemaMetaOptional" + }, + "; } | (unknown extends Value ? ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaArray", + "text": "SchemaArray" + }, + " | ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaObject", + "text": "SchemaObject" + }, + " | ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaChildValue", + "text": "SchemaChildValue" + }, + " : NonNullable extends (infer U)[] ? ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaArray", + "text": "SchemaArray" + }, + " : NonNullable extends object ? ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaObject", + "text": "SchemaObject" + }, + " : ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaChildValue", + "text": "SchemaChildValue" + }, + ")" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaChildValue", + "type": "Interface", + "tags": [], + "label": "SchemaChildValue", + "description": [], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaChildValue", + "text": "SchemaChildValue" + }, + "" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaChildValue.type", + "type": "Uncategorized", + "tags": [], + "label": "type", + "description": [], + "signature": [ + "NonNullable extends string ? ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.AllowedSchemaStringTypes", + "text": "AllowedSchemaStringTypes" + }, + " : NonNullable extends number ? ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.AllowedSchemaNumberTypes", + "text": "AllowedSchemaNumberTypes" + }, + " : NonNullable extends boolean ? \"boolean\" : ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.AllowedSchemaTypes", + "text": "AllowedSchemaTypes" + } + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaChildValue._meta", + "type": "CompoundType", + "tags": [], + "label": "_meta", + "description": [], + "signature": [ + "{ description: string; } & ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaMetaOptional", + "text": "SchemaMetaOptional" + }, + "" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaMeta", + "type": "Interface", + "tags": [], + "label": "SchemaMeta", + "description": [ + "\nSchema meta with optional description" + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaMeta", + "text": "SchemaMeta" + }, + "" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaMeta._meta", + "type": "CompoundType", + "tags": [], + "label": "_meta", + "description": [], + "signature": [ + "({ description?: string | undefined; } & ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaMetaOptional", + "text": "SchemaMetaOptional" + }, + ") | undefined" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaObject", + "type": "Interface", + "tags": [], + "label": "SchemaObject", + "description": [ + "\nSchema to represent an object" + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaObject", + "text": "SchemaObject" + }, + " extends ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaMeta", + "text": "SchemaMeta" + }, + "" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaObject.properties", + "type": "Object", + "tags": [], + "label": "properties", + "description": [], + "signature": [ + "{ [Key in keyof Required]: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaValue", + "text": "SchemaValue" + }, + "; }" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.ShipperClassConstructor", + "type": "Interface", + "tags": [], + "label": "ShipperClassConstructor", + "description": [ + "\nConstructor of a {@link IShipper}" + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.ShipperClassConstructor", + "text": "ShipperClassConstructor" + }, + "" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.ShipperClassConstructor.shipperName", + "type": "string", + "tags": [], + "label": "shipperName", + "description": [ + "\nThe shipper's unique name" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.ShipperClassConstructor.Unnamed", + "type": "Any", + "tags": [], + "label": "Unnamed", + "description": [ + "\nThe constructor" + ], + "signature": [ + "any" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.TelemetryCounter", + "type": "Interface", + "tags": [], + "label": "TelemetryCounter", + "description": [ + "\nShape of the events emitted by the telemetryCounter$ observable" + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.TelemetryCounter.type", + "type": "Enum", + "tags": [], + "label": "type", + "description": [ + "\nIndicates if the event contains data about succeeded, failed or dropped events." + ], + "signature": [ + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.TelemetryCounterType", + "text": "TelemetryCounterType" + } + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.TelemetryCounter.source", + "type": "string", + "tags": [], + "label": "source", + "description": [ + "\nWho emitted the event? It can be \"client\" or the name of the shipper." + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.TelemetryCounter.event_type", + "type": "string", + "tags": [], + "label": "event_type", + "description": [ + "\nThe event type the success/failure/drop event refers to." + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.TelemetryCounter.code", + "type": "string", + "tags": [], + "label": "code", + "description": [ + "\nCode to provide additional information about the success or failure. Examples are 200/400/504/ValidationError/UnknownError" + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.TelemetryCounter.count", + "type": "number", + "tags": [], + "label": "count", + "description": [ + "\nThe number of events that this counter refers to." + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false + } + ], + "initialIsOpen": false + } + ], + "enums": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.TelemetryCounterType", + "type": "Enum", + "tags": [], + "label": "TelemetryCounterType", + "description": [ + "\nTypes of the Telemetry Counter: It allows to differentiate what happened to the events" + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false, + "initialIsOpen": false + } + ], + "misc": [ + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.AllowedSchemaBooleanTypes", + "type": "Type", + "tags": [], + "label": "AllowedSchemaBooleanTypes", + "description": [ + "Types matching boolean values" + ], + "signature": [ + "\"boolean\"" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.AllowedSchemaNumberTypes", + "type": "Type", + "tags": [], + "label": "AllowedSchemaNumberTypes", + "description": [ + "Types matching number values" + ], + "signature": [ + "\"date\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"double\"" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.AllowedSchemaStringTypes", + "type": "Type", + "tags": [], + "label": "AllowedSchemaStringTypes", + "description": [ + "Types matching string values" + ], + "signature": [ + "\"keyword\" | \"date\" | \"text\"" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.AllowedSchemaTypes", + "type": "Type", + "tags": [], + "label": "AllowedSchemaTypes", + "description": [ + "\nPossible type values in the schema" + ], + "signature": [ + "\"boolean\" | \"keyword\" | \"date\" | \"text\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"double\"" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.EventType", + "type": "Type", + "tags": [], + "label": "EventType", + "description": [ + "\nEvent Type used for indexed structures. Only used to improve the readability of the types" + ], + "signature": [ + "string" + ], + "path": "packages/elastic-analytics/src/events/types.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.PossibleSchemaTypes", + "type": "Type", + "tags": [], + "label": "PossibleSchemaTypes", + "description": [ + "\nHelper to ensure the declared types match the schema types" + ], + "signature": [ + "Value extends string ? ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.AllowedSchemaStringTypes", + "text": "AllowedSchemaStringTypes" + }, + " : Value extends number ? ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.AllowedSchemaNumberTypes", + "text": "AllowedSchemaNumberTypes" + }, + " : Value extends boolean ? \"boolean\" : ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.AllowedSchemaTypes", + "text": "AllowedSchemaTypes" + } + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.RootSchema", + "type": "Type", + "tags": [], + "label": "RootSchema", + "description": [ + "\nSchema definition to match the structure of the properties provided.\n" + ], + "signature": [ + "{ [Key in keyof Required]: ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaValue", + "text": "SchemaValue" + }, + "; }" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaMetaOptional", + "type": "Type", + "tags": [], + "label": "SchemaMetaOptional", + "description": [ + "\nEnforces { optional: true } if the value can be undefined" + ], + "signature": [ + "unknown extends Value ? { optional?: boolean | undefined; } : undefined extends Value ? { optional: true; } : { optional?: false | undefined; }" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.SchemaValue", + "type": "Type", + "tags": [], + "label": "SchemaValue", + "description": [ + "\nType that defines all the possible values that the Schema accepts.\nThese types definitions are helping to identify earlier the possible missing `properties` nesting when\nmanually defining the schemas." + ], + "signature": [ + "{ type: \"pass_through\"; _meta: { description: string; } & ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaMetaOptional", + "text": "SchemaMetaOptional" + }, + "; } | (unknown extends Value ? ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaArray", + "text": "SchemaArray" + }, + " | ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaObject", + "text": "SchemaObject" + }, + " | ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaChildValue", + "text": "SchemaChildValue" + }, + " : NonNullable extends (infer U)[] ? ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaArray", + "text": "SchemaArray" + }, + " : NonNullable extends object ? ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaObject", + "text": "SchemaObject" + }, + " : ", + { + "pluginId": "@elastic/analytics", + "scope": "server", + "docId": "kibElasticAnalyticsPluginApi", + "section": "def-server.SchemaChildValue", + "text": "SchemaChildValue" + }, + ")" + ], + "path": "packages/elastic-analytics/src/schema/types.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "@elastic/analytics", + "id": "def-server.ShipperName", + "type": "Type", + "tags": [], + "label": "ShipperName", + "description": [ + "\nShipper Name used for indexed structures. Only used to improve the readability of the types" + ], + "signature": [ + "string" + ], + "path": "packages/elastic-analytics/src/analytics_client/types.ts", + "deprecated": false, + "initialIsOpen": false + } + ], + "objects": [] + }, + "common": { + "classes": [], + "functions": [], + "interfaces": [], + "enums": [], + "misc": [], + "objects": [] + } +} \ No newline at end of file diff --git a/api_docs/elastic_analytics.mdx b/api_docs/elastic_analytics.mdx new file mode 100644 index 0000000000000..2d00c52f5e6a0 --- /dev/null +++ b/api_docs/elastic_analytics.mdx @@ -0,0 +1,36 @@ +--- +id: kibElasticAnalyticsPluginApi +slug: /kibana-dev-docs/api/elastic-analytics +title: "@elastic/analytics" +image: https://source.unsplash.com/400x175/?github +summary: API docs for the @elastic/analytics plugin +date: 2022-04-05 +tags: ['contributor', 'dev', 'apidocs', 'kibana', '@elastic/analytics'] +warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. +--- +import elasticAnalyticsObj from './elastic_analytics.devdocs.json'; + + + +Contact [Owner missing] for questions regarding this plugin. + +**Code health stats** + +| Public API count | Any count | Items lacking comments | Missing exports | +|-------------------|-----------|------------------------|-----------------| +| 82 | 1 | 11 | 0 | + +## Server + +### Functions + + +### Interfaces + + +### Enums + + +### Consts, variables and types + + diff --git a/api_docs/elastic_apm_synthtrace.devdocs.json b/api_docs/elastic_apm_synthtrace.devdocs.json index fea30b403b0b9..0e802d55936c3 100644 --- a/api_docs/elastic_apm_synthtrace.devdocs.json +++ b/api_docs/elastic_apm_synthtrace.devdocs.json @@ -150,7 +150,7 @@ "[], options?: ", "StreamToBulkOptions", " | undefined) => Promise<", - "IndicesRefreshResponse", + "ShardsOperationResponseBase", ">" ], "path": "packages/elastic-apm-synthtrace/src/lib/apm/client/apm_synthtrace_es_client.ts", diff --git a/api_docs/elastic_apm_synthtrace.mdx b/api_docs/elastic_apm_synthtrace.mdx index adc81c10d554e..a1ce9ad2020bd 100644 --- a/api_docs/elastic_apm_synthtrace.mdx +++ b/api_docs/elastic_apm_synthtrace.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/elastic-apm-synthtrace title: "@elastic/apm-synthtrace" image: https://source.unsplash.com/400x175/?github summary: API docs for the @elastic/apm-synthtrace plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@elastic/apm-synthtrace'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/elastic_datemath.mdx b/api_docs/elastic_datemath.mdx index 603fcf30aee95..14fd7fef84034 100644 --- a/api_docs/elastic_datemath.mdx +++ b/api_docs/elastic_datemath.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/elastic-datemath title: "@elastic/datemath" image: https://source.unsplash.com/400x175/?github summary: API docs for the @elastic/datemath plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@elastic/datemath'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/embeddable.devdocs.json b/api_docs/embeddable.devdocs.json index f6bbd0035ca40..4ff19a79a26b4 100644 --- a/api_docs/embeddable.devdocs.json +++ b/api_docs/embeddable.devdocs.json @@ -1306,6 +1306,54 @@ ], "returnComment": [] }, + { + "parentPluginId": "embeddable", + "id": "def-public.Container.onRemoveEmbeddable", + "type": "Function", + "tags": [], + "label": "onRemoveEmbeddable", + "description": [ + "\nControl the panels that are pushed to the input stream when an embeddable is\nremoved. This can be used if removing one embeddable has knock-on effects, like\nre-ordering embeddables that come after it." + ], + "signature": [ + "(embeddableId: string) => { [key: string]: ", + { + "pluginId": "embeddable", + "scope": "common", + "docId": "kibEmbeddablePluginApi", + "section": "def-common.PanelState", + "text": "PanelState" + }, + "<", + { + "pluginId": "embeddable", + "scope": "common", + "docId": "kibEmbeddablePluginApi", + "section": "def-common.EmbeddableInput", + "text": "EmbeddableInput" + }, + " & { id: string; }>; }" + ], + "path": "src/plugins/embeddable/public/lib/containers/container.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "embeddable", + "id": "def-public.Container.onRemoveEmbeddable.$1", + "type": "string", + "tags": [], + "label": "embeddableId", + "description": [], + "signature": [ + "string" + ], + "path": "src/plugins/embeddable/public/lib/containers/container.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [] + }, { "parentPluginId": "embeddable", "id": "def-public.Container.getChildIds", diff --git a/api_docs/embeddable.mdx b/api_docs/embeddable.mdx index 860e9899adfae..47e2bc353aa60 100644 --- a/api_docs/embeddable.mdx +++ b/api_docs/embeddable.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/embeddable title: "embeddable" image: https://source.unsplash.com/400x175/?github summary: API docs for the embeddable plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddable'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 474 | 0 | 385 | 4 | +| 476 | 0 | 386 | 4 | ## Client diff --git a/api_docs/embeddable_enhanced.mdx b/api_docs/embeddable_enhanced.mdx index 2bc4c277cd901..1829aa20035c7 100644 --- a/api_docs/embeddable_enhanced.mdx +++ b/api_docs/embeddable_enhanced.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/embeddableEnhanced title: "embeddableEnhanced" image: https://source.unsplash.com/400x175/?github summary: API docs for the embeddableEnhanced plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddableEnhanced'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/encrypted_saved_objects.mdx b/api_docs/encrypted_saved_objects.mdx index 1e6eea778efdf..f278c6e339e36 100644 --- a/api_docs/encrypted_saved_objects.mdx +++ b/api_docs/encrypted_saved_objects.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/encryptedSavedObjects title: "encryptedSavedObjects" image: https://source.unsplash.com/400x175/?github summary: API docs for the encryptedSavedObjects plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'encryptedSavedObjects'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/enterprise_search.mdx b/api_docs/enterprise_search.mdx index e97f98b8b403e..8ea1f6d5c47b3 100644 --- a/api_docs/enterprise_search.mdx +++ b/api_docs/enterprise_search.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/enterpriseSearch title: "enterpriseSearch" image: https://source.unsplash.com/400x175/?github summary: API docs for the enterpriseSearch plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'enterpriseSearch'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/es_ui_shared.mdx b/api_docs/es_ui_shared.mdx index e722fbb7d81d3..3f8b8a4e25633 100644 --- a/api_docs/es_ui_shared.mdx +++ b/api_docs/es_ui_shared.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/esUiShared title: "esUiShared" image: https://source.unsplash.com/400x175/?github summary: API docs for the esUiShared plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'esUiShared'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/event_annotation.mdx b/api_docs/event_annotation.mdx index cf43a56980cb7..db8d13ecbffad 100644 --- a/api_docs/event_annotation.mdx +++ b/api_docs/event_annotation.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/eventAnnotation title: "eventAnnotation" image: https://source.unsplash.com/400x175/?github summary: API docs for the eventAnnotation plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotation'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/event_log.devdocs.json b/api_docs/event_log.devdocs.json index b90aee758878d..cf94115cf3b25 100644 --- a/api_docs/event_log.devdocs.json +++ b/api_docs/event_log.devdocs.json @@ -1047,7 +1047,7 @@ "label": "data", "description": [], "signature": [ - "(Readonly<{ user?: Readonly<{ name?: string | undefined; } & {}> | undefined; message?: string | undefined; error?: Readonly<{ message?: string | undefined; type?: string | undefined; id?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: number | undefined; number_of_scheduled_actions?: number | undefined; number_of_searches?: number | undefined; total_indexing_duration_ms?: number | undefined; es_search_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; } & {}> | undefined; version?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: number | undefined; scheduled?: string | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; outcome?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; original?: string | undefined; duration?: number | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; hash?: string | undefined; dataset?: string | undefined; severity?: number | undefined; created?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; } & {}> | undefined)[]" + "(Readonly<{ user?: Readonly<{ name?: string | undefined; } & {}> | undefined; message?: string | undefined; error?: Readonly<{ message?: string | undefined; type?: string | undefined; id?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: number | undefined; number_of_scheduled_actions?: number | undefined; number_of_searches?: number | undefined; total_indexing_duration_ms?: number | undefined; es_search_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; } & {}> | undefined; version?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: number | undefined; scheduled?: string | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; outcome?: string | undefined; category?: string[] | undefined; url?: string | undefined; end?: string | undefined; original?: string | undefined; duration?: number | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; hash?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; } & {}> | undefined)[]" ], "path": "x-pack/plugins/event_log/server/es/cluster_client_adapter.ts", "deprecated": false @@ -1066,7 +1066,7 @@ "label": "IEvent", "description": [], "signature": [ - "DeepPartial | undefined; message?: string | undefined; error?: Readonly<{ message?: string | undefined; type?: string | undefined; id?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: number | undefined; number_of_scheduled_actions?: number | undefined; number_of_searches?: number | undefined; total_indexing_duration_ms?: number | undefined; es_search_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; } & {}> | undefined; version?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: number | undefined; scheduled?: string | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; outcome?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; original?: string | undefined; duration?: number | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; hash?: string | undefined; dataset?: string | undefined; severity?: number | undefined; created?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; } & {}>>> | undefined" + "DeepPartial | undefined; message?: string | undefined; error?: Readonly<{ message?: string | undefined; type?: string | undefined; id?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: number | undefined; number_of_scheduled_actions?: number | undefined; number_of_searches?: number | undefined; total_indexing_duration_ms?: number | undefined; es_search_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; } & {}> | undefined; version?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: number | undefined; scheduled?: string | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; outcome?: string | undefined; category?: string[] | undefined; url?: string | undefined; end?: string | undefined; original?: string | undefined; duration?: number | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; hash?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; } & {}>>> | undefined" ], "path": "x-pack/plugins/event_log/generated/schemas.ts", "deprecated": false, @@ -1080,7 +1080,7 @@ "label": "IValidatedEvent", "description": [], "signature": [ - "Readonly<{ user?: Readonly<{ name?: string | undefined; } & {}> | undefined; message?: string | undefined; error?: Readonly<{ message?: string | undefined; type?: string | undefined; id?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: number | undefined; number_of_scheduled_actions?: number | undefined; number_of_searches?: number | undefined; total_indexing_duration_ms?: number | undefined; es_search_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; } & {}> | undefined; version?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: number | undefined; scheduled?: string | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; outcome?: string | undefined; end?: string | undefined; category?: string[] | undefined; url?: string | undefined; original?: string | undefined; duration?: number | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; hash?: string | undefined; dataset?: string | undefined; severity?: number | undefined; created?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; } & {}> | undefined" + "Readonly<{ user?: Readonly<{ name?: string | undefined; } & {}> | undefined; message?: string | undefined; error?: Readonly<{ message?: string | undefined; type?: string | undefined; id?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: number | undefined; number_of_scheduled_actions?: number | undefined; number_of_searches?: number | undefined; total_indexing_duration_ms?: number | undefined; es_search_duration_ms?: number | undefined; total_search_duration_ms?: number | undefined; execution_gap_duration_s?: number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; } & {}> | undefined; version?: string | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: number | undefined; scheduled?: string | undefined; } & {}> | undefined; space_ids?: string[] | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; rule?: Readonly<{ id?: string | undefined; description?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; outcome?: string | undefined; category?: string[] | undefined; url?: string | undefined; end?: string | undefined; original?: string | undefined; duration?: number | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; hash?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; } & {}> | undefined" ], "path": "x-pack/plugins/event_log/generated/schemas.ts", "deprecated": false, diff --git a/api_docs/event_log.mdx b/api_docs/event_log.mdx index 838c79855d025..40049f0fbe11d 100644 --- a/api_docs/event_log.mdx +++ b/api_docs/event_log.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/eventLog title: "eventLog" image: https://source.unsplash.com/400x175/?github summary: API docs for the eventLog plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventLog'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_error.mdx b/api_docs/expression_error.mdx index 38f020b62092f..47da67003080d 100644 --- a/api_docs/expression_error.mdx +++ b/api_docs/expression_error.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionError title: "expressionError" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionError plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionError'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_gauge.devdocs.json b/api_docs/expression_gauge.devdocs.json index ed153c7d2cdd3..63e409a1a6c3a 100644 --- a/api_docs/expression_gauge.devdocs.json +++ b/api_docs/expression_gauge.devdocs.json @@ -102,7 +102,15 @@ "section": "def-common.Accessors", "text": "Accessors" }, - " | undefined) => number" + " | undefined, paletteParams?: ", + { + "pluginId": "expressionGauge", + "scope": "common", + "docId": "kibExpressionGaugePluginApi", + "section": "def-common.CustomPaletteParams", + "text": "CustomPaletteParams" + }, + " | undefined, isRespectRanges?: boolean | undefined) => number" ], "path": "src/plugins/chart_expressions/expression_gauge/public/components/utils/accessors.ts", "deprecated": false, @@ -148,6 +156,41 @@ "path": "src/plugins/chart_expressions/expression_gauge/public/components/utils/accessors.ts", "deprecated": false, "isRequired": false + }, + { + "parentPluginId": "expressionGauge", + "id": "def-public.getMaxValue.$3", + "type": "Object", + "tags": [], + "label": "paletteParams", + "description": [], + "signature": [ + { + "pluginId": "expressionGauge", + "scope": "common", + "docId": "kibExpressionGaugePluginApi", + "section": "def-common.CustomPaletteParams", + "text": "CustomPaletteParams" + }, + " | undefined" + ], + "path": "src/plugins/chart_expressions/expression_gauge/public/components/utils/accessors.ts", + "deprecated": false, + "isRequired": false + }, + { + "parentPluginId": "expressionGauge", + "id": "def-public.getMaxValue.$4", + "type": "CompoundType", + "tags": [], + "label": "isRespectRanges", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/chart_expressions/expression_gauge/public/components/utils/accessors.ts", + "deprecated": false, + "isRequired": false } ], "returnComment": [], @@ -177,7 +220,15 @@ "section": "def-common.Accessors", "text": "Accessors" }, - " | undefined) => any" + " | undefined, paletteParams?: ", + { + "pluginId": "expressionGauge", + "scope": "common", + "docId": "kibExpressionGaugePluginApi", + "section": "def-common.CustomPaletteParams", + "text": "CustomPaletteParams" + }, + " | undefined, isRespectRanges?: boolean | undefined) => any" ], "path": "src/plugins/chart_expressions/expression_gauge/public/components/utils/accessors.ts", "deprecated": false, @@ -223,6 +274,41 @@ "path": "src/plugins/chart_expressions/expression_gauge/public/components/utils/accessors.ts", "deprecated": false, "isRequired": false + }, + { + "parentPluginId": "expressionGauge", + "id": "def-public.getMinValue.$3", + "type": "Object", + "tags": [], + "label": "paletteParams", + "description": [], + "signature": [ + { + "pluginId": "expressionGauge", + "scope": "common", + "docId": "kibExpressionGaugePluginApi", + "section": "def-common.CustomPaletteParams", + "text": "CustomPaletteParams" + }, + " | undefined" + ], + "path": "src/plugins/chart_expressions/expression_gauge/public/components/utils/accessors.ts", + "deprecated": false, + "isRequired": false + }, + { + "parentPluginId": "expressionGauge", + "id": "def-public.getMinValue.$4", + "type": "CompoundType", + "tags": [], + "label": "isRespectRanges", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/chart_expressions/expression_gauge/public/components/utils/accessors.ts", + "deprecated": false, + "isRequired": false } ], "returnComment": [], @@ -982,6 +1068,19 @@ } ] }, + { + "parentPluginId": "expressionGauge", + "id": "def-common.GaugeState.respectRanges", + "type": "CompoundType", + "tags": [], + "label": "respectRanges", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/chart_expressions/expression_gauge/common/types/expression_functions.ts", + "deprecated": false + }, { "parentPluginId": "expressionGauge", "id": "def-common.GaugeState.commonLabel", diff --git a/api_docs/expression_gauge.mdx b/api_docs/expression_gauge.mdx index 9bb9b12d02707..b99d793cc0063 100644 --- a/api_docs/expression_gauge.mdx +++ b/api_docs/expression_gauge.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionGauge title: "expressionGauge" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionGauge plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionGauge'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Vis Editors](https://github.com/orgs/elastic/teams/kibana-vis-editors) | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 71 | 0 | 71 | 2 | +| 76 | 0 | 76 | 2 | ## Client diff --git a/api_docs/expression_heatmap.mdx b/api_docs/expression_heatmap.mdx index 146bb572eedb5..aad7b2efe25d8 100644 --- a/api_docs/expression_heatmap.mdx +++ b/api_docs/expression_heatmap.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionHeatmap title: "expressionHeatmap" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionHeatmap plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionHeatmap'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_image.mdx b/api_docs/expression_image.mdx index 7ab108c6cd4f4..feea2fe660d34 100644 --- a/api_docs/expression_image.mdx +++ b/api_docs/expression_image.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionImage title: "expressionImage" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionImage plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionImage'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_metric.mdx b/api_docs/expression_metric.mdx index 21b4ca9d8773d..8affa769b01a2 100644 --- a/api_docs/expression_metric.mdx +++ b/api_docs/expression_metric.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionMetric title: "expressionMetric" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionMetric plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetric'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_metric_vis.mdx b/api_docs/expression_metric_vis.mdx index 965dfa6c2fa36..a428ff8611edf 100644 --- a/api_docs/expression_metric_vis.mdx +++ b/api_docs/expression_metric_vis.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionMetricVis title: "expressionMetricVis" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionMetricVis plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetricVis'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_partition_vis.mdx b/api_docs/expression_partition_vis.mdx index 981c10aae7283..2ed4287363bf1 100644 --- a/api_docs/expression_partition_vis.mdx +++ b/api_docs/expression_partition_vis.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionPartitionVis title: "expressionPartitionVis" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionPartitionVis plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionPartitionVis'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_repeat_image.mdx b/api_docs/expression_repeat_image.mdx index dfeee9cc5290a..30b19d8b19abb 100644 --- a/api_docs/expression_repeat_image.mdx +++ b/api_docs/expression_repeat_image.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionRepeatImage title: "expressionRepeatImage" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionRepeatImage plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRepeatImage'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_reveal_image.mdx b/api_docs/expression_reveal_image.mdx index c0c9436011614..8e270f3640f04 100644 --- a/api_docs/expression_reveal_image.mdx +++ b/api_docs/expression_reveal_image.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionRevealImage title: "expressionRevealImage" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionRevealImage plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRevealImage'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_shape.mdx b/api_docs/expression_shape.mdx index ad96dbf11f267..54a9aa6e92925 100644 --- a/api_docs/expression_shape.mdx +++ b/api_docs/expression_shape.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionShape title: "expressionShape" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionShape plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionShape'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_tagcloud.mdx b/api_docs/expression_tagcloud.mdx index 0a300752b5735..e3f34e10096c9 100644 --- a/api_docs/expression_tagcloud.mdx +++ b/api_docs/expression_tagcloud.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionTagcloud title: "expressionTagcloud" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionTagcloud plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionTagcloud'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expression_x_y.mdx b/api_docs/expression_x_y.mdx index 858f0ed4a7002..1bb894548102d 100644 --- a/api_docs/expression_x_y.mdx +++ b/api_docs/expression_x_y.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressionXY title: "expressionXY" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressionXY plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionXY'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/expressions.devdocs.json b/api_docs/expressions.devdocs.json index 07ed1dfd834c3..5da80bd20a369 100644 --- a/api_docs/expressions.devdocs.json +++ b/api_docs/expressions.devdocs.json @@ -6931,7 +6931,7 @@ "\nTracks state of execution.\n\n- `not-started` - before .start() method was called.\n- `pending` - immediately after .start() method is called.\n- `result` - when expression execution completed.\n- `error` - when execution failed with error." ], "signature": [ - "\"error\" | \"result\" | \"not-started\" | \"pending\"" + "\"error\" | \"not-started\" | \"pending\" | \"result\"" ], "path": "src/plugins/expressions/common/execution/container.ts", "deprecated": false @@ -10465,7 +10465,7 @@ "label": "padding", "description": [], "signature": [ - "\"m\" | \"s\" | \"l\" | \"xs\" | \"xl\" | undefined" + "\"m\" | \"s\" | \"xs\" | \"l\" | \"xl\" | undefined" ], "path": "src/plugins/expressions/public/react_expression_renderer/react_expression_renderer.tsx", "deprecated": false @@ -17079,7 +17079,7 @@ "\nTracks state of execution.\n\n- `not-started` - before .start() method was called.\n- `pending` - immediately after .start() method is called.\n- `result` - when expression execution completed.\n- `error` - when execution failed with error." ], "signature": [ - "\"error\" | \"result\" | \"not-started\" | \"pending\"" + "\"error\" | \"not-started\" | \"pending\" | \"result\"" ], "path": "src/plugins/expressions/common/execution/container.ts", "deprecated": false @@ -28341,7 +28341,7 @@ "\nTracks state of execution.\n\n- `not-started` - before .start() method was called.\n- `pending` - immediately after .start() method is called.\n- `result` - when expression execution completed.\n- `error` - when execution failed with error." ], "signature": [ - "\"error\" | \"result\" | \"not-started\" | \"pending\"" + "\"error\" | \"not-started\" | \"pending\" | \"result\"" ], "path": "src/plugins/expressions/common/execution/container.ts", "deprecated": false @@ -32719,7 +32719,7 @@ "label": "metric", "description": [], "signature": [ - "\"max\" | \"min\" | \"sum\" | \"average\"" + "\"sum\" | \"max\" | \"min\" | \"average\"" ], "path": "src/plugins/expressions/common/expression_functions/specs/overall_metric.ts", "deprecated": false diff --git a/api_docs/expressions.mdx b/api_docs/expressions.mdx index 863a44e1db472..8470b4f8a9643 100644 --- a/api_docs/expressions.mdx +++ b/api_docs/expressions.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/expressions title: "expressions" image: https://source.unsplash.com/400x175/?github summary: API docs for the expressions plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressions'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/features.mdx b/api_docs/features.mdx index 4d44d85f5af35..19443c000875b 100644 --- a/api_docs/features.mdx +++ b/api_docs/features.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/features title: "features" image: https://source.unsplash.com/400x175/?github summary: API docs for the features plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'features'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/field_formats.devdocs.json b/api_docs/field_formats.devdocs.json index fbe312ee376af..3128c6077b0c5 100644 --- a/api_docs/field_formats.devdocs.json +++ b/api_docs/field_formats.devdocs.json @@ -4807,7 +4807,7 @@ "label": "FieldFormatsContentType", "description": [], "signature": [ - "\"text\" | \"html\"" + "\"html\" | \"text\"" ], "path": "src/plugins/field_formats/common/types.ts", "deprecated": false, @@ -5083,7 +5083,7 @@ "label": "HTML_CONTEXT_TYPE", "description": [], "signature": [ - "\"text\" | \"html\"" + "\"html\" | \"text\"" ], "path": "src/plugins/field_formats/common/content_types/html_content_type.ts", "deprecated": false, @@ -5361,7 +5361,7 @@ "label": "TEXT_CONTEXT_TYPE", "description": [], "signature": [ - "\"text\" | \"html\"" + "\"html\" | \"text\"" ], "path": "src/plugins/field_formats/common/content_types/text_content_type.ts", "deprecated": false, diff --git a/api_docs/field_formats.mdx b/api_docs/field_formats.mdx index a3755ab95d7cd..41c16cfcde6a2 100644 --- a/api_docs/field_formats.mdx +++ b/api_docs/field_formats.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/fieldFormats title: "fieldFormats" image: https://source.unsplash.com/400x175/?github summary: API docs for the fieldFormats plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fieldFormats'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/file_upload.mdx b/api_docs/file_upload.mdx index 599bcb60fba89..5361e280670e0 100644 --- a/api_docs/file_upload.mdx +++ b/api_docs/file_upload.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/fileUpload title: "fileUpload" image: https://source.unsplash.com/400x175/?github summary: API docs for the fileUpload plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fileUpload'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/fleet.devdocs.json b/api_docs/fleet.devdocs.json index 8ba2cf8a6aba9..71cb3650bbbce 100644 --- a/api_docs/fleet.devdocs.json +++ b/api_docs/fleet.devdocs.json @@ -20773,7 +20773,7 @@ "section": "def-common.PackageSpecCategory", "text": "PackageSpecCategory" }, - " | undefined)[] | undefined; name: string; version: string; path: string; internal?: boolean | undefined; data_streams?: ", + " | undefined)[] | undefined; name: string; version: string; internal?: boolean | undefined; path: string; data_streams?: ", { "pluginId": "fleet", "scope": "common", diff --git a/api_docs/fleet.mdx b/api_docs/fleet.mdx index aa74d88d6aa16..35b1cf07adef1 100644 --- a/api_docs/fleet.mdx +++ b/api_docs/fleet.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/fleet title: "fleet" image: https://source.unsplash.com/400x175/?github summary: API docs for the fleet plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fleet'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/global_search.mdx b/api_docs/global_search.mdx index 6c2c5d2889d0f..9f756367f808c 100644 --- a/api_docs/global_search.mdx +++ b/api_docs/global_search.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/globalSearch title: "globalSearch" image: https://source.unsplash.com/400x175/?github summary: API docs for the globalSearch plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'globalSearch'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/home.mdx b/api_docs/home.mdx index 77a51505a2f61..ba9950de8c4df 100644 --- a/api_docs/home.mdx +++ b/api_docs/home.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/home title: "home" image: https://source.unsplash.com/400x175/?github summary: API docs for the home plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'home'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/index_lifecycle_management.mdx b/api_docs/index_lifecycle_management.mdx index 8fae7c156a419..4b3d1ee7c566a 100644 --- a/api_docs/index_lifecycle_management.mdx +++ b/api_docs/index_lifecycle_management.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/indexLifecycleManagement title: "indexLifecycleManagement" image: https://source.unsplash.com/400x175/?github summary: API docs for the indexLifecycleManagement plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexLifecycleManagement'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/index_management.devdocs.json b/api_docs/index_management.devdocs.json index 72a707f85e60e..93ffcfc2fe1f4 100644 --- a/api_docs/index_management.devdocs.json +++ b/api_docs/index_management.devdocs.json @@ -2411,7 +2411,7 @@ "label": "MAJOR_VERSION", "description": [], "signature": [ - "\"8.2.0\"" + "\"8.3.0\"" ], "path": "x-pack/plugins/index_management/common/constants/plugin.ts", "deprecated": false, diff --git a/api_docs/index_management.mdx b/api_docs/index_management.mdx index 7fcaa9e14541d..9350e37eebf19 100644 --- a/api_docs/index_management.mdx +++ b/api_docs/index_management.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/indexManagement title: "indexManagement" image: https://source.unsplash.com/400x175/?github summary: API docs for the indexManagement plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexManagement'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/infra.devdocs.json b/api_docs/infra.devdocs.json index ea811c16216ce..958899c4c8def 100644 --- a/api_docs/infra.devdocs.json +++ b/api_docs/infra.devdocs.json @@ -307,7 +307,7 @@ "tags": [], "label": "InfraConfig", "description": [], - "path": "x-pack/plugins/infra/server/types.ts", + "path": "x-pack/plugins/infra/common/plugin_config_types.ts", "deprecated": false, "children": [ { @@ -320,7 +320,7 @@ "signature": [ "{ inventory_threshold: { group_by_page_size: number; }; metric_threshold: { group_by_page_size: number; }; }" ], - "path": "x-pack/plugins/infra/server/types.ts", + "path": "x-pack/plugins/infra/common/plugin_config_types.ts", "deprecated": false }, { @@ -333,7 +333,7 @@ "signature": [ "{ compositeSize: number; }" ], - "path": "x-pack/plugins/infra/server/types.ts", + "path": "x-pack/plugins/infra/common/plugin_config_types.ts", "deprecated": false }, { @@ -346,7 +346,7 @@ "signature": [ "{ default?: { fields?: { message?: string[] | undefined; } | undefined; } | undefined; } | undefined" ], - "path": "x-pack/plugins/infra/server/types.ts", + "path": "x-pack/plugins/infra/common/plugin_config_types.ts", "deprecated": false } ], @@ -380,7 +380,7 @@ "tags": [], "label": "InfraPluginSetup", "description": [], - "path": "x-pack/plugins/infra/server/plugin.ts", + "path": "x-pack/plugins/infra/server/types.ts", "deprecated": false, "children": [ { @@ -395,7 +395,7 @@ "InfraStaticSourceConfiguration", ") => void" ], - "path": "x-pack/plugins/infra/server/plugin.ts", + "path": "x-pack/plugins/infra/server/types.ts", "deprecated": false, "children": [ { @@ -408,7 +408,7 @@ "signature": [ "string" ], - "path": "x-pack/plugins/infra/server/plugin.ts", + "path": "x-pack/plugins/infra/server/types.ts", "deprecated": false, "isRequired": true }, @@ -422,16 +422,56 @@ "signature": [ "InfraStaticSourceConfiguration" ], - "path": "x-pack/plugins/infra/server/plugin.ts", + "path": "x-pack/plugins/infra/server/types.ts", "deprecated": false, "isRequired": true } ], "returnComment": [] + }, + { + "parentPluginId": "infra", + "id": "def-server.InfraPluginSetup.logViews", + "type": "Object", + "tags": [], + "label": "logViews", + "description": [], + "signature": [ + "LogViewsServiceSetup" + ], + "path": "x-pack/plugins/infra/server/types.ts", + "deprecated": false } ], "lifecycle": "setup", "initialIsOpen": true + }, + "start": { + "parentPluginId": "infra", + "id": "def-server.InfraPluginStart", + "type": "Interface", + "tags": [], + "label": "InfraPluginStart", + "description": [], + "path": "x-pack/plugins/infra/server/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "infra", + "id": "def-server.InfraPluginStart.logViews", + "type": "Object", + "tags": [], + "label": "logViews", + "description": [], + "signature": [ + "LogViewsServiceStart" + ], + "path": "x-pack/plugins/infra/server/types.ts", + "deprecated": false + } + ], + "lifecycle": "start", + "initialIsOpen": true } }, "common": { diff --git a/api_docs/infra.mdx b/api_docs/infra.mdx index 7c6a88d9dd1bd..1ad1b38648945 100644 --- a/api_docs/infra.mdx +++ b/api_docs/infra.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/infra title: "infra" image: https://source.unsplash.com/400x175/?github summary: API docs for the infra plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'infra'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Logs and Metrics UI](https://github.com/orgs/elastic/teams/logs-metrics | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 28 | 0 | 25 | 3 | +| 31 | 0 | 28 | 5 | ## Client @@ -42,6 +42,9 @@ Contact [Logs and Metrics UI](https://github.com/orgs/elastic/teams/logs-metrics ### Setup +### Start + + ### Interfaces diff --git a/api_docs/inspector.mdx b/api_docs/inspector.mdx index baaa6001edb0b..5ebe20d7baa93 100644 --- a/api_docs/inspector.mdx +++ b/api_docs/inspector.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/inspector title: "inspector" image: https://source.unsplash.com/400x175/?github summary: API docs for the inspector plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'inspector'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/interactive_setup.mdx b/api_docs/interactive_setup.mdx index cfa5fe0702a66..2e1ad77a61fb9 100644 --- a/api_docs/interactive_setup.mdx +++ b/api_docs/interactive_setup.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/interactiveSetup title: "interactiveSetup" image: https://source.unsplash.com/400x175/?github summary: API docs for the interactiveSetup plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'interactiveSetup'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_ace.mdx b/api_docs/kbn_ace.mdx index 8524b1aca18ed..28ed37ce7ba84 100644 --- a/api_docs/kbn_ace.mdx +++ b/api_docs/kbn_ace.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-ace title: "@kbn/ace" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/ace plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ace'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_alerts.mdx b/api_docs/kbn_alerts.mdx index 2c6c02ddf0c50..feba71871e675 100644 --- a/api_docs/kbn_alerts.mdx +++ b/api_docs/kbn_alerts.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-alerts title: "@kbn/alerts" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/alerts plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_analytics.mdx b/api_docs/kbn_analytics.mdx index 3c94f10dda196..523542b3a852d 100644 --- a/api_docs/kbn_analytics.mdx +++ b/api_docs/kbn_analytics.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-analytics title: "@kbn/analytics" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/analytics plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_apm_config_loader.mdx b/api_docs/kbn_apm_config_loader.mdx index 4c5f60105cffd..2ed7dbdbfda88 100644 --- a/api_docs/kbn_apm_config_loader.mdx +++ b/api_docs/kbn_apm_config_loader.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-apm-config-loader title: "@kbn/apm-config-loader" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/apm-config-loader plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-config-loader'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_apm_utils.mdx b/api_docs/kbn_apm_utils.mdx index a6896c0760e1b..49fb44941d1dc 100644 --- a/api_docs/kbn_apm_utils.mdx +++ b/api_docs/kbn_apm_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-apm-utils title: "@kbn/apm-utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/apm-utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_axe_config.mdx b/api_docs/kbn_axe_config.mdx index c581f469cc98f..6acea95d20cc4 100644 --- a/api_docs/kbn_axe_config.mdx +++ b/api_docs/kbn_axe_config.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-axe-config title: "@kbn/axe-config" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/axe-config plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/axe-config'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_bazel_packages.mdx b/api_docs/kbn_bazel_packages.mdx index 5cc63c34e7baf..4cecba08dd051 100644 --- a/api_docs/kbn_bazel_packages.mdx +++ b/api_docs/kbn_bazel_packages.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-bazel-packages title: "@kbn/bazel-packages" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/bazel-packages plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/bazel-packages'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_cli_dev_mode.mdx b/api_docs/kbn_cli_dev_mode.mdx index da89161857ca8..c3491abc76979 100644 --- a/api_docs/kbn_cli_dev_mode.mdx +++ b/api_docs/kbn_cli_dev_mode.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-cli-dev-mode title: "@kbn/cli-dev-mode" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/cli-dev-mode plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cli-dev-mode'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_config.mdx b/api_docs/kbn_config.mdx index f7e9c775f6fbb..ae52de0962bce 100644 --- a/api_docs/kbn_config.mdx +++ b/api_docs/kbn_config.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-config title: "@kbn/config" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/config plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_config_schema.mdx b/api_docs/kbn_config_schema.mdx index 6b1630ba7d9f5..2eebafa2279fe 100644 --- a/api_docs/kbn_config_schema.mdx +++ b/api_docs/kbn_config_schema.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-config-schema title: "@kbn/config-schema" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/config-schema plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-schema'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_crypto.mdx b/api_docs/kbn_crypto.mdx index 22258a34b16c4..de871c1b01bbd 100644 --- a/api_docs/kbn_crypto.mdx +++ b/api_docs/kbn_crypto.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-crypto title: "@kbn/crypto" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/crypto plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_dev_utils.devdocs.json b/api_docs/kbn_dev_utils.devdocs.json index df9555c477a97..c45d0515c0bb4 100644 --- a/api_docs/kbn_dev_utils.devdocs.json +++ b/api_docs/kbn_dev_utils.devdocs.json @@ -931,7 +931,7 @@ "label": "indent", "description": [], "signature": [ - "{ (delta: number): undefined; (delta: number, block: () => Promise): Promise; (delta: number, block: () => T): T; }" + "{ (delta: number): void; (delta: number, block: () => Promise): Promise; (delta: number, block: () => T): T; }" ], "path": "packages/kbn-dev-utils/src/tooling_log/tooling_log.ts", "deprecated": false, diff --git a/api_docs/kbn_dev_utils.mdx b/api_docs/kbn_dev_utils.mdx index d9a845b2dcc84..39d04687e47e7 100644 --- a/api_docs/kbn_dev_utils.mdx +++ b/api_docs/kbn_dev_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-dev-utils title: "@kbn/dev-utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/dev-utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_doc_links.mdx b/api_docs/kbn_doc_links.mdx index 6e55a17479915..3f83c0371ca56 100644 --- a/api_docs/kbn_doc_links.mdx +++ b/api_docs/kbn_doc_links.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-doc-links title: "@kbn/doc-links" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/doc-links plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/doc-links'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_docs_utils.mdx b/api_docs/kbn_docs_utils.mdx index 8211548cab2d7..a2568bc87ea2a 100644 --- a/api_docs/kbn_docs_utils.mdx +++ b/api_docs/kbn_docs_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-docs-utils title: "@kbn/docs-utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/docs-utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/docs-utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_es_archiver.mdx b/api_docs/kbn_es_archiver.mdx index c487e83164c17..965ed6526f6a9 100644 --- a/api_docs/kbn_es_archiver.mdx +++ b/api_docs/kbn_es_archiver.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-es-archiver title: "@kbn/es-archiver" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/es-archiver plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-archiver'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_es_query.devdocs.json b/api_docs/kbn_es_query.devdocs.json index 3383877678249..a1d716484b793 100644 --- a/api_docs/kbn_es_query.devdocs.json +++ b/api_docs/kbn_es_query.devdocs.json @@ -3420,7 +3420,7 @@ "label": "function", "description": [], "signature": [ - "\"nested\" | \"is\" | \"exists\" | \"and\" | \"or\" | \"range\" | \"not\"" + "\"nested\" | \"exists\" | \"and\" | \"or\" | \"is\" | \"range\" | \"not\"" ], "path": "packages/kbn-es-query/src/kuery/node_types/types.ts", "deprecated": false diff --git a/api_docs/kbn_es_query.mdx b/api_docs/kbn_es_query.mdx index f707fc2f8fbfb..3c39bf2f5d09d 100644 --- a/api_docs/kbn_es_query.mdx +++ b/api_docs/kbn_es_query.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-es-query title: "@kbn/es-query" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/es-query plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-query'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_eslint_plugin_imports.devdocs.json b/api_docs/kbn_eslint_plugin_imports.devdocs.json new file mode 100644 index 0000000000000..47400f2102348 --- /dev/null +++ b/api_docs/kbn_eslint_plugin_imports.devdocs.json @@ -0,0 +1,244 @@ +{ + "id": "@kbn/eslint-plugin-imports", + "client": { + "classes": [], + "functions": [], + "interfaces": [], + "enums": [], + "misc": [], + "objects": [] + }, + "server": { + "classes": [], + "functions": [ + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.resolveKibanaImport", + "type": "Function", + "tags": [], + "label": "resolveKibanaImport", + "description": [ + "\nResolve an import request. All import requests in the repository should return a result, if they don't it's a bug\nwhich should be caught by the `@kbn/import/no_unresolved` rule, which should never be disabled. If you need help\nadding support for an import style please reach out to operations.\n" + ], + "signature": [ + "(req: string, dirname: string) => ", + { + "pluginId": "@kbn/eslint-plugin-imports", + "scope": "server", + "docId": "kibKbnEslintPluginImportsPluginApi", + "section": "def-server.ResolveResult", + "text": "ResolveResult" + }, + " | null" + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_kibana_import.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.resolveKibanaImport.$1", + "type": "string", + "tags": [], + "label": "req", + "description": [ + "Text from an import/require, like `../../src/core/public` or `@kbn/std`" + ], + "signature": [ + "string" + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_kibana_import.ts", + "deprecated": false, + "isRequired": true + }, + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.resolveKibanaImport.$2", + "type": "string", + "tags": [], + "label": "dirname", + "description": [ + "The directory of the file where the req was found" + ], + "signature": [ + "string" + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_kibana_import.ts", + "deprecated": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + } + ], + "interfaces": [ + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.FileResult", + "type": "Interface", + "tags": [], + "label": "FileResult", + "description": [ + "\nResolution result indicating that the import resolves to a specific file, possible in a nodeModule, with\nthe path of that file and the name of the nodeModule if applicable" + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_result.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.FileResult.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "signature": [ + "\"file\"" + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_result.ts", + "deprecated": false + }, + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.FileResult.absolute", + "type": "string", + "tags": [], + "label": "absolute", + "description": [], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_result.ts", + "deprecated": false + }, + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.FileResult.nodeModule", + "type": "string", + "tags": [], + "label": "nodeModule", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_result.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.IgnoreResult", + "type": "Interface", + "tags": [], + "label": "IgnoreResult", + "description": [ + "\nResolution result indicating that the import request can't be resolved, but it shouldn't need to be\nbecause the file that is imported can't be resolved from the source alone, usually because it is explicitly\nimporting a build asset. Import requests which meet this criteria are manually added to the resolver and\ncan be trusted to exist after the build it complete or in their used location." + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_result.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.IgnoreResult.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "signature": [ + "\"ignore\"" + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_result.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.TypesResult", + "type": "Interface", + "tags": [], + "label": "TypesResult", + "description": [ + "\nResolution result indicating that the import only resolves to an @types package, including the name of\nthe @types package. We don't validate the sub-path of these import strings and assume that TS will validate\nthem, we just need to know that they don't map to actual files on the filesystem or modules which will\nend up in the build or running code." + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_result.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.TypesResult.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "signature": [ + "\"@types\"" + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_result.ts", + "deprecated": false + }, + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.TypesResult.module", + "type": "string", + "tags": [], + "label": "module", + "description": [], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_result.ts", + "deprecated": false + } + ], + "initialIsOpen": false + } + ], + "enums": [], + "misc": [ + { + "parentPluginId": "@kbn/eslint-plugin-imports", + "id": "def-server.ResolveResult", + "type": "Type", + "tags": [], + "label": "ResolveResult", + "description": [ + "\nPossible resolve result types" + ], + "signature": [ + { + "pluginId": "@kbn/eslint-plugin-imports", + "scope": "server", + "docId": "kibKbnEslintPluginImportsPluginApi", + "section": "def-server.IgnoreResult", + "text": "IgnoreResult" + }, + " | ", + { + "pluginId": "@kbn/eslint-plugin-imports", + "scope": "server", + "docId": "kibKbnEslintPluginImportsPluginApi", + "section": "def-server.TypesResult", + "text": "TypesResult" + }, + " | ", + { + "pluginId": "@kbn/eslint-plugin-imports", + "scope": "server", + "docId": "kibKbnEslintPluginImportsPluginApi", + "section": "def-server.FileResult", + "text": "FileResult" + } + ], + "path": "packages/kbn-eslint-plugin-imports/src/resolve_result.ts", + "deprecated": false, + "initialIsOpen": false + } + ], + "objects": [] + }, + "common": { + "classes": [], + "functions": [], + "interfaces": [], + "enums": [], + "misc": [], + "objects": [] + } +} \ No newline at end of file diff --git a/api_docs/kbn_eslint_plugin_imports.mdx b/api_docs/kbn_eslint_plugin_imports.mdx new file mode 100644 index 0000000000000..b1469acd5ce18 --- /dev/null +++ b/api_docs/kbn_eslint_plugin_imports.mdx @@ -0,0 +1,33 @@ +--- +id: kibKbnEslintPluginImportsPluginApi +slug: /kibana-dev-docs/api/kbn-eslint-plugin-imports +title: "@kbn/eslint-plugin-imports" +image: https://source.unsplash.com/400x175/?github +summary: API docs for the @kbn/eslint-plugin-imports plugin +date: 2022-04-05 +tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/eslint-plugin-imports'] +warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. +--- +import kbnEslintPluginImportsObj from './kbn_eslint_plugin_imports.devdocs.json'; + + + +Contact [Owner missing] for questions regarding this plugin. + +**Code health stats** + +| Public API count | Any count | Items lacking comments | Missing exports | +|-------------------|-----------|------------------------|-----------------| +| 13 | 0 | 6 | 0 | + +## Server + +### Functions + + +### Interfaces + + +### Consts, variables and types + + diff --git a/api_docs/kbn_field_types.mdx b/api_docs/kbn_field_types.mdx index b9cbc692a6d38..b100124a4b173 100644 --- a/api_docs/kbn_field_types.mdx +++ b/api_docs/kbn_field_types.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-field-types title: "@kbn/field-types" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/field-types plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-types'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_generate.mdx b/api_docs/kbn_generate.mdx index 8281ef3900b76..f678ebba804cc 100644 --- a/api_docs/kbn_generate.mdx +++ b/api_docs/kbn_generate.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-generate title: "@kbn/generate" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/generate plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_i18n.mdx b/api_docs/kbn_i18n.mdx index c297ad3c1e7c8..cadd77a894b98 100644 --- a/api_docs/kbn_i18n.mdx +++ b/api_docs/kbn_i18n.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-i18n title: "@kbn/i18n" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/i18n plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_interpreter.mdx b/api_docs/kbn_interpreter.mdx index 176d35992aaf2..d07e5a0a44859 100644 --- a/api_docs/kbn_interpreter.mdx +++ b/api_docs/kbn_interpreter.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-interpreter title: "@kbn/interpreter" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/interpreter plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/interpreter'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_io_ts_utils.mdx b/api_docs/kbn_io_ts_utils.mdx index f5a4cd10806f4..2e6530549dee3 100644 --- a/api_docs/kbn_io_ts_utils.mdx +++ b/api_docs/kbn_io_ts_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-io-ts-utils title: "@kbn/io-ts-utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/io-ts-utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/io-ts-utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_logging.devdocs.json b/api_docs/kbn_logging.devdocs.json index 574eac0a280ca..f9bca4daaf11f 100644 --- a/api_docs/kbn_logging.devdocs.json +++ b/api_docs/kbn_logging.devdocs.json @@ -658,7 +658,7 @@ "label": "EcsEventType", "description": [], "signature": [ - "\"start\" | \"user\" | \"error\" | \"end\" | \"info\" | \"group\" | \"protocol\" | \"connection\" | \"access\" | \"admin\" | \"allowed\" | \"change\" | \"creation\" | \"deletion\" | \"denied\" | \"installation\"" + "\"start\" | \"user\" | \"error\" | \"info\" | \"group\" | \"end\" | \"protocol\" | \"connection\" | \"access\" | \"admin\" | \"allowed\" | \"change\" | \"creation\" | \"deletion\" | \"denied\" | \"installation\"" ], "path": "packages/kbn-logging/src/ecs/event.ts", "deprecated": false, diff --git a/api_docs/kbn_logging.mdx b/api_docs/kbn_logging.mdx index 35a0dbcaba0ee..071f96e712bb7 100644 --- a/api_docs/kbn_logging.mdx +++ b/api_docs/kbn_logging.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-logging title: "@kbn/logging" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/logging plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_logging_mocks.mdx b/api_docs/kbn_logging_mocks.mdx index ff3514367615d..3eee38ebb640b 100644 --- a/api_docs/kbn_logging_mocks.mdx +++ b/api_docs/kbn_logging_mocks.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-logging-mocks title: "@kbn/logging-mocks" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/logging-mocks plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging-mocks'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_mapbox_gl.mdx b/api_docs/kbn_mapbox_gl.mdx index 3663a185e3ac5..53aa377e5c7a7 100644 --- a/api_docs/kbn_mapbox_gl.mdx +++ b/api_docs/kbn_mapbox_gl.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-mapbox-gl title: "@kbn/mapbox-gl" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/mapbox-gl plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/mapbox-gl'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_monaco.mdx b/api_docs/kbn_monaco.mdx index 5c6ee5f3e07ea..71a68c280f4c4 100644 --- a/api_docs/kbn_monaco.mdx +++ b/api_docs/kbn_monaco.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-monaco title: "@kbn/monaco" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/monaco plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/monaco'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_optimizer.mdx b/api_docs/kbn_optimizer.mdx index ea11a5271d5ff..2a473e955b4f0 100644 --- a/api_docs/kbn_optimizer.mdx +++ b/api_docs/kbn_optimizer.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer title: "@kbn/optimizer" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/optimizer plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_plugin_discovery.mdx b/api_docs/kbn_plugin_discovery.mdx index 6c7d41ca33a6f..0bdfc493aa7d4 100644 --- a/api_docs/kbn_plugin_discovery.mdx +++ b/api_docs/kbn_plugin_discovery.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-discovery title: "@kbn/plugin-discovery" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/plugin-discovery plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-discovery'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_plugin_generator.mdx b/api_docs/kbn_plugin_generator.mdx index ed201ea462591..6803a60cd1d81 100644 --- a/api_docs/kbn_plugin_generator.mdx +++ b/api_docs/kbn_plugin_generator.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-generator title: "@kbn/plugin-generator" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/plugin-generator plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-generator'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_plugin_helpers.mdx b/api_docs/kbn_plugin_helpers.mdx index 4aa241720feb3..b549f24fa74fa 100644 --- a/api_docs/kbn_plugin_helpers.mdx +++ b/api_docs/kbn_plugin_helpers.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-helpers title: "@kbn/plugin-helpers" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/plugin-helpers plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-helpers'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_pm.mdx b/api_docs/kbn_pm.mdx index 3c2e74728224f..c71a8c2a1e351 100644 --- a/api_docs/kbn_pm.mdx +++ b/api_docs/kbn_pm.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-pm title: "@kbn/pm" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/pm plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/pm'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_react_field.mdx b/api_docs/kbn_react_field.mdx index 11e47015b2828..5ada92c6138c5 100644 --- a/api_docs/kbn_react_field.mdx +++ b/api_docs/kbn_react_field.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-react-field title: "@kbn/react-field" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/react-field plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-field'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_rule_data_utils.devdocs.json b/api_docs/kbn_rule_data_utils.devdocs.json index 743f776125f2f..0d1b639b9f508 100644 --- a/api_docs/kbn_rule_data_utils.devdocs.json +++ b/api_docs/kbn_rule_data_utils.devdocs.json @@ -973,7 +973,7 @@ "label": "STATUS_VALUES", "description": [], "signature": [ - "\"open\" | \"in-progress\" | \"acknowledged\" | \"closed\"" + "\"open\" | \"closed\" | \"in-progress\" | \"acknowledged\"" ], "path": "packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts", "deprecated": false, diff --git a/api_docs/kbn_rule_data_utils.mdx b/api_docs/kbn_rule_data_utils.mdx index d7ed74e8e69eb..13068a7957a81 100644 --- a/api_docs/kbn_rule_data_utils.mdx +++ b/api_docs/kbn_rule_data_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-rule-data-utils title: "@kbn/rule-data-utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/rule-data-utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rule-data-utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_autocomplete.devdocs.json b/api_docs/kbn_securitysolution_autocomplete.devdocs.json index 993affe204eae..ee08de8665996 100644 --- a/api_docs/kbn_securitysolution_autocomplete.devdocs.json +++ b/api_docs/kbn_securitysolution_autocomplete.devdocs.json @@ -305,9 +305,9 @@ "\nGiven an array of lists and optionally a field this will return all\nthe lists that match against the field based on the types from the field\n\nNOTE: That we support one additional property from \"FieldSpec\" located here:\nsrc/plugins/data/common/index_patterns/fields/types.ts\nThis type property is esTypes. If it exists and is on there we will read off the esTypes." ], "signature": [ - "(lists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[], field?: (", + "(lists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[], field?: (", "DataViewFieldBase", - " & { esTypes?: string[] | undefined; }) | undefined) => { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]" + " & { esTypes?: string[] | undefined; }) | undefined) => { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]" ], "path": "packages/kbn-securitysolution-autocomplete/src/filter_field_to_list/index.ts", "deprecated": false, @@ -322,7 +322,7 @@ "The lists to match against the field" ], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]" + "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]" ], "path": "packages/kbn-securitysolution-autocomplete/src/filter_field_to_list/index.ts", "deprecated": false, diff --git a/api_docs/kbn_securitysolution_autocomplete.mdx b/api_docs/kbn_securitysolution_autocomplete.mdx index d955f4c0d5a8e..c2866fcd43b3f 100644 --- a/api_docs/kbn_securitysolution_autocomplete.mdx +++ b/api_docs/kbn_securitysolution_autocomplete.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-autocomplete title: "@kbn/securitysolution-autocomplete" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-autocomplete plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-autocomplete'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_es_utils.devdocs.json b/api_docs/kbn_securitysolution_es_utils.devdocs.json index 06b914a4aeee5..4f614b716c4d1 100644 --- a/api_docs/kbn_securitysolution_es_utils.devdocs.json +++ b/api_docs/kbn_securitysolution_es_utils.devdocs.json @@ -429,7 +429,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -439,7 +439,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -447,7 +447,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -459,7 +459,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -469,7 +469,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -477,7 +477,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -485,7 +485,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -495,7 +495,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -503,7 +503,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -582,9 +582,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -713,7 +711,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -723,7 +721,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -731,7 +729,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -739,7 +737,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -749,7 +747,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -757,7 +755,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -828,29 +826,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -1193,7 +1191,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -1203,7 +1201,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -1211,7 +1209,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -1238,29 +1236,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -1516,6 +1514,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", @@ -1671,7 +1671,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -1681,7 +1681,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -1689,7 +1689,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -1701,7 +1701,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -1711,7 +1711,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -1719,7 +1719,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -1727,7 +1727,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -1737,7 +1737,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -1745,7 +1745,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -1824,9 +1824,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -1955,7 +1953,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -1965,7 +1963,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -1973,7 +1971,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -1981,7 +1979,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -1991,7 +1989,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -1999,7 +1997,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -2070,29 +2068,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -2435,7 +2433,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -2445,7 +2443,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -2453,7 +2451,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -2480,29 +2478,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -2758,6 +2756,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", diff --git a/api_docs/kbn_securitysolution_es_utils.mdx b/api_docs/kbn_securitysolution_es_utils.mdx index 3eb2456084466..ed7d867290493 100644 --- a/api_docs/kbn_securitysolution_es_utils.mdx +++ b/api_docs/kbn_securitysolution_es_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-es-utils title: "@kbn/securitysolution-es-utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-es-utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-es-utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_hook_utils.mdx b/api_docs/kbn_securitysolution_hook_utils.mdx index 7c7113c0acc2d..41a05b8d05265 100644 --- a/api_docs/kbn_securitysolution_hook_utils.mdx +++ b/api_docs/kbn_securitysolution_hook_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-hook-utils title: "@kbn/securitysolution-hook-utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-hook-utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-hook-utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_io_ts_alerting_types.devdocs.json b/api_docs/kbn_securitysolution_io_ts_alerting_types.devdocs.json index 5ee0ce30bc831..91614a6831f7c 100644 --- a/api_docs/kbn_securitysolution_io_ts_alerting_types.devdocs.json +++ b/api_docs/kbn_securitysolution_io_ts_alerting_types.devdocs.json @@ -216,7 +216,7 @@ "label": "Language", "description": [], "signature": [ - "\"eql\" | \"lucene\" | \"kuery\"" + "\"eql\" | \"kuery\" | \"lucene\"" ], "path": "packages/kbn-securitysolution-io-ts-alerting-types/src/language/index.ts", "deprecated": false, @@ -230,7 +230,7 @@ "label": "LanguageOrUndefined", "description": [], "signature": [ - "\"eql\" | \"lucene\" | \"kuery\" | undefined" + "\"eql\" | \"kuery\" | \"lucene\" | undefined" ], "path": "packages/kbn-securitysolution-io-ts-alerting-types/src/language/index.ts", "deprecated": false, @@ -622,7 +622,7 @@ "label": "ThreatLanguage", "description": [], "signature": [ - "\"eql\" | \"lucene\" | \"kuery\" | undefined" + "\"eql\" | \"kuery\" | \"lucene\" | undefined" ], "path": "packages/kbn-securitysolution-io-ts-alerting-types/src/threat_mapping/index.ts", "deprecated": false, @@ -636,7 +636,7 @@ "label": "ThreatLanguageOrUndefined", "description": [], "signature": [ - "\"eql\" | \"lucene\" | \"kuery\" | undefined" + "\"eql\" | \"kuery\" | \"lucene\" | undefined" ], "path": "packages/kbn-securitysolution-io-ts-alerting-types/src/threat_mapping/index.ts", "deprecated": false, @@ -932,7 +932,7 @@ ], "label": "action_group", "description": [ - "\nParams is an \"object\", since it is a type of AlertActionParams which is action templates." + "\nParams is an \"object\", since it is a type of RuleActionParams which is action templates." ], "signature": [ "StringC" diff --git a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx index fb537b08780a2..bb61fa2b22770 100644 --- a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx +++ b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-alerting-types title: "@kbn/securitysolution-io-ts-alerting-types" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-io-ts-alerting-types plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-alerting-types'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json b/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json index 512f130f72ef4..f3b10dd30d340 100644 --- a/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json +++ b/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json @@ -27,7 +27,7 @@ "label": "updateExceptionListItemValidate", "description": [], "signature": [ - "(schema: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]" + "(schema: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts", "deprecated": false, @@ -40,7 +40,7 @@ "label": "schema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts", "deprecated": false, @@ -58,7 +58,7 @@ "label": "validateComments", "description": [], "signature": [ - "(item: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]" + "(item: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts", "deprecated": false, @@ -71,7 +71,7 @@ "label": "item", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts", "deprecated": false, @@ -153,7 +153,7 @@ "label": "listItem", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts", "deprecated": false @@ -1216,7 +1216,7 @@ "label": "listItem", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts", "deprecated": false @@ -1307,7 +1307,7 @@ "label": "exceptions", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts", "deprecated": false @@ -1897,7 +1897,7 @@ "label": "CreateEndpointListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"os_types\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"os_types\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_endpoint_list_item_schema/index.ts", "deprecated": false, @@ -1925,7 +1925,7 @@ "label": "CreateExceptionListItemSchema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts", "deprecated": false, @@ -1939,7 +1939,7 @@ "label": "CreateExceptionListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts", "deprecated": false, @@ -2009,7 +2009,7 @@ "label": "CreateListSchema", "description": [], "signature": [ - "{ description: string; name: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; } & { deserializer?: string | undefined; id?: string | undefined; meta?: object | undefined; serializer?: string | undefined; version?: number | undefined; }" + "{ description: string; name: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; } & { deserializer?: string | undefined; id?: string | undefined; meta?: object | undefined; serializer?: string | undefined; version?: number | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_list_schema/index.ts", "deprecated": false, @@ -2023,7 +2023,7 @@ "label": "CreateListSchemaDecoded", "description": [], "signature": [ - "{ type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; id: string | undefined; description: string; name: string; meta: object | undefined; serializer: string | undefined; deserializer: string | undefined; } & { version: number; }" + "{ type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; id: string | undefined; description: string; name: string; meta: object | undefined; serializer: string | undefined; deserializer: string | undefined; } & { version: number; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_list_schema/index.ts", "deprecated": false, @@ -2317,7 +2317,7 @@ "label": "EntriesArray", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries/index.ts", "deprecated": false, @@ -2331,7 +2331,7 @@ "label": "EntriesArrayOrUndefined", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[] | undefined" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[] | undefined" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries/index.ts", "deprecated": false, @@ -2345,7 +2345,7 @@ "label": "Entry", "description": [], "signature": [ - "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }" + "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries/index.ts", "deprecated": false, @@ -2373,7 +2373,7 @@ "label": "EntryList", "description": [], "signature": [ - "{ field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; }" + "{ field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries_list/index.ts", "deprecated": false, @@ -2443,7 +2443,7 @@ "label": "ExceptionListItemSchema", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.ts", "deprecated": false, @@ -2765,7 +2765,7 @@ "label": "FoundExceptionListItemSchema", "description": [], "signature": [ - "{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }" + "{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_exception_list_item_schema/index.ts", "deprecated": false, @@ -2793,7 +2793,7 @@ "label": "FoundListItemSchema", "description": [], "signature": [ - "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; }" + "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_list_item_schema/index.ts", "deprecated": false, @@ -2807,7 +2807,7 @@ "label": "FoundListSchema", "description": [], "signature": [ - "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }" + "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_list_schema/index.ts", "deprecated": false, @@ -2919,7 +2919,7 @@ "label": "ImportExceptionListItemSchema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts", "deprecated": false, @@ -2933,7 +2933,7 @@ "label": "ImportExceptionListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts", "deprecated": false, @@ -2989,7 +2989,7 @@ "label": "ImportListItemQuerySchema", "description": [], "signature": [ - "{ deserializer: string | undefined; list_id: string | undefined; serializer: string | undefined; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\" | undefined; }" + "{ deserializer: string | undefined; list_id: string | undefined; serializer: string | undefined; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\" | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_list_item_query_schema/index.ts", "deprecated": false, @@ -3003,7 +3003,7 @@ "label": "ImportListItemQuerySchemaEncoded", "description": [], "signature": [ - "{ deserializer?: string | undefined; list_id?: string | undefined; serializer?: string | undefined; type?: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\" | undefined; }" + "{ deserializer?: string | undefined; list_id?: string | undefined; serializer?: string | undefined; type?: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\" | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_list_item_query_schema/index.ts", "deprecated": false, @@ -3115,7 +3115,7 @@ "label": "ListArraySchema", "description": [], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]" + "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_schema/index.ts", "deprecated": false, @@ -3157,7 +3157,7 @@ "label": "ListItemArraySchema", "description": [], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]" + "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_item_schema/index.ts", "deprecated": false, @@ -3185,7 +3185,7 @@ "label": "ListItemSchema", "description": [], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }" + "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_item_schema/index.ts", "deprecated": false, @@ -3213,7 +3213,7 @@ "label": "ListSchema", "description": [], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }" + "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_schema/index.ts", "deprecated": false, @@ -3423,7 +3423,7 @@ "label": "NonEmptyEntriesArray", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/non_empty_entries_array/index.ts", "deprecated": false, @@ -3437,7 +3437,7 @@ "label": "NonEmptyEntriesArrayDecoded", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/non_empty_entries_array/index.ts", "deprecated": false, @@ -3829,7 +3829,7 @@ "label": "SearchListItemArraySchema", "description": [], "signature": [ - "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]" + "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/search_list_item_schema/index.ts", "deprecated": false, @@ -3843,7 +3843,7 @@ "label": "SearchListItemSchema", "description": [], "signature": [ - "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }" + "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/search_list_item_schema/index.ts", "deprecated": false, @@ -3983,7 +3983,7 @@ "label": "Type", "description": [], "signature": [ - "\"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"" + "\"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/type/index.ts", "deprecated": false, @@ -3997,7 +3997,7 @@ "label": "TypeOrUndefined", "description": [], "signature": [ - "\"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\" | undefined" + "\"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\" | undefined" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/type/index.ts", "deprecated": false, @@ -4053,7 +4053,7 @@ "label": "UpdateEndpointListItemSchema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts", "deprecated": false, @@ -4067,7 +4067,7 @@ "label": "UpdateEndpointListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts", "deprecated": false, @@ -4081,7 +4081,7 @@ "label": "UpdateExceptionListItemSchema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts", "deprecated": false, @@ -4095,7 +4095,7 @@ "label": "UpdateExceptionListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"namespace_type\" | \"os_types\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"namespace_type\" | \"os_types\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts", "deprecated": false, @@ -4628,7 +4628,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; list_id: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; list_id: ", "Type", "; name: ", "StringC", @@ -6914,7 +6914,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; item_id: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; item_id: ", "Type", "; list_id: ", "Type", @@ -7847,7 +7847,7 @@ ], "signature": [ "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>" + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/non_empty_entries_array/index.ts", "deprecated": false, @@ -8780,7 +8780,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; name: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; name: ", "StringC", "; type: ", "KeyofC", @@ -8833,7 +8833,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; name: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; })[], unknown>; name: ", "StringC", "; type: ", "KeyofC", diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.mdx b/api_docs/kbn_securitysolution_io_ts_list_types.mdx index b413aa92d307b..dd8f1bf8648d9 100644 --- a/api_docs/kbn_securitysolution_io_ts_list_types.mdx +++ b/api_docs/kbn_securitysolution_io_ts_list_types.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-list-types title: "@kbn/securitysolution-io-ts-list-types" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-io-ts-list-types plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-list-types'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_io_ts_types.mdx b/api_docs/kbn_securitysolution_io_ts_types.mdx index 6b9cd9cd10441..65d532fec19e4 100644 --- a/api_docs/kbn_securitysolution_io_ts_types.mdx +++ b/api_docs/kbn_securitysolution_io_ts_types.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-types title: "@kbn/securitysolution-io-ts-types" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-io-ts-types plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-types'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_io_ts_utils.mdx b/api_docs/kbn_securitysolution_io_ts_utils.mdx index 838812cd2861e..a5c39ba338990 100644 --- a/api_docs/kbn_securitysolution_io_ts_utils.mdx +++ b/api_docs/kbn_securitysolution_io_ts_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-utils title: "@kbn/securitysolution-io-ts-utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-io-ts-utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_list_api.devdocs.json b/api_docs/kbn_securitysolution_list_api.devdocs.json index a571fe8e84785..816e93b590a41 100644 --- a/api_docs/kbn_securitysolution_list_api.devdocs.json +++ b/api_docs/kbn_securitysolution_list_api.devdocs.json @@ -62,7 +62,7 @@ "signature": [ "({ http, listItem, signal, }: ", "AddExceptionListItemProps", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-api/src/api/index.ts", "deprecated": false, @@ -206,7 +206,7 @@ "signature": [ "({ http, id, namespaceType, signal, }: ", "ApiCallByIdProps", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-api/src/api/index.ts", "deprecated": false, @@ -245,7 +245,7 @@ "section": "def-common.DeleteListParams", "text": "DeleteListParams" }, - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "packages/kbn-securitysolution-list-api/src/list_api/index.ts", "deprecated": false, @@ -399,7 +399,7 @@ "signature": [ "({ http, id, namespaceType, signal, }: ", "ApiCallByIdProps", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-api/src/api/index.ts", "deprecated": false, @@ -432,7 +432,7 @@ "signature": [ "({ filterOptions, http, listIds, namespaceTypes, pagination, signal, }: ", "ApiCallByListIdProps", - ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }>" + ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }>" ], "path": "packages/kbn-securitysolution-list-api/src/api/index.ts", "deprecated": false, @@ -504,7 +504,7 @@ "section": "def-common.FindListsParams", "text": "FindListsParams" }, - ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" + ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" ], "path": "packages/kbn-securitysolution-list-api/src/list_api/index.ts", "deprecated": false, @@ -549,7 +549,7 @@ "section": "def-common.ImportListParams", "text": "ImportListParams" }, - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "packages/kbn-securitysolution-list-api/src/list_api/index.ts", "deprecated": false, @@ -743,7 +743,7 @@ "signature": [ "({ http, listItem, signal, }: ", "UpdateExceptionListItemProps", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-api/src/api/index.ts", "deprecated": false, @@ -1076,7 +1076,7 @@ "label": "type", "description": [], "signature": [ - "\"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\" | undefined" + "\"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\" | undefined" ], "path": "packages/kbn-securitysolution-list-api/src/list_api/types.ts", "deprecated": false diff --git a/api_docs/kbn_securitysolution_list_api.mdx b/api_docs/kbn_securitysolution_list_api.mdx index af6cd2a8f925f..0f81fc34f3478 100644 --- a/api_docs/kbn_securitysolution_list_api.mdx +++ b/api_docs/kbn_securitysolution_list_api.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-api title: "@kbn/securitysolution-list-api" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-list-api plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-api'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_list_constants.mdx b/api_docs/kbn_securitysolution_list_constants.mdx index ed74a8abf103c..698ac13af76d0 100644 --- a/api_docs/kbn_securitysolution_list_constants.mdx +++ b/api_docs/kbn_securitysolution_list_constants.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-constants title: "@kbn/securitysolution-list-constants" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-list-constants plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-constants'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_list_hooks.devdocs.json b/api_docs/kbn_securitysolution_list_hooks.devdocs.json index e2262c6e263c2..248881607be2d 100644 --- a/api_docs/kbn_securitysolution_list_hooks.devdocs.json +++ b/api_docs/kbn_securitysolution_list_hooks.devdocs.json @@ -29,7 +29,7 @@ "\nThis adds an id to the incoming exception item entries as ReactJS prefers to have\nan id added to them for use as a stable id. Later if we decide to change the data\nmodel to have id's within the array then this code should be removed. If not, then\nthis code should stay as an adapter for ReactJS.\n\nThis does break the type system slightly as we are lying a bit to the type system as we return\nthe same exceptionItem as we have previously but are augmenting the arrays with an id which TypeScript\ndoesn't mind us doing here. However, downstream you will notice that you have an id when the type\ndoes not indicate it. In that case use (ExceptionItem & { id: string }) temporarily if you're using the id. If you're not,\nyou can ignore the id and just use the normal TypeScript with ReactJS.\n" ], "signature": [ - "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -44,7 +44,7 @@ "The exceptionItem to add an id to the threat matches." ], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -66,7 +66,7 @@ "\nThis removes an id from the exceptionItem entries as ReactJS prefers to have\nan id added to them for use as a stable id. Later if we decide to change the data\nmodel to have id's within the array then this code should be removed. If not, then\nthis code should stay as an adapter for ReactJS.\n" ], "signature": [ - "(exceptionItem: T) => T" + "(exceptionItem: T) => T" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -103,7 +103,7 @@ "\nTransforms the output of rules to compensate for technical debt or UI concerns such as\nReactJS preferences for having ids within arrays if the data is not modeled that way.\n\nIf you add a new transform of the input called \"myNewTransform\" do it\nin the form of:\nflow(addIdToExceptionItemEntries, myNewTransform)(exceptionItem)\n" ], "signature": [ - "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -118,7 +118,7 @@ "The exceptionItem to transform the output of" ], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -138,7 +138,7 @@ "label": "transformNewItemOutput", "description": [], "signature": [ - "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -151,7 +151,7 @@ "label": "exceptionItem", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -171,7 +171,7 @@ "\nTransforms the output of exception items to compensate for technical debt or UI concerns such as\nReactJS preferences for having ids within arrays if the data is not modeled that way.\n\nIf you add a new transform of the output called \"myNewTransform\" do it\nin the form of:\nflow(removeIdFromExceptionItemsEntries, myNewTransform)(exceptionItem)\n" ], "signature": [ - "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" + "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -186,7 +186,7 @@ "The exceptionItem to transform the output of" ], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -317,7 +317,7 @@ "OptionalSignalArgs", "<", "DeleteListParams", - ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" + ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_delete_list/index.ts", "deprecated": false, @@ -445,7 +445,7 @@ "OptionalSignalArgs", "<", "FindListsParams", - ">], { cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" + ">], { cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_find_lists/index.ts", "deprecated": false, @@ -467,7 +467,7 @@ "OptionalSignalArgs", "<", "ImportListParams", - ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" + ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_import_list/index.ts", "deprecated": false, @@ -623,7 +623,7 @@ "label": "addExceptionListItem", "description": [], "signature": [ - "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false, @@ -646,7 +646,7 @@ "label": "listItem", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false @@ -664,7 +664,7 @@ "label": "updateExceptionListItem", "description": [], "signature": [ - "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false, @@ -687,7 +687,7 @@ "label": "listItem", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false @@ -771,7 +771,7 @@ "signature": [ "(arg: ", "ApiCallMemoProps", - " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }) => Promise" + " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }) => Promise" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false, @@ -785,7 +785,7 @@ "description": [], "signature": [ "ApiCallMemoProps", - " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }" + " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false, @@ -954,7 +954,7 @@ "label": "ReturnExceptionListAndItems", "description": [], "signature": [ - "[boolean, { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[], ", + "[boolean, { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[], ", "Pagination", ", Func | null]" ], @@ -996,7 +996,7 @@ "label": "ReturnPersistExceptionItem", "description": [], "signature": [ - "[PersistReturnExceptionItem, React.Dispatch<({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | null>]" + "[PersistReturnExceptionItem, React.Dispatch<({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | null>]" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_persist_exception_item/index.ts", "deprecated": false, diff --git a/api_docs/kbn_securitysolution_list_hooks.mdx b/api_docs/kbn_securitysolution_list_hooks.mdx index 02f7f64b5d592..db34eab6092e6 100644 --- a/api_docs/kbn_securitysolution_list_hooks.mdx +++ b/api_docs/kbn_securitysolution_list_hooks.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-hooks title: "@kbn/securitysolution-list-hooks" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-list-hooks plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-hooks'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_list_utils.devdocs.json b/api_docs/kbn_securitysolution_list_utils.devdocs.json index afa076dd52597..e10ed1097e954 100644 --- a/api_docs/kbn_securitysolution_list_utils.devdocs.json +++ b/api_docs/kbn_securitysolution_list_utils.devdocs.json @@ -27,7 +27,7 @@ "label": "addIdToEntries", "description": [], "signature": [ - "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts", "deprecated": false, @@ -40,7 +40,7 @@ "label": "entries", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts", "deprecated": false, @@ -58,7 +58,7 @@ "label": "buildExceptionFilter", "description": [], "signature": [ - "({ lists, excludeExceptions, chunkSize, alias, }: { lists: ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]; excludeExceptions: boolean; chunkSize: number; alias: string | null; }) => ", + "({ lists, excludeExceptions, chunkSize, alias, }: { lists: ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]; excludeExceptions: boolean; chunkSize: number; alias: string | null; }) => ", "Filter", " | undefined" ], @@ -83,7 +83,7 @@ "label": "lists", "description": [], "signature": [ - "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]" + "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]" ], "path": "packages/kbn-securitysolution-list-utils/src/build_exception_filter/index.ts", "deprecated": false @@ -703,7 +703,7 @@ "section": "def-common.ExceptionsBuilderExceptionItem", "text": "ExceptionsBuilderExceptionItem" }, - "[]) => ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]" + "[]) => ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]" ], "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts", "deprecated": false, @@ -957,7 +957,7 @@ "section": "def-common.FormattedBuilderEntry", "text": "FormattedBuilderEntry" }, - ") => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }) & { id?: string | undefined; }" + ") => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }) & { id?: string | undefined; }" ], "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts", "deprecated": false, @@ -1099,7 +1099,7 @@ "section": "def-common.FormattedBuilderEntry", "text": "FormattedBuilderEntry" }, - ", newField: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }) => { index: number; updatedEntry: ", + ", newField: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }) => { index: number; updatedEntry: ", { "pluginId": "@kbn/securitysolution-list-utils", "scope": "common", @@ -1144,7 +1144,7 @@ "- newly selected list" ], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }" + "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }" ], "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts", "deprecated": false, @@ -2529,7 +2529,7 @@ "label": "hasLargeValueList", "description": [], "signature": [ - "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => boolean" + "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => boolean" ], "path": "packages/kbn-securitysolution-list-utils/src/has_large_value_list/index.ts", "deprecated": false, @@ -2542,7 +2542,7 @@ "label": "entries", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "packages/kbn-securitysolution-list-utils/src/has_large_value_list/index.ts", "deprecated": false, @@ -3170,7 +3170,7 @@ "label": "BuilderEntry", "description": [], "signature": [ - "(({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }) & { id?: string | undefined; }) | ", + "(({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }) & { id?: string | undefined; }) | ", { "pluginId": "@kbn/securitysolution-list-utils", "scope": "common", @@ -3229,7 +3229,7 @@ "label": "CreateExceptionListItemBuilderSchema", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"meta\" | \"entries\"> & { meta: { temporaryUuid: string; }; entries: ", + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"meta\" | \"entries\"> & { meta: { temporaryUuid: string; }; entries: ", { "pluginId": "@kbn/securitysolution-list-utils", "scope": "common", @@ -3363,7 +3363,7 @@ "label": "ExceptionListItemBuilderSchema", "description": [], "signature": [ - "Omit<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }, \"entries\"> & { entries: ", + "Omit<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }, \"entries\"> & { entries: ", { "pluginId": "@kbn/securitysolution-list-utils", "scope": "common", diff --git a/api_docs/kbn_securitysolution_list_utils.mdx b/api_docs/kbn_securitysolution_list_utils.mdx index 5282f6d885fd7..935139d5e2871 100644 --- a/api_docs/kbn_securitysolution_list_utils.mdx +++ b/api_docs/kbn_securitysolution_list_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-utils title: "@kbn/securitysolution-list-utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-list-utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_rules.mdx b/api_docs/kbn_securitysolution_rules.mdx index 02866aae0e153..8063a4d5dd5fa 100644 --- a/api_docs/kbn_securitysolution_rules.mdx +++ b/api_docs/kbn_securitysolution_rules.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-rules title: "@kbn/securitysolution-rules" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-rules plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-rules'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_t_grid.mdx b/api_docs/kbn_securitysolution_t_grid.mdx index 908381a0819ec..6b5ef155d35b4 100644 --- a/api_docs/kbn_securitysolution_t_grid.mdx +++ b/api_docs/kbn_securitysolution_t_grid.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-t-grid title: "@kbn/securitysolution-t-grid" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-t-grid plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-t-grid'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_securitysolution_utils.devdocs.json b/api_docs/kbn_securitysolution_utils.devdocs.json index b312c9d9d3ca9..21ffac0a2035c 100644 --- a/api_docs/kbn_securitysolution_utils.devdocs.json +++ b/api_docs/kbn_securitysolution_utils.devdocs.json @@ -145,7 +145,7 @@ "section": "def-server.OperatingSystem", "text": "OperatingSystem" }, - "; field: \"file.path.text\" | ", + "; field: ", { "pluginId": "@kbn/securitysolution-utils", "scope": "server", @@ -208,8 +208,16 @@ "pluginId": "@kbn/securitysolution-utils", "scope": "server", "docId": "kibKbnSecuritysolutionUtilsPluginApi", - "section": "def-server.AllConditionEntryFields", - "text": "AllConditionEntryFields" + "section": "def-server.TrustedAppConditionEntryField", + "text": "TrustedAppConditionEntryField" + }, + " | ", + { + "pluginId": "@kbn/securitysolution-utils", + "scope": "server", + "docId": "kibKbnSecuritysolutionUtilsPluginApi", + "section": "def-server.BlocklistConditionEntryField", + "text": "BlocklistConditionEntryField" } ], "path": "packages/kbn-securitysolution-utils/src/path_validations/index.ts", @@ -425,6 +433,7 @@ "label": "AllConditionEntryFields", "description": [], "signature": [ + "\"file.path.text\" | ", { "pluginId": "@kbn/securitysolution-utils", "scope": "server", diff --git a/api_docs/kbn_securitysolution_utils.mdx b/api_docs/kbn_securitysolution_utils.mdx index 87d2592c4b036..d9c6d570aa91b 100644 --- a/api_docs/kbn_securitysolution_utils.mdx +++ b/api_docs/kbn_securitysolution_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-utils title: "@kbn/securitysolution-utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/securitysolution-utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_server_http_tools.mdx b/api_docs/kbn_server_http_tools.mdx index 2677b348f7f65..5947022a02051 100644 --- a/api_docs/kbn_server_http_tools.mdx +++ b/api_docs/kbn_server_http_tools.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-server-http-tools title: "@kbn/server-http-tools" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/server-http-tools plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-http-tools'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_server_route_repository.mdx b/api_docs/kbn_server_route_repository.mdx index c413d8863a573..59f1273b9499f 100644 --- a/api_docs/kbn_server_route_repository.mdx +++ b/api_docs/kbn_server_route_repository.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-server-route-repository title: "@kbn/server-route-repository" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/server-route-repository plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-route-repository'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_shared_ux_components.devdocs.json b/api_docs/kbn_shared_ux_components.devdocs.json index f59c6bafff3d5..77f778bb3f118 100644 --- a/api_docs/kbn_shared_ux_components.devdocs.json +++ b/api_docs/kbn_shared_ux_components.devdocs.json @@ -120,6 +120,96 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "@kbn/shared-ux-components", + "id": "def-common.KibanaPageTemplateSolutionNav", + "type": "Function", + "tags": [], + "label": "KibanaPageTemplateSolutionNav", + "description": [ + "\nA `KibanaPageTemplateSolutionNav` component that is wrapped by the `withSuspense` HOC. This component can\nbe used directly by consumers and will load the `KibanaPageTemplateSolutionNavLazy` component lazily with\na predefined fallback and error boundary." + ], + "signature": [ + "React.ForwardRefExoticComponent<", + "CommonProps", + " & { children?: undefined; className?: string | undefined; heading?: React.ReactNode; headingProps?: ", + "EuiSideNavHeadingProps", + " | undefined; toggleOpenOnMobile?: React.MouseEventHandler | undefined; isOpenOnMobile?: boolean | undefined; mobileTitle?: React.ReactNode; mobileBreakpoints?: ", + "EuiBreakpointSize", + "[] | undefined; items: ", + "EuiSideNavItemType", + "<{}>[]; renderItem?: ", + "RenderItem", + "<{}> | undefined; truncate?: boolean | undefined; } & { name: string; icon?: ", + "IconType", + " | undefined; isOpenOnDesktop?: boolean | undefined; onCollapse?: (() => void) | undefined; } & React.RefAttributes<{}>>" + ], + "path": "packages/kbn-shared-ux-components/src/index.ts", + "deprecated": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "@kbn/shared-ux-components", + "id": "def-common.KibanaPageTemplateSolutionNav.$1", + "type": "Uncategorized", + "tags": [], + "label": "props", + "description": [], + "signature": [ + "P" + ], + "path": "node_modules/@types/react/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/shared-ux-components", + "id": "def-common.KibanaPageTemplateSolutionNavLazy", + "type": "Function", + "tags": [], + "label": "KibanaPageTemplateSolutionNavLazy", + "description": [ + "\nThe lazily loaded `KibanaPageTemplateSolutionNav` component that is wrapped by the `withSuspense` HOC. Consumers should use\n`React.Suspense` or `withSuspense` HOC to load this component." + ], + "signature": [ + "React.ExoticComponent<", + "CommonProps", + " & { children?: undefined; className?: string | undefined; heading?: React.ReactNode; headingProps?: ", + "EuiSideNavHeadingProps", + " | undefined; toggleOpenOnMobile?: React.MouseEventHandler | undefined; isOpenOnMobile?: boolean | undefined; mobileTitle?: React.ReactNode; mobileBreakpoints?: ", + "EuiBreakpointSize", + "[] | undefined; items: ", + "EuiSideNavItemType", + "<{}>[]; renderItem?: ", + "RenderItem", + "<{}> | undefined; truncate?: boolean | undefined; } & { name: string; icon?: ", + "IconType", + " | undefined; isOpenOnDesktop?: boolean | undefined; onCollapse?: (() => void) | undefined; } & { children?: React.ReactNode; }> & { readonly _result: React.FunctionComponent<", + "KibanaPageTemplateSolutionNavProps", + ">; }" + ], + "path": "packages/kbn-shared-ux-components/src/index.ts", + "deprecated": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "@kbn/shared-ux-components", + "id": "def-common.KibanaPageTemplateSolutionNavLazy.$1", + "type": "Uncategorized", + "tags": [], + "label": "props", + "description": [], + "signature": [ + "P" + ], + "path": "node_modules/@types/react/index.d.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "@kbn/shared-ux-components", "id": "def-common.KibanaSolutionAvatar", @@ -446,7 +536,7 @@ "signature": [ "React.ExoticComponent & { ref?: React.RefObject | ((instance: HTMLDivElement | null) => void) | null | undefined; }> & { readonly _result: React.FC<", + " & { children?: React.ReactNode; }, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"className\" | \"key\" | \"title\" | \"id\" | \"css\" | \"security\" | \"defaultValue\" | \"hidden\" | \"defaultChecked\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"style\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"role\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-label\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"currentAppId$\" | \"navigateToUrl\"> & { ref?: React.RefObject | ((instance: HTMLDivElement | null) => void) | null | undefined; }> & { readonly _result: React.FC<", "RedirectAppLinksProps", ">; }" ], diff --git a/api_docs/kbn_shared_ux_components.mdx b/api_docs/kbn_shared_ux_components.mdx index 36276e57dcfd5..f5b118c1b36d2 100644 --- a/api_docs/kbn_shared_ux_components.mdx +++ b/api_docs/kbn_shared_ux_components.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-components title: "@kbn/shared-ux-components" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/shared-ux-components plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-components'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Owner missing] for questions regarding this plugin. | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 28 | 0 | 4 | 3 | +| 32 | 0 | 4 | 4 | ## Common diff --git a/api_docs/kbn_shared_ux_services.mdx b/api_docs/kbn_shared_ux_services.mdx index ff2466baf1b5d..e2cb765ac7161 100644 --- a/api_docs/kbn_shared_ux_services.mdx +++ b/api_docs/kbn_shared_ux_services.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-services title: "@kbn/shared-ux-services" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/shared-ux-services plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-services'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_shared_ux_storybook.mdx b/api_docs/kbn_shared_ux_storybook.mdx index 98f6cf1704913..7643af3cf9f90 100644 --- a/api_docs/kbn_shared_ux_storybook.mdx +++ b/api_docs/kbn_shared_ux_storybook.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook title: "@kbn/shared-ux-storybook" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/shared-ux-storybook plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_shared_ux_utility.mdx b/api_docs/kbn_shared_ux_utility.mdx index adaaa0c8a367b..31ccc6897e4cb 100644 --- a/api_docs/kbn_shared_ux_utility.mdx +++ b/api_docs/kbn_shared_ux_utility.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-utility title: "@kbn/shared-ux-utility" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/shared-ux-utility plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-utility'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_std.mdx b/api_docs/kbn_std.mdx index b61ea07d5300f..ad1559fa9ea9d 100644 --- a/api_docs/kbn_std.mdx +++ b/api_docs/kbn_std.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-std title: "@kbn/std" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/std plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/std'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_storybook.mdx b/api_docs/kbn_storybook.mdx index 839213025b486..98453e30ef707 100644 --- a/api_docs/kbn_storybook.mdx +++ b/api_docs/kbn_storybook.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-storybook title: "@kbn/storybook" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/storybook plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/storybook'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_telemetry_tools.mdx b/api_docs/kbn_telemetry_tools.mdx index fc545ecce0818..0e9beedb79fde 100644 --- a/api_docs/kbn_telemetry_tools.mdx +++ b/api_docs/kbn_telemetry_tools.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-telemetry-tools title: "@kbn/telemetry-tools" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/telemetry-tools plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/telemetry-tools'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_test.mdx b/api_docs/kbn_test.mdx index 1893238bef52c..f44a7d8a0b889 100644 --- a/api_docs/kbn_test.mdx +++ b/api_docs/kbn_test.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-test title: "@kbn/test" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/test plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_test_jest_helpers.mdx b/api_docs/kbn_test_jest_helpers.mdx index 2b2c380ecb720..4c9edbd805851 100644 --- a/api_docs/kbn_test_jest_helpers.mdx +++ b/api_docs/kbn_test_jest_helpers.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-test-jest-helpers title: "@kbn/test-jest-helpers" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/test-jest-helpers plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-jest-helpers'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_type_summarizer.mdx b/api_docs/kbn_type_summarizer.mdx index dd7f61d56d02e..385d3c755dfe2 100644 --- a/api_docs/kbn_type_summarizer.mdx +++ b/api_docs/kbn_type_summarizer.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-type-summarizer title: "@kbn/type-summarizer" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/type-summarizer plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/type-summarizer'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_typed_react_router_config.mdx b/api_docs/kbn_typed_react_router_config.mdx index 86e1656cbbb98..02f14ac7a325b 100644 --- a/api_docs/kbn_typed_react_router_config.mdx +++ b/api_docs/kbn_typed_react_router_config.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-typed-react-router-config title: "@kbn/typed-react-router-config" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/typed-react-router-config plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/typed-react-router-config'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_ui_theme.mdx b/api_docs/kbn_ui_theme.mdx index 01313a4de5107..48796dd5266f6 100644 --- a/api_docs/kbn_ui_theme.mdx +++ b/api_docs/kbn_ui_theme.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-ui-theme title: "@kbn/ui-theme" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/ui-theme plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-theme'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_utility_types.mdx b/api_docs/kbn_utility_types.mdx index 179519dafe718..f000ebff89f1f 100644 --- a/api_docs/kbn_utility_types.mdx +++ b/api_docs/kbn_utility_types.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types title: "@kbn/utility-types" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/utility-types plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kbn_utils.mdx b/api_docs/kbn_utils.mdx index ad0bbbe8b4741..5359a84655647 100644 --- a/api_docs/kbn_utils.mdx +++ b/api_docs/kbn_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kbn-utils title: "@kbn/utils" image: https://source.unsplash.com/400x175/?github summary: API docs for the @kbn/utils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kibana_overview.mdx b/api_docs/kibana_overview.mdx index 91f52ef3761de..e61834056f960 100644 --- a/api_docs/kibana_overview.mdx +++ b/api_docs/kibana_overview.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kibanaOverview title: "kibanaOverview" image: https://source.unsplash.com/400x175/?github summary: API docs for the kibanaOverview plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaOverview'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kibana_react.devdocs.json b/api_docs/kibana_react.devdocs.json index 74f669998457e..fa0be3526203f 100644 --- a/api_docs/kibana_react.devdocs.json +++ b/api_docs/kibana_react.devdocs.json @@ -3930,7 +3930,15 @@ "label": "KibanaServices", "description": [], "signature": [ - "{ application?: ", + "{ analytics?: ", + { + "pluginId": "core", + "scope": "public", + "docId": "kibCorePluginApi", + "section": "def-public.AnalyticsServiceStart", + "text": "AnalyticsServiceStart" + }, + " | undefined; application?: ", { "pluginId": "core", "scope": "public", diff --git a/api_docs/kibana_react.mdx b/api_docs/kibana_react.mdx index 7a88499a27661..60767318538de 100644 --- a/api_docs/kibana_react.mdx +++ b/api_docs/kibana_react.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kibanaReact title: "kibanaReact" image: https://source.unsplash.com/400x175/?github summary: API docs for the kibanaReact plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaReact'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/kibana_utils.mdx b/api_docs/kibana_utils.mdx index a4399259731ec..e049912e4e732 100644 --- a/api_docs/kibana_utils.mdx +++ b/api_docs/kibana_utils.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/kibanaUtils title: "kibanaUtils" image: https://source.unsplash.com/400x175/?github summary: API docs for the kibanaUtils plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaUtils'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/lens.devdocs.json b/api_docs/lens.devdocs.json index 066c92e71f29c..53b0ee481dc97 100644 --- a/api_docs/lens.devdocs.json +++ b/api_docs/lens.devdocs.json @@ -7416,7 +7416,7 @@ "label": "OperationTypePost712", "description": [], "signature": [ - "\"filters\" | \"max\" | \"min\" | \"count\" | \"sum\" | \"median\" | \"date_histogram\" | \"percentile\" | \"average\" | \"range\" | \"terms\" | \"cumulative_sum\" | \"moving_average\" | \"unique_count\" | \"last_value\" | \"counter_rate\" | \"differences\"" + "\"filters\" | \"count\" | \"sum\" | \"max\" | \"min\" | \"median\" | \"date_histogram\" | \"percentile\" | \"average\" | \"range\" | \"terms\" | \"cumulative_sum\" | \"moving_average\" | \"unique_count\" | \"last_value\" | \"counter_rate\" | \"differences\"" ], "path": "x-pack/plugins/lens/server/migrations/types.ts", "deprecated": false, @@ -7430,7 +7430,7 @@ "label": "OperationTypePre712", "description": [], "signature": [ - "\"filters\" | \"max\" | \"min\" | \"count\" | \"sum\" | \"avg\" | \"median\" | \"date_histogram\" | \"percentile\" | \"range\" | \"terms\" | \"cumulative_sum\" | \"derivative\" | \"moving_average\" | \"last_value\" | \"counter_rate\" | \"cardinality\"" + "\"filters\" | \"count\" | \"sum\" | \"avg\" | \"max\" | \"min\" | \"median\" | \"date_histogram\" | \"percentile\" | \"range\" | \"terms\" | \"cumulative_sum\" | \"derivative\" | \"moving_average\" | \"last_value\" | \"counter_rate\" | \"cardinality\"" ], "path": "x-pack/plugins/lens/server/migrations/types.ts", "deprecated": false, diff --git a/api_docs/lens.mdx b/api_docs/lens.mdx index f402cc9da023d..2974c7140ed53 100644 --- a/api_docs/lens.mdx +++ b/api_docs/lens.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/lens title: "lens" image: https://source.unsplash.com/400x175/?github summary: API docs for the lens plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lens'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/license_api_guard.mdx b/api_docs/license_api_guard.mdx index b4aff7714efa4..ff9b643e9d694 100644 --- a/api_docs/license_api_guard.mdx +++ b/api_docs/license_api_guard.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/licenseApiGuard title: "licenseApiGuard" image: https://source.unsplash.com/400x175/?github summary: API docs for the licenseApiGuard plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseApiGuard'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/license_management.mdx b/api_docs/license_management.mdx index 420b57b1f1031..f2ad339d8c0d8 100644 --- a/api_docs/license_management.mdx +++ b/api_docs/license_management.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/licenseManagement title: "licenseManagement" image: https://source.unsplash.com/400x175/?github summary: API docs for the licenseManagement plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseManagement'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/licensing.mdx b/api_docs/licensing.mdx index 79b03fe099f74..e9208ee1f9f8e 100644 --- a/api_docs/licensing.mdx +++ b/api_docs/licensing.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/licensing title: "licensing" image: https://source.unsplash.com/400x175/?github summary: API docs for the licensing plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licensing'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/lists.devdocs.json b/api_docs/lists.devdocs.json index c529d5af7a548..950e244c88b49 100644 --- a/api_docs/lists.devdocs.json +++ b/api_docs/lists.devdocs.json @@ -311,7 +311,7 @@ "label": "exceptionItems", "description": [], "signature": [ - "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]" + "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]" ], "path": "x-pack/plugins/lists/public/exceptions/components/builder/exception_items_renderer.tsx", "deprecated": false @@ -324,7 +324,7 @@ "label": "exceptionsToDelete", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]" ], "path": "x-pack/plugins/lists/public/exceptions/components/builder/exception_items_renderer.tsx", "deprecated": false @@ -597,7 +597,7 @@ "signature": [ "({ itemId, id, namespaceType, }: ", "GetExceptionListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -669,7 +669,7 @@ "signature": [ "({ comments, description, entries, itemId, meta, name, osTypes, tags, type, }: ", "CreateEndpointListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -703,7 +703,7 @@ "signature": [ "({ _version, comments, description, entries, id, itemId, meta, name, osTypes, tags, type, }: ", "UpdateEndpointListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -737,7 +737,7 @@ "signature": [ "({ itemId, id, }: ", "GetEndpointListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -925,7 +925,7 @@ "section": "def-server.CreateExceptionListItemOptions", "text": "CreateExceptionListItemOptions" }, - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -987,7 +987,7 @@ "section": "def-server.UpdateExceptionListItemOptions", "text": "UpdateExceptionListItemOptions" }, - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1034,7 +1034,7 @@ "signature": [ "({ id, itemId, namespaceType, }: ", "DeleteExceptionListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1108,7 +1108,7 @@ "signature": [ "({ id, itemId, }: ", "DeleteEndpointListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1140,7 +1140,7 @@ "signature": [ "({ listId, filter, perPage, pit, page, searchAfter, sortField, sortOrder, namespaceType, }: ", "FindExceptionListItemOptions", - ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" + ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1172,7 +1172,7 @@ "signature": [ "({ listId, filter, perPage, pit, page, searchAfter, sortField, sortOrder, namespaceType, }: ", "FindExceptionListsItemOptions", - ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" + ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1204,7 +1204,7 @@ "signature": [ "({ perPage, pit, page, searchAfter, sortField, sortOrder, valueListId, }: ", "FindValueListExceptionListsItems", - ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" + ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1270,7 +1270,7 @@ "signature": [ "({ filter, perPage, page, pit, searchAfter, sortField, sortOrder, }: ", "FindEndpointListItemOptions", - ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" + ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1737,7 +1737,7 @@ "signature": [ "({ id }: ", "GetListOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -1769,7 +1769,7 @@ "signature": [ "({ id, deserializer, immutable, serializer, name, description, type, meta, version, }: ", "CreateListOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -1801,7 +1801,7 @@ "signature": [ "({ id, deserializer, serializer, name, description, immutable, type, meta, version, }: ", "CreateListIfItDoesNotExistOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2133,7 +2133,7 @@ "signature": [ "({ id }: ", "DeleteListItemOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2165,7 +2165,7 @@ "signature": [ "({ listId, value, type, }: ", "DeleteListItemByValueOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2197,7 +2197,7 @@ "signature": [ "({ id }: ", "DeleteListOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2261,7 +2261,7 @@ "signature": [ "({ deserializer, serializer, type, listId, stream, meta, version, }: ", "ImportListItemsToStreamOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2293,7 +2293,7 @@ "signature": [ "({ listId, value, type, }: ", "GetListItemByValueOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2325,7 +2325,7 @@ "signature": [ "({ id, deserializer, serializer, listId, value, type, meta, }: ", "CreateListItemOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2357,7 +2357,7 @@ "signature": [ "({ _version, id, value, meta, }: ", "UpdateListItemOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2389,7 +2389,7 @@ "signature": [ "({ _version, id, name, description, meta, version, }: ", "UpdateListOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2421,7 +2421,7 @@ "signature": [ "({ id }: ", "GetListItemOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2453,7 +2453,7 @@ "signature": [ "({ type, listId, value, }: ", "GetListItemsByValueOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2485,7 +2485,7 @@ "signature": [ "({ type, listId, value, }: ", "SearchListItemByValuesOptions", - ") => Promise<{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]>" + ") => Promise<{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2517,7 +2517,7 @@ "signature": [ "({ filter, currentIndexPosition, perPage, page, sortField, sortOrder, searchAfter, }: ", "FindListOptions", - ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" + ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2549,7 +2549,7 @@ "signature": [ "({ listId, filter, currentIndexPosition, perPage, page, sortField, sortOrder, searchAfter, }: ", "FindListItemOptions", - ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; } | null>" + ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2608,7 +2608,7 @@ "label": "entries", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts", "deprecated": false @@ -2874,7 +2874,7 @@ "label": "entries", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"text\" | \"binary\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"keyword\" | \"ip\" | \"date\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"text\" | \"date_nanos\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"double\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\" | \"date_range\" | \"ip_range\" | \"shape\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts", "deprecated": false @@ -3881,7 +3881,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -3891,7 +3891,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -3899,7 +3899,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -3911,7 +3911,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -3921,7 +3921,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -3929,7 +3929,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -3937,7 +3937,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -3947,7 +3947,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -3955,7 +3955,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -4034,9 +4034,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -4169,7 +4167,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -4179,7 +4177,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -4187,7 +4185,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -4195,7 +4193,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -4205,7 +4203,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -4213,7 +4211,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -4284,29 +4282,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -4649,7 +4647,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -4659,7 +4657,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -4667,7 +4665,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -4694,29 +4692,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -4972,6 +4970,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", diff --git a/api_docs/lists.mdx b/api_docs/lists.mdx index 2b1a6bd35b251..4be9824f833d2 100644 --- a/api_docs/lists.mdx +++ b/api_docs/lists.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/lists title: "lists" image: https://source.unsplash.com/400x175/?github summary: API docs for the lists plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lists'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/management.mdx b/api_docs/management.mdx index ab9bec5d300d6..3f6a113909a8b 100644 --- a/api_docs/management.mdx +++ b/api_docs/management.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/management title: "management" image: https://source.unsplash.com/400x175/?github summary: API docs for the management plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'management'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/maps.mdx b/api_docs/maps.mdx index efb5cb75504c5..ae9babe656796 100644 --- a/api_docs/maps.mdx +++ b/api_docs/maps.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/maps title: "maps" image: https://source.unsplash.com/400x175/?github summary: API docs for the maps plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'maps'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/maps_ems.mdx b/api_docs/maps_ems.mdx index cb370a3797a1c..4fa7850a0e9c9 100644 --- a/api_docs/maps_ems.mdx +++ b/api_docs/maps_ems.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/mapsEms title: "mapsEms" image: https://source.unsplash.com/400x175/?github summary: API docs for the mapsEms plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'mapsEms'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/metrics_entities.devdocs.json b/api_docs/metrics_entities.devdocs.json index 6fd9a6509488d..8a4c69fc1e824 100644 --- a/api_docs/metrics_entities.devdocs.json +++ b/api_docs/metrics_entities.devdocs.json @@ -97,7 +97,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -107,7 +107,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -115,7 +115,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -127,7 +127,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -137,7 +137,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -145,7 +145,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -153,7 +153,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -163,7 +163,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -171,7 +171,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -250,9 +250,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -385,7 +383,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -395,7 +393,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -403,7 +401,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -411,7 +409,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -421,7 +419,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -429,7 +427,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -500,29 +498,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -865,7 +863,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -875,7 +873,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -883,7 +881,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -910,29 +908,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -1188,6 +1186,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", diff --git a/api_docs/metrics_entities.mdx b/api_docs/metrics_entities.mdx index 54c8be06368da..cbe21f8f4da51 100644 --- a/api_docs/metrics_entities.mdx +++ b/api_docs/metrics_entities.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/metricsEntities title: "metricsEntities" image: https://source.unsplash.com/400x175/?github summary: API docs for the metricsEntities plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'metricsEntities'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/ml.mdx b/api_docs/ml.mdx index 4b0a0d50a851f..f78b0773ab8b7 100644 --- a/api_docs/ml.mdx +++ b/api_docs/ml.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/ml title: "ml" image: https://source.unsplash.com/400x175/?github summary: API docs for the ml plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ml'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/monitoring.mdx b/api_docs/monitoring.mdx index f02d3b935b84b..9d4656621ad0b 100644 --- a/api_docs/monitoring.mdx +++ b/api_docs/monitoring.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/monitoring title: "monitoring" image: https://source.unsplash.com/400x175/?github summary: API docs for the monitoring plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoring'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/monitoring_collection.mdx b/api_docs/monitoring_collection.mdx index 6e7314779aaeb..fd085531e49d8 100644 --- a/api_docs/monitoring_collection.mdx +++ b/api_docs/monitoring_collection.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/monitoringCollection title: "monitoringCollection" image: https://source.unsplash.com/400x175/?github summary: API docs for the monitoringCollection plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoringCollection'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/navigation.devdocs.json b/api_docs/navigation.devdocs.json index 1c0ee8bee9a25..7512f5d4cd86e 100644 --- a/api_docs/navigation.devdocs.json +++ b/api_docs/navigation.devdocs.json @@ -151,7 +151,7 @@ "section": "def-public.CoreStart", "text": "CoreStart" }, - ", { data }: ", + ", { unifiedSearch }: ", "NavigationPluginStartDependencies", ") => ", { @@ -190,7 +190,7 @@ "id": "def-public.NavigationPublicPlugin.start.$2", "type": "Object", "tags": [], - "label": "{ data }", + "label": "{ unifiedSearch }", "description": [], "signature": [ "NavigationPluginStartDependencies" @@ -655,13 +655,13 @@ "SearchBarOwnProps", " & { appName: string; useDefaultBehaviors?: boolean | undefined; savedQueryId?: string | undefined; onSavedQueryIdChange?: ((savedQueryId?: string | undefined) => void) | undefined; } & Omit<", { - "pluginId": "data", + "pluginId": "unifiedSearch", "scope": "public", - "docId": "kibDataUiPluginApi", + "docId": "kibUnifiedSearchPluginApi", "section": "def-public.SearchBarProps", "text": "SearchBarProps" }, - ", \"intl\" | \"kibana\" | \"timeHistory\"> & { config?: ", + ", \"kibana\" | \"intl\" | \"timeHistory\"> & { config?: ", { "pluginId": "navigation", "scope": "public", @@ -671,13 +671,13 @@ }, "[] | undefined; badges?: (", "EuiBadgeProps", - " & { badgeText: string; })[] | undefined; showSearchBar?: boolean | undefined; showQueryBar?: boolean | undefined; showQueryInput?: boolean | undefined; showDatePicker?: boolean | undefined; showFilterBar?: boolean | undefined; data?: ", + " & { badgeText: string; })[] | undefined; showSearchBar?: boolean | undefined; showQueryBar?: boolean | undefined; showQueryInput?: boolean | undefined; showDatePicker?: boolean | undefined; showFilterBar?: boolean | undefined; unifiedSearch?: ", { - "pluginId": "data", + "pluginId": "unifiedSearch", "scope": "public", - "docId": "kibDataPluginApi", - "section": "def-public.DataPublicPluginStart", - "text": "DataPublicPluginStart" + "docId": "kibUnifiedSearchPluginApi", + "section": "def-public.UnifiedSearchPublicPluginStart", + "text": "UnifiedSearchPublicPluginStart" }, " | undefined; className?: string | undefined; setMenuMountPoint?: ((menuMount: ", { diff --git a/api_docs/navigation.mdx b/api_docs/navigation.mdx index e07b8011d3838..5c0088964dbc6 100644 --- a/api_docs/navigation.mdx +++ b/api_docs/navigation.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/navigation title: "navigation" image: https://source.unsplash.com/400x175/?github summary: API docs for the navigation plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'navigation'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/newsfeed.mdx b/api_docs/newsfeed.mdx index 5b48a4a5925de..1e3cfb7a6fa96 100644 --- a/api_docs/newsfeed.mdx +++ b/api_docs/newsfeed.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/newsfeed title: "newsfeed" image: https://source.unsplash.com/400x175/?github summary: API docs for the newsfeed plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'newsfeed'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/observability.devdocs.json b/api_docs/observability.devdocs.json index efccaf7e0d44b..6dde3e0820d9a 100644 --- a/api_docs/observability.devdocs.json +++ b/api_docs/observability.devdocs.json @@ -678,9 +678,9 @@ }, " | undefined; }; selectedAlertId?: string | undefined; } & ", "CommonProps", - " & { as?: \"div\" | undefined; } & _EuiFlyoutProps & Omit, HTMLDivElement>, keyof _EuiFlyoutProps> & Omit, HTMLDivElement>, \"key\" | \"css\" | keyof React.HTMLAttributes> & { ref?: React.RefObject | ((instance: HTMLDivElement | null) => void) | null | undefined; }, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"title\" | \"id\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"as\" | keyof ", + " & { as?: \"div\" | undefined; } & _EuiFlyoutProps & Omit, HTMLDivElement>, keyof _EuiFlyoutProps> & Omit, HTMLDivElement>, \"key\" | \"css\" | keyof React.HTMLAttributes> & { ref?: React.RefObject | ((instance: HTMLDivElement | null) => void) | null | undefined; }, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"title\" | \"id\" | \"security\" | \"defaultValue\" | \"hidden\" | \"defaultChecked\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"as\" | keyof ", "CommonProps", - " | keyof React.ClassAttributes | keyof _EuiFlyoutProps>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"alert\" | \"key\" | \"title\" | \"id\" | \"css\" | \"security\" | \"defaultChecked\" | \"defaultValue\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"hidden\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"as\" | keyof ", + " | keyof React.ClassAttributes | keyof _EuiFlyoutProps>, \"children\" | \"onClick\" | \"onChange\" | \"color\" | \"onKeyDown\" | \"alert\" | \"key\" | \"title\" | \"id\" | \"css\" | \"security\" | \"defaultValue\" | \"hidden\" | \"defaultChecked\" | \"suppressContentEditableWarning\" | \"suppressHydrationWarning\" | \"accessKey\" | \"contentEditable\" | \"contextMenu\" | \"dir\" | \"draggable\" | \"lang\" | \"placeholder\" | \"slot\" | \"spellCheck\" | \"tabIndex\" | \"translate\" | \"radioGroup\" | \"about\" | \"datatype\" | \"inlist\" | \"prefix\" | \"property\" | \"resource\" | \"typeof\" | \"vocab\" | \"autoCapitalize\" | \"autoCorrect\" | \"autoSave\" | \"itemProp\" | \"itemScope\" | \"itemType\" | \"itemID\" | \"itemRef\" | \"results\" | \"unselectable\" | \"inputMode\" | \"is\" | \"aria-activedescendant\" | \"aria-atomic\" | \"aria-autocomplete\" | \"aria-busy\" | \"aria-checked\" | \"aria-colcount\" | \"aria-colindex\" | \"aria-colspan\" | \"aria-controls\" | \"aria-current\" | \"aria-describedby\" | \"aria-details\" | \"aria-disabled\" | \"aria-dropeffect\" | \"aria-errormessage\" | \"aria-expanded\" | \"aria-flowto\" | \"aria-grabbed\" | \"aria-haspopup\" | \"aria-hidden\" | \"aria-invalid\" | \"aria-keyshortcuts\" | \"aria-labelledby\" | \"aria-level\" | \"aria-live\" | \"aria-modal\" | \"aria-multiline\" | \"aria-multiselectable\" | \"aria-orientation\" | \"aria-owns\" | \"aria-placeholder\" | \"aria-posinset\" | \"aria-pressed\" | \"aria-readonly\" | \"aria-relevant\" | \"aria-required\" | \"aria-roledescription\" | \"aria-rowcount\" | \"aria-rowindex\" | \"aria-rowspan\" | \"aria-selected\" | \"aria-setsize\" | \"aria-sort\" | \"aria-valuemax\" | \"aria-valuemin\" | \"aria-valuenow\" | \"aria-valuetext\" | \"dangerouslySetInnerHTML\" | \"onCopy\" | \"onCopyCapture\" | \"onCut\" | \"onCutCapture\" | \"onPaste\" | \"onPasteCapture\" | \"onCompositionEnd\" | \"onCompositionEndCapture\" | \"onCompositionStart\" | \"onCompositionStartCapture\" | \"onCompositionUpdate\" | \"onCompositionUpdateCapture\" | \"onFocus\" | \"onFocusCapture\" | \"onBlur\" | \"onBlurCapture\" | \"onChangeCapture\" | \"onBeforeInput\" | \"onBeforeInputCapture\" | \"onInput\" | \"onInputCapture\" | \"onReset\" | \"onResetCapture\" | \"onSubmit\" | \"onSubmitCapture\" | \"onInvalid\" | \"onInvalidCapture\" | \"onLoad\" | \"onLoadCapture\" | \"onError\" | \"onErrorCapture\" | \"onKeyDownCapture\" | \"onKeyPress\" | \"onKeyPressCapture\" | \"onKeyUp\" | \"onKeyUpCapture\" | \"onAbort\" | \"onAbortCapture\" | \"onCanPlay\" | \"onCanPlayCapture\" | \"onCanPlayThrough\" | \"onCanPlayThroughCapture\" | \"onDurationChange\" | \"onDurationChangeCapture\" | \"onEmptied\" | \"onEmptiedCapture\" | \"onEncrypted\" | \"onEncryptedCapture\" | \"onEnded\" | \"onEndedCapture\" | \"onLoadedData\" | \"onLoadedDataCapture\" | \"onLoadedMetadata\" | \"onLoadedMetadataCapture\" | \"onLoadStart\" | \"onLoadStartCapture\" | \"onPause\" | \"onPauseCapture\" | \"onPlay\" | \"onPlayCapture\" | \"onPlaying\" | \"onPlayingCapture\" | \"onProgress\" | \"onProgressCapture\" | \"onRateChange\" | \"onRateChangeCapture\" | \"onSeeked\" | \"onSeekedCapture\" | \"onSeeking\" | \"onSeekingCapture\" | \"onStalled\" | \"onStalledCapture\" | \"onSuspend\" | \"onSuspendCapture\" | \"onTimeUpdate\" | \"onTimeUpdateCapture\" | \"onVolumeChange\" | \"onVolumeChangeCapture\" | \"onWaiting\" | \"onWaitingCapture\" | \"onAuxClick\" | \"onAuxClickCapture\" | \"onClickCapture\" | \"onContextMenu\" | \"onContextMenuCapture\" | \"onDoubleClick\" | \"onDoubleClickCapture\" | \"onDrag\" | \"onDragCapture\" | \"onDragEnd\" | \"onDragEndCapture\" | \"onDragEnter\" | \"onDragEnterCapture\" | \"onDragExit\" | \"onDragExitCapture\" | \"onDragLeave\" | \"onDragLeaveCapture\" | \"onDragOver\" | \"onDragOverCapture\" | \"onDragStart\" | \"onDragStartCapture\" | \"onDrop\" | \"onDropCapture\" | \"onMouseDown\" | \"onMouseDownCapture\" | \"onMouseEnter\" | \"onMouseLeave\" | \"onMouseMove\" | \"onMouseMoveCapture\" | \"onMouseOut\" | \"onMouseOutCapture\" | \"onMouseOver\" | \"onMouseOverCapture\" | \"onMouseUp\" | \"onMouseUpCapture\" | \"onSelect\" | \"onSelectCapture\" | \"onTouchCancel\" | \"onTouchCancelCapture\" | \"onTouchEnd\" | \"onTouchEndCapture\" | \"onTouchMove\" | \"onTouchMoveCapture\" | \"onTouchStart\" | \"onTouchStartCapture\" | \"onPointerDown\" | \"onPointerDownCapture\" | \"onPointerMove\" | \"onPointerMoveCapture\" | \"onPointerUp\" | \"onPointerUpCapture\" | \"onPointerCancel\" | \"onPointerCancelCapture\" | \"onPointerEnter\" | \"onPointerEnterCapture\" | \"onPointerLeave\" | \"onPointerLeaveCapture\" | \"onPointerOver\" | \"onPointerOverCapture\" | \"onPointerOut\" | \"onPointerOutCapture\" | \"onGotPointerCapture\" | \"onGotPointerCaptureCapture\" | \"onLostPointerCapture\" | \"onLostPointerCaptureCapture\" | \"onScroll\" | \"onScrollCapture\" | \"onWheel\" | \"onWheelCapture\" | \"onAnimationStart\" | \"onAnimationStartCapture\" | \"onAnimationEnd\" | \"onAnimationEndCapture\" | \"onAnimationIteration\" | \"onAnimationIterationCapture\" | \"onTransitionEnd\" | \"onTransitionEndCapture\" | \"as\" | keyof ", "CommonProps", " | \"alerts\" | keyof _EuiFlyoutProps | \"isInApp\" | \"observabilityRuleTypeRegistry\" | \"selectedAlertId\"> & { ref?: React.RefObject | ((instance: HTMLDivElement | null) => void) | null | undefined; }> & { readonly _result: ({ alert, alerts, isInApp, observabilityRuleTypeRegistry, onClose, selectedAlertId, }: AlertsFlyoutProps) => JSX.Element | null; }" ], @@ -997,7 +997,7 @@ "label": "shouldHandleLinkEvent", "description": [], "signature": [ - "(e: React.MouseEvent | React.MouseEvent) => boolean" + "(e: React.MouseEvent | React.MouseEvent) => boolean" ], "path": "x-pack/plugins/observability/public/hooks/use_link_props.ts", "deprecated": false, @@ -1010,7 +1010,7 @@ "label": "e", "description": [], "signature": [ - "React.MouseEvent | React.MouseEvent" + "React.MouseEvent | React.MouseEvent" ], "path": "x-pack/plugins/observability/public/hooks/use_link_props.ts", "deprecated": false, @@ -4629,7 +4629,7 @@ "section": "def-public.KibanaPageTemplateProps", "text": "KibanaPageTemplateProps" }, - ", \"children\" | \"paddingSize\" | \"data-test-subj\" | \"restrictWidth\" | \"template\" | \"noDataConfig\" | \"pageHeader\" | \"pageBodyProps\" | \"pageContentProps\" | \"pageContentBodyProps\" | \"isEmptyState\"> & { showSolutionNav?: boolean | undefined; }" + ", \"children\" | \"data-test-subj\" | \"paddingSize\" | \"restrictWidth\" | \"template\" | \"noDataConfig\" | \"pageHeader\" | \"pageBodyProps\" | \"pageContentProps\" | \"pageContentBodyProps\" | \"isEmptyState\"> & { showSolutionNav?: boolean | undefined; }" ], "path": "x-pack/plugins/observability/public/components/shared/page_template/lazy_page_template.tsx", "deprecated": false, @@ -4798,7 +4798,7 @@ "DisambiguateSet", ", Omit, \"href\">> & Omit, \"href\">) | (", "DisambiguateSet", - ", \"href\">, React.ButtonHTMLAttributes> & React.ButtonHTMLAttributes))), \"onClick\" | \"color\" | \"target\" | \"rel\"> & { size?: ItemSize | undefined; color?: Color | undefined; label: React.ReactNode; isActive?: boolean | undefined; isDisabled?: boolean | undefined; href?: string | undefined; target?: string | undefined; rel?: string | undefined; iconType?: ", + ", \"href\">, React.ButtonHTMLAttributes> & React.ButtonHTMLAttributes))), \"onClick\" | \"color\" | \"rel\" | \"target\"> & { size?: ItemSize | undefined; color?: Color | undefined; label: React.ReactNode; isActive?: boolean | undefined; isDisabled?: boolean | undefined; href?: string | undefined; target?: string | undefined; rel?: string | undefined; iconType?: ", "IconType", " | undefined; iconProps?: Omit<", "EuiIconProps", @@ -4884,7 +4884,7 @@ "label": "uptimeOverviewLocatorID", "description": [], "signature": [ - "\"uptime-overview-locator\"" + "\"UPTIME_OVERVIEW_LOCATOR\"" ], "path": "x-pack/plugins/observability/common/index.ts", "deprecated": false, @@ -5205,7 +5205,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -5215,7 +5215,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -5223,7 +5223,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -5235,7 +5235,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -5245,7 +5245,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -5253,7 +5253,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -5261,7 +5261,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -5271,7 +5271,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -5279,7 +5279,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -5358,9 +5358,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -5493,7 +5491,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -5503,7 +5501,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -5511,7 +5509,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -5519,7 +5517,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -5529,7 +5527,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -5537,7 +5535,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -5608,29 +5606,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -5973,7 +5971,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -5983,7 +5981,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -5991,7 +5989,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -6018,29 +6016,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -6296,6 +6294,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", @@ -7052,7 +7052,7 @@ "; }>; getById: (getByIdParams: { id: string; }) => Promise<", "GetResponse", ">; delete: (deleteParams: { id: string; }) => Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }" ], "path": "x-pack/plugins/observability/server/lib/annotations/bootstrap_annotations.ts", @@ -7098,7 +7098,7 @@ "; }>; getById: (getByIdParams: { id: string; }) => Promise<", "GetResponse", ">; delete: (deleteParams: { id: string; }) => Promise<", - "DeleteResponse", + "WriteResponseBase", ">; } | undefined>; }" ], "path": "x-pack/plugins/observability/server/plugin.ts", @@ -7435,7 +7435,7 @@ "label": "uptimeOverviewLocatorID", "description": [], "signature": [ - "\"uptime-overview-locator\"" + "\"UPTIME_OVERVIEW_LOCATOR\"" ], "path": "x-pack/plugins/observability/common/index.ts", "deprecated": false, diff --git a/api_docs/observability.mdx b/api_docs/observability.mdx index 7e5c1aebfa196..9675c6927423c 100644 --- a/api_docs/observability.mdx +++ b/api_docs/observability.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/observability title: "observability" image: https://source.unsplash.com/400x175/?github summary: API docs for the observability plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observability'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/osquery.mdx b/api_docs/osquery.mdx index f0e809e47a95b..7c84da2e6ca7a 100644 --- a/api_docs/osquery.mdx +++ b/api_docs/osquery.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/osquery title: "osquery" image: https://source.unsplash.com/400x175/?github summary: API docs for the osquery plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'osquery'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/plugin_directory.mdx b/api_docs/plugin_directory.mdx index 8c6bb5654d279..84e92c68c5944 100644 --- a/api_docs/plugin_directory.mdx +++ b/api_docs/plugin_directory.mdx @@ -3,7 +3,7 @@ id: kibDevDocsPluginDirectory slug: /kibana-dev-docs/api-meta/plugin-api-directory title: Directory summary: Directory of public APIs available through plugins or packages. -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -12,13 +12,13 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | Count | Plugins or Packages with a
public API | Number of teams | |--------------|----------|------------------------| -| 251 | 185 | 42 | +| 231 | 188 | 35 | ### Public API health stats | API Count | Any Count | Missing comments | Missing exports | |--------------|----------|-----------------|--------| -| 25349 | 169 | 19463 | 1117 | +| 25613 | 171 | 19521 | 1128 | ## Plugin Directory @@ -26,7 +26,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex |--------------|----------------|-----------|--------------|----------|---------------|--------| | | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 127 | 0 | 127 | 10 | | | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 23 | 0 | 19 | 1 | -| | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 323 | 0 | 315 | 21 | +| | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 334 | 0 | 325 | 20 | | | [APM UI](https://github.com/orgs/elastic/teams/apm-ui) | The user interface for Elastic APM | 40 | 0 | 40 | 50 | | | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 9 | 0 | 9 | 0 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Considering using bfetch capabilities when fetching large amounts of data. This services supports batching HTTP requests and streaming responses back. | 78 | 1 | 69 | 2 | @@ -36,23 +36,23 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 28 | 0 | 23 | 0 | | | [Cloud Security Posture](https://github.com/orgs/elastic/teams/cloud-posture-security) | The cloud security posture plugin | 14 | 0 | 14 | 0 | | | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 13 | 0 | 13 | 1 | -| | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Controls Plugin contains embeddable components intended to create a simple query interface for end users, and a powerful editing suite that allows dashboard authors to build controls | 185 | 0 | 179 | 4 | -| | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2375 | 15 | 970 | 33 | +| | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Controls Plugin contains embeddable components intended to create a simple query interface for end users, and a powerful editing suite that allows dashboard authors to build controls | 188 | 0 | 182 | 4 | +| | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2497 | 15 | 971 | 33 | | crossClusterReplication | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 | | | [Fleet](https://github.com/orgs/elastic/teams/fleet) | Add custom data integrations so they can be displayed in the Fleet integrations app | 98 | 0 | 79 | 1 | | | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds the Dashboard app to Kibana | 151 | 0 | 149 | 14 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 52 | 0 | 51 | 0 | -| | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 3457 | 40 | 2844 | 27 | +| | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 3426 | 40 | 2816 | 20 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Enhanced data plugin. (See src/plugins/data.) Enhances the main data plugin with a search session management UI. Includes a reusable search session indicator component to use in other applications. Exposes routes for managing search sessions. Includes a service that monitors, updates, and cleans up search session saved objects. | 16 | 0 | 16 | 2 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | This plugin provides the ability to create data views via a modal flyout from any kibana app | 13 | 0 | 7 | 0 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Reusable data view field editor across Kibana | 42 | 0 | 37 | 3 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data view management app | 2 | 0 | 2 | 0 | -| | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 863 | 3 | 711 | 15 | +| | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 862 | 3 | 710 | 15 | | | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | The Data Visualizer tools help you understand your data, by analyzing the metrics and fields in a log file or an existing Elasticsearch index. | 23 | 2 | 19 | 1 | | | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 10 | 0 | 8 | 2 | | | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin contains the Discover application and the saved search embeddable. | 77 | 0 | 61 | 7 | | | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 37 | 0 | 35 | 2 | -| | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds embeddables service to Kibana | 474 | 0 | 385 | 4 | +| | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds embeddables service to Kibana | 476 | 0 | 386 | 4 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Extends embeddable plugin with more functionality | 14 | 0 | 14 | 0 | | | [Platform Security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides encryption and decryption utilities for saved objects containing sensitive information. | 48 | 0 | 44 | 0 | | | [Enterprise Search](https://github.com/orgs/elastic/teams/enterprise-search-frontend) | Adds dashboards for discovering and managing Enterprise Search products. | 2 | 0 | 2 | 0 | @@ -60,7 +60,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-vis-editors) | The Event Annotation service contains expressions for event annotations | 49 | 0 | 49 | 3 | | | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 91 | 0 | 91 | 9 | | | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds 'error' renderer to expressions | 17 | 0 | 15 | 2 | -| | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-vis-editors) | Expression Gauge plugin adds a `gauge` renderer and function to the expression plugin. The renderer will display the `gauge` chart. | 71 | 0 | 71 | 2 | +| | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-vis-editors) | Expression Gauge plugin adds a `gauge` renderer and function to the expression plugin. The renderer will display the `gauge` chart. | 76 | 0 | 76 | 2 | | | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-vis-editors) | Expression Heatmap plugin adds a `heatmap` renderer and function to the expression plugin. The renderer will display the `heatmap` chart. | 119 | 0 | 115 | 3 | | | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds 'image' function and renderer to expressions | 26 | 0 | 26 | 0 | | | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds 'metric' function and renderer to expressions | 32 | 0 | 27 | 0 | @@ -84,7 +84,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 140 | 0 | 102 | 0 | | | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 4 | 0 | 4 | 0 | | | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 175 | 0 | 170 | 3 | -| | [Logs and Metrics UI](https://github.com/orgs/elastic/teams/logs-metrics-ui) | This plugin visualizes data from Filebeat and Metricbeat, and integrates with other Observability solutions | 28 | 0 | 25 | 3 | +| | [Logs and Metrics UI](https://github.com/orgs/elastic/teams/logs-metrics-ui) | This plugin visualizes data from Filebeat and Metricbeat, and integrates with other Observability solutions | 31 | 0 | 28 | 5 | | ingestPipelines | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 | | inputControlVis | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds Input Control visualization to Kibana | 0 | 0 | 0 | 0 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 123 | 2 | 96 | 4 | @@ -130,7 +130,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds URL Service and sharing capabilities to Kibana | 113 | 0 | 54 | 10 | | | [Shared UX](https://github.com/orgs/elastic/teams/shared-ux) | A plugin providing components and services for shared user experiences in Kibana. | 4 | 0 | 0 | 0 | | | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 21 | 1 | 21 | 1 | -| | [Platform Security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides the Spaces feature, which allows saved objects to be organized into meaningful categories. | 259 | 0 | 64 | 0 | +| | [Platform Security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides the Spaces feature, which allows saved objects to be organized into meaningful categories. | 260 | 0 | 64 | 0 | | | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 4 | 0 | 4 | 0 | | | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 77 | 0 | 39 | 7 | | | [Kibana Telemetry](https://github.com/orgs/elastic/teams/kibana-telemetry) | - | 43 | 0 | 1 | 0 | @@ -140,9 +140,10 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | [Security solution](https://github.com/orgs/elastic/teams/security-solution) | - | 435 | 1 | 331 | 35 | | | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the transforms features provided by Elastic. Transforms enable you to convert existing Elasticsearch indices into summarized indices, which provide opportunities for new insights and analytics. | 4 | 0 | 4 | 1 | | translations | [Kibana Localization](https://github.com/orgs/elastic/teams/kibana-localization) | - | 0 | 0 | 0 | 0 | -| | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 302 | 0 | 288 | 23 | +| | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 304 | 0 | 290 | 23 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds UI Actions service to Kibana | 130 | 0 | 91 | 11 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Extends UI Actions plugin with more functionality | 203 | 0 | 141 | 9 | +| | [Unified Search](https://github.com/orgs/elastic/teams/kibana-app-services) | Contains all the key functionality of Kibana's unified search experience.Contains all the key functionality of Kibana's unified search experience. | 48 | 1 | 45 | 6 | | upgradeAssistant | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 | | uptime | [Uptime](https://github.com/orgs/elastic/teams/uptime) | This plugin visualizes data from Synthetics and Heartbeat, and integrates with other Observability solutions. | 0 | 0 | 0 | 0 | | urlDrilldown | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds drilldown implementations to Kibana | 0 | 0 | 0 | 0 | @@ -169,6 +170,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | Package name           | Maintaining team | Description | API Cnt | Any Cnt | Missing
comments | Missing
exports | |--------------|----------------|-----------|--------------|----------|---------------|--------| +| | [Owner missing] | - | 82 | 1 | 11 | 0 | | | [Owner missing] | Elastic APM trace data generator | 62 | 0 | 62 | 9 | | | [Owner missing] | elasticsearch datemath parser, used in kibana | 44 | 0 | 43 | 0 | | | [Owner missing] | - | 11 | 5 | 11 | 0 | @@ -187,6 +189,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | [Owner missing] | - | 1 | 0 | 1 | 0 | | | [Owner missing] | - | 27 | 0 | 14 | 1 | | | [Owner missing] | - | 213 | 1 | 159 | 11 | +| | [Owner missing] | - | 13 | 0 | 6 | 0 | | | [Owner missing] | - | 20 | 0 | 16 | 0 | | | [Owner missing] | - | 1 | 0 | 0 | 0 | | | [Owner missing] | - | 51 | 0 | 48 | 0 | @@ -219,7 +222,7 @@ warning: This document is auto-generated and is meant to be viewed inside our ex | | [Owner missing] | security solution utilities to use across plugins such lists, security_solution, cases, etc... | 31 | 0 | 29 | 0 | | | [Owner missing] | - | 53 | 0 | 50 | 1 | | | [Owner missing] | - | 25 | 0 | 24 | 1 | -| | [Owner missing] | - | 28 | 0 | 4 | 3 | +| | [Owner missing] | - | 32 | 0 | 4 | 4 | | | [Owner missing] | - | 67 | 0 | 43 | 0 | | | [Owner missing] | - | 10 | 0 | 2 | 0 | | | [Owner missing] | - | 9 | 0 | 3 | 0 | diff --git a/api_docs/presentation_util.mdx b/api_docs/presentation_util.mdx index ce0f50cfc3aa1..ad2ac1542b0e2 100644 --- a/api_docs/presentation_util.mdx +++ b/api_docs/presentation_util.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/presentationUtil title: "presentationUtil" image: https://source.unsplash.com/400x175/?github summary: API docs for the presentationUtil plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'presentationUtil'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/remote_clusters.mdx b/api_docs/remote_clusters.mdx index 6f7bf55ef4b03..b4d4cc4459eb6 100644 --- a/api_docs/remote_clusters.mdx +++ b/api_docs/remote_clusters.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/remoteClusters title: "remoteClusters" image: https://source.unsplash.com/400x175/?github summary: API docs for the remoteClusters plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'remoteClusters'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/reporting.mdx b/api_docs/reporting.mdx index 122bb403b6b02..976c1fc50da8d 100644 --- a/api_docs/reporting.mdx +++ b/api_docs/reporting.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/reporting title: "reporting" image: https://source.unsplash.com/400x175/?github summary: API docs for the reporting plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'reporting'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/rollup.mdx b/api_docs/rollup.mdx index fcb31da37804c..febdb7ef3b9de 100644 --- a/api_docs/rollup.mdx +++ b/api_docs/rollup.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/rollup title: "rollup" image: https://source.unsplash.com/400x175/?github summary: API docs for the rollup plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'rollup'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/rule_registry.devdocs.json b/api_docs/rule_registry.devdocs.json index 2b623199d9ae8..7bf4b15d0ef30 100644 --- a/api_docs/rule_registry.devdocs.json +++ b/api_docs/rule_registry.devdocs.json @@ -95,8 +95,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, " = never>({ id, status, _version, index, }: ", "UpdateOptions", @@ -142,8 +142,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, " = never>({ ids, query, index, status, }: ", "BulkUpdateOptions", @@ -187,8 +187,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, " = never>({ query, aggs, _source, track_total_hits: trackTotalHits, size, index, }: { query?: object | undefined; aggs?: object | undefined; index: string | undefined; track_total_hits?: boolean | undefined; _source?: string[] | undefined; size?: number | undefined; }) => Promise<", "SearchResponse", @@ -1136,16 +1136,16 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, " = never, State extends ", { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeState", - "text": "AlertTypeState" + "section": "def-common.RuleTypeState", + "text": "RuleTypeState" }, " = never, InstanceState extends { [x: string]: unknown; } = never, InstanceContext extends { [x: string]: unknown; } = never, ActionGroupIds extends string = never>(wrappedExecutor: ", { @@ -1160,8 +1160,8 @@ "pluginId": "alerting", "scope": "server", "docId": "kibAlertingPluginApi", - "section": "def-server.AlertExecutorOptions", - "text": "AlertExecutorOptions" + "section": "def-server.RuleExecutorOptions", + "text": "RuleExecutorOptions" }, "(type: ", { @@ -1363,8 +1363,8 @@ "pluginId": "alerting", "scope": "server", "docId": "kibAlertingPluginApi", - "section": "def-server.AlertExecutorOptions", - "text": "AlertExecutorOptions" + "section": "def-server.RuleExecutorOptions", + "text": "RuleExecutorOptions" }, ">) => Promise; id: string; name: string; validate?: { params?: ", - "AlertTypeParamsValidator", + "RuleTypeParamsValidator", " | undefined; } | undefined; cancelAlertsOnRuleTimeout?: boolean | undefined; config?: ", "RuleTypeConfig", " | undefined; actionGroups: ", @@ -2863,16 +2863,16 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, ", TState extends ", { "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeState", - "text": "AlertTypeState" + "section": "def-common.RuleTypeState", + "text": "RuleTypeState" }, ", TInstanceContext extends { [x: string]: unknown; } = {}, TActionGroupIds extends string = never>(type: ", { @@ -3029,16 +3029,16 @@ "pluginId": "alerting", "scope": "server", "docId": "kibAlertingPluginApi", - "section": "def-server.AlertExecutorOptions", - "text": "AlertExecutorOptions" + "section": "def-server.RuleExecutorOptions", + "text": "RuleExecutorOptions" }, ", \"services\"> & { services: ", { "pluginId": "alerting", "scope": "server", "docId": "kibAlertingPluginApi", - "section": "def-server.AlertServices", - "text": "AlertServices" + "section": "def-server.RuleExecutorServices", + "text": "RuleExecutorServices" }, " & ", { @@ -3156,8 +3156,8 @@ "pluginId": "alerting", "scope": "server", "docId": "kibAlertingPluginApi", - "section": "def-server.AlertExecutorOptions", - "text": "AlertExecutorOptions" + "section": "def-server.RuleExecutorOptions", + "text": "RuleExecutorOptions" }, " | undefined; onCopyCapture?: React.ClipboardEventHandler | undefined; onCut?: React.ClipboardEventHandler | undefined; onCutCapture?: React.ClipboardEventHandler | undefined; onPaste?: React.ClipboardEventHandler | undefined; onPasteCapture?: React.ClipboardEventHandler | undefined; onCompositionEnd?: React.CompositionEventHandler | undefined; onCompositionEndCapture?: React.CompositionEventHandler | undefined; onCompositionStart?: React.CompositionEventHandler | undefined; onCompositionStartCapture?: React.CompositionEventHandler | undefined; onCompositionUpdate?: React.CompositionEventHandler | undefined; onCompositionUpdateCapture?: React.CompositionEventHandler | undefined; onFocus?: React.FocusEventHandler | undefined; onFocusCapture?: React.FocusEventHandler | undefined; onBlur?: React.FocusEventHandler | undefined; onBlurCapture?: React.FocusEventHandler | undefined; onChangeCapture?: React.FormEventHandler | undefined; onBeforeInput?: React.FormEventHandler | undefined; onBeforeInputCapture?: React.FormEventHandler | undefined; onInput?: React.FormEventHandler | undefined; onInputCapture?: React.FormEventHandler | undefined; onReset?: React.FormEventHandler | undefined; onResetCapture?: React.FormEventHandler | undefined; onSubmit?: React.FormEventHandler | undefined; onSubmitCapture?: React.FormEventHandler | undefined; onInvalid?: React.FormEventHandler | undefined; onInvalidCapture?: React.FormEventHandler | undefined; onLoad?: React.ReactEventHandler | undefined; onLoadCapture?: React.ReactEventHandler | undefined; onError?: React.ReactEventHandler | undefined; onErrorCapture?: React.ReactEventHandler | undefined; onKeyDownCapture?: React.KeyboardEventHandler | undefined; onKeyPress?: React.KeyboardEventHandler | undefined; onKeyPressCapture?: React.KeyboardEventHandler | undefined; onKeyUp?: React.KeyboardEventHandler | undefined; onKeyUpCapture?: React.KeyboardEventHandler | undefined; onAbort?: React.ReactEventHandler | undefined; onAbortCapture?: React.ReactEventHandler | undefined; onCanPlay?: React.ReactEventHandler | undefined; onCanPlayCapture?: React.ReactEventHandler | undefined; onCanPlayThrough?: React.ReactEventHandler | undefined; onCanPlayThroughCapture?: React.ReactEventHandler | undefined; onDurationChange?: React.ReactEventHandler | undefined; onDurationChangeCapture?: React.ReactEventHandler | undefined; onEmptied?: React.ReactEventHandler | undefined; onEmptiedCapture?: React.ReactEventHandler | undefined; onEncrypted?: React.ReactEventHandler | undefined; onEncryptedCapture?: React.ReactEventHandler | undefined; onEnded?: React.ReactEventHandler | undefined; onEndedCapture?: React.ReactEventHandler | undefined; onLoadedData?: React.ReactEventHandler | undefined; onLoadedDataCapture?: React.ReactEventHandler | undefined; onLoadedMetadata?: React.ReactEventHandler | undefined; onLoadedMetadataCapture?: React.ReactEventHandler | undefined; onLoadStart?: React.ReactEventHandler | undefined; onLoadStartCapture?: React.ReactEventHandler | undefined; onPause?: React.ReactEventHandler | undefined; onPauseCapture?: React.ReactEventHandler | undefined; onPlay?: React.ReactEventHandler | undefined; onPlayCapture?: React.ReactEventHandler | undefined; onPlaying?: React.ReactEventHandler | undefined; onPlayingCapture?: React.ReactEventHandler | undefined; onProgress?: React.ReactEventHandler | undefined; onProgressCapture?: React.ReactEventHandler | undefined; onRateChange?: React.ReactEventHandler | undefined; onRateChangeCapture?: React.ReactEventHandler | undefined; onSeeked?: React.ReactEventHandler | undefined; onSeekedCapture?: React.ReactEventHandler | undefined; onSeeking?: React.ReactEventHandler | undefined; onSeekingCapture?: React.ReactEventHandler | undefined; onStalled?: React.ReactEventHandler | undefined; onStalledCapture?: React.ReactEventHandler | undefined; onSuspend?: React.ReactEventHandler | undefined; onSuspendCapture?: React.ReactEventHandler | undefined; onTimeUpdate?: React.ReactEventHandler | undefined; onTimeUpdateCapture?: React.ReactEventHandler | undefined; onVolumeChange?: React.ReactEventHandler | undefined; onVolumeChangeCapture?: React.ReactEventHandler | undefined; onWaiting?: React.ReactEventHandler | undefined; onWaitingCapture?: React.ReactEventHandler | undefined; onAuxClick?: React.MouseEventHandler | undefined; onAuxClickCapture?: React.MouseEventHandler | undefined; onClickCapture?: React.MouseEventHandler | undefined; onContextMenu?: React.MouseEventHandler | undefined; onContextMenuCapture?: React.MouseEventHandler | undefined; onDoubleClick?: React.MouseEventHandler | undefined; onDoubleClickCapture?: React.MouseEventHandler | undefined; onDrag?: React.DragEventHandler | undefined; onDragCapture?: React.DragEventHandler | undefined; onDragEnd?: React.DragEventHandler | undefined; onDragEndCapture?: React.DragEventHandler | undefined; onDragEnter?: React.DragEventHandler | undefined; onDragEnterCapture?: React.DragEventHandler | undefined; onDragExit?: React.DragEventHandler | undefined; onDragExitCapture?: React.DragEventHandler | undefined; onDragLeave?: React.DragEventHandler | undefined; onDragLeaveCapture?: React.DragEventHandler | undefined; onDragOver?: React.DragEventHandler | undefined; onDragOverCapture?: React.DragEventHandler | undefined; onDragStart?: React.DragEventHandler | undefined; onDragStartCapture?: React.DragEventHandler | undefined; onDrop?: React.DragEventHandler | undefined; onDropCapture?: React.DragEventHandler | undefined; onMouseDown?: React.MouseEventHandler | undefined; onMouseDownCapture?: React.MouseEventHandler | undefined; onMouseEnter?: React.MouseEventHandler | undefined; onMouseLeave?: React.MouseEventHandler | undefined; onMouseMove?: React.MouseEventHandler | undefined; onMouseMoveCapture?: React.MouseEventHandler | undefined; onMouseOut?: React.MouseEventHandler | undefined; onMouseOutCapture?: React.MouseEventHandler | undefined; onMouseOver?: React.MouseEventHandler | undefined; onMouseOverCapture?: React.MouseEventHandler | undefined; onMouseUp?: React.MouseEventHandler | undefined; onMouseUpCapture?: React.MouseEventHandler | undefined; onSelect?: React.ReactEventHandler | undefined; onSelectCapture?: React.ReactEventHandler | undefined; onTouchCancel?: React.TouchEventHandler | undefined; onTouchCancelCapture?: React.TouchEventHandler | undefined; onTouchEnd?: React.TouchEventHandler | undefined; onTouchEndCapture?: React.TouchEventHandler | undefined; onTouchMove?: React.TouchEventHandler | undefined; onTouchMoveCapture?: React.TouchEventHandler | undefined; onTouchStart?: React.TouchEventHandler | undefined; onTouchStartCapture?: React.TouchEventHandler | undefined; onPointerDown?: React.PointerEventHandler | undefined; onPointerDownCapture?: React.PointerEventHandler | undefined; onPointerMove?: React.PointerEventHandler | undefined; onPointerMoveCapture?: React.PointerEventHandler | undefined; onPointerUp?: React.PointerEventHandler | undefined; onPointerUpCapture?: React.PointerEventHandler | undefined; onPointerCancel?: React.PointerEventHandler | undefined; onPointerCancelCapture?: React.PointerEventHandler | undefined; onPointerEnter?: React.PointerEventHandler | undefined; onPointerEnterCapture?: React.PointerEventHandler | undefined; onPointerLeave?: React.PointerEventHandler | undefined; onPointerLeaveCapture?: React.PointerEventHandler | undefined; onPointerOver?: React.PointerEventHandler | undefined; onPointerOverCapture?: React.PointerEventHandler | undefined; onPointerOut?: React.PointerEventHandler | undefined; onPointerOutCapture?: React.PointerEventHandler | undefined; onGotPointerCapture?: React.PointerEventHandler | undefined; onGotPointerCaptureCapture?: React.PointerEventHandler | undefined; onLostPointerCapture?: React.PointerEventHandler | undefined; onLostPointerCaptureCapture?: React.PointerEventHandler | undefined; onScroll?: React.UIEventHandler | undefined; onScrollCapture?: React.UIEventHandler | undefined; onWheel?: React.WheelEventHandler | undefined; onWheelCapture?: React.WheelEventHandler | undefined; onAnimationStart?: React.AnimationEventHandler | undefined; onAnimationStartCapture?: React.AnimationEventHandler | undefined; onAnimationEnd?: React.AnimationEventHandler | undefined; onAnimationEndCapture?: React.AnimationEventHandler | undefined; onAnimationIteration?: React.AnimationEventHandler | undefined; onAnimationIterationCapture?: React.AnimationEventHandler | undefined; onTransitionEnd?: React.TransitionEventHandler | undefined; onTransitionEndCapture?: React.TransitionEventHandler | undefined; 'data-test-subj'?: string | undefined; width?: string | undefined; render?: ((value: any, record: ", + "; defaultValue?: string | number | string[] | undefined; hidden?: boolean | undefined; defaultChecked?: boolean | undefined; suppressContentEditableWarning?: boolean | undefined; suppressHydrationWarning?: boolean | undefined; accessKey?: string | undefined; contentEditable?: Booleanish | \"inherit\" | undefined; contextMenu?: string | undefined; dir?: string | undefined; draggable?: Booleanish | undefined; lang?: string | undefined; placeholder?: string | undefined; slot?: string | undefined; spellCheck?: Booleanish | undefined; style?: React.CSSProperties | undefined; tabIndex?: number | undefined; translate?: \"yes\" | \"no\" | undefined; radioGroup?: string | undefined; role?: string | undefined; about?: string | undefined; datatype?: string | undefined; inlist?: any; prefix?: string | undefined; property?: string | undefined; resource?: string | undefined; typeof?: string | undefined; vocab?: string | undefined; autoCapitalize?: string | undefined; autoCorrect?: string | undefined; autoSave?: string | undefined; itemProp?: string | undefined; itemScope?: boolean | undefined; itemType?: string | undefined; itemID?: string | undefined; itemRef?: string | undefined; results?: number | undefined; unselectable?: \"on\" | \"off\" | undefined; inputMode?: \"none\" | \"email\" | \"search\" | \"text\" | \"tel\" | \"url\" | \"numeric\" | \"decimal\" | undefined; is?: string | undefined; 'aria-activedescendant'?: string | undefined; 'aria-atomic'?: boolean | \"true\" | \"false\" | undefined; 'aria-autocomplete'?: \"none\" | \"list\" | \"inline\" | \"both\" | undefined; 'aria-busy'?: boolean | \"true\" | \"false\" | undefined; 'aria-checked'?: boolean | \"mixed\" | \"true\" | \"false\" | undefined; 'aria-colcount'?: number | undefined; 'aria-colindex'?: number | undefined; 'aria-colspan'?: number | undefined; 'aria-controls'?: string | undefined; 'aria-current'?: boolean | \"date\" | \"page\" | \"time\" | \"true\" | \"false\" | \"step\" | \"location\" | undefined; 'aria-describedby'?: string | undefined; 'aria-details'?: string | undefined; 'aria-disabled'?: boolean | \"true\" | \"false\" | undefined; 'aria-dropeffect'?: \"none\" | \"copy\" | \"link\" | \"execute\" | \"move\" | \"popup\" | undefined; 'aria-errormessage'?: string | undefined; 'aria-expanded'?: boolean | \"true\" | \"false\" | undefined; 'aria-flowto'?: string | undefined; 'aria-grabbed'?: boolean | \"true\" | \"false\" | undefined; 'aria-haspopup'?: boolean | \"grid\" | \"menu\" | \"true\" | \"false\" | \"listbox\" | \"tree\" | \"dialog\" | undefined; 'aria-hidden'?: boolean | \"true\" | \"false\" | undefined; 'aria-invalid'?: boolean | \"true\" | \"false\" | \"grammar\" | \"spelling\" | undefined; 'aria-keyshortcuts'?: string | undefined; 'aria-label'?: string | undefined; 'aria-labelledby'?: string | undefined; 'aria-level'?: number | undefined; 'aria-live'?: \"off\" | \"assertive\" | \"polite\" | undefined; 'aria-modal'?: boolean | \"true\" | \"false\" | undefined; 'aria-multiline'?: boolean | \"true\" | \"false\" | undefined; 'aria-multiselectable'?: boolean | \"true\" | \"false\" | undefined; 'aria-orientation'?: \"horizontal\" | \"vertical\" | undefined; 'aria-owns'?: string | undefined; 'aria-placeholder'?: string | undefined; 'aria-posinset'?: number | undefined; 'aria-pressed'?: boolean | \"mixed\" | \"true\" | \"false\" | undefined; 'aria-readonly'?: boolean | \"true\" | \"false\" | undefined; 'aria-relevant'?: \"all\" | \"text\" | \"additions\" | \"additions text\" | \"removals\" | undefined; 'aria-required'?: boolean | \"true\" | \"false\" | undefined; 'aria-roledescription'?: string | undefined; 'aria-rowcount'?: number | undefined; 'aria-rowindex'?: number | undefined; 'aria-rowspan'?: number | undefined; 'aria-selected'?: boolean | \"true\" | \"false\" | undefined; 'aria-setsize'?: number | undefined; 'aria-sort'?: \"none\" | \"other\" | \"ascending\" | \"descending\" | undefined; 'aria-valuemax'?: number | undefined; 'aria-valuemin'?: number | undefined; 'aria-valuenow'?: number | undefined; 'aria-valuetext'?: string | undefined; dangerouslySetInnerHTML?: { __html: string; } | undefined; onCopy?: React.ClipboardEventHandler | undefined; onCopyCapture?: React.ClipboardEventHandler | undefined; onCut?: React.ClipboardEventHandler | undefined; onCutCapture?: React.ClipboardEventHandler | undefined; onPaste?: React.ClipboardEventHandler | undefined; onPasteCapture?: React.ClipboardEventHandler | undefined; onCompositionEnd?: React.CompositionEventHandler | undefined; onCompositionEndCapture?: React.CompositionEventHandler | undefined; onCompositionStart?: React.CompositionEventHandler | undefined; onCompositionStartCapture?: React.CompositionEventHandler | undefined; onCompositionUpdate?: React.CompositionEventHandler | undefined; onCompositionUpdateCapture?: React.CompositionEventHandler | undefined; onFocus?: React.FocusEventHandler | undefined; onFocusCapture?: React.FocusEventHandler | undefined; onBlur?: React.FocusEventHandler | undefined; onBlurCapture?: React.FocusEventHandler | undefined; onChangeCapture?: React.FormEventHandler | undefined; onBeforeInput?: React.FormEventHandler | undefined; onBeforeInputCapture?: React.FormEventHandler | undefined; onInput?: React.FormEventHandler | undefined; onInputCapture?: React.FormEventHandler | undefined; onReset?: React.FormEventHandler | undefined; onResetCapture?: React.FormEventHandler | undefined; onSubmit?: React.FormEventHandler | undefined; onSubmitCapture?: React.FormEventHandler | undefined; onInvalid?: React.FormEventHandler | undefined; onInvalidCapture?: React.FormEventHandler | undefined; onLoad?: React.ReactEventHandler | undefined; onLoadCapture?: React.ReactEventHandler | undefined; onError?: React.ReactEventHandler | undefined; onErrorCapture?: React.ReactEventHandler | undefined; onKeyDownCapture?: React.KeyboardEventHandler | undefined; onKeyPress?: React.KeyboardEventHandler | undefined; onKeyPressCapture?: React.KeyboardEventHandler | undefined; onKeyUp?: React.KeyboardEventHandler | undefined; onKeyUpCapture?: React.KeyboardEventHandler | undefined; onAbort?: React.ReactEventHandler | undefined; onAbortCapture?: React.ReactEventHandler | undefined; onCanPlay?: React.ReactEventHandler | undefined; onCanPlayCapture?: React.ReactEventHandler | undefined; onCanPlayThrough?: React.ReactEventHandler | undefined; onCanPlayThroughCapture?: React.ReactEventHandler | undefined; onDurationChange?: React.ReactEventHandler | undefined; onDurationChangeCapture?: React.ReactEventHandler | undefined; onEmptied?: React.ReactEventHandler | undefined; onEmptiedCapture?: React.ReactEventHandler | undefined; onEncrypted?: React.ReactEventHandler | undefined; onEncryptedCapture?: React.ReactEventHandler | undefined; onEnded?: React.ReactEventHandler | undefined; onEndedCapture?: React.ReactEventHandler | undefined; onLoadedData?: React.ReactEventHandler | undefined; onLoadedDataCapture?: React.ReactEventHandler | undefined; onLoadedMetadata?: React.ReactEventHandler | undefined; onLoadedMetadataCapture?: React.ReactEventHandler | undefined; onLoadStart?: React.ReactEventHandler | undefined; onLoadStartCapture?: React.ReactEventHandler | undefined; onPause?: React.ReactEventHandler | undefined; onPauseCapture?: React.ReactEventHandler | undefined; onPlay?: React.ReactEventHandler | undefined; onPlayCapture?: React.ReactEventHandler | undefined; onPlaying?: React.ReactEventHandler | undefined; onPlayingCapture?: React.ReactEventHandler | undefined; onProgress?: React.ReactEventHandler | undefined; onProgressCapture?: React.ReactEventHandler | undefined; onRateChange?: React.ReactEventHandler | undefined; onRateChangeCapture?: React.ReactEventHandler | undefined; onSeeked?: React.ReactEventHandler | undefined; onSeekedCapture?: React.ReactEventHandler | undefined; onSeeking?: React.ReactEventHandler | undefined; onSeekingCapture?: React.ReactEventHandler | undefined; onStalled?: React.ReactEventHandler | undefined; onStalledCapture?: React.ReactEventHandler | undefined; onSuspend?: React.ReactEventHandler | undefined; onSuspendCapture?: React.ReactEventHandler | undefined; onTimeUpdate?: React.ReactEventHandler | undefined; onTimeUpdateCapture?: React.ReactEventHandler | undefined; onVolumeChange?: React.ReactEventHandler | undefined; onVolumeChangeCapture?: React.ReactEventHandler | undefined; onWaiting?: React.ReactEventHandler | undefined; onWaitingCapture?: React.ReactEventHandler | undefined; onAuxClick?: React.MouseEventHandler | undefined; onAuxClickCapture?: React.MouseEventHandler | undefined; onClickCapture?: React.MouseEventHandler | undefined; onContextMenu?: React.MouseEventHandler | undefined; onContextMenuCapture?: React.MouseEventHandler | undefined; onDoubleClick?: React.MouseEventHandler | undefined; onDoubleClickCapture?: React.MouseEventHandler | undefined; onDrag?: React.DragEventHandler | undefined; onDragCapture?: React.DragEventHandler | undefined; onDragEnd?: React.DragEventHandler | undefined; onDragEndCapture?: React.DragEventHandler | undefined; onDragEnter?: React.DragEventHandler | undefined; onDragEnterCapture?: React.DragEventHandler | undefined; onDragExit?: React.DragEventHandler | undefined; onDragExitCapture?: React.DragEventHandler | undefined; onDragLeave?: React.DragEventHandler | undefined; onDragLeaveCapture?: React.DragEventHandler | undefined; onDragOver?: React.DragEventHandler | undefined; onDragOverCapture?: React.DragEventHandler | undefined; onDragStart?: React.DragEventHandler | undefined; onDragStartCapture?: React.DragEventHandler | undefined; onDrop?: React.DragEventHandler | undefined; onDropCapture?: React.DragEventHandler | undefined; onMouseDown?: React.MouseEventHandler | undefined; onMouseDownCapture?: React.MouseEventHandler | undefined; onMouseEnter?: React.MouseEventHandler | undefined; onMouseLeave?: React.MouseEventHandler | undefined; onMouseMove?: React.MouseEventHandler | undefined; onMouseMoveCapture?: React.MouseEventHandler | undefined; onMouseOut?: React.MouseEventHandler | undefined; onMouseOutCapture?: React.MouseEventHandler | undefined; onMouseOver?: React.MouseEventHandler | undefined; onMouseOverCapture?: React.MouseEventHandler | undefined; onMouseUp?: React.MouseEventHandler | undefined; onMouseUpCapture?: React.MouseEventHandler | undefined; onSelect?: React.ReactEventHandler | undefined; onSelectCapture?: React.ReactEventHandler | undefined; onTouchCancel?: React.TouchEventHandler | undefined; onTouchCancelCapture?: React.TouchEventHandler | undefined; onTouchEnd?: React.TouchEventHandler | undefined; onTouchEndCapture?: React.TouchEventHandler | undefined; onTouchMove?: React.TouchEventHandler | undefined; onTouchMoveCapture?: React.TouchEventHandler | undefined; onTouchStart?: React.TouchEventHandler | undefined; onTouchStartCapture?: React.TouchEventHandler | undefined; onPointerDown?: React.PointerEventHandler | undefined; onPointerDownCapture?: React.PointerEventHandler | undefined; onPointerMove?: React.PointerEventHandler | undefined; onPointerMoveCapture?: React.PointerEventHandler | undefined; onPointerUp?: React.PointerEventHandler | undefined; onPointerUpCapture?: React.PointerEventHandler | undefined; onPointerCancel?: React.PointerEventHandler | undefined; onPointerCancelCapture?: React.PointerEventHandler | undefined; onPointerEnter?: React.PointerEventHandler | undefined; onPointerEnterCapture?: React.PointerEventHandler | undefined; onPointerLeave?: React.PointerEventHandler | undefined; onPointerLeaveCapture?: React.PointerEventHandler | undefined; onPointerOver?: React.PointerEventHandler | undefined; onPointerOverCapture?: React.PointerEventHandler | undefined; onPointerOut?: React.PointerEventHandler | undefined; onPointerOutCapture?: React.PointerEventHandler | undefined; onGotPointerCapture?: React.PointerEventHandler | undefined; onGotPointerCaptureCapture?: React.PointerEventHandler | undefined; onLostPointerCapture?: React.PointerEventHandler | undefined; onLostPointerCaptureCapture?: React.PointerEventHandler | undefined; onScroll?: React.UIEventHandler | undefined; onScrollCapture?: React.UIEventHandler | undefined; onWheel?: React.WheelEventHandler | undefined; onWheelCapture?: React.WheelEventHandler | undefined; onAnimationStart?: React.AnimationEventHandler | undefined; onAnimationStartCapture?: React.AnimationEventHandler | undefined; onAnimationEnd?: React.AnimationEventHandler | undefined; onAnimationEndCapture?: React.AnimationEventHandler | undefined; onAnimationIteration?: React.AnimationEventHandler | undefined; onAnimationIterationCapture?: React.AnimationEventHandler | undefined; onTransitionEnd?: React.TransitionEventHandler | undefined; onTransitionEndCapture?: React.TransitionEventHandler | undefined; 'data-test-subj'?: string | undefined; render?: ((value: any, record: ", { "pluginId": "savedObjectsManagement", "scope": "public", @@ -294,7 +294,7 @@ "section": "def-public.SavedObjectsManagementRecord", "text": "SavedObjectsManagementRecord" }, - ") => React.ReactNode) | undefined; readOnly?: boolean | undefined; align?: ", + ") => React.ReactNode) | undefined; width?: string | undefined; readOnly?: boolean | undefined; align?: ", "HorizontalAlignment", " | undefined; abbr?: string | undefined; footer?: string | React.ReactElement> | ((props: ", "EuiTableFooterProps", diff --git a/api_docs/saved_objects_management.mdx b/api_docs/saved_objects_management.mdx index 976a9d2eda8ae..19d9efeb08286 100644 --- a/api_docs/saved_objects_management.mdx +++ b/api_docs/saved_objects_management.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/savedObjectsManagement title: "savedObjectsManagement" image: https://source.unsplash.com/400x175/?github summary: API docs for the savedObjectsManagement plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsManagement'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/saved_objects_tagging.mdx b/api_docs/saved_objects_tagging.mdx index e8e6ea5d6cd30..10b3bdaa00b3f 100644 --- a/api_docs/saved_objects_tagging.mdx +++ b/api_docs/saved_objects_tagging.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/savedObjectsTagging title: "savedObjectsTagging" image: https://source.unsplash.com/400x175/?github summary: API docs for the savedObjectsTagging plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTagging'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/saved_objects_tagging_oss.mdx b/api_docs/saved_objects_tagging_oss.mdx index 89ce30b10e7cf..9d5079950e171 100644 --- a/api_docs/saved_objects_tagging_oss.mdx +++ b/api_docs/saved_objects_tagging_oss.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/savedObjectsTaggingOss title: "savedObjectsTaggingOss" image: https://source.unsplash.com/400x175/?github summary: API docs for the savedObjectsTaggingOss plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTaggingOss'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/screenshot_mode.mdx b/api_docs/screenshot_mode.mdx index 71394f207d496..ad29af1bd007a 100644 --- a/api_docs/screenshot_mode.mdx +++ b/api_docs/screenshot_mode.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/screenshotMode title: "screenshotMode" image: https://source.unsplash.com/400x175/?github summary: API docs for the screenshotMode plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotMode'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/screenshotting.mdx b/api_docs/screenshotting.mdx index a4fcac213a3e0..fb6bac64aa793 100644 --- a/api_docs/screenshotting.mdx +++ b/api_docs/screenshotting.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/screenshotting title: "screenshotting" image: https://source.unsplash.com/400x175/?github summary: API docs for the screenshotting plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotting'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/security.mdx b/api_docs/security.mdx index 026c00e70970c..c2ca4891fb327 100644 --- a/api_docs/security.mdx +++ b/api_docs/security.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/security title: "security" image: https://source.unsplash.com/400x175/?github summary: API docs for the security plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'security'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/security_solution.mdx b/api_docs/security_solution.mdx index 8bcd60c0cae56..52564d9c3f7ad 100644 --- a/api_docs/security_solution.mdx +++ b/api_docs/security_solution.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/securitySolution title: "securitySolution" image: https://source.unsplash.com/400x175/?github summary: API docs for the securitySolution plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolution'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/session_view.mdx b/api_docs/session_view.mdx index d224cde4395cb..8d8ff594c127f 100644 --- a/api_docs/session_view.mdx +++ b/api_docs/session_view.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/sessionView title: "sessionView" image: https://source.unsplash.com/400x175/?github summary: API docs for the sessionView plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'sessionView'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/share.mdx b/api_docs/share.mdx index f5914e2632561..04dfc6ca76d26 100644 --- a/api_docs/share.mdx +++ b/api_docs/share.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/share title: "share" image: https://source.unsplash.com/400x175/?github summary: API docs for the share plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'share'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/shared_u_x.mdx b/api_docs/shared_u_x.mdx index 94e2cb705bb76..555c0c3a3c255 100644 --- a/api_docs/shared_u_x.mdx +++ b/api_docs/shared_u_x.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/sharedUX title: "sharedUX" image: https://source.unsplash.com/400x175/?github summary: API docs for the sharedUX plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'sharedUX'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/snapshot_restore.mdx b/api_docs/snapshot_restore.mdx index 91ee3d1a59995..de02f4b4b2387 100644 --- a/api_docs/snapshot_restore.mdx +++ b/api_docs/snapshot_restore.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/snapshotRestore title: "snapshotRestore" image: https://source.unsplash.com/400x175/?github summary: API docs for the snapshotRestore plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'snapshotRestore'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/spaces.devdocs.json b/api_docs/spaces.devdocs.json index 2474be31bef20..24c3e5c55aeec 100644 --- a/api_docs/spaces.devdocs.json +++ b/api_docs/spaces.devdocs.json @@ -1929,6 +1929,21 @@ "deprecated": false, "children": [], "returnComment": [] + }, + { + "parentPluginId": "spaces", + "id": "def-public.SpaceListProps.cursorStyle", + "type": "string", + "tags": [], + "label": "cursorStyle", + "description": [ + "\nStyle for the cursor when mousing over space avatars." + ], + "signature": [ + "string | undefined" + ], + "path": "x-pack/plugins/spaces/public/space_list/types.ts", + "deprecated": false } ], "initialIsOpen": false diff --git a/api_docs/spaces.mdx b/api_docs/spaces.mdx index 41ad901adde42..cd2fa16dd5876 100644 --- a/api_docs/spaces.mdx +++ b/api_docs/spaces.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/spaces title: "spaces" image: https://source.unsplash.com/400x175/?github summary: API docs for the spaces plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'spaces'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Platform Security](https://github.com/orgs/elastic/teams/kibana-securit | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 259 | 0 | 64 | 0 | +| 260 | 0 | 64 | 0 | ## Client diff --git a/api_docs/stack_alerts.mdx b/api_docs/stack_alerts.mdx index 692a2ca5d80c0..c48f110748511 100644 --- a/api_docs/stack_alerts.mdx +++ b/api_docs/stack_alerts.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/stackAlerts title: "stackAlerts" image: https://source.unsplash.com/400x175/?github summary: API docs for the stackAlerts plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackAlerts'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/task_manager.mdx b/api_docs/task_manager.mdx index 9f73f27387abd..cade7c0b9b88e 100644 --- a/api_docs/task_manager.mdx +++ b/api_docs/task_manager.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/taskManager title: "taskManager" image: https://source.unsplash.com/400x175/?github summary: API docs for the taskManager plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'taskManager'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/telemetry.devdocs.json b/api_docs/telemetry.devdocs.json index 33ac6a757d48f..c95f1325348d3 100644 --- a/api_docs/telemetry.devdocs.json +++ b/api_docs/telemetry.devdocs.json @@ -647,7 +647,7 @@ ], "signature": [ "{ timestamp: string; cluster_uuid: string; cluster_name: string; version: string; cluster_stats: Omit<", - "ClusterStatsResponse", + "ClusterStatsStatsResponseBase", ", \"cluster_name\" | \"_nodes\">; collection: string; stack_stats: { data: ", { "pluginId": "telemetry", diff --git a/api_docs/telemetry.mdx b/api_docs/telemetry.mdx index 6226e32da8b1c..94652e3525420 100644 --- a/api_docs/telemetry.mdx +++ b/api_docs/telemetry.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/telemetry title: "telemetry" image: https://source.unsplash.com/400x175/?github summary: API docs for the telemetry plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetry'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/telemetry_collection_manager.devdocs.json b/api_docs/telemetry_collection_manager.devdocs.json index 97cdd58386164..c0bed4f0c9b72 100644 --- a/api_docs/telemetry_collection_manager.devdocs.json +++ b/api_docs/telemetry_collection_manager.devdocs.json @@ -113,7 +113,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -123,7 +123,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -131,7 +131,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -143,7 +143,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -153,7 +153,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -161,7 +161,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -169,7 +169,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -179,7 +179,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -187,7 +187,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -266,9 +266,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -401,7 +399,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -411,7 +409,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -419,7 +417,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -427,7 +425,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -437,7 +435,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -445,7 +443,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -516,29 +514,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -881,7 +879,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -891,7 +889,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -899,7 +897,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -926,29 +924,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -1204,6 +1202,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", diff --git a/api_docs/telemetry_collection_manager.mdx b/api_docs/telemetry_collection_manager.mdx index 8195ed66521b7..af2ea6cc6e530 100644 --- a/api_docs/telemetry_collection_manager.mdx +++ b/api_docs/telemetry_collection_manager.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionManager title: "telemetryCollectionManager" image: https://source.unsplash.com/400x175/?github summary: API docs for the telemetryCollectionManager plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionManager'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/telemetry_collection_xpack.mdx b/api_docs/telemetry_collection_xpack.mdx index 2db6ebd03274d..1034c582fe31a 100644 --- a/api_docs/telemetry_collection_xpack.mdx +++ b/api_docs/telemetry_collection_xpack.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionXpack title: "telemetryCollectionXpack" image: https://source.unsplash.com/400x175/?github summary: API docs for the telemetryCollectionXpack plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionXpack'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/telemetry_management_section.mdx b/api_docs/telemetry_management_section.mdx index a4a1b021024bc..7067c7e1d3ae6 100644 --- a/api_docs/telemetry_management_section.mdx +++ b/api_docs/telemetry_management_section.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/telemetryManagementSection title: "telemetryManagementSection" image: https://source.unsplash.com/400x175/?github summary: API docs for the telemetryManagementSection plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryManagementSection'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/timelines.devdocs.json b/api_docs/timelines.devdocs.json index 7018ab360d9fc..4853c844a07fe 100644 --- a/api_docs/timelines.devdocs.json +++ b/api_docs/timelines.devdocs.json @@ -517,7 +517,7 @@ "EuiDataGridColumn", ", \"id\" | \"display\" | \"displayAsText\" | \"initialWidth\"> & Pick<", "EuiDataGridColumn", - ", \"id\" | \"schema\" | \"display\" | \"actions\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", + ", \"id\" | \"schema\" | \"actions\" | \"display\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", "TGridCellAction", "[] | undefined; category?: string | undefined; columnHeaderType: ", { @@ -549,7 +549,7 @@ "EuiDataGridColumn", ", \"id\" | \"display\" | \"displayAsText\" | \"initialWidth\"> & Pick<", "EuiDataGridColumn", - ", \"id\" | \"schema\" | \"display\" | \"actions\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", + ", \"id\" | \"schema\" | \"actions\" | \"display\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", "TGridCellAction", "[] | undefined; category?: string | undefined; columnHeaderType: ", { @@ -2047,7 +2047,7 @@ "EuiDataGridColumn", ", \"id\" | \"display\" | \"displayAsText\" | \"initialWidth\"> & Pick<", "EuiDataGridColumn", - ", \"id\" | \"schema\" | \"display\" | \"actions\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", + ", \"id\" | \"schema\" | \"actions\" | \"display\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", "TGridCellAction", "[] | undefined; category?: string | undefined; columnHeaderType: ", { @@ -2598,7 +2598,7 @@ "EuiDataGridColumn", ", \"id\" | \"display\" | \"displayAsText\" | \"initialWidth\"> & Pick<", "EuiDataGridColumn", - ", \"id\" | \"schema\" | \"display\" | \"actions\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", + ", \"id\" | \"schema\" | \"actions\" | \"display\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", "TGridCellAction", "[] | undefined; category?: string | undefined; columnHeaderType: ", { @@ -2614,7 +2614,7 @@ "Filter", "[] | undefined; dataViewId: string | null; sort: ", "SortColumnTimeline", - "[]; version: string | null; isLoading: boolean; filterManager?: ", + "[]; version: string | null; filterManager?: ", { "pluginId": "data", "scope": "public", @@ -2626,7 +2626,7 @@ "EuiDataGridColumn", ", \"id\" | \"display\" | \"displayAsText\" | \"initialWidth\"> & Pick<", "EuiDataGridColumn", - ", \"id\" | \"schema\" | \"display\" | \"actions\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", + ", \"id\" | \"schema\" | \"actions\" | \"display\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", "TGridCellAction", "[] | undefined; category?: string | undefined; columnHeaderType: ", { @@ -2638,7 +2638,7 @@ }, "; description?: string | null | undefined; example?: string | number | null | undefined; format?: string | undefined; linkField?: string | undefined; placeholder?: string | undefined; subType?: ", "IFieldSubType", - " | undefined; type?: string | undefined; })[]; savedObjectId: string | null; dataProviders: ", + " | undefined; type?: string | undefined; })[]; savedObjectId: string | null; isLoading: boolean; dataProviders: ", { "pluginId": "timelines", "scope": "common", @@ -3747,7 +3747,7 @@ "signature": [ "Pick<", "EuiDataGridColumn", - ", \"id\" | \"schema\" | \"display\" | \"actions\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", + ", \"id\" | \"schema\" | \"actions\" | \"display\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", "TGridCellAction", "[] | undefined; category?: string | undefined; columnHeaderType: ", { @@ -5390,7 +5390,7 @@ "label": "language", "description": [], "signature": [ - "\"eql\" | \"lucene\" | \"kuery\"" + "\"eql\" | \"kuery\" | \"lucene\"" ], "path": "x-pack/plugins/timelines/common/search_strategy/timeline/events/all/index.ts", "deprecated": false @@ -6252,7 +6252,7 @@ "label": "AlertWorkflowStatus", "description": [], "signature": [ - "\"open\" | \"acknowledged\" | \"closed\"" + "\"open\" | \"closed\" | \"acknowledged\"" ], "path": "x-pack/plugins/timelines/common/types/timeline/actions/index.ts", "deprecated": false, @@ -6367,7 +6367,7 @@ "signature": [ "Pick<", "EuiDataGridColumn", - ", \"id\" | \"schema\" | \"display\" | \"actions\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", + ", \"id\" | \"schema\" | \"actions\" | \"display\" | \"defaultSortDirection\" | \"displayAsText\" | \"initialWidth\" | \"isSortable\"> & { aggregatable?: boolean | undefined; tGridCellActions?: ", "TGridCellAction", "[] | undefined; category?: string | undefined; columnHeaderType: ", { diff --git a/api_docs/timelines.mdx b/api_docs/timelines.mdx index 9b0fdb3821720..1c5a341eabe9a 100644 --- a/api_docs/timelines.mdx +++ b/api_docs/timelines.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/timelines title: "timelines" image: https://source.unsplash.com/400x175/?github summary: API docs for the timelines plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'timelines'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/transform.mdx b/api_docs/transform.mdx index 8b082a74f69d7..ea19c16ba59fe 100644 --- a/api_docs/transform.mdx +++ b/api_docs/transform.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/transform title: "transform" image: https://source.unsplash.com/400x175/?github summary: API docs for the transform plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'transform'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/triggers_actions_ui.devdocs.json b/api_docs/triggers_actions_ui.devdocs.json index 1688c97a8287c..16508005f0572 100644 --- a/api_docs/triggers_actions_ui.devdocs.json +++ b/api_docs/triggers_actions_ui.devdocs.json @@ -1103,8 +1103,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, ">[]; }>" ], @@ -1666,62 +1666,6 @@ ], "initialIsOpen": false }, - { - "parentPluginId": "triggersActionsUi", - "id": "def-public.AlertAction", - "type": "Interface", - "tags": [], - "label": "AlertAction", - "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "children": [ - { - "parentPluginId": "triggersActionsUi", - "id": "def-public.AlertAction.group", - "type": "string", - "tags": [], - "label": "group", - "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false - }, - { - "parentPluginId": "triggersActionsUi", - "id": "def-public.AlertAction.id", - "type": "string", - "tags": [], - "label": "id", - "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false - }, - { - "parentPluginId": "triggersActionsUi", - "id": "def-public.AlertAction.actionTypeId", - "type": "string", - "tags": [], - "label": "actionTypeId", - "description": [], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false - }, - { - "parentPluginId": "triggersActionsUi", - "id": "def-public.AlertAction.params", - "type": "Object", - "tags": [], - "label": "params", - "description": [], - "signature": [ - "SavedObjectAttributes" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false - } - ], - "initialIsOpen": false - }, { "parentPluginId": "triggersActionsUi", "id": "def-public.Comparator", @@ -1890,6 +1834,62 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "triggersActionsUi", + "id": "def-public.RuleAction", + "type": "Interface", + "tags": [], + "label": "RuleAction", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "triggersActionsUi", + "id": "def-public.RuleAction.group", + "type": "string", + "tags": [], + "label": "group", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "triggersActionsUi", + "id": "def-public.RuleAction.id", + "type": "string", + "tags": [], + "label": "id", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "triggersActionsUi", + "id": "def-public.RuleAction.actionTypeId", + "type": "string", + "tags": [], + "label": "actionTypeId", + "description": [], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + }, + { + "parentPluginId": "triggersActionsUi", + "id": "def-public.RuleAction.params", + "type": "Object", + "tags": [], + "label": "params", + "description": [], + "signature": [ + "SavedObjectAttributes" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "triggersActionsUi", "id": "def-public.RuleTableItem", @@ -1918,8 +1918,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, ">" ], @@ -2486,6 +2486,25 @@ ], "path": "x-pack/plugins/triggers_actions_ui/public/types.ts", "deprecated": false + }, + { + "parentPluginId": "triggersActionsUi", + "id": "def-public.RuleTypeParamsExpressionProps.unifiedSearch", + "type": "Object", + "tags": [], + "label": "unifiedSearch", + "description": [], + "signature": [ + { + "pluginId": "unifiedSearch", + "scope": "public", + "docId": "kibUnifiedSearchPluginApi", + "section": "def-public.UnifiedSearchPublicPluginStart", + "text": "UnifiedSearchPublicPluginStart" + } + ], + "path": "x-pack/plugins/triggers_actions_ui/public/types.ts", + "deprecated": false } ], "initialIsOpen": false @@ -2701,8 +2720,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, ">[]; get: (id: string) => ", { @@ -2717,8 +2736,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, ">; register: (objectType: ", { @@ -2733,8 +2752,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, ">) => void; has: (id: string) => boolean; }" ], @@ -2815,6 +2834,25 @@ ], "path": "x-pack/plugins/triggers_actions_ui/public/application/app.tsx", "deprecated": false + }, + { + "parentPluginId": "triggersActionsUi", + "id": "def-public.TriggersAndActionsUiServices.unifiedSearch", + "type": "Object", + "tags": [], + "label": "unifiedSearch", + "description": [], + "signature": [ + { + "pluginId": "unifiedSearch", + "scope": "public", + "docId": "kibUnifiedSearchPluginApi", + "section": "def-public.UnifiedSearchPublicPluginStart", + "text": "UnifiedSearchPublicPluginStart" + } + ], + "path": "x-pack/plugins/triggers_actions_ui/public/application/app.tsx", + "deprecated": false } ], "initialIsOpen": false @@ -2965,20 +3003,6 @@ "deprecated": false, "initialIsOpen": false }, - { - "parentPluginId": "triggersActionsUi", - "id": "def-public.AlertTypeParams", - "type": "Type", - "tags": [], - "label": "AlertTypeParams", - "description": [], - "signature": [ - "{ [x: string]: unknown; }" - ], - "path": "x-pack/plugins/alerting/common/alert.ts", - "deprecated": false, - "initialIsOpen": false - }, { "parentPluginId": "triggersActionsUi", "id": "def-public.AsApiContract", @@ -3020,8 +3044,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.SanitizedAlert", - "text": "SanitizedAlert" + "section": "def-common.SanitizedRule", + "text": "SanitizedRule" }, ", \"alertTypeId\"> & { ruleTypeId: string; }" ], @@ -3051,6 +3075,20 @@ "deprecated": false, "initialIsOpen": false }, + { + "parentPluginId": "triggersActionsUi", + "id": "def-public.RuleTypeParams", + "type": "Type", + "tags": [], + "label": "RuleTypeParams", + "description": [], + "signature": [ + "{ [x: string]: unknown; }" + ], + "path": "x-pack/plugins/alerting/common/rule.ts", + "deprecated": false, + "initialIsOpen": false + }, { "parentPluginId": "triggersActionsUi", "id": "def-public.RuleTypeRegistryContract", @@ -3072,8 +3110,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, ">[]; get: (id: string) => ", { @@ -3088,8 +3126,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, ">; register: (objectType: ", { @@ -3104,8 +3142,8 @@ "pluginId": "alerting", "scope": "common", "docId": "kibAlertingPluginApi", - "section": "def-common.AlertTypeParams", - "text": "AlertTypeParams" + "section": "def-common.RuleTypeParams", + "text": "RuleTypeParams" }, ">) => void; has: (id: string) => boolean; }" ], diff --git a/api_docs/triggers_actions_ui.mdx b/api_docs/triggers_actions_ui.mdx index 4ba01e01c926b..88c76bf1729fd 100644 --- a/api_docs/triggers_actions_ui.mdx +++ b/api_docs/triggers_actions_ui.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/triggersActionsUi title: "triggersActionsUi" image: https://source.unsplash.com/400x175/?github summary: API docs for the triggersActionsUi plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'triggersActionsUi'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- @@ -18,7 +18,7 @@ Contact [Response Ops](https://github.com/orgs/elastic/teams/response-ops) for q | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 302 | 0 | 288 | 23 | +| 304 | 0 | 290 | 23 | ## Client diff --git a/api_docs/ui_actions.mdx b/api_docs/ui_actions.mdx index 9718fbd9e9484..4bd49250ad905 100644 --- a/api_docs/ui_actions.mdx +++ b/api_docs/ui_actions.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/uiActions title: "uiActions" image: https://source.unsplash.com/400x175/?github summary: API docs for the uiActions plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActions'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/ui_actions_enhanced.mdx b/api_docs/ui_actions_enhanced.mdx index e7b4305df1087..51e13512c54de 100644 --- a/api_docs/ui_actions_enhanced.mdx +++ b/api_docs/ui_actions_enhanced.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/uiActionsEnhanced title: "uiActionsEnhanced" image: https://source.unsplash.com/400x175/?github summary: API docs for the uiActionsEnhanced plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActionsEnhanced'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/data_ui.devdocs.json b/api_docs/unified_search.devdocs.json similarity index 61% rename from api_docs/data_ui.devdocs.json rename to api_docs/unified_search.devdocs.json index 37756da83475a..5d2e50e061270 100644 --- a/api_docs/data_ui.devdocs.json +++ b/api_docs/unified_search.devdocs.json @@ -1,10 +1,10 @@ { - "id": "data.ui", + "id": "unifiedSearch", "client": { "classes": [], "functions": [ { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.FilterItem", "type": "Function", "tags": [], @@ -15,11 +15,11 @@ "FilterItemProps", ") => JSX.Element" ], - "path": "src/plugins/data/public/ui/filter_bar/index.tsx", + "path": "src/plugins/unified_search/public/filter_bar/index.tsx", "deprecated": false, "children": [ { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.FilterItem.$1", "type": "Object", "tags": [], @@ -28,7 +28,7 @@ "signature": [ "FilterItemProps" ], - "path": "src/plugins/data/public/ui/filter_bar/index.tsx", + "path": "src/plugins/unified_search/public/filter_bar/index.tsx", "deprecated": false, "isRequired": true } @@ -37,7 +37,7 @@ "initialIsOpen": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.FilterLabel", "type": "Function", "tags": [], @@ -48,11 +48,11 @@ "FilterLabelProps", ") => JSX.Element" ], - "path": "src/plugins/data/public/ui/filter_bar/index.tsx", + "path": "src/plugins/unified_search/public/filter_bar/index.tsx", "deprecated": false, "children": [ { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.FilterLabel.$1", "type": "Object", "tags": [], @@ -61,7 +61,7 @@ "signature": [ "FilterLabelProps" ], - "path": "src/plugins/data/public/ui/filter_bar/index.tsx", + "path": "src/plugins/unified_search/public/filter_bar/index.tsx", "deprecated": false, "isRequired": true } @@ -70,7 +70,7 @@ "initialIsOpen": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInput", "type": "Function", "tags": [], @@ -79,19 +79,19 @@ "signature": [ "(props: ", { - "pluginId": "data", + "pluginId": "unifiedSearch", "scope": "public", - "docId": "kibDataUiPluginApi", + "docId": "kibUnifiedSearchPluginApi", "section": "def-public.QueryStringInputProps", "text": "QueryStringInputProps" }, ") => JSX.Element" ], - "path": "src/plugins/data/public/ui/query_string_input/index.tsx", + "path": "src/plugins/unified_search/public/query_string_input/index.tsx", "deprecated": false, "children": [ { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInput.$1", "type": "Object", "tags": [], @@ -99,14 +99,14 @@ "description": [], "signature": [ { - "pluginId": "data", + "pluginId": "unifiedSearch", "scope": "public", - "docId": "kibDataUiPluginApi", + "docId": "kibUnifiedSearchPluginApi", "section": "def-public.QueryStringInputProps", "text": "QueryStringInputProps" } ], - "path": "src/plugins/data/public/ui/query_string_input/index.tsx", + "path": "src/plugins/unified_search/public/query_string_input/index.tsx", "deprecated": false, "isRequired": true } @@ -117,17 +117,83 @@ ], "interfaces": [ { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", + "id": "def-public.ApplyGlobalFilterActionContext", + "type": "Interface", + "tags": [], + "label": "ApplyGlobalFilterActionContext", + "description": [], + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "unifiedSearch", + "id": "def-public.ApplyGlobalFilterActionContext.filters", + "type": "Array", + "tags": [], + "label": "filters", + "description": [], + "signature": [ + "Filter", + "[]" + ], + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts", + "deprecated": false + }, + { + "parentPluginId": "unifiedSearch", + "id": "def-public.ApplyGlobalFilterActionContext.timeFieldName", + "type": "string", + "tags": [], + "label": "timeFieldName", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts", + "deprecated": false + }, + { + "parentPluginId": "unifiedSearch", + "id": "def-public.ApplyGlobalFilterActionContext.embeddable", + "type": "Unknown", + "tags": [], + "label": "embeddable", + "description": [], + "signature": [ + "unknown" + ], + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts", + "deprecated": false + }, + { + "parentPluginId": "unifiedSearch", + "id": "def-public.ApplyGlobalFilterActionContext.controlledBy", + "type": "string", + "tags": [], + "label": "controlledBy", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts", + "deprecated": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps", "type": "Interface", "tags": [], "label": "QueryStringInputProps", "description": [], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false, "children": [ { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.indexPatterns", "type": "Array", "tags": [], @@ -144,11 +210,11 @@ }, ")[]" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.query", "type": "Object", "tags": [], @@ -157,11 +223,11 @@ "signature": [ "{ query: string | { [key: string]: any; }; language: string; }" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.disableAutoFocus", "type": "CompoundType", "tags": [], @@ -170,11 +236,11 @@ "signature": [ "boolean | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.screenTitle", "type": "string", "tags": [], @@ -183,11 +249,11 @@ "signature": [ "string | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.prepend", "type": "Any", "tags": [], @@ -196,25 +262,31 @@ "signature": [ "any" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.persistedLog", "type": "Object", "tags": [], "label": "persistedLog", "description": [], "signature": [ - "PersistedLog", + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.PersistedLog", + "text": "PersistedLog" + }, " | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.bubbleSubmitEvent", "type": "CompoundType", "tags": [], @@ -223,11 +295,11 @@ "signature": [ "boolean | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.placeholder", "type": "string", "tags": [], @@ -236,11 +308,11 @@ "signature": [ "string | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.disableLanguageSwitcher", "type": "CompoundType", "tags": [], @@ -249,11 +321,11 @@ "signature": [ "boolean | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.languageSwitcherPopoverAnchorPosition", "type": "CompoundType", "tags": [], @@ -262,11 +334,11 @@ "signature": [ "\"upCenter\" | \"upLeft\" | \"upRight\" | \"downCenter\" | \"downLeft\" | \"downRight\" | \"leftCenter\" | \"leftUp\" | \"leftDown\" | \"rightCenter\" | \"rightUp\" | \"rightDown\" | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.onBlur", "type": "Function", "tags": [], @@ -275,13 +347,13 @@ "signature": [ "(() => void) | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false, "children": [], "returnComment": [] }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.onChange", "type": "Function", "tags": [], @@ -292,11 +364,11 @@ "Query", ") => void) | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false, "children": [ { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.onChange.$1", "type": "Object", "tags": [], @@ -305,7 +377,7 @@ "signature": [ "Query" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false, "isRequired": true } @@ -313,7 +385,7 @@ "returnComment": [] }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.onChangeQueryInputFocus", "type": "Function", "tags": [], @@ -322,11 +394,11 @@ "signature": [ "((isFocused: boolean) => void) | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false, "children": [ { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.onChangeQueryInputFocus.$1", "type": "boolean", "tags": [], @@ -335,7 +407,7 @@ "signature": [ "boolean" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false, "isRequired": true } @@ -343,7 +415,7 @@ "returnComment": [] }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.onSubmit", "type": "Function", "tags": [], @@ -354,11 +426,11 @@ "Query", ") => void) | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false, "children": [ { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.onSubmit.$1", "type": "Object", "tags": [], @@ -367,7 +439,7 @@ "signature": [ "Query" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false, "isRequired": true } @@ -375,7 +447,7 @@ "returnComment": [] }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.submitOnBlur", "type": "CompoundType", "tags": [], @@ -384,11 +456,11 @@ "signature": [ "boolean | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.dataTestSubj", "type": "string", "tags": [], @@ -397,11 +469,11 @@ "signature": [ "string | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.size", "type": "CompoundType", "tags": [], @@ -411,11 +483,11 @@ "SuggestionsListSize", " | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.className", "type": "string", "tags": [], @@ -424,11 +496,11 @@ "signature": [ "string | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.isInvalid", "type": "CompoundType", "tags": [], @@ -437,11 +509,11 @@ "signature": [ "boolean | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.isClearable", "type": "CompoundType", "tags": [], @@ -450,11 +522,11 @@ "signature": [ "boolean | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.iconType", "type": "CompoundType", "tags": [], @@ -464,11 +536,11 @@ "IconType", " | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.nonKqlMode", "type": "CompoundType", "tags": [], @@ -477,11 +549,11 @@ "signature": [ "\"lucene\" | \"text\" | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.nonKqlModeHelpText", "type": "string", "tags": [], @@ -490,11 +562,11 @@ "signature": [ "string | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.autoSubmit", "type": "CompoundType", "tags": [], @@ -503,11 +575,11 @@ "signature": [ "boolean | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.storageKey", "type": "string", "tags": [], @@ -516,11 +588,11 @@ "signature": [ "string | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.QueryStringInputProps.timeRangeForSuggestionsOverride", "type": "CompoundType", "tags": [], @@ -531,7 +603,7 @@ "signature": [ "boolean | undefined" ], - "path": "src/plugins/data/public/ui/query_string_input/query_string_input.tsx", + "path": "src/plugins/unified_search/public/query_string_input/query_string_input.tsx", "deprecated": false } ], @@ -541,7 +613,21 @@ "enums": [], "misc": [ { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", + "id": "def-public.ACTION_GLOBAL_APPLY_FILTER", + "type": "string", + "tags": [], + "label": "ACTION_GLOBAL_APPLY_FILTER", + "description": [], + "signature": [ + "\"ACTION_GLOBAL_APPLY_FILTER\"" + ], + "path": "src/plugins/unified_search/public/actions/apply_filter_action.ts", + "deprecated": false, + "initialIsOpen": false + }, + { + "parentPluginId": "unifiedSearch", "id": "def-public.IndexPatternSelectProps", "type": "Type", "tags": [], @@ -555,12 +641,12 @@ "EuiComboBoxProps", ", \"onChange\" | \"selectedOptions\" | \"options\" | \"isLoading\" | \"onSearchChange\">, \"placeholder\">> & { onChange: (indexPatternId?: string | undefined) => void; indexPatternId: string; onNoIndexPatterns?: (() => void) | undefined; }" ], - "path": "src/plugins/data/public/ui/index_pattern_select/index_pattern_select.tsx", + "path": "src/plugins/unified_search/public/index_pattern_select/index_pattern_select.tsx", "deprecated": false, "initialIsOpen": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.SearchBar", "type": "CompoundType", "tags": [], @@ -571,20 +657,20 @@ "SearchBarOwnProps", " & ", "SearchBarInjectedDeps", - ", \"kibana\">, keyof ", + ", \"kibana\">, \"timeHistory\" | keyof ", "SearchBarOwnProps", - " | \"timeHistory\" | \"onFiltersUpdated\" | \"onRefreshChange\">, any> & { WrappedComponent: React.ComponentType, any> & { WrappedComponent: React.ComponentType & ReactIntl.InjectedIntlProps>; }" ], - "path": "src/plugins/data/public/ui/search_bar/index.tsx", + "path": "src/plugins/unified_search/public/search_bar/index.tsx", "deprecated": false, "initialIsOpen": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.SearchBarProps", "type": "Type", "tags": [], @@ -595,12 +681,12 @@ " & ", "SearchBarInjectedDeps" ], - "path": "src/plugins/data/public/ui/search_bar/search_bar.tsx", + "path": "src/plugins/unified_search/public/search_bar/search_bar.tsx", "deprecated": false, "initialIsOpen": false }, { - "parentPluginId": "data", + "parentPluginId": "unifiedSearch", "id": "def-public.StatefulSearchBarProps", "type": "Type", "tags": [], @@ -610,12 +696,43 @@ "SearchBarOwnProps", " & { appName: string; useDefaultBehaviors?: boolean | undefined; savedQueryId?: string | undefined; onSavedQueryIdChange?: ((savedQueryId?: string | undefined) => void) | undefined; }" ], - "path": "src/plugins/data/public/ui/search_bar/create_search_bar.tsx", + "path": "src/plugins/unified_search/public/search_bar/create_search_bar.tsx", "deprecated": false, "initialIsOpen": false } ], - "objects": [] + "objects": [], + "start": { + "parentPluginId": "unifiedSearch", + "id": "def-public.UnifiedSearchPublicPluginStart", + "type": "Interface", + "tags": [], + "label": "UnifiedSearchPublicPluginStart", + "description": [ + "\nUnified search plugin public Start contract" + ], + "path": "src/plugins/unified_search/public/types.ts", + "deprecated": false, + "children": [ + { + "parentPluginId": "unifiedSearch", + "id": "def-public.UnifiedSearchPublicPluginStart.ui", + "type": "Object", + "tags": [], + "label": "ui", + "description": [ + "\nprewired UI components\n{@link DataPublicPluginStartUi}" + ], + "signature": [ + "UnifiedSearchPublicPluginStartUi" + ], + "path": "src/plugins/unified_search/public/types.ts", + "deprecated": false + } + ], + "lifecycle": "start", + "initialIsOpen": true + } }, "server": { "classes": [], diff --git a/api_docs/unified_search.mdx b/api_docs/unified_search.mdx new file mode 100644 index 0000000000000..5090a1f15bee8 --- /dev/null +++ b/api_docs/unified_search.mdx @@ -0,0 +1,36 @@ +--- +id: kibUnifiedSearchPluginApi +slug: /kibana-dev-docs/api/unifiedSearch +title: "unifiedSearch" +image: https://source.unsplash.com/400x175/?github +summary: API docs for the unifiedSearch plugin +date: 2022-04-05 +tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch'] +warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. +--- +import unifiedSearchObj from './unified_search.devdocs.json'; + +Contains all the key functionality of Kibana's unified search experience.Contains all the key functionality of Kibana's unified search experience. + +Contact [Unified Search](https://github.com/orgs/elastic/teams/kibana-app-services) for questions regarding this plugin. + +**Code health stats** + +| Public API count | Any count | Items lacking comments | Missing exports | +|-------------------|-----------|------------------------|-----------------| +| 48 | 1 | 45 | 6 | + +## Client + +### Start + + +### Functions + + +### Interfaces + + +### Consts, variables and types + + diff --git a/api_docs/url_forwarding.mdx b/api_docs/url_forwarding.mdx index ce5d58c8c1a41..49e61cb0452fe 100644 --- a/api_docs/url_forwarding.mdx +++ b/api_docs/url_forwarding.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/urlForwarding title: "urlForwarding" image: https://source.unsplash.com/400x175/?github summary: API docs for the urlForwarding plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'urlForwarding'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/usage_collection.devdocs.json b/api_docs/usage_collection.devdocs.json index 6c4c1a8bedc1e..46559368d5450 100644 --- a/api_docs/usage_collection.devdocs.json +++ b/api_docs/usage_collection.devdocs.json @@ -367,7 +367,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; (this: That, params: ", "CreateRequest", " | ", @@ -377,7 +377,7 @@ " | undefined): Promise<", "TransportResult", "<", - "CreateResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "CreateRequest", " | ", @@ -385,7 +385,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "CreateResponse", + "WriteResponseBase", ">; }; monitoring: ", "default", "; security: ", @@ -397,7 +397,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; (this: That, params: ", "IndexRequest", " | ", @@ -407,7 +407,7 @@ " | undefined): Promise<", "TransportResult", "<", - "IndexResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "IndexRequest", " | ", @@ -415,7 +415,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "IndexResponse", + "WriteResponseBase", ">; }; delete: { (this: That, params: ", "DeleteRequest", " | ", @@ -423,7 +423,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; (this: That, params: ", "DeleteRequest", " | ", @@ -433,7 +433,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteResponse", + "WriteResponseBase", ", unknown>>; (this: That, params: ", "DeleteRequest", " | ", @@ -441,7 +441,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteResponse", + "WriteResponseBase", ">; }; get: { (this: That, params: ", "GetRequest", " | ", @@ -520,9 +520,7 @@ "TransportRequestOptions", " | undefined): Promise<", "ClosePointInTimeResponse", - ">; }; transform: ", - "default", - "; helpers: ", + ">; }; helpers: ", "default", "; [kInternal]: symbol | null; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", "default", @@ -655,7 +653,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -665,7 +663,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ", unknown>>; (this: That, params: ", "DeleteByQueryRethrottleRequest", " | ", @@ -673,7 +671,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteByQueryRethrottleResponse", + "TasksTaskListResponseBase", ">; }; deleteScript: { (this: That, params: ", "DeleteScriptRequest", " | ", @@ -681,7 +679,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -691,7 +689,7 @@ " | undefined): Promise<", "TransportResult", "<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "DeleteScriptRequest", " | ", @@ -699,7 +697,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "DeleteScriptResponse", + "AcknowledgedResponseBase", ">; }; enrich: ", "default", "; exists: { (this: That, params: ", @@ -770,29 +768,29 @@ "ExplainResponse", ">; }; features: ", "default", - "; fieldCaps: { (this: That, params?: ", + "; fieldCaps: { (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "FieldCapsResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "FieldCapsResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "FieldCapsRequest", " | ", "FieldCapsRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "FieldCapsResponse", @@ -1135,7 +1133,7 @@ ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; (this: That, params: ", "PutScriptRequest", " | ", @@ -1145,7 +1143,7 @@ " | undefined): Promise<", "TransportResult", "<", - "PutScriptResponse", + "AcknowledgedResponseBase", ", unknown>>; (this: That, params: ", "PutScriptRequest", " | ", @@ -1153,7 +1151,7 @@ ", options?: ", "TransportRequestOptions", " | undefined): Promise<", - "PutScriptResponse", + "AcknowledgedResponseBase", ">; }; rankEval: { (this: That, params: ", "RankEvalRequest", " | ", @@ -1180,29 +1178,29 @@ "TransportRequestOptions", " | undefined): Promise<", "RankEvalResponse", - ">; }; reindex: { (this: That, params?: ", + ">; }; reindex: { (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithOutMeta", " | undefined): Promise<", "ReindexResponse", - ">; (this: That, params?: ", + ">; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptionsWithMeta", " | undefined): Promise<", "TransportResult", "<", "ReindexResponse", - ", unknown>>; (this: That, params?: ", + ", unknown>>; (this: That, params: ", "ReindexRequest", " | ", "ReindexRequest", - " | undefined, options?: ", + ", options?: ", "TransportRequestOptions", " | undefined): Promise<", "ReindexResponse", @@ -1458,6 +1456,8 @@ "TermvectorsResponse", ">; }; textStructure: ", "default", + "; transform: ", + "default", "; updateByQuery: { (this: That, params: ", "UpdateByQueryRequest", " | ", @@ -2187,12 +2187,12 @@ "tags": [], "label": "AllowedSchemaTypes", "description": [ - "\nPossible type values in the schema" + "\r\nPossible type values in the schema" ], "signature": [ "\"boolean\" | \"keyword\" | \"date\" | \"text\" | \"integer\" | \"long\" | \"short\" | \"byte\" | \"float\" | \"double\"" ], - "path": "src/plugins/usage_collection/server/collector/types.ts", + "path": "node_modules/@types/elastic__analytics/index.d.ts", "deprecated": false, "initialIsOpen": false }, diff --git a/api_docs/usage_collection.mdx b/api_docs/usage_collection.mdx index e329fc2368ef2..362ddd4e39eb8 100644 --- a/api_docs/usage_collection.mdx +++ b/api_docs/usage_collection.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/usageCollection title: "usageCollection" image: https://source.unsplash.com/400x175/?github summary: API docs for the usageCollection plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'usageCollection'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/ux.mdx b/api_docs/ux.mdx index 486a70d7409a0..6ccc23ba38612 100644 --- a/api_docs/ux.mdx +++ b/api_docs/ux.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/ux title: "ux" image: https://source.unsplash.com/400x175/?github summary: API docs for the ux plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ux'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/vis_default_editor.mdx b/api_docs/vis_default_editor.mdx index 768b41f8c9dab..c335a368d7b71 100644 --- a/api_docs/vis_default_editor.mdx +++ b/api_docs/vis_default_editor.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visDefaultEditor title: "visDefaultEditor" image: https://source.unsplash.com/400x175/?github summary: API docs for the visDefaultEditor plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visDefaultEditor'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/vis_type_gauge.mdx b/api_docs/vis_type_gauge.mdx index 71e51e5bbe6ad..f1504dbc739ba 100644 --- a/api_docs/vis_type_gauge.mdx +++ b/api_docs/vis_type_gauge.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visTypeGauge title: "visTypeGauge" image: https://source.unsplash.com/400x175/?github summary: API docs for the visTypeGauge plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeGauge'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/vis_type_heatmap.mdx b/api_docs/vis_type_heatmap.mdx index 003a2c7075272..e36cb3c375d3c 100644 --- a/api_docs/vis_type_heatmap.mdx +++ b/api_docs/vis_type_heatmap.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visTypeHeatmap title: "visTypeHeatmap" image: https://source.unsplash.com/400x175/?github summary: API docs for the visTypeHeatmap plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeHeatmap'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/vis_type_pie.mdx b/api_docs/vis_type_pie.mdx index 2581b91dbd51c..6fd8b8f633d78 100644 --- a/api_docs/vis_type_pie.mdx +++ b/api_docs/vis_type_pie.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visTypePie title: "visTypePie" image: https://source.unsplash.com/400x175/?github summary: API docs for the visTypePie plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypePie'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/vis_type_table.mdx b/api_docs/vis_type_table.mdx index ac3f81d346b75..9fb56a55bd2d9 100644 --- a/api_docs/vis_type_table.mdx +++ b/api_docs/vis_type_table.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visTypeTable title: "visTypeTable" image: https://source.unsplash.com/400x175/?github summary: API docs for the visTypeTable plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTable'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/vis_type_timelion.mdx b/api_docs/vis_type_timelion.mdx index 508f8cfcdd3cf..91e5141ff9cfd 100644 --- a/api_docs/vis_type_timelion.mdx +++ b/api_docs/vis_type_timelion.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visTypeTimelion title: "visTypeTimelion" image: https://source.unsplash.com/400x175/?github summary: API docs for the visTypeTimelion plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimelion'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/vis_type_timeseries.mdx b/api_docs/vis_type_timeseries.mdx index 7eb32bcc46969..ba5ac71899536 100644 --- a/api_docs/vis_type_timeseries.mdx +++ b/api_docs/vis_type_timeseries.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visTypeTimeseries title: "visTypeTimeseries" image: https://source.unsplash.com/400x175/?github summary: API docs for the visTypeTimeseries plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimeseries'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/vis_type_vega.mdx b/api_docs/vis_type_vega.mdx index d8c74d3dfa184..c978eed560309 100644 --- a/api_docs/vis_type_vega.mdx +++ b/api_docs/vis_type_vega.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visTypeVega title: "visTypeVega" image: https://source.unsplash.com/400x175/?github summary: API docs for the visTypeVega plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVega'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/vis_type_vislib.mdx b/api_docs/vis_type_vislib.mdx index 4e2c403803cb4..9638ab6b1db54 100644 --- a/api_docs/vis_type_vislib.mdx +++ b/api_docs/vis_type_vislib.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visTypeVislib title: "visTypeVislib" image: https://source.unsplash.com/400x175/?github summary: API docs for the visTypeVislib plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVislib'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/vis_type_xy.mdx b/api_docs/vis_type_xy.mdx index 4780c404f7133..6728cabe0e78c 100644 --- a/api_docs/vis_type_xy.mdx +++ b/api_docs/vis_type_xy.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visTypeXy title: "visTypeXy" image: https://source.unsplash.com/400x175/?github summary: API docs for the visTypeXy plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeXy'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/api_docs/visualizations.devdocs.json b/api_docs/visualizations.devdocs.json index a6f758e30e8a4..9cd950856997f 100644 --- a/api_docs/visualizations.devdocs.json +++ b/api_docs/visualizations.devdocs.json @@ -3158,7 +3158,7 @@ "label": "timefilter", "description": [], "signature": [ - "{ isTimeRangeSelectorEnabled: () => boolean; isAutoRefreshSelectorEnabled: () => boolean; isTimeTouched: () => boolean; getEnabledUpdated$: () => ", + "{ isTimeRangeSelectorEnabled: () => boolean; isAutoRefreshSelectorEnabled: () => boolean; isTimeTouched: () => boolean; isRefreshIntervalTouched: () => boolean; getEnabledUpdated$: () => ", "Observable", "; getTimeUpdate$: () => ", "Observable", diff --git a/api_docs/visualizations.mdx b/api_docs/visualizations.mdx index 532f802499ec0..abd99851677e0 100644 --- a/api_docs/visualizations.mdx +++ b/api_docs/visualizations.mdx @@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/visualizations title: "visualizations" image: https://source.unsplash.com/400x175/?github summary: API docs for the visualizations plugin -date: 2022-03-30 +date: 2022-04-05 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visualizations'] warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info. --- diff --git a/docs/development/core/public/kibana-plugin-core-public.analyticsservicesetup.md b/docs/development/core/public/kibana-plugin-core-public.analyticsservicesetup.md new file mode 100644 index 0000000000000..b1d059fe556b4 --- /dev/null +++ b/docs/development/core/public/kibana-plugin-core-public.analyticsservicesetup.md @@ -0,0 +1,13 @@ + + +[Home](./index.md) > [kibana-plugin-core-public](./kibana-plugin-core-public.md) > [AnalyticsServiceSetup](./kibana-plugin-core-public.analyticsservicesetup.md) + +## AnalyticsServiceSetup type + +Exposes the public APIs of the AnalyticsClient during the setup phase. + +Signature: + +```typescript +export declare type AnalyticsServiceSetup = AnalyticsClient; +``` diff --git a/docs/development/core/public/kibana-plugin-core-public.analyticsservicestart.md b/docs/development/core/public/kibana-plugin-core-public.analyticsservicestart.md new file mode 100644 index 0000000000000..9198bc7275046 --- /dev/null +++ b/docs/development/core/public/kibana-plugin-core-public.analyticsservicestart.md @@ -0,0 +1,13 @@ + + +[Home](./index.md) > [kibana-plugin-core-public](./kibana-plugin-core-public.md) > [AnalyticsServiceStart](./kibana-plugin-core-public.analyticsservicestart.md) + +## AnalyticsServiceStart type + +Exposes the public APIs of the AnalyticsClient during the start phase + +Signature: + +```typescript +export declare type AnalyticsServiceStart = Pick; +``` diff --git a/docs/development/core/public/kibana-plugin-core-public.applicationstart.md b/docs/development/core/public/kibana-plugin-core-public.applicationstart.md index eeb8ff3753f13..62128b840fb78 100644 --- a/docs/development/core/public/kibana-plugin-core-public.applicationstart.md +++ b/docs/development/core/public/kibana-plugin-core-public.applicationstart.md @@ -25,5 +25,5 @@ export interface ApplicationStart | --- | --- | | [getUrlForApp(appId, options)](./kibana-plugin-core-public.applicationstart.geturlforapp.md) | Returns the absolute path (or URL) to a given app, including the global base path.By default, it returns the absolute path of the application (e.g /basePath/app/my-app). Use the absolute option to generate an absolute url instead (e.g http://host:port/basePath/app/my-app)Note that when generating absolute urls, the origin (protocol, host and port) are determined from the browser's current location. | | [navigateToApp(appId, options)](./kibana-plugin-core-public.applicationstart.navigatetoapp.md) | Navigate to a given app | -| [navigateToUrl(url, options)](./kibana-plugin-core-public.applicationstart.navigatetourl.md) | Navigate to given URL in a SPA friendly way when possible (when the URL will redirect to a valid application within the current basePath).The method resolves pathnames the same way browsers do when resolving a <a href> value. The provided url can be: - an absolute URL - an absolute path - a path relative to the current URL (window.location.href)If all these criteria are true for the given URL: - (only for absolute URLs) The origin of the URL matches the origin of the browser's current location - The resolved pathname of the provided URL/path starts with the current basePath (eg. /mybasepath/s/my-space) - The pathname segment after the basePath matches any known application route (eg. /app// or any application's appRoute configuration)Then a SPA navigation will be performed using navigateToApp using the corresponding application and path. Otherwise, fallback to a full page reload to navigate to the url using window.location.assign | +| [navigateToUrl(url, options)](./kibana-plugin-core-public.applicationstart.navigatetourl.md) | Navigate to given URL in a SPA friendly way when possible (when the URL will redirect to a valid application within the current basePath).The method resolves pathnames the same way browsers do when resolving a <a href> value. The provided url can be: - an absolute URL - an absolute path - a path relative to the current URL (window.location.href)If all these criteria are true for the given URL: - (only for absolute URLs) The origin of the URL matches the origin of the browser's current location - The resolved pathname of the provided URL/path starts with the current basePath (eg. /mybasepath/s/my-space) - The pathname segment after the basePath matches any known application route (eg. /app// or any application's appRoute configuration)Then a SPA navigation will be performed using navigateToApp using the corresponding application and path. Otherwise, fallback to a full page reload to navigate to the url using window.location.assign. | diff --git a/docs/development/core/public/kibana-plugin-core-public.applicationstart.navigatetourl.md b/docs/development/core/public/kibana-plugin-core-public.applicationstart.navigatetourl.md index b7fbb12f12e29..601018c0cce45 100644 --- a/docs/development/core/public/kibana-plugin-core-public.applicationstart.navigatetourl.md +++ b/docs/development/core/public/kibana-plugin-core-public.applicationstart.navigatetourl.md @@ -10,7 +10,7 @@ The method resolves pathnames the same way browsers do when resolving a `/ or any application's `appRoute` configuration) -Then a SPA navigation will be performed using `navigateToApp` using the corresponding application and path. Otherwise, fallback to a full page reload to navigate to the url using `window.location.assign` +Then a SPA navigation will be performed using `navigateToApp` using the corresponding application and path. Otherwise, fallback to a full page reload to navigate to the url using `window.location.assign`. Signature: diff --git a/docs/development/core/public/kibana-plugin-core-public.coresetup.analytics.md b/docs/development/core/public/kibana-plugin-core-public.coresetup.analytics.md new file mode 100644 index 0000000000000..13c5fbdbee32d --- /dev/null +++ b/docs/development/core/public/kibana-plugin-core-public.coresetup.analytics.md @@ -0,0 +1,13 @@ + + +[Home](./index.md) > [kibana-plugin-core-public](./kibana-plugin-core-public.md) > [CoreSetup](./kibana-plugin-core-public.coresetup.md) > [analytics](./kibana-plugin-core-public.coresetup.analytics.md) + +## CoreSetup.analytics property + +[AnalyticsServiceSetup](./kibana-plugin-core-public.analyticsservicesetup.md) + +Signature: + +```typescript +analytics: AnalyticsServiceSetup; +``` diff --git a/docs/development/core/public/kibana-plugin-core-public.coresetup.md b/docs/development/core/public/kibana-plugin-core-public.coresetup.md index 31793ec6f7a58..0298ac904f952 100644 --- a/docs/development/core/public/kibana-plugin-core-public.coresetup.md +++ b/docs/development/core/public/kibana-plugin-core-public.coresetup.md @@ -16,6 +16,7 @@ export interface CoreSetup + +[Home](./index.md) > [kibana-plugin-core-public](./kibana-plugin-core-public.md) > [CoreStart](./kibana-plugin-core-public.corestart.md) > [analytics](./kibana-plugin-core-public.corestart.analytics.md) + +## CoreStart.analytics property + +[AnalyticsServiceStart](./kibana-plugin-core-public.analyticsservicestart.md) + +Signature: + +```typescript +analytics: AnalyticsServiceStart; +``` diff --git a/docs/development/core/public/kibana-plugin-core-public.corestart.md b/docs/development/core/public/kibana-plugin-core-public.corestart.md index edd80e1adb9f9..34576c4df2e40 100644 --- a/docs/development/core/public/kibana-plugin-core-public.corestart.md +++ b/docs/development/core/public/kibana-plugin-core-public.corestart.md @@ -16,6 +16,7 @@ export interface CoreStart | Property | Type | Description | | --- | --- | --- | +| [analytics](./kibana-plugin-core-public.corestart.analytics.md) | AnalyticsServiceStart | [AnalyticsServiceStart](./kibana-plugin-core-public.analyticsservicestart.md) | | [application](./kibana-plugin-core-public.corestart.application.md) | ApplicationStart | [ApplicationStart](./kibana-plugin-core-public.applicationstart.md) | | [chrome](./kibana-plugin-core-public.corestart.chrome.md) | ChromeStart | [ChromeStart](./kibana-plugin-core-public.chromestart.md) | | [deprecations](./kibana-plugin-core-public.corestart.deprecations.md) | DeprecationsServiceStart | [DeprecationsServiceStart](./kibana-plugin-core-public.deprecationsservicestart.md) | diff --git a/docs/development/core/public/kibana-plugin-core-public.md b/docs/development/core/public/kibana-plugin-core-public.md index 241cd378ebcda..54d68668a2e44 100644 --- a/docs/development/core/public/kibana-plugin-core-public.md +++ b/docs/development/core/public/kibana-plugin-core-public.md @@ -151,6 +151,8 @@ The plugin integrates with the core system via lifecycle events: `setup` | Type Alias | Description | | --- | --- | +| [AnalyticsServiceSetup](./kibana-plugin-core-public.analyticsservicesetup.md) | Exposes the public APIs of the AnalyticsClient during the setup phase. | +| [AnalyticsServiceStart](./kibana-plugin-core-public.analyticsservicestart.md) | Exposes the public APIs of the AnalyticsClient during the start phase | | [AppDeepLink](./kibana-plugin-core-public.appdeeplink.md) | Input type for registering secondary in-app locations for an application.Deep links must include at least one of path or deepLinks. A deep link that does not have a path represents a topological level in the application's hierarchy, but does not have a destination URL that is user-accessible. | | [AppLeaveAction](./kibana-plugin-core-public.appleaveaction.md) | Possible actions to return from a [AppLeaveHandler](./kibana-plugin-core-public.appleavehandler.md)See [AppLeaveConfirmAction](./kibana-plugin-core-public.appleaveconfirmaction.md) and [AppLeaveDefaultAction](./kibana-plugin-core-public.appleavedefaultaction.md) | | [AppLeaveHandler](./kibana-plugin-core-public.appleavehandler.md) | A handler that will be executed before leaving the application, either when going to another application or when closing the browser tab or manually changing the url. Should return confirm to prompt a message to the user before leaving the page, or default to keep the default behavior (doing nothing).See [AppMountParameters](./kibana-plugin-core-public.appmountparameters.md) for detailed usage examples. | diff --git a/docs/development/core/public/kibana-plugin-core-public.navigatetourloptions.forceredirect.md b/docs/development/core/public/kibana-plugin-core-public.navigatetourloptions.forceredirect.md index 1603524322dd7..a71196093a9a0 100644 --- a/docs/development/core/public/kibana-plugin-core-public.navigatetourloptions.forceredirect.md +++ b/docs/development/core/public/kibana-plugin-core-public.navigatetourloptions.forceredirect.md @@ -4,7 +4,7 @@ ## NavigateToUrlOptions.forceRedirect property -if true, will redirect directly to the url +if true will force a full page reload/refresh/assign, overriding the outcome of other url checks against current the location (effectively using `window.location.assign` instead of `push`) Signature: diff --git a/docs/development/core/public/kibana-plugin-core-public.navigatetourloptions.md b/docs/development/core/public/kibana-plugin-core-public.navigatetourloptions.md index ccf09e21189ef..2ee7b4f843c67 100644 --- a/docs/development/core/public/kibana-plugin-core-public.navigatetourloptions.md +++ b/docs/development/core/public/kibana-plugin-core-public.navigatetourloptions.md @@ -16,6 +16,6 @@ export interface NavigateToUrlOptions | Property | Type | Description | | --- | --- | --- | -| [forceRedirect?](./kibana-plugin-core-public.navigatetourloptions.forceredirect.md) | boolean | (Optional) if true, will redirect directly to the url | +| [forceRedirect?](./kibana-plugin-core-public.navigatetourloptions.forceredirect.md) | boolean | (Optional) if true will force a full page reload/refresh/assign, overriding the outcome of other url checks against current the location (effectively using window.location.assign instead of push) | | [skipAppLeave?](./kibana-plugin-core-public.navigatetourloptions.skipappleave.md) | boolean | (Optional) if true, will bypass the default onAppLeave behavior | diff --git a/docs/development/core/server/kibana-plugin-core-server.analyticsservicepreboot.md b/docs/development/core/server/kibana-plugin-core-server.analyticsservicepreboot.md new file mode 100644 index 0000000000000..d648455dde18d --- /dev/null +++ b/docs/development/core/server/kibana-plugin-core-server.analyticsservicepreboot.md @@ -0,0 +1,13 @@ + + +[Home](./index.md) > [kibana-plugin-core-server](./kibana-plugin-core-server.md) > [AnalyticsServicePreboot](./kibana-plugin-core-server.analyticsservicepreboot.md) + +## AnalyticsServicePreboot type + +Exposes the public APIs of the AnalyticsClient during the preboot phase + +Signature: + +```typescript +export declare type AnalyticsServicePreboot = AnalyticsClient; +``` diff --git a/docs/development/core/server/kibana-plugin-core-server.analyticsservicesetup.md b/docs/development/core/server/kibana-plugin-core-server.analyticsservicesetup.md new file mode 100644 index 0000000000000..aa84919848f24 --- /dev/null +++ b/docs/development/core/server/kibana-plugin-core-server.analyticsservicesetup.md @@ -0,0 +1,13 @@ + + +[Home](./index.md) > [kibana-plugin-core-server](./kibana-plugin-core-server.md) > [AnalyticsServiceSetup](./kibana-plugin-core-server.analyticsservicesetup.md) + +## AnalyticsServiceSetup type + +Exposes the public APIs of the AnalyticsClient during the setup phase. + +Signature: + +```typescript +export declare type AnalyticsServiceSetup = AnalyticsClient; +``` diff --git a/docs/development/core/server/kibana-plugin-core-server.analyticsservicestart.md b/docs/development/core/server/kibana-plugin-core-server.analyticsservicestart.md new file mode 100644 index 0000000000000..828577889da61 --- /dev/null +++ b/docs/development/core/server/kibana-plugin-core-server.analyticsservicestart.md @@ -0,0 +1,13 @@ + + +[Home](./index.md) > [kibana-plugin-core-server](./kibana-plugin-core-server.md) > [AnalyticsServiceStart](./kibana-plugin-core-server.analyticsservicestart.md) + +## AnalyticsServiceStart type + +Exposes the public APIs of the AnalyticsClient during the start phase + +Signature: + +```typescript +export declare type AnalyticsServiceStart = Pick; +``` diff --git a/docs/development/core/server/kibana-plugin-core-server.corepreboot.analytics.md b/docs/development/core/server/kibana-plugin-core-server.corepreboot.analytics.md new file mode 100644 index 0000000000000..b9846fa851b35 --- /dev/null +++ b/docs/development/core/server/kibana-plugin-core-server.corepreboot.analytics.md @@ -0,0 +1,13 @@ + + +[Home](./index.md) > [kibana-plugin-core-server](./kibana-plugin-core-server.md) > [CorePreboot](./kibana-plugin-core-server.corepreboot.md) > [analytics](./kibana-plugin-core-server.corepreboot.analytics.md) + +## CorePreboot.analytics property + +[AnalyticsServicePreboot](./kibana-plugin-core-server.analyticsservicepreboot.md) + +Signature: + +```typescript +analytics: AnalyticsServicePreboot; +``` diff --git a/docs/development/core/server/kibana-plugin-core-server.corepreboot.md b/docs/development/core/server/kibana-plugin-core-server.corepreboot.md index 3ac97d2ca3b37..027dca5362f8d 100644 --- a/docs/development/core/server/kibana-plugin-core-server.corepreboot.md +++ b/docs/development/core/server/kibana-plugin-core-server.corepreboot.md @@ -16,6 +16,7 @@ export interface CorePreboot | Property | Type | Description | | --- | --- | --- | +| [analytics](./kibana-plugin-core-server.corepreboot.analytics.md) | AnalyticsServicePreboot | [AnalyticsServicePreboot](./kibana-plugin-core-server.analyticsservicepreboot.md) | | [elasticsearch](./kibana-plugin-core-server.corepreboot.elasticsearch.md) | ElasticsearchServicePreboot | [ElasticsearchServicePreboot](./kibana-plugin-core-server.elasticsearchservicepreboot.md) | | [http](./kibana-plugin-core-server.corepreboot.http.md) | HttpServicePreboot | [HttpServicePreboot](./kibana-plugin-core-server.httpservicepreboot.md) | | [preboot](./kibana-plugin-core-server.corepreboot.preboot.md) | PrebootServicePreboot | [PrebootServicePreboot](./kibana-plugin-core-server.prebootservicepreboot.md) | diff --git a/docs/development/core/server/kibana-plugin-core-server.coresetup.analytics.md b/docs/development/core/server/kibana-plugin-core-server.coresetup.analytics.md new file mode 100644 index 0000000000000..3e6d8a5c2c230 --- /dev/null +++ b/docs/development/core/server/kibana-plugin-core-server.coresetup.analytics.md @@ -0,0 +1,13 @@ + + +[Home](./index.md) > [kibana-plugin-core-server](./kibana-plugin-core-server.md) > [CoreSetup](./kibana-plugin-core-server.coresetup.md) > [analytics](./kibana-plugin-core-server.coresetup.analytics.md) + +## CoreSetup.analytics property + +[AnalyticsServiceSetup](./kibana-plugin-core-server.analyticsservicesetup.md) + +Signature: + +```typescript +analytics: AnalyticsServiceSetup; +``` diff --git a/docs/development/core/server/kibana-plugin-core-server.coresetup.md b/docs/development/core/server/kibana-plugin-core-server.coresetup.md index 276a17f9aac89..9db55fd3865c3 100644 --- a/docs/development/core/server/kibana-plugin-core-server.coresetup.md +++ b/docs/development/core/server/kibana-plugin-core-server.coresetup.md @@ -16,6 +16,7 @@ export interface CoreSetup + +[Home](./index.md) > [kibana-plugin-core-server](./kibana-plugin-core-server.md) > [CoreStart](./kibana-plugin-core-server.corestart.md) > [analytics](./kibana-plugin-core-server.corestart.analytics.md) + +## CoreStart.analytics property + +[AnalyticsServiceStart](./kibana-plugin-core-server.analyticsservicestart.md) + +Signature: + +```typescript +analytics: AnalyticsServiceStart; +``` diff --git a/docs/development/core/server/kibana-plugin-core-server.corestart.md b/docs/development/core/server/kibana-plugin-core-server.corestart.md index 93ef386eb4447..31eecb0a5360c 100644 --- a/docs/development/core/server/kibana-plugin-core-server.corestart.md +++ b/docs/development/core/server/kibana-plugin-core-server.corestart.md @@ -16,6 +16,7 @@ export interface CoreStart | Property | Type | Description | | --- | --- | --- | +| [analytics](./kibana-plugin-core-server.corestart.analytics.md) | AnalyticsServiceStart | [AnalyticsServiceStart](./kibana-plugin-core-server.analyticsservicestart.md) | | [capabilities](./kibana-plugin-core-server.corestart.capabilities.md) | CapabilitiesStart | [CapabilitiesStart](./kibana-plugin-core-server.capabilitiesstart.md) | | [docLinks](./kibana-plugin-core-server.corestart.doclinks.md) | DocLinksServiceStart | [DocLinksServiceStart](./kibana-plugin-core-server.doclinksservicestart.md) | | [elasticsearch](./kibana-plugin-core-server.corestart.elasticsearch.md) | ElasticsearchServiceStart | [ElasticsearchServiceStart](./kibana-plugin-core-server.elasticsearchservicestart.md) | diff --git a/docs/development/core/server/kibana-plugin-core-server.md b/docs/development/core/server/kibana-plugin-core-server.md index 60bbd9af2c9d3..d142579e1ced3 100644 --- a/docs/development/core/server/kibana-plugin-core-server.md +++ b/docs/development/core/server/kibana-plugin-core-server.md @@ -253,6 +253,9 @@ The plugin integrates with the core system via lifecycle events: `setup` | Type Alias | Description | | --- | --- | +| [AnalyticsServicePreboot](./kibana-plugin-core-server.analyticsservicepreboot.md) | Exposes the public APIs of the AnalyticsClient during the preboot phase | +| [AnalyticsServiceSetup](./kibana-plugin-core-server.analyticsservicesetup.md) | Exposes the public APIs of the AnalyticsClient during the setup phase. | +| [AnalyticsServiceStart](./kibana-plugin-core-server.analyticsservicestart.md) | Exposes the public APIs of the AnalyticsClient during the start phase | | [AppenderConfigType](./kibana-plugin-core-server.appenderconfigtype.md) | | | [AuthenticationHandler](./kibana-plugin-core-server.authenticationhandler.md) | See [AuthToolkit](./kibana-plugin-core-server.authtoolkit.md). | | [AuthHeaders](./kibana-plugin-core-server.authheaders.md) | Auth Headers map | diff --git a/package.json b/package.json index f4cfe51b749c7..b07109e676a67 100644 --- a/package.json +++ b/package.json @@ -101,6 +101,7 @@ "@dnd-kit/core": "^3.1.1", "@dnd-kit/sortable": "^4.0.0", "@dnd-kit/utilities": "^2.0.0", + "@elastic/analytics": "link:bazel-bin/packages/elastic-analytics", "@elastic/apm-rum": "^5.10.2", "@elastic/apm-rum-react": "^1.3.4", "@elastic/apm-synthtrace": "link:bazel-bin/packages/elastic-apm-synthtrace", @@ -200,6 +201,7 @@ "@turf/distance": "6.0.1", "@turf/helpers": "6.0.1", "@turf/length": "^6.0.2", + "@types/elastic__analytics": "link:bazel-bin/packages/elastic-analytics/npm_module_types", "@types/jsonwebtoken": "^8.5.6", "@types/moment-duration-format": "^2.2.3", "JSONStream": "1.3.5", diff --git a/packages/BUILD.bazel b/packages/BUILD.bazel index 962aa8f0d9a29..8f86b74347f02 100644 --- a/packages/BUILD.bazel +++ b/packages/BUILD.bazel @@ -9,6 +9,7 @@ filegroup( name = "build_pkg_code", srcs = [ + "//packages/elastic-analytics:build", "//packages/elastic-apm-synthtrace:build", "//packages/elastic-datemath:build", "//packages/elastic-eslint-config-kibana:build", @@ -96,6 +97,7 @@ filegroup( filegroup( name = "build_pkg_types", srcs = [ + "//packages/elastic-analytics:build_types", "//packages/elastic-apm-synthtrace:build_types", "//packages/elastic-datemath:build_types", "//packages/elastic-safer-lodash-set:build_types", diff --git a/packages/elastic-analytics/BUILD.bazel b/packages/elastic-analytics/BUILD.bazel new file mode 100644 index 0000000000000..a73c908c7ea52 --- /dev/null +++ b/packages/elastic-analytics/BUILD.bazel @@ -0,0 +1,118 @@ +load("@npm//@bazel/typescript:index.bzl", "ts_config") +load("@build_bazel_rules_nodejs//:index.bzl", "js_library") +load("//src/dev/bazel:index.bzl", "jsts_transpiler", "pkg_npm", "pkg_npm_types", "ts_project") + +PKG_DIRNAME = "elastic-analytics" +PKG_REQUIRE_NAME = "@elastic/analytics" + +SOURCE_FILES = glob( + [ + "src/**/*.ts", + ], + exclude = [ + "**/*.test.*", + ], +) + +SRCS = SOURCE_FILES + +filegroup( + name = "srcs", + srcs = SRCS, +) + +NPM_MODULE_EXTRA_FILES = [ + "package.json", +] + +# In this array place runtime dependencies, including other packages and NPM packages +# which must be available for this code to run. +# +# To reference other packages use: +# "//repo/relative/path/to/package" +# eg. "//packages/kbn-utils" +# +# To reference a NPM package use: +# "@npm//name-of-package" +# eg. "@npm//lodash" +RUNTIME_DEPS = [ + "@npm//rxjs", +] + +# In this array place dependencies necessary to build the types, which will include the +# :npm_module_types target of other packages and packages from NPM, including @types/* +# packages. +# +# To reference the types for another package use: +# "//repo/relative/path/to/package:npm_module_types" +# eg. "//packages/kbn-utils:npm_module_types" +# +# References to NPM packages work the same as RUNTIME_DEPS +TYPES_DEPS = [ + "@npm//@types/node", + "@npm//@types/jest", + "@npm//rxjs", + "//packages/kbn-logging:npm_module_types", + "//packages/kbn-logging-mocks:npm_module_types", +] + +jsts_transpiler( + name = "target_node", + srcs = SRCS, + build_pkg_name = package_name(), +) + +ts_config( + name = "tsconfig", + src = "tsconfig.json", + deps = [ + "//:tsconfig.base.json", + "//:tsconfig.bazel.json", + ], +) + +ts_project( + name = "tsc_types", + args = ['--pretty'], + srcs = SRCS, + deps = TYPES_DEPS, + declaration = True, + emit_declaration_only = True, + out_dir = "target_types", + root_dir = "src", + tsconfig = ":tsconfig", +) + +js_library( + name = PKG_DIRNAME, + srcs = NPM_MODULE_EXTRA_FILES, + deps = RUNTIME_DEPS + [":target_node"], + package_name = PKG_REQUIRE_NAME, + visibility = ["//visibility:public"], +) + +pkg_npm( + name = "npm_module", + deps = [":" + PKG_DIRNAME], +) + +filegroup( + name = "build", + srcs = [":npm_module"], + visibility = ["//visibility:public"], +) + +pkg_npm_types( + name = "npm_module_types", + srcs = SRCS, + deps = [":tsc_types"], + package_name = PKG_REQUIRE_NAME, + tsconfig = ":tsconfig", + visibility = ["//visibility:public"], +) + +filegroup( + name = "build_types", + srcs = [":npm_module_types"], + visibility = ["//visibility:public"], +) diff --git a/packages/elastic-analytics/README.md b/packages/elastic-analytics/README.md new file mode 100644 index 0000000000000..f5cd01c811ac6 --- /dev/null +++ b/packages/elastic-analytics/README.md @@ -0,0 +1,331 @@ +# @elastic/analytics + +This module implements the Analytics client used for Event-Based Telemetry. The intention of the client is to be usable on both: the UI and the Server sides. + +## How to use it + +It all starts by creating the client with the `createAnalytics` API: + +```typescript +import { createAnalytics } from '@elastic/analytics'; + +const analytics = createAnalytics({ + // Set to `true` when running in developer mode. + // It enables development helpers like schema validation and extra debugging features. + isDev: false, + // Set to `staging` if you don't want your events to be sent to the production cluster. Useful for CI & QA environments. + sendTo: 'production', + // The application's instrumented logger + logger, +}); +``` + +### Reporting events + +Reporting events is as simple as calling the `reportEvent` API every time your application needs to track an event: + +```typescript +analytics.reportEvent('my_unique_event_name', myEventProperties); +``` + +But first, it requires a setup phase where the application must declare the event and the structure of the `eventProperties`: + +```typescript +analytics.registerEventType({ + eventType: 'my_unique_event_name', + schema: { + my_keyword: { + type: 'keyword', + _meta: { + description: 'Represents the key property...' + } + }, + my_number: { + type: 'long', + _meta: { + description: 'Indicates the number of times...', + optional: true + } + }, + my_complex_unknown_meta_object: { + type: 'pass_through', + _meta: { + description: 'Unknown object that contains the key-values...' + } + }, + my_array_of_str: { + type: 'array', + items: { + type: 'text', + _meta: { + description: 'List of tags...' + } + } + }, + my_object: { + properties: { + my_timestamp: { + type: 'date', + _meta: { + description: 'timestamp when the user...' + } + } + } + }, + my_array_of_objects: { + type: 'array', + items: { + properties: { + my_bool_prop: { + type: 'boolean', + _meta: { + description: '`true` when...' + } + } + } + } + } + } +}); +``` + +For more information about how to declare the schemas, refer to the section [Schema definition](#schema-definition). + +### Enriching events + +Context is important! For that reason, the client internally appends the timestamp in which the event was generated and any additional context provided by the Context Providers. To register a context provider use the `registerContextProvider` API: + +```typescript +analytics.registerContextProvider({ + name: 'my_context_provider', + // RxJS Observable that emits every time the context changes. For example: a License changes from `basic` to `trial`. + context$, + // Similar to the `reportEvent` API, schema defining the structure of the expected output of the context$ observable. + schema, +}) +``` + +### Setting the user's opt-in consent + +The client cannot send any data until the user provides consent. At the beginning, the client will internally enqueue any incoming events until the consent is either granted or refused. + +To set the user's selection use the `optIn` API: + +```typescript +analytics.optIn({ + global: { + enabled: true, // The user granted consent + shippers: { + shipperA: false, // Shipper A is explicitly disabled for all events + } + }, + event_types: { + my_unique_event_name: { + enabled: true, // The consent is explictly granted to send this type of event (only if global === true) + shippers: { + shipperB: false, // Shipper B is not allowed to report this event. + } + }, + my_other_event_name: { + enabled: false, // The consent is not granted to send this type of event. + } + } +}) +``` + +### Shipping events + +In order to report the event to an analytics tool, we need to register the shippers our application wants to use. To register a shipper use the API `registerShipper`: + +```typescript +analytics.registerShipper(ShipperClass, shipperOptions); +``` + +There are some prebuilt shippers in this package that can be enabled using the API above. Additionally, each application can register their own custom shippers. + +#### Prebuilt shippers + +TODO when actually implemented + +#### Custom shippers + +To use your own shipper, you just need to implement and register it!: + +```typescript +import type { + AnalyticsClientInitContext, + Event, + EventContext, + IShipper, + TelemetryCounter +} from '@elastic/analytics'; + +class MyVeryOwnShipper implements IShipper { + constructor(myOptions: MyOptions, initContext: AnalyticsClientInitContext) { + // ... + } + + public reportEvents(events: Event[]): void { + // Send the events to the analytics platform + } + public optIn(isOptedIn: boolean): void { + // Start/stop any sending mechanisms + } + + public extendContext(newContext: EventContext): void { + // Call any custom APIs to internally set the context + } + + // Emit any success/failed/dropped activity + public telemetryCounter$: Observable; +} + +// Register the custom shipper +analytics.registerShipper(MyVeryOwnShipper, myOptions); +``` + +### Schema definition + +Schemas are a framework that allows us to document the structure of the events that our application will report. It is useful to understand the meaning of the events that we report. And, at the same time, it serves as an extra validation step from the developer's point of view. + +The syntax of a schema is a _simplified ES mapping on steroids_: it removes some of the ES mapping complexity, and at the same time, it includes features that are specific to the telemetry collection. + +**DISCLAIMER:** **The schema is not a direct mapping to ES indices.** The final structure of how the event is stored will depend on many factors like the context providers, shippers and final analytics solution. + +#### Schema Specification: Primitive data types (`string`, `number`, `boolean`) + +When declaring primitive values like `string` or `number`, the basic schema must contain both: `type` and `_meta`. + +The `type` value depends on the type of the content to report in that field. Refer to the table below for the values allowed in the schema `type`: + +| Typescript `type` | Schema `type` | +|:-----------------:|:-----------------------:| +| `boolean` | `boolean` | +| `string` | `keyword` | +| `string` | `text` | +| `string` | `date` (for ISO format) | +| `number` | `date` (for ms format) | +| `number` | `byte` | +| `number` | `short` | +| `number` | `integer` | +| `number` | `long` | +| `number` | `double` | +| `number` | `float` | + +```typescript +const stringSchema: SchemaValue = { + type: 'text', + _meta: { + description: 'Description of the feature that was broken', + optional: false, + }, +} +``` + +For the `_meta`, refer to [Schema Specification: `_meta`](#schema-specification-_meta). + +#### Schema Specification: Objects + +Declaring the schema of an object contains 2 main attributes: `properties` and an optional `_meta`: + +The `properties` attribute is an object with all the keys that the original object may include: + +```typescript +interface MyObject { + an_id: string; + a_description: string; + a_number?: number; + a_boolean: boolean; +} + +const objectSchema: SchemaObject = { + properties: { + an_id: { + type: 'keyword', + _meta: { + description: 'The ID of the element that generated the event', + optional: false, + }, + }, + a_description: { + type: 'text', + _meta: { + description: 'The human readable description of the element that generated the event', + optional: false, + }, + }, + a_number: { + type: 'long', + _meta: { + description: 'The number of times the element is used', + optional: true, + }, + }, + a_boolean: { + type: 'boolean', + _meta: { + description: 'Is the element still active', + optional: false, + }, + }, + }, + _meta: { + description: 'MyObject represents the events generated by elements in the UI when ...', + optional: false, + } +} +``` + +For the optional `_meta`, refer to [Schema Specification: `_meta`](#schema-specification-_meta). + +#### Schema Specification: Arrays + +Declaring the schema of an array contains 2 main attributes: `items` and an optional `_meta`: + +The `items` attribute is an object declaring the schema of the elements inside the array. At the moment, we only support arrays of one type, so `Array` are not allowed. + +```typescript +type MyArray = string[]; + +const arraySchema: SchemaArray = { + items: { + type: 'keyword', + _meta: { + description: 'Tag attached to the element...', + optional: false, + }, + }, + _meta: { + description: 'List of tags attached to the element...', + optional: false, + } +} +``` + +For the optional `_meta`, refer to [Schema Specification: `_meta`](#schema-specification-_meta). + +#### Schema Specification: Special type `pass_through` + +In case a property in the schema is just used to pass through some unknown content that is declared and validated somewhere else, or that it can dynamically grow and shrink, you may use the `type: 'pass_through'` option. It behaves like a [first-order data type](#schema-specification-first-order-data-types-string-number-boolean): + +```typescript +type MyUnknownType = unknown; + +const passThroughSchema: SchemaValue = { + type: 'pass_through', + _meta: { + description: 'Payload context recevied from the HTTP request...', + optional: false, + }, +} +``` + +For the optional `_meta`, refer to [Schema Specification: `_meta`](#schema-specification-_meta). + +#### Schema Specification: `_meta` + +The `_meta` adds the invaluable information of a `description` and whether a field is `optional` in the payload. + +It can be attached to any schema definition as seen in the examples above. For high-order types, like arrays or objects, the `_meta` field is optional. For first-order types, like numbers, strings, booleans or `pass_through`, the `_meta` key is mandatory. + +The field `_meta.optional` is not required unless the schema is describing an optional field. In that case, `_meta.optional: true` is required. However, it's highly encouraged to be explicit about declaring it even when the described field is not optional. diff --git a/packages/elastic-analytics/jest.config.js b/packages/elastic-analytics/jest.config.js new file mode 100644 index 0000000000000..cc7f3da0561cd --- /dev/null +++ b/packages/elastic-analytics/jest.config.js @@ -0,0 +1,13 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +module.exports = { + preset: '@kbn/test/jest_node', + rootDir: '../..', + roots: ['/packages/elastic-analytics'], +}; diff --git a/packages/elastic-analytics/package.json b/packages/elastic-analytics/package.json new file mode 100644 index 0000000000000..bd688a0ab74d5 --- /dev/null +++ b/packages/elastic-analytics/package.json @@ -0,0 +1,7 @@ +{ + "name": "@elastic/analytics", + "private": true, + "version": "1.0.0", + "main": "./target_node/index.js", + "license": "SSPL-1.0 OR Elastic License 2.0" +} diff --git a/packages/elastic-analytics/src/analytics_client/analytics_client.test.ts b/packages/elastic-analytics/src/analytics_client/analytics_client.test.ts new file mode 100644 index 0000000000000..05b5f6c40dc7b --- /dev/null +++ b/packages/elastic-analytics/src/analytics_client/analytics_client.test.ts @@ -0,0 +1,1283 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +// eslint-disable-next-line max-classes-per-file +import type { Observable } from 'rxjs'; +import { BehaviorSubject, Subject } from 'rxjs'; +import type { MockedLogger } from '@kbn/logging-mocks'; +import { loggerMock } from '@kbn/logging-mocks'; +import { AnalyticsClient } from './analytics_client'; +import { take, toArray } from 'rxjs/operators'; +import { shippersMock } from '../shippers/mocks'; +import type { EventContext, TelemetryCounter } from '../events'; +import { TelemetryCounterType } from '../events'; + +const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms)); + +describe('AnalyticsClient', () => { + let analyticsClient: AnalyticsClient; + let logger: MockedLogger; + + beforeEach(() => { + logger = loggerMock.create(); + analyticsClient = new AnalyticsClient({ + logger, + isDev: true, + sendTo: 'staging', + }); + }); + + describe('registerEventType', () => { + test('successfully registers a event type', () => { + analyticsClient.registerEventType({ + eventType: 'testEvent', + schema: { + a_field: { + type: 'keyword', + _meta: { + description: 'description of a_field', + }, + }, + }, + }); + }); + + test('cannot register the same event type twice', () => { + analyticsClient.registerEventType({ + eventType: 'testEvent', + schema: { + a_field: { + type: 'keyword', + _meta: { + description: 'description of a_field', + }, + }, + }, + }); + + expect(() => + analyticsClient.registerEventType({ + eventType: 'testEvent', + schema: { + b_field: { + type: 'date', + _meta: { + description: 'description of a_field', + }, + }, + }, + }) + ).toThrowErrorMatchingInlineSnapshot(`"Event Type \\"testEvent\\" is already registered."`); + }); + + test('it can be used after deconstruction of the client', () => { + const { registerEventType } = analyticsClient; + registerEventType({ + eventType: 'testEvent', + schema: { + a_field: { + type: 'keyword', + _meta: { + description: 'description of a_field', + }, + }, + }, + }); + }); + }); + + describe('reportEvent', () => { + test('fails to report an event type because it is not registered yet', () => { + expect(() => + analyticsClient.reportEvent('testEvent', { a_field: 'a' }) + ).toThrowErrorMatchingInlineSnapshot( + `"Attempted to report event type \\"testEvent\\", before registering it. Use the \\"registerEventType\\" API to register it."` + ); + }); + + test('enqueues multiple events before specifying the optIn consent and registering a shipper', async () => { + analyticsClient.registerEventType({ + eventType: 'testEvent', + schema: { + a_field: { + type: 'keyword', + _meta: { + description: 'description of a_field', + }, + }, + }, + }); + + // eslint-disable-next-line dot-notation + const internalQueuePromise = analyticsClient['internalEventQueue$'] + .pipe(take(3), toArray()) + .toPromise(); + + const telemetryCounterPromise = analyticsClient.telemetryCounter$ + .pipe(take(3), toArray()) + .toPromise(); + + analyticsClient.reportEvent('testEvent', { a_field: 'a' }); + analyticsClient.reportEvent('testEvent', { a_field: 'b' }); + analyticsClient.reportEvent('testEvent', { a_field: 'c' }); + + // Expect 3 enqueued testEvent, but not shipped + const eventCounters = await telemetryCounterPromise; + expect(eventCounters).toHaveLength(3); + eventCounters.forEach((eventCounter) => { + expect(eventCounter).toEqual({ + type: 'enqueued', + source: 'client', + event_type: 'testEvent', + code: 'enqueued', + count: 1, + }); + }); + + // The events went to the internal queue because there are no optIn nor shippers specified yet + const enqueuedEvents = await internalQueuePromise; + expect(enqueuedEvents).toEqual([ + { + context: {}, + event_type: 'testEvent', + properties: { a_field: 'a' }, + timestamp: expect.any(String), + }, + { + context: {}, + event_type: 'testEvent', + properties: { a_field: 'b' }, + timestamp: expect.any(String), + }, + { + context: {}, + event_type: 'testEvent', + properties: { a_field: 'c' }, + timestamp: expect.any(String), + }, + ]); + }); + + test('it can be used after deconstruction of the client', () => { + const { registerEventType, reportEvent } = analyticsClient; + registerEventType({ + eventType: 'testEvent', + schema: { + a_field: { + type: 'keyword', + _meta: { + description: 'description of a_field', + }, + }, + }, + }); + reportEvent('testEvent', { a_field: 'a' }); + }); + + test('Handles errors coming from the shipper.reportEvents API', () => { + const { optIn, registerEventType, registerShipper, reportEvent } = analyticsClient; + const reportEventsMock = jest.fn().mockImplementation(() => { + throw new Error('Something went terribly wrong'); + }); + class MockedShipper extends shippersMock.MockedShipper { + reportEvents = reportEventsMock; + } + optIn({ global: { enabled: true } }); + registerShipper(MockedShipper, {}); + registerEventType({ eventType: 'testEvent', schema: {} }); + reportEvent('testEvent', {}); + expect(reportEventsMock).toHaveBeenCalledWith([ + { + timestamp: expect.any(String), + event_type: 'testEvent', + properties: {}, + context: {}, + }, + ]); + expect(logger.warn).toHaveBeenCalledWith( + `Failed to report event "testEvent" via shipper "${MockedShipper.shipperName}"`, + expect.any(Error) + ); + }); + }); + + describe('registerShipper', () => { + test('Registers a global shipper', () => { + // eslint-disable-next-line dot-notation + expect(analyticsClient['shippersRegistry'].allShippers.size).toBe(0); + analyticsClient.registerShipper(shippersMock.MockedShipper, {}); + + // eslint-disable-next-line dot-notation + expect(analyticsClient['shippersRegistry'].allShippers.size).toBe(1); + + expect( + // eslint-disable-next-line dot-notation + analyticsClient['shippersRegistry'].allShippers.get(shippersMock.MockedShipper.shipperName) + ).toBeTruthy(); + }); + + test('Fails to register the same global shipper twice', () => { + analyticsClient.registerShipper(shippersMock.MockedShipper, {}); + expect(() => + analyticsClient.registerShipper(shippersMock.MockedShipper, {}) + ).toThrowErrorMatchingInlineSnapshot(`"Shipper \\"mocked-shipper\\" is already registered"`); + }); + + test('Registers an event exclusive shipper', () => { + analyticsClient.registerShipper( + shippersMock.MockedShipper, + {}, + { exclusiveEventTypes: ['eventA', 'eventB'] } + ); + + // eslint-disable-next-line dot-notation + expect(analyticsClient['shippersRegistry'].allShippers.size).toBe(1); + + // eslint-disable-next-line dot-notation + expect(analyticsClient['shippersRegistry'].getShippersForEventType('eventA').size).toBe(1); + // eslint-disable-next-line dot-notation + expect(analyticsClient['shippersRegistry'].getShippersForEventType('eventB').size).toBe(1); + // eslint-disable-next-line dot-notation + expect(analyticsClient['shippersRegistry'].getShippersForEventType('eventC').size).toBe(0); + }); + + test('Forwards the telemetryCounter$ events from the shipper, overwriting the `source` property', async () => { + class MockedShipper extends shippersMock.MockedShipper { + constructor({ telemetryCounter$ }: { telemetryCounter$: Subject }) { + super(); + this.telemetryCounter$ = telemetryCounter$; + } + } + + const mockTelemetryCounter$ = new Subject(); + + // Typescript also helps with the config type inference <3 + analyticsClient.registerShipper(MockedShipper, { telemetryCounter$: mockTelemetryCounter$ }); + + const counterEventPromise = analyticsClient.telemetryCounter$.pipe(take(1)).toPromise(); + + const counter: TelemetryCounter = { + type: TelemetryCounterType.succeeded, + source: 'a random value', + event_type: 'eventTypeA', + code: '200', + count: 1000, + }; + + mockTelemetryCounter$.next(counter); + + await expect(counterEventPromise).resolves.toEqual({ + ...counter, + source: MockedShipper.shipperName, + }); + }); + + class MockedShipper extends shippersMock.MockedShipper { + constructor({ + optInMock, + extendContextMock, + }: { + optInMock?: jest.Mock; + extendContextMock?: jest.Mock; + }) { + super(); + if (optInMock) this.optIn = optInMock; + if (extendContextMock) this.extendContext = extendContextMock; + } + } + + test('Registers a shipper and sets the opt-in status if the opt-in status was previously set', () => { + // Call the optIn method before registering the shipper + analyticsClient.optIn({ global: { enabled: true } }); + + const optIn = jest.fn(); + analyticsClient.registerShipper(MockedShipper, { optInMock: optIn }); + expect(optIn).toHaveBeenCalledWith(true); + }); + + test('Registers a shipper and spreads the opt-in status changes', () => { + const optIn = jest.fn(); + analyticsClient.registerShipper(MockedShipper, { optInMock: optIn }); + expect(optIn).not.toHaveBeenCalled(); + + // Call the optIn method after registering the shipper + analyticsClient.optIn({ global: { enabled: true } }); + expect(optIn).toHaveBeenCalledWith(true); + }); + + test('Spreads the context updates to the shipper (only after opt-in)', async () => { + const extendContextMock = jest.fn(); + analyticsClient.registerShipper(MockedShipper, { extendContextMock }); + expect(extendContextMock).toHaveBeenCalledTimes(0); // Not until we have opt-in + analyticsClient.optIn({ global: { enabled: true } }); + await delay(10); + expect(extendContextMock).toHaveBeenCalledWith({}); // The initial context + + const context$ = new Subject<{ a_field: boolean }>(); + analyticsClient.registerContextProvider({ + name: 'contextProviderA', + schema: { + a_field: { + type: 'boolean', + _meta: { + description: 'a_field description', + }, + }, + }, + context$, + }); + + context$.next({ a_field: true }); + expect(extendContextMock).toHaveBeenCalledWith({ a_field: true }); // After update + }); + + test('Does not spread the context if opt-in === false', async () => { + const extendContextMock = jest.fn(); + analyticsClient.registerShipper(MockedShipper, { extendContextMock }); + expect(extendContextMock).toHaveBeenCalledTimes(0); // Not until we have opt-in + analyticsClient.optIn({ global: { enabled: false } }); + await delay(10); + expect(extendContextMock).toHaveBeenCalledTimes(0); // Not until we have opt-in + }); + + test('Handles errors in the shipper', async () => { + const extendContextMock = jest.fn().mockImplementation(() => { + throw new Error('Something went terribly wrong'); + }); + analyticsClient.registerShipper(MockedShipper, { extendContextMock }); + analyticsClient.optIn({ global: { enabled: true } }); + await delay(10); + expect(extendContextMock).toHaveBeenCalledWith({}); // The initial context + expect(logger.warn).toHaveBeenCalledWith( + `Shipper "${MockedShipper.shipperName}" failed to extend the context`, + expect.any(Error) + ); + }); + }); + + describe('registerContextProvider', () => { + let globalContext$: Observable>; + + beforeEach(() => { + // eslint-disable-next-line dot-notation + globalContext$ = analyticsClient['context$']; + }); + + test('Registers a context provider', async () => { + const context$ = new Subject<{ a_field: boolean }>(); + analyticsClient.registerContextProvider({ + name: 'contextProviderA', + schema: { + a_field: { + type: 'boolean', + _meta: { + description: 'a_field description', + }, + }, + }, + context$, + }); + + const globalContextPromise = globalContext$.pipe(take(2), toArray()).toPromise(); + context$.next({ a_field: true }); + await expect(globalContextPromise).resolves.toEqual([ + {}, // Original empty state + { a_field: true }, + ]); + }); + + test('It does not break if context emits `undefined`', async () => { + const context$ = new Subject<{ a_field: boolean }>(); + analyticsClient.registerContextProvider({ + name: 'contextProviderA', + schema: { + a_field: { + type: 'boolean', + _meta: { + description: 'a_field description', + }, + }, + }, + context$, + }); + + const globalContextPromise = globalContext$.pipe(take(3), toArray()).toPromise(); + context$.next(); + context$.next(undefined); + await expect(globalContextPromise).resolves.toEqual([ + {}, // Original empty state + {}, + {}, + ]); + }); + + test('It does not break for BehaviourSubjects (emitting as soon as they connect)', async () => { + const context$ = new BehaviorSubject<{ a_field: boolean }>({ a_field: true }); + analyticsClient.registerContextProvider({ + name: 'contextProviderA', + schema: { + a_field: { + type: 'boolean', + _meta: { + description: 'a_field description', + }, + }, + }, + context$, + }); + + const globalContextPromise = globalContext$.pipe(take(1), toArray()).toPromise(); + await expect(globalContextPromise).resolves.toEqual([ + { a_field: true }, // No original empty state + ]); + }); + + test('Merges all the contexts together', async () => { + const contextA$ = new Subject<{ a_field: boolean }>(); + analyticsClient.registerContextProvider({ + name: 'contextProviderA', + schema: { + a_field: { + type: 'boolean', + _meta: { + description: 'a_field description', + }, + }, + }, + context$: contextA$, + }); + + const contextB$ = new Subject<{ a_field?: boolean; b_field: number }>(); + analyticsClient.registerContextProvider({ + name: 'contextProviderB', + schema: { + a_field: { + type: 'boolean', + _meta: { + description: 'a_field description', + optional: true, + }, + }, + b_field: { + type: 'long', + _meta: { + description: 'b_field description', + }, + }, + }, + context$: contextB$, + }); + + const globalContextPromise = globalContext$.pipe(take(6), toArray()).toPromise(); + contextA$.next({ a_field: true }); + contextB$.next({ b_field: 1 }); + contextB$.next({ a_field: false, b_field: 1 }); + contextA$.next({ a_field: true }); + contextB$.next({ b_field: 2 }); + await expect(globalContextPromise).resolves.toEqual([ + {}, // Original empty state + { a_field: true }, + { a_field: true, b_field: 1 }, // Merged A & B + { a_field: false, b_field: 1 }, // a_field updated from B + { a_field: false, b_field: 1 }, // a_field still from B because it was registered later. + // We may want to change this last behaviour in the future but, for now, it's fine. + { a_field: true, b_field: 2 }, // a_field is now taken from A because B is not providing it yet. + ]); + }); + + test('The global context is not polluted by context providers removing reported fields', async () => { + const context$ = new Subject<{ a_field?: boolean; b_field: number }>(); + analyticsClient.registerContextProvider({ + name: 'contextProviderA', + schema: { + a_field: { + type: 'boolean', + _meta: { + description: 'a_field description', + optional: true, + }, + }, + b_field: { + type: 'long', + _meta: { + description: 'b_field description', + }, + }, + }, + context$, + }); + + const globalContextPromise = globalContext$.pipe(take(6), toArray()).toPromise(); + context$.next({ b_field: 1 }); + context$.next({ a_field: false, b_field: 1 }); + context$.next({ a_field: true, b_field: 1 }); + context$.next({ b_field: 1 }); + context$.next({ a_field: true, b_field: 2 }); + await expect(globalContextPromise).resolves.toEqual([ + {}, // Original empty state + { b_field: 1 }, + { a_field: false, b_field: 1 }, + { a_field: true, b_field: 1 }, + { b_field: 1 }, // a_field is removed because the context provider removed it. + { a_field: true, b_field: 2 }, + ]); + }); + + test('Fails to register 2 context providers with the same name', () => { + analyticsClient.registerContextProvider({ + name: 'contextProviderA', + schema: { + a_field: { + type: 'boolean', + _meta: { + description: 'a_field description', + }, + }, + }, + context$: new Subject<{ a_field: boolean }>(), + }); + expect(() => { + analyticsClient.registerContextProvider({ + name: 'contextProviderA', + schema: { + a_field: { + type: 'boolean', + _meta: { + description: 'a_field description', + }, + }, + }, + context$: new Subject<{ a_field: boolean }>(), + }); + }).toThrowErrorMatchingInlineSnapshot( + `"Context provider with name 'contextProviderA' already registered"` + ); + }); + + test('Does not remove the context provider after it completes', async () => { + const context$ = new Subject<{ a_field: boolean }>(); + + const contextProvidersRegistry = + // eslint-disable-next-line dot-notation + analyticsClient['contextService']['contextProvidersRegistry']; + + // The context registry is empty + expect(contextProvidersRegistry.size).toBe(0); + + analyticsClient.registerContextProvider({ + name: 'contextProviderA', + schema: { + a_field: { + type: 'boolean', + _meta: { + description: 'a_field description', + }, + }, + }, + context$, + }); + + const globalContextPromise = globalContext$.pipe(take(4), toArray()).toPromise(); + context$.next({ a_field: true }); + // The size of the registry grows on the first emission + expect(contextProvidersRegistry.size).toBe(1); + + context$.next({ a_field: true }); + // Still in the registry + expect(contextProvidersRegistry.size).toBe(1); + context$.complete(); + // Still in the registry + expect(contextProvidersRegistry.size).toBe(1); + analyticsClient.removeContextProvider('contextProviderA'); + // The context provider is removed from the registry + expect(contextProvidersRegistry.size).toBe(0); + await expect(globalContextPromise).resolves.toEqual([ + {}, // Original empty state + { a_field: true }, + { a_field: true }, + {}, + ]); + }); + }); + + describe('optIn', () => { + let optInMock1: jest.Mock; + let optInMock2: jest.Mock; + + beforeEach(() => { + optInMock1 = jest.fn(); + + class MockedShipper1 extends shippersMock.MockedShipper { + static shipperName = 'mocked-shipper-1'; + optIn = optInMock1; + } + optInMock2 = jest.fn(); + class MockedShipper2 extends shippersMock.MockedShipper { + static shipperName = 'mocked-shipper-2'; + optIn = optInMock2; + } + + analyticsClient.registerShipper(MockedShipper1, {}); + analyticsClient.registerShipper(MockedShipper2, {}); + }); + + test('Updates global optIn config', () => { + // eslint-disable-next-line dot-notation + expect(analyticsClient['optInConfig$'].value).toBeUndefined(); + + analyticsClient.optIn({ global: { enabled: true } }); + // eslint-disable-next-line dot-notation + expect(analyticsClient['optInConfig$'].value!['optInConfig']).toEqual({ + global: { enabled: true }, + }); + }); + + test('Updates each shipper optIn config for global opt-in: true', () => { + analyticsClient.optIn({ global: { enabled: true } }); + expect(optInMock1).toHaveBeenCalledWith(true); + expect(optInMock2).toHaveBeenCalledWith(true); + }); + + test('Updates each shipper optIn config for global opt-in: false', () => { + analyticsClient.optIn({ global: { enabled: false } }); + expect(optInMock1).toHaveBeenCalledWith(false); + expect(optInMock2).toHaveBeenCalledWith(false); + }); + + test('Updates each shipper optIn config for global opt-in: true && shipper-specific: true', () => { + analyticsClient.optIn({ + global: { enabled: true, shippers: { ['mocked-shipper-1']: true } }, + }); + expect(optInMock1).toHaveBeenCalledWith(true); // Using global and shipper-specific + expect(optInMock2).toHaveBeenCalledWith(true); // Using only global + }); + + test('Updates each shipper optIn config for global opt-in: true && shipper-specific: false', () => { + analyticsClient.optIn({ + global: { enabled: true, shippers: { ['mocked-shipper-1']: false } }, + }); + expect(optInMock1).toHaveBeenCalledWith(false); // Using global and shipper-specific + expect(optInMock2).toHaveBeenCalledWith(true); // Using only global + }); + + test('Updates each shipper optIn config for global opt-in: false && shipper-specific: true', () => { + analyticsClient.optIn({ + global: { enabled: false, shippers: { ['mocked-shipper-1']: true } }, + }); + expect(optInMock1).toHaveBeenCalledWith(false); // Using global and shipper-specific + expect(optInMock2).toHaveBeenCalledWith(false); // Using only global + }); + + test('Updates each shipper optIn config for global opt-in: false && shipper-specific: false', () => { + analyticsClient.optIn({ + global: { enabled: false, shippers: { ['mocked-shipper-1']: false } }, + }); + expect(optInMock1).toHaveBeenCalledWith(false); // Using global and shipper-specific + expect(optInMock2).toHaveBeenCalledWith(false); // Using only global + }); + test('Catches error in the shipper.optIn method', () => { + optInMock1.mockImplementation(() => { + throw new Error('Something went terribly wrong'); + }); + analyticsClient.optIn({ global: { enabled: true } }); + expect(optInMock1).toHaveBeenCalledWith(true); // Using global and shipper-specific + expect(optInMock2).toHaveBeenCalledWith(true); // Using only global + expect(logger.warn).toHaveBeenCalledWith( + 'Failed to set isOptedIn:true in shipper mocked-shipper-1', + expect.any(Error) + ); + }); + }); + + describe('E2E', () => { + class MockedShipper1 extends shippersMock.MockedShipper { + static shipperName = 'mocked-shipper-1'; + constructor({ reportEventsMock }: { reportEventsMock: jest.Mock }) { + super(); + this.reportEvents = reportEventsMock; + } + } + + class MockedShipper2 extends MockedShipper1 { + static shipperName = 'mocked-shipper-2'; + } + + beforeEach(() => { + analyticsClient.registerEventType({ + eventType: 'event-type-a', + schema: { + a_field: { + type: 'keyword', + _meta: { + description: 'description of a_field', + }, + }, + }, + }); + analyticsClient.registerEventType({ + eventType: 'event-type-b', + schema: { + b_field: { + type: 'long', + _meta: { + description: 'description of b_field', + }, + }, + }, + }); + }); + + test('Enqueues early events', async () => { + // eslint-disable-next-line dot-notation + const internalEventQueue$ = analyticsClient['internalEventQueue$']; + + const internalQueuePromise = internalEventQueue$.pipe(take(2), toArray()).toPromise(); + + const telemetryCounterPromise = analyticsClient.telemetryCounter$ + .pipe(take(2), toArray()) + .toPromise(); + + analyticsClient.reportEvent('event-type-a', { a_field: 'a' }); + analyticsClient.reportEvent('event-type-b', { b_field: 100 }); + + // Expect 2 enqueued testEvent, but not shipped + await expect(telemetryCounterPromise).resolves.toEqual([ + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-b', + code: 'enqueued', + count: 1, + }, + ]); + + // The events went to the internal queue because there are no optIn nor shippers specified yet + await expect(internalQueuePromise).resolves.toEqual([ + { + context: {}, + event_type: 'event-type-a', + properties: { a_field: 'a' }, + timestamp: expect.any(String), + }, + { + context: {}, + event_type: 'event-type-b', + properties: { b_field: 100 }, + timestamp: expect.any(String), + }, + ]); + }); + + test('Sends events from the internal queue when there are shippers and an opt-in response is true', async () => { + const telemetryCounterPromise = analyticsClient.telemetryCounter$ + .pipe(take(3 + 2), toArray()) // Waiting for 3 enqueued + 2 batch-shipped events + .toPromise(); + + // Send multiple events of 1 type to test the grouping logic as well + analyticsClient.reportEvent('event-type-a', { a_field: 'a' }); + analyticsClient.reportEvent('event-type-b', { b_field: 100 }); + analyticsClient.reportEvent('event-type-a', { a_field: 'b' }); + + // As proven in the previous test, the events are still enqueued. + // Let's register a shipper and opt-in to test the dequeue logic. + const reportEventsMock = jest.fn(); + analyticsClient.registerShipper(MockedShipper1, { reportEventsMock }); + analyticsClient.optIn({ global: { enabled: true } }); + await delay(10); + + expect(reportEventsMock).toHaveBeenCalledTimes(2); + expect(reportEventsMock).toHaveBeenNthCalledWith(1, [ + { + context: {}, + event_type: 'event-type-a', + properties: { a_field: 'a' }, + timestamp: expect.any(String), + }, + { + context: {}, + event_type: 'event-type-a', + properties: { a_field: 'b' }, + timestamp: expect.any(String), + }, + ]); + expect(reportEventsMock).toHaveBeenNthCalledWith(2, [ + { + context: {}, + event_type: 'event-type-b', + properties: { b_field: 100 }, + timestamp: expect.any(String), + }, + ]); + + // Expect 3 enqueued events, and 2 sent_to_shipper batched requests + await expect(telemetryCounterPromise).resolves.toEqual([ + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-b', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'sent_to_shipper', + source: 'client', + event_type: 'event-type-a', + code: 'OK', + count: 2, + }, + { + type: 'sent_to_shipper', + source: 'client', + event_type: 'event-type-b', + code: 'OK', + count: 1, + }, + ]); + }); + + test('Discards events from the internal queue when there are shippers and an opt-in response is false', async () => { + const telemetryCounterPromise = analyticsClient.telemetryCounter$ + .pipe(take(3), toArray()) // Waiting for 3 enqueued + .toPromise(); + + // Send multiple events of 1 type to test the grouping logic as well + analyticsClient.reportEvent('event-type-a', { a_field: 'a' }); + analyticsClient.reportEvent('event-type-b', { b_field: 100 }); + analyticsClient.reportEvent('event-type-a', { a_field: 'b' }); + + const reportEventsMock = jest.fn(); + analyticsClient.registerShipper(MockedShipper1, { reportEventsMock }); + analyticsClient.optIn({ global: { enabled: false } }); + + expect(reportEventsMock).toHaveBeenCalledTimes(0); + + // Expect 2 enqueued, but not shipped + await expect(telemetryCounterPromise).resolves.toEqual([ + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-b', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + ]); + }); + + test('Discards only one type of the enqueued events based on event_type config', async () => { + const telemetryCounterPromise = analyticsClient.telemetryCounter$ + .pipe(take(3 + 1), toArray()) // Waiting for 3 enqueued + 1 batch-shipped events + .toPromise(); + + // Send multiple events of 1 type to test the grouping logic as well + analyticsClient.reportEvent('event-type-a', { a_field: 'a' }); + analyticsClient.reportEvent('event-type-b', { b_field: 100 }); + analyticsClient.reportEvent('event-type-a', { a_field: 'b' }); + + const reportEventsMock = jest.fn(); + analyticsClient.registerShipper(MockedShipper1, { reportEventsMock }); + analyticsClient.optIn({ + global: { enabled: true }, + event_types: { ['event-type-a']: { enabled: false } }, + }); + await delay(10); + + expect(reportEventsMock).toHaveBeenCalledTimes(1); + expect(reportEventsMock).toHaveBeenNthCalledWith(1, [ + { + context: {}, + event_type: 'event-type-b', + properties: { b_field: 100 }, + timestamp: expect.any(String), + }, + ]); + + // Expect 3 enqueued events, and 1 sent_to_shipper batched request + await expect(telemetryCounterPromise).resolves.toEqual([ + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-b', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'sent_to_shipper', + source: 'client', + event_type: 'event-type-b', + code: 'OK', + count: 1, + }, + ]); + }); + + test('Discards the event at the shipper level (for a specific event)', async () => { + const telemetryCounterPromise = analyticsClient.telemetryCounter$ + .pipe(take(3 + 2), toArray()) // Waiting for 3 enqueued + 2 batch-shipped events + .toPromise(); + + // Send multiple events of 1 type to test the grouping logic as well + analyticsClient.reportEvent('event-type-a', { a_field: 'a' }); + analyticsClient.reportEvent('event-type-b', { b_field: 100 }); + analyticsClient.reportEvent('event-type-a', { a_field: 'b' }); + + // Register 2 shippers and set 1 of them as disabled for event-type-a + const reportEventsMock1 = jest.fn(); + const reportEventsMock2 = jest.fn(); + analyticsClient.registerShipper(MockedShipper1, { reportEventsMock: reportEventsMock1 }); + analyticsClient.registerShipper(MockedShipper2, { reportEventsMock: reportEventsMock2 }); + analyticsClient.optIn({ + global: { enabled: true }, + event_types: { + ['event-type-a']: { enabled: true, shippers: { [MockedShipper2.shipperName]: false } }, + }, + }); + await delay(10); + + expect(reportEventsMock1).toHaveBeenCalledTimes(2); + expect(reportEventsMock1).toHaveBeenNthCalledWith(1, [ + { + context: {}, + event_type: 'event-type-a', + properties: { a_field: 'a' }, + timestamp: expect.any(String), + }, + { + context: {}, + event_type: 'event-type-a', + properties: { a_field: 'b' }, + timestamp: expect.any(String), + }, + ]); + expect(reportEventsMock1).toHaveBeenNthCalledWith(2, [ + { + context: {}, + event_type: 'event-type-b', + properties: { b_field: 100 }, + timestamp: expect.any(String), + }, + ]); + expect(reportEventsMock2).toHaveBeenCalledTimes(1); + expect(reportEventsMock2).toHaveBeenNthCalledWith(1, [ + { + context: {}, + event_type: 'event-type-b', + properties: { b_field: 100 }, + timestamp: expect.any(String), + }, + ]); + + // Expect 3 enqueued events, and 2 sent_to_shipper batched requests + await expect(telemetryCounterPromise).resolves.toEqual([ + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-b', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'sent_to_shipper', + source: 'client', + event_type: 'event-type-a', + code: 'OK', + count: 2, + }, + { + type: 'sent_to_shipper', + source: 'client', + event_type: 'event-type-b', + code: 'OK', + count: 1, + }, + ]); + }); + + test('Discards all the events at the shipper level (globally disabled)', async () => { + const telemetryCounterPromise = analyticsClient.telemetryCounter$ + .pipe(take(3 + 2), toArray()) // Waiting for 3 enqueued + 2 batch-shipped events + .toPromise(); + + // Send multiple events of 1 type to test the grouping logic as well + analyticsClient.reportEvent('event-type-a', { a_field: 'a' }); + analyticsClient.reportEvent('event-type-b', { b_field: 100 }); + analyticsClient.reportEvent('event-type-a', { a_field: 'b' }); + + // Register 2 shippers and set 1 of them as globally disabled + const reportEventsMock1 = jest.fn(); + const reportEventsMock2 = jest.fn(); + analyticsClient.registerShipper(MockedShipper1, { reportEventsMock: reportEventsMock1 }); + analyticsClient.registerShipper(MockedShipper2, { reportEventsMock: reportEventsMock2 }); + analyticsClient.optIn({ + global: { enabled: true, shippers: { [MockedShipper2.shipperName]: false } }, + event_types: { + ['event-type-a']: { enabled: true }, + }, + }); + await delay(10); + + expect(reportEventsMock1).toHaveBeenCalledTimes(2); + expect(reportEventsMock1).toHaveBeenNthCalledWith(1, [ + { + context: {}, + event_type: 'event-type-a', + properties: { a_field: 'a' }, + timestamp: expect.any(String), + }, + { + context: {}, + event_type: 'event-type-a', + properties: { a_field: 'b' }, + timestamp: expect.any(String), + }, + ]); + expect(reportEventsMock1).toHaveBeenNthCalledWith(2, [ + { + context: {}, + event_type: 'event-type-b', + properties: { b_field: 100 }, + timestamp: expect.any(String), + }, + ]); + expect(reportEventsMock2).toHaveBeenCalledTimes(0); + + // Expect 3 enqueued events, and 2 sent_to_shipper batched requests + await expect(telemetryCounterPromise).resolves.toEqual([ + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-b', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'sent_to_shipper', + source: 'client', + event_type: 'event-type-a', + code: 'OK', + count: 2, + }, + { + type: 'sent_to_shipper', + source: 'client', + event_type: 'event-type-b', + code: 'OK', + count: 1, + }, + ]); + }); + + test('Discards incoming events when opt-in response is false', async () => { + // Set OptIn and shipper first to test the "once-set up" scenario + const reportEventsMock = jest.fn(); + analyticsClient.registerShipper(MockedShipper1, { reportEventsMock }); + analyticsClient.optIn({ global: { enabled: false } }); + + const telemetryCounterPromise = analyticsClient.telemetryCounter$ + .pipe(take(3), toArray()) // Waiting for 3 enqueued + .toPromise(); + + // Send multiple events of 1 type to test the non-grouping logic at this stage as well + analyticsClient.reportEvent('event-type-a', { a_field: 'a' }); + analyticsClient.reportEvent('event-type-b', { b_field: 100 }); + analyticsClient.reportEvent('event-type-a', { a_field: 'b' }); + + expect(reportEventsMock).toHaveBeenCalledTimes(0); + + // Expect 2 enqueued, but not shipped + await expect(telemetryCounterPromise).resolves.toEqual([ + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-b', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + ]); + }); + + test('Forwards incoming events to the shippers when opt-in response is true', async () => { + // Set OptIn and shipper first to test the "once-set up" scenario + const reportEventsMock = jest.fn(); + analyticsClient.registerShipper(MockedShipper1, { reportEventsMock }); + analyticsClient.optIn({ global: { enabled: true } }); + + const telemetryCounterPromise = analyticsClient.telemetryCounter$ + .pipe(take(3 * 2), toArray()) // Waiting for 2 events per each reportEvent call: enqueued and sent_to_shipper + .toPromise(); + + // Send multiple events of 1 type to test the non-grouping logic at this stage as well + analyticsClient.reportEvent('event-type-a', { a_field: 'a' }); + analyticsClient.reportEvent('event-type-b', { b_field: 100 }); + analyticsClient.reportEvent('event-type-a', { a_field: 'b' }); + + // This time the reportEvent API is called once per event (no grouping/batching applied at this stage) + expect(reportEventsMock).toHaveBeenCalledTimes(3); + expect(reportEventsMock).toHaveBeenNthCalledWith(1, [ + { + context: {}, + event_type: 'event-type-a', + properties: { a_field: 'a' }, + timestamp: expect.any(String), + }, + ]); + expect(reportEventsMock).toHaveBeenNthCalledWith(2, [ + { + context: {}, + event_type: 'event-type-b', + properties: { b_field: 100 }, + timestamp: expect.any(String), + }, + ]); + expect(reportEventsMock).toHaveBeenNthCalledWith(3, [ + { + context: {}, + event_type: 'event-type-a', + properties: { a_field: 'b' }, + timestamp: expect.any(String), + }, + ]); + + // Expect 2 enqueued, but not shipped + await expect(telemetryCounterPromise).resolves.toEqual([ + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'sent_to_shipper', + source: 'client', + event_type: 'event-type-a', + code: 'OK', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-b', + code: 'enqueued', + count: 1, + }, + { + type: 'sent_to_shipper', + source: 'client', + event_type: 'event-type-b', + code: 'OK', + count: 1, + }, + { + type: 'enqueued', + source: 'client', + event_type: 'event-type-a', + code: 'enqueued', + count: 1, + }, + { + type: 'sent_to_shipper', + source: 'client', + event_type: 'event-type-a', + code: 'OK', + count: 1, + }, + ]); + }); + }); +}); diff --git a/packages/elastic-analytics/src/analytics_client/analytics_client.ts b/packages/elastic-analytics/src/analytics_client/analytics_client.ts new file mode 100644 index 0000000000000..1c7f261aaf4b4 --- /dev/null +++ b/packages/elastic-analytics/src/analytics_client/analytics_client.ts @@ -0,0 +1,300 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { Observable } from 'rxjs'; +import { BehaviorSubject, Subject, combineLatest, from } from 'rxjs'; +import { + buffer, + bufferCount, + concatMap, + delay, + filter, + groupBy, + map, + mergeMap, + share, + shareReplay, + skipWhile, + takeUntil, + tap, +} from 'rxjs/operators'; +import type { IShipper } from '../shippers'; +import type { + AnalyticsClientInitContext, + ContextProviderName, + ContextProviderOpts, + EventTypeOpts, + IAnalyticsClient, + OptInConfig, + RegisterShipperOpts, + ShipperClassConstructor, +} from './types'; +import type { Event, EventContext, EventType, TelemetryCounter } from '../events'; +import { TelemetryCounterType } from '../events'; +import { ShippersRegistry } from './shippers_registry'; +import { OptInConfigService } from './opt_in_config'; +import { ContextService } from './context_service'; + +export class AnalyticsClient implements IAnalyticsClient { + private readonly internalTelemetryCounter$ = new Subject(); + public readonly telemetryCounter$: Observable = + this.internalTelemetryCounter$.pipe(share()); // Using `share` so we can have multiple subscribers + /** + * This queue holds all the events until both conditions occur: + * 1. We know the user's optIn decision. + * 2. We have, at least, one registered shipper. + * @private + */ + private readonly internalEventQueue$ = new Subject(); + private readonly shippersRegistry = new ShippersRegistry(); + /** + * Observable used to report when a shipper is registered. + * @private + */ + private readonly shipperRegistered$ = new Subject(); + private readonly eventTypeRegistry = new Map>(); + private readonly contextService: ContextService; + private readonly context$ = new BehaviorSubject>({}); + private readonly optInConfig$ = new BehaviorSubject(undefined); + private readonly optInConfigWithReplay$ = this.optInConfig$.pipe( + filter((optInConfig): optInConfig is OptInConfigService => typeof optInConfig !== 'undefined'), + shareReplay(1) + ); + private readonly contextWithReplay$ = this.context$.pipe( + skipWhile(() => !this.optInConfig$.value), // Do not forward the context events until we have an optInConfig value + shareReplay(1) + ); + + constructor(private readonly initContext: AnalyticsClientInitContext) { + this.contextService = new ContextService(this.context$, this.initContext.isDev); + this.reportEnqueuedEventsWhenClientIsReady(); + } + + public reportEvent = >( + eventType: EventType, + eventData: EventTypeData + ) => { + // Fetch the timestamp as soon as we receive the event. + const timestamp = new Date().toISOString(); + + this.internalTelemetryCounter$.next({ + type: TelemetryCounterType.enqueued, + source: 'client', + event_type: eventType, + code: 'enqueued', + count: 1, + }); + + if (!this.eventTypeRegistry.get(eventType)) { + this.internalTelemetryCounter$.next({ + type: TelemetryCounterType.dropped, + source: 'client', + event_type: eventType, + code: 'UnregisteredType', + count: 1, + }); + throw new Error( + `Attempted to report event type "${eventType}", before registering it. Use the "registerEventType" API to register it.` + ); + } + + if (this.initContext.isDev) { + // TODO: In the future we may need to validate the eventData based on the eventType's registered schema (only if isDev) + } + + const optInConfig = this.optInConfig$.value; + + if (optInConfig?.isEventTypeOptedIn(eventType) === false) { + // If opted out, skip early + return; + } + + const event: Event = { + timestamp, + event_type: eventType, + context: this.context$.value, + properties: eventData, + }; + + if (typeof optInConfig === 'undefined') { + // If the opt-in config is not provided yet, we need to enqueue the event to an internal queue + this.internalEventQueue$.next(event); + } else { + this.sendToShipper(eventType, [event]); + } + }; + + public registerEventType = (eventTypeOps: EventTypeOpts) => { + if (this.eventTypeRegistry.get(eventTypeOps.eventType)) { + throw new Error(`Event Type "${eventTypeOps.eventType}" is already registered.`); + } + this.eventTypeRegistry.set(eventTypeOps.eventType, eventTypeOps); + }; + + public optIn = (optInConfig: OptInConfig) => { + const optInConfigInstance = new OptInConfigService(optInConfig); + this.optInConfig$.next(optInConfigInstance); + }; + + public registerContextProvider = (contextProviderOpts: ContextProviderOpts) => { + this.contextService.registerContextProvider(contextProviderOpts); + }; + + public removeContextProvider = (name: ContextProviderName) => { + this.contextService.removeContextProvider(name); + }; + + public registerShipper = ( + ShipperClass: ShipperClassConstructor, + shipperConfig: ShipperConfig, + { exclusiveEventTypes = [] }: RegisterShipperOpts = {} + ) => { + const shipperName = ShipperClass.shipperName; + const shipper = new ShipperClass(shipperConfig, { + ...this.initContext, + logger: this.initContext.logger.get('shipper', shipperName), + }); + if (exclusiveEventTypes.length) { + // This feature is not intended to be supported in the MVP. + // I can remove it if we think it causes more bad than good. + exclusiveEventTypes.forEach((eventType) => { + this.shippersRegistry.addEventExclusiveShipper(eventType, shipperName, shipper); + }); + } else { + this.shippersRegistry.addGlobalShipper(shipperName, shipper); + } + + // Subscribe to the shipper's telemetryCounter$ and pass it over to the client's-level observable + shipper.telemetryCounter$?.subscribe((counter) => + this.internalTelemetryCounter$.next({ + ...counter, + source: shipperName, // Enforce the shipper's name in the `source` + }) + ); + + // Spread the optIn configuration updates + this.optInConfigWithReplay$.subscribe((optInConfig) => { + const isOptedIn = optInConfig.isShipperOptedIn(shipperName); + try { + shipper.optIn(isOptedIn); + } catch (err) { + this.initContext.logger.warn( + `Failed to set isOptedIn:${isOptedIn} in shipper ${shipperName}`, + err + ); + } + }); + + // Spread the global context if it has custom extendContext method + if (shipper.extendContext) { + this.contextWithReplay$.subscribe((context) => { + try { + shipper.extendContext!(context); + } catch (err) { + this.initContext.logger.warn( + `Shipper "${shipperName}" failed to extend the context`, + err + ); + } + }); + } + + // Notify that a shipper is registered + this.shipperRegistered$.next(); + }; + + /** + * Forwards the `events` to the registered shippers, bearing in mind if the shipper is opted-in for that eventType. + * @param eventType The event type's name + * @param events A bulk array of events matching the eventType. + * @private + */ + private sendToShipper(eventType: EventType, events: Event[]) { + let sentToShipper = false; + this.shippersRegistry.getShippersForEventType(eventType).forEach((shipper, shipperName) => { + const isShipperOptedIn = this.optInConfig$.value?.isShipperOptedIn(shipperName, eventType); + + // Only send it to the non-explicitly opted-out shippers + if (isShipperOptedIn) { + sentToShipper = true; + try { + shipper.reportEvents(events); + } catch (err) { + this.initContext.logger.warn( + `Failed to report event "${eventType}" via shipper "${shipperName}"`, + err + ); + } + } + }); + if (sentToShipper) { + this.internalTelemetryCounter$.next({ + type: TelemetryCounterType.sent_to_shipper, + source: 'client', + event_type: eventType, + code: 'OK', + count: events.length, + }); + } + } + + /** + * Once the client is ready (it has a valid optInConfig and at least one shipper), + * flush any early events and ship them or discard them based on the optInConfig. + * @private + */ + private reportEnqueuedEventsWhenClientIsReady() { + // Observer that will emit when both events occur: the OptInConfig is set + a shipper has been registered + const configReceivedAndShipperReceivedObserver$ = combineLatest([ + this.optInConfigWithReplay$, + this.shipperRegistered$, + ]); + + // Flush the internal queue when we get any optInConfig and, at least, 1 shipper + this.internalEventQueue$ + .pipe( + // Take until will close the observer once we reach the condition below + takeUntil(configReceivedAndShipperReceivedObserver$), + + // Accumulate the events until we can send them + buffer(configReceivedAndShipperReceivedObserver$), + + // Minimal delay only to make this chain async and let the optIn operation to complete first. + delay(0), + + // Re-emit the context to make sure all the shippers got it (only if opted-in) + tap(() => { + if (this.optInConfig$.value?.isOptedIn()) { + this.context$.next(this.context$.value); + } + }), + + // Minimal delay only to make this chain async and let + // the context update operation to complete first. + delay(0), + + // Flatten the array of events + concatMap((events) => from(events)), + + // Discard opted-out events + filter((event) => this.optInConfig$.value?.isEventTypeOptedIn(event.event_type) === true), + + // Let's group the requests per eventType for easier batching + groupBy((event) => event.event_type), + mergeMap((groupedObservable) => + groupedObservable.pipe( + bufferCount(1000), // Batching up-to 1000 events per event type for backpressure reasons + map((events) => ({ eventType: groupedObservable.key, events })) + ) + ) + ) + .subscribe(({ eventType, events }) => { + this.sendToShipper(eventType, events); + }); + } +} diff --git a/packages/elastic-analytics/src/analytics_client/context_service.ts b/packages/elastic-analytics/src/analytics_client/context_service.ts new file mode 100644 index 0000000000000..cee3e56b389d1 --- /dev/null +++ b/packages/elastic-analytics/src/analytics_client/context_service.ts @@ -0,0 +1,77 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { Subject, Subscription } from 'rxjs'; +import { tap } from 'rxjs/operators'; +import type { EventContext } from '../events'; +import type { ContextProviderName, ContextProviderOpts } from './types'; + +export class ContextService { + private readonly contextProvidersRegistry = new Map>(); + private readonly contextProvidersSubscriptions = new Map(); + + constructor( + private readonly context$: Subject>, + private readonly isDevMode: boolean + ) {} + + /** + * Registers a context provider, and subscribes to any updates from it. + * @param contextProviderOpts The options to register the context provider {@link ContextProviderOpts} + */ + public registerContextProvider({ name, context$ }: ContextProviderOpts) { + if (this.contextProvidersSubscriptions.has(name)) { + throw new Error(`Context provider with name '${name}' already registered`); + } + + const subscription = context$ + .pipe( + tap((ctx) => { + if (this.isDevMode) { + // TODO: In the future we may need to validate the input of the context based on the schema (only if isDev) + } + }) + ) + .subscribe((context) => { + // We store each context linked to the context provider so they can increase and reduce + // the number of fields they report without having left-overs in the global context. + this.contextProvidersRegistry.set(name, context); + + // For every context change, we rebuild the global context. + // It's better to do it here than to rebuild it for every reportEvent. + this.updateGlobalContext(); + }); + + this.contextProvidersSubscriptions.set(name, subscription); + } + + /** + * Removes the context provider from the registry, unsubscribes from it, and rebuilds the global context. + * @param name The name of the context provider to remove. + */ + public removeContextProvider(name: ContextProviderName) { + this.contextProvidersSubscriptions.get(name)?.unsubscribe(); + this.contextProvidersRegistry.delete(name); + this.updateGlobalContext(); + } + + /** + * Loops through all the context providers and sets the global context + * @private + */ + private updateGlobalContext() { + this.context$.next( + [...this.contextProvidersRegistry.values()].reduce((acc, context) => { + return { + ...acc, + ...context, + }; + }, {} as Partial) + ); + } +} diff --git a/packages/elastic-analytics/src/analytics_client/index.ts b/packages/elastic-analytics/src/analytics_client/index.ts new file mode 100644 index 0000000000000..7a682de3c9772 --- /dev/null +++ b/packages/elastic-analytics/src/analytics_client/index.ts @@ -0,0 +1,26 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +export type { + IAnalyticsClient, + // Types for the constructor + AnalyticsClientInitContext, + // Types for the registerShipper API + ShipperClassConstructor, + RegisterShipperOpts, + // Types for the optIn API + OptInConfig, + OptInConfigPerType, + ShipperName, + // Types for the registerContextProvider API + ContextProviderOpts, + // Types for the registerEventType API + EventTypeOpts, +} from './types'; + +export { AnalyticsClient } from './analytics_client'; diff --git a/packages/elastic-analytics/src/analytics_client/mocks.ts b/packages/elastic-analytics/src/analytics_client/mocks.ts new file mode 100644 index 0000000000000..da707178a756e --- /dev/null +++ b/packages/elastic-analytics/src/analytics_client/mocks.ts @@ -0,0 +1,26 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { Subject } from 'rxjs'; +import type { IAnalyticsClient } from './types'; + +function createMockedAnalyticsClient(): jest.Mocked { + return { + optIn: jest.fn(), + reportEvent: jest.fn(), + registerEventType: jest.fn(), + registerContextProvider: jest.fn(), + removeContextProvider: jest.fn(), + registerShipper: jest.fn(), + telemetryCounter$: new Subject(), + }; +} + +export const analyticsClientMock = { + create: createMockedAnalyticsClient, +}; diff --git a/packages/elastic-analytics/src/analytics_client/opt_in_config.test.ts b/packages/elastic-analytics/src/analytics_client/opt_in_config.test.ts new file mode 100644 index 0000000000000..8c34d79086a3c --- /dev/null +++ b/packages/elastic-analytics/src/analytics_client/opt_in_config.test.ts @@ -0,0 +1,329 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { OptInConfigService } from './opt_in_config'; + +describe('OptInConfigService', () => { + describe('isOptedIn', () => { + test('Returns `true` when `global.enabled: true`', () => { + const config = new OptInConfigService({ global: { enabled: true } }); + expect(config.isOptedIn()).toBe(true); + }); + + test('Returns `false` when `global.enabled: false`', () => { + const config = new OptInConfigService({ global: { enabled: false } }); + expect(config.isOptedIn()).toBe(false); + }); + }); + + describe('isEventTypeOptedIn', () => { + test('Returns `true` when `global.enabled: true` and no eventType specific config is provided', () => { + const config = new OptInConfigService({ global: { enabled: true } }); + expect(config.isEventTypeOptedIn('test-event-1')).toBe(true); + }); + + test('Returns `false` when `global.enabled: false` and no eventType specific config is provided', () => { + const config = new OptInConfigService({ global: { enabled: false } }); + expect(config.isEventTypeOptedIn('test-event-1')).toBe(false); + }); + + test('Returns `true` when `global.enabled: true` and event_type config exists but not for the requested eventType', () => { + const config = new OptInConfigService({ + global: { enabled: true }, + event_types: { + 'test-event-2': { enabled: true }, + 'test-event-3': { enabled: false }, + }, + }); + expect(config.isEventTypeOptedIn('test-event-1')).toBe(true); + }); + + test('Returns `false` when `global.enabled: false` and event_type config exists but not for the requested eventType', () => { + const config = new OptInConfigService({ + global: { enabled: false }, + event_types: { + 'test-event-2': { enabled: true }, + 'test-event-3': { enabled: false }, + }, + }); + expect(config.isEventTypeOptedIn('test-event-1')).toBe(false); + }); + + test('Returns `true` when `global.enabled: true` and event_type config exists and it is `true`', () => { + const config = new OptInConfigService({ + global: { enabled: true }, + event_types: { + 'test-event-1': { enabled: true }, + }, + }); + expect(config.isEventTypeOptedIn('test-event-1')).toBe(true); + }); + + test('Returns `false` when `global.enabled: false` and event_type config exists and it is `true`', () => { + const config = new OptInConfigService({ + global: { enabled: false }, + event_types: { + 'test-event-1': { enabled: true }, + }, + }); + expect(config.isEventTypeOptedIn('test-event-1')).toBe(false); + }); + + test('Returns `false` when `global.enabled: true` and event_type config exists and it is `false`', () => { + const config = new OptInConfigService({ + global: { enabled: true }, + event_types: { + 'test-event-1': { enabled: false }, + }, + }); + expect(config.isEventTypeOptedIn('test-event-1')).toBe(false); + }); + + test('Returns `false` when `global.enabled: false` and event_type config exists and it is `false`', () => { + const config = new OptInConfigService({ + global: { enabled: false }, + event_types: { + 'test-event-1': { enabled: false }, + }, + }); + expect(config.isEventTypeOptedIn('test-event-1')).toBe(false); + }); + }); + describe('isShipperOptedIn', () => { + test('Returns `true` when `global.enabled: true` and no shipper specific config is provided', () => { + const config = new OptInConfigService({ global: { enabled: true } }); + expect(config.isShipperOptedIn('test-shipper-1')).toBe(true); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(true); + }); + + test('Returns `false` when `global.enabled: false` and no shipper specific config is provided', () => { + const config = new OptInConfigService({ global: { enabled: false } }); + expect(config.isShipperOptedIn('test-shipper-1')).toBe(false); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(false); + }); + + test('Returns `true` when `global.enabled: true` and shipper config exists but not for the requested eventType', () => { + const config = new OptInConfigService({ + global: { + enabled: true, + shippers: { + 'test-shipper-2': true, + 'test-shipper-3': false, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1')).toBe(true); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(true); + }); + + test('Returns `false` when `global.enabled: false` and shipper config exists but not for the requested eventType', () => { + const config = new OptInConfigService({ + global: { + enabled: false, + shippers: { + 'test-shipper-2': true, + 'test-shipper-3': false, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1')).toBe(false); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(false); + }); + + test('Returns `true` when `global.enabled: true` and shipper config exists and it is `true`', () => { + const config = new OptInConfigService({ + global: { + enabled: true, + shippers: { + 'test-shipper-1': true, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1')).toBe(true); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(true); + }); + + test('Returns `false` when `global.enabled: false` and shipper config exists and it is `true`', () => { + const config = new OptInConfigService({ + global: { + enabled: false, + shippers: { + 'test-shipper-1': true, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1')).toBe(false); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(false); + }); + + test('Returns `false` when `global.enabled: true` and shipper config exists and it is `false`', () => { + const config = new OptInConfigService({ + global: { + enabled: true, + shippers: { + 'test-shipper-1': false, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1')).toBe(false); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(false); + }); + + test('Returns `false` when `global.enabled: false` and shipper config exists and it is `false`', () => { + const config = new OptInConfigService({ + global: { + enabled: false, + shippers: { + 'test-shipper-1': false, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1')).toBe(false); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(false); + }); + + describe('with event_type config', () => { + test('Returns `true` when `global.enabled: true`, `shipper: true` and `event: true` (no `event.shippers`)', () => { + const config = new OptInConfigService({ + global: { + enabled: true, + shippers: { + 'test-shipper-1': true, + }, + }, + event_types: { + 'test-event-1': { + enabled: true, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(true); + }); + + test('Returns `true` when `global.enabled: true`, `shipper: true`, `event: true` (`event.shippers` exists but for others)', () => { + const config = new OptInConfigService({ + global: { + enabled: true, + shippers: { + 'test-shipper-1': true, + }, + }, + event_types: { + 'test-event-1': { + enabled: true, + shippers: { + 'test-shipper-2': false, + }, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(true); + }); + + test('Returns `true` when `global.enabled: true`, `shipper: true`, `event: true` (`event.shipper: true`)', () => { + const config = new OptInConfigService({ + global: { + enabled: true, + shippers: { + 'test-shipper-1': true, + }, + }, + event_types: { + 'test-event-1': { + enabled: true, + shippers: { + 'test-shipper-1': true, + }, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(true); + }); + + test('Returns `false` when `global.enabled: false`, `shipper: true`, `event: true` (`event.shipper: true`)', () => { + const config = new OptInConfigService({ + global: { + enabled: false, + shippers: { + 'test-shipper-1': true, + }, + }, + event_types: { + 'test-event-1': { + enabled: true, + shippers: { + 'test-shipper-1': true, + }, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(false); + }); + + test('Returns `false` when `global.enabled: true`, `shipper: false`, `event: true` (`event.shipper: true`)', () => { + const config = new OptInConfigService({ + global: { + enabled: true, + shippers: { + 'test-shipper-1': false, + }, + }, + event_types: { + 'test-event-1': { + enabled: true, + shippers: { + 'test-shipper-1': true, + }, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(false); + }); + + test('Returns `false` when `global.enabled: true`, `shipper: true`, `event: false` (`event.shipper: true`)', () => { + const config = new OptInConfigService({ + global: { + enabled: true, + shippers: { + 'test-shipper-1': true, + }, + }, + event_types: { + 'test-event-1': { + enabled: false, + shippers: { + 'test-shipper-1': true, + }, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(false); + }); + + test('Returns `false` when `global.enabled: true`, `shipper: true`, `event: true` (`event.shipper: false`)', () => { + const config = new OptInConfigService({ + global: { + enabled: true, + shippers: { + 'test-shipper-1': true, + }, + }, + event_types: { + 'test-event-1': { + enabled: true, + shippers: { + 'test-shipper-1': false, + }, + }, + }, + }); + expect(config.isShipperOptedIn('test-shipper-1', 'test-event-1')).toBe(false); + }); + }); + }); +}); diff --git a/packages/elastic-analytics/src/analytics_client/opt_in_config.ts b/packages/elastic-analytics/src/analytics_client/opt_in_config.ts new file mode 100644 index 0000000000000..6fece8b8e2a8f --- /dev/null +++ b/packages/elastic-analytics/src/analytics_client/opt_in_config.ts @@ -0,0 +1,71 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { OptInConfig, ShipperName } from './types'; +import type { EventType } from '../events'; + +export class OptInConfigService { + constructor(private readonly optInConfig: OptInConfig) {} + + /** + * Is globally opted in? + */ + public isOptedIn(): boolean { + return this.optInConfig.global.enabled; + } + + /** + * Is the given event type opted in? + * @param eventType the event type to check + */ + public isEventTypeOptedIn(eventType: EventType): boolean { + if (!this.isOptedIn()) { + return false; + } + // In case of not provided a specific eventType consent, we assume opted-in + const isEventTypeOptedIn = + (this.optInConfig.event_types && this.optInConfig.event_types[eventType]?.enabled) ?? true; + + return isEventTypeOptedIn; + } + + /** + * Is the given shipper opted in? + * @param shipperName the shipper to check + * @param eventType the event type to check for the shipper + */ + public isShipperOptedIn(shipperName: ShipperName, eventType?: EventType): boolean { + if (!this.isOptedIn()) { + return false; + } + + // In case of not provided a specific shipper consent, we assume opted-in + const isShipperGloballyOptedIn: boolean = + (this.optInConfig.global.shippers && this.optInConfig.global.shippers[shipperName]) ?? true; + + if (!isShipperGloballyOptedIn) { + return false; + } + + if (eventType) { + if (!this.isEventTypeOptedIn(eventType)) { + return false; + } + + const eventTypeOptInConfig = + this.optInConfig.event_types && this.optInConfig.event_types[eventType]; + // In case of not provided a specific eventType-level shipper consent, we assume opted-in + const isEventTypeShipperOptedIn: boolean = + (eventTypeOptInConfig?.shippers && eventTypeOptInConfig.shippers[shipperName]) ?? true; + + return isEventTypeShipperOptedIn; + } else { + return isShipperGloballyOptedIn; + } + } +} diff --git a/packages/elastic-analytics/src/analytics_client/shippers_registry.test.ts b/packages/elastic-analytics/src/analytics_client/shippers_registry.test.ts new file mode 100644 index 0000000000000..9fbb4c308f56c --- /dev/null +++ b/packages/elastic-analytics/src/analytics_client/shippers_registry.test.ts @@ -0,0 +1,123 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { ShippersRegistry } from './shippers_registry'; +import { shippersMock } from '../shippers/mocks'; + +describe('ShippersRegistry', () => { + let shippersRegistry: ShippersRegistry; + + beforeEach(() => { + shippersRegistry = new ShippersRegistry(); + }); + + describe('Global Shippers', () => { + test('adds a shipper without an error', () => { + const shipper = shippersMock.createShipper(); + expect(shippersRegistry.allShippers.size).toBe(0); + shippersRegistry.addGlobalShipper('testShipper', shipper); + expect(shippersRegistry.allShippers.size).toBe(1); + }); + + test('fails to add the same shipper name twice (even when the shipper implementation is different)', () => { + const shipper1 = shippersMock.createShipper(); + const shipper2 = shippersMock.createShipper(); + shippersRegistry.addGlobalShipper('testShipper', shipper1); + expect(() => + shippersRegistry.addGlobalShipper('testShipper', shipper2) + ).toThrowErrorMatchingInlineSnapshot(`"Shipper \\"testShipper\\" is already registered"`); + }); + + test('adds multiple shippers with different names (even when the shipper implementation is the same)', () => { + const shipper = shippersMock.createShipper(); // Explicitly testing with the same shipper implementation + + expect(shippersRegistry.allShippers.size).toBe(0); + shippersRegistry.addGlobalShipper('testShipper1', shipper); + expect(shippersRegistry.allShippers.size).toBe(1); + shippersRegistry.addGlobalShipper('testShipper2', shipper); + expect(shippersRegistry.allShippers.size).toBe(2); + }); + + test('returns a global shipper if there is no event-type specific shipper', () => { + const shipper = shippersMock.createShipper(); + const shipperName = 'testShipper'; + expect(shippersRegistry.allShippers.size).toBe(0); + shippersRegistry.addGlobalShipper(shipperName, shipper); + expect(shippersRegistry.allShippers.size).toBe(1); + + const shippersForEventType = shippersRegistry.getShippersForEventType( + `RandomEvent${Date.now()}` + ); + // eslint-disable-next-line dot-notation + expect(shippersForEventType).toBe(shippersRegistry['globalShippers']); + expect(shippersForEventType.size).toBe(1); + expect(shippersForEventType.get(shipperName)).toBe(shipper); + }); + }); + + describe('Event-Exclusive Shippers', () => { + test('adds a shipper without an error', () => { + const shipper = shippersMock.createShipper(); + expect(shippersRegistry.allShippers.size).toBe(0); + shippersRegistry.addEventExclusiveShipper('testEvent', 'testShipper', shipper); + expect(shippersRegistry.allShippers.size).toBe(1); + }); + + test('fails to add the same shipper name twice (even when the shipper implementation is different)', () => { + const shipper1 = shippersMock.createShipper(); + const shipper2 = shippersMock.createShipper(); + shippersRegistry.addEventExclusiveShipper('testEvent', 'testShipper', shipper1); + expect(() => + shippersRegistry.addEventExclusiveShipper('testEvent', 'testShipper', shipper2) + ).toThrowErrorMatchingInlineSnapshot( + `"testShipper is already registered for event-type testEvent"` + ); + }); + + test('adds multiple shippers with different names (even when the shipper implementation is the same)', () => { + const shipper = shippersMock.createShipper(); // Explicitly testing with the same shipper implementation + + expect(shippersRegistry.allShippers.size).toBe(0); + shippersRegistry.addEventExclusiveShipper('testEvent', 'testShipper1', shipper); + expect(shippersRegistry.allShippers.size).toBe(1); + shippersRegistry.addEventExclusiveShipper('testEvent', 'testShipper2', shipper); + expect(shippersRegistry.allShippers.size).toBe(2); + }); + + test('adds the same shipper to different event types. The allShippers count does not increase', () => { + const shipper = shippersMock.createShipper(); // Explicitly testing with the same shipper implementation + + expect(shippersRegistry.allShippers.size).toBe(0); + shippersRegistry.addEventExclusiveShipper('testEvent1', 'testShipper', shipper); + expect(shippersRegistry.allShippers.size).toBe(1); + shippersRegistry.addEventExclusiveShipper('testEvent2', 'testShipper', shipper); + expect(shippersRegistry.allShippers.size).toBe(1); // This is still 1 because the shipper is the same + }); + + test('returns an event-specific shipper', () => { + const shipper = shippersMock.createShipper(); + const shipperName = 'testShipper'; + const eventTypeName = 'testEvent'; + expect(shippersRegistry.allShippers.size).toBe(0); + shippersRegistry.addEventExclusiveShipper(eventTypeName, shipperName, shipper); + expect(shippersRegistry.allShippers.size).toBe(1); + + const shippersForEventType = shippersRegistry.getShippersForEventType(eventTypeName); + expect(shippersForEventType.size).toBe(1); + expect(shippersForEventType.get(shipperName)).toBe(shipper); + + // No event-specific shipper found, returns global but no shippers found in global + const shippersForEventTypeNotFound = shippersRegistry.getShippersForEventType( + `RandomEvent${Date.now()}` + ); + // eslint-disable-next-line dot-notation + expect(shippersForEventTypeNotFound).toBe(shippersRegistry['globalShippers']); + expect(shippersForEventTypeNotFound.size).toBe(0); + }); + }); +}); diff --git a/packages/elastic-analytics/src/analytics_client/shippers_registry.ts b/packages/elastic-analytics/src/analytics_client/shippers_registry.ts new file mode 100644 index 0000000000000..8380775679861 --- /dev/null +++ b/packages/elastic-analytics/src/analytics_client/shippers_registry.ts @@ -0,0 +1,73 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { EventType } from '../events'; +import type { IShipper } from '../shippers'; +import type { ShipperName } from './types'; + +/** + * Holds the map of the { [shipperName]: shipperInstance } + */ +export type ShippersMap = Map; + +export class ShippersRegistry { + /** + * Holds all the shippers: global and eventTypeExclusive. + * This helps to avoid looping over all the shippers when we just need them all. + */ + public readonly allShippers: ShippersMap = new Map(); + /** + * Holds the shippers that are not registered as exclusive to any event-type + */ + private readonly globalShippers: ShippersMap = new Map(); + /** + * Holds the shippers that are exclusive to an event-type in the format of { [eventType]: ShippersMap } + */ + private readonly eventTypeExclusiveShippers: Map = new Map(); + + /** + * Adds shipper to the registry. + * @param shipperName The unique name of the shipper. + * @param shipper The initialized shipper. + */ + public addGlobalShipper(shipperName: ShipperName, shipper: IShipper) { + if (this.globalShippers.get(shipperName)) { + throw new Error(`Shipper "${shipperName}" is already registered`); + } + this.globalShippers.set(shipperName, shipper); + this.allShippers.set(shipperName, shipper); + } + + /** + * Adds an event-type exclusive shipper. + * @param eventType The name of the event type + * @param shipperName The unique name for the shipper. + * @param shipper The initialized shipper. + */ + public addEventExclusiveShipper( + eventType: EventType, + shipperName: ShipperName, + shipper: IShipper + ) { + const eventExclusiveMap = this.eventTypeExclusiveShippers.get(eventType) || new Map(); + if (eventExclusiveMap.get(shipperName)) { + throw new Error(`${shipperName} is already registered for event-type ${eventType}`); + } + eventExclusiveMap.set(shipperName, shipper); + this.eventTypeExclusiveShippers.set(eventType, eventExclusiveMap); + this.allShippers.set(shipperName, shipper); + } + + /** + * Returns the shippers that must be used for the specified event type. + * @param eventType The name of the event type. + */ + public getShippersForEventType(eventType: EventType): ShippersMap { + return this.eventTypeExclusiveShippers.get(eventType) || this.globalShippers; + } +} diff --git a/packages/elastic-analytics/src/analytics_client/types.ts b/packages/elastic-analytics/src/analytics_client/types.ts new file mode 100644 index 0000000000000..782d6b16fa594 --- /dev/null +++ b/packages/elastic-analytics/src/analytics_client/types.ts @@ -0,0 +1,214 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { Observable } from 'rxjs'; + +// If we are going to export this to a separate NPM module in the future, +// we'll need to revisit this import. +import type { Logger } from '@kbn/logging'; + +import type { IShipper } from '../shippers'; +import type { EventContext, EventType, TelemetryCounter } from '../events'; +import type { RootSchema } from '../schema'; + +/** + * General settings of the analytics client + */ +export interface AnalyticsClientInitContext { + /** + * Boolean indicating if it's running in developer mode. + */ + isDev: boolean; + /** + * Specify if the shippers should send their data to the production or staging environments. + */ + sendTo: 'production' | 'staging'; + /** + * Application-provided logger. + */ + logger: Logger; +} + +/** + * Shipper Name used for indexed structures. Only used to improve the readability of the types + */ +export type ShipperName = string; + +/** + * Constructor of a {@link IShipper} + */ +export interface ShipperClassConstructor { + /** + * The shipper's unique name + */ + shipperName: ShipperName; + + /** + * The constructor + * @param config The shipper's custom config + * @param initContext Common context {@link AnalyticsClientInitContext} + */ + new (config: Config, initContext: AnalyticsClientInitContext): Shipper; +} + +/** + * Optional options to register a shipper + */ +export interface RegisterShipperOpts { + /** + * List of event types that will be received only by this shipper. + * @deprecated + * @internal Set as internal and deprecated until we come up with the best design for this. + * Not in the scope of the initial MVP. + */ + exclusiveEventTypes?: EventType[]; +} + +/** + * Sets whether a type of event is enabled/disabled globally or per shipper. + */ +export interface OptInConfigPerType { + /** + * The event type is globally enabled. + */ + enabled: boolean; + /** + * Controls if an event type should be disabled for a specific type of shipper. + * @example If the event type is automatically tracked by ShipperA, the config would look like: + * ``` + * { + * enabled: true, + * shippers: { + * ShipperA: false + * } + * } + * ``` + */ + shippers?: Record; +} + +/** + * + */ +export interface OptInConfig { + /** + * Controls the global enabled/disabled behaviour of the client and shippers. + */ + global: OptInConfigPerType; + /** + * Controls if an event type should be disabled for a specific type of shipper. + * @example If "clicks" are automatically tracked by ShipperA, the config would look like: + * ``` + * { + * global: { enabled: true }, + * event_types: { + * click: { + * enabled: true, + * shippers: { + * ShipperA: false + * } + * } + * } + * } + * ``` + */ + event_types?: Record; +} + +/** + * ContextProviderName used for indexed structures. Only used to improve the readability of the types + */ +export type ContextProviderName = string; + +/** + * Definition of a context provider + */ +export interface ContextProviderOpts> { + /** + * The name of the provider. + */ + name: ContextProviderName; + /** + * Observable that emits the custom context. + */ + context$: Observable; + /** + * Schema declaring and documenting the expected output in the context$ + * + * @remark During development, it may be used to validate the provided values. + */ + schema: RootSchema; +} + +/** + * Definition of an Event Type. + */ +export interface EventTypeOpts { + /** + * The event type's unique name. + */ + eventType: EventType; + /** + * Schema declaring and documenting the expected structure of this event type. + * + * @remark During development, it may be used to validate the provided values. + */ + schema: RootSchema; +} + +/** + * Analytics client's public APIs + */ +export interface IAnalyticsClient { + /** + * Reports a telemetry event. + * @param eventType The event type registered via the `registerEventType` API. + * @param eventData The properties matching the schema declared in the `registerEventType` API. + */ + reportEvent: >( + eventType: EventType, + eventData: EventTypeData + ) => void; + /** + * Registers the event type that will be emitted via the reportEvent API. + * @param eventTypeOps + */ + registerEventType: (eventTypeOps: EventTypeOpts) => void; + + /** + * Set up the shipper that will be used to report the telemetry events. + * @param Shipper The {@link IShipper} class to instantiate the shipper. + * @param shipperConfig The config specific to the Shipper to instantiate. + * @param opts Additional options to register the shipper {@link RegisterShipperOpts}. + */ + registerShipper: ( + Shipper: ShipperClassConstructor, + shipperConfig: ShipperConfig, + opts?: RegisterShipperOpts + ) => void; + /** + * Used to control the user's consent to report the data. + * In the advanced mode, it allows to "cherry-pick" which events and shippers are enabled/disabled. + * @param optInConfig {@link OptInConfig} + */ + optIn: (optInConfig: OptInConfig) => void; + /** + * Registers the context provider to enrich the any reported events. + * @param contextProviderOpts {@link ContextProviderOpts} + */ + registerContextProvider: (contextProviderOpts: ContextProviderOpts) => void; + /** + * Removes the context provider and stop enriching the events from its context. + * @param contextProviderName The name of the context provider to remove. + */ + removeContextProvider: (contextProviderName: ContextProviderName) => void; + /** + * Observable to emit the stats of the processed events. + */ + readonly telemetryCounter$: Observable; +} diff --git a/packages/elastic-analytics/src/events/index.ts b/packages/elastic-analytics/src/events/index.ts new file mode 100644 index 0000000000000..3400a496aa9b7 --- /dev/null +++ b/packages/elastic-analytics/src/events/index.ts @@ -0,0 +1,10 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +export type { Event, EventType, EventContext, TelemetryCounter } from './types'; +export { TelemetryCounterType } from './types'; diff --git a/packages/elastic-analytics/src/events/types.ts b/packages/elastic-analytics/src/events/types.ts new file mode 100644 index 0000000000000..8523b7791150a --- /dev/null +++ b/packages/elastic-analytics/src/events/types.ts @@ -0,0 +1,95 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { ShipperName } from '../analytics_client'; + +export interface EventContext { + // TODO: Extend with known keys + [key: string]: unknown; +} + +/** + * Event Type used for indexed structures. Only used to improve the readability of the types + */ +export type EventType = string; + +/** + * Types of the Telemetry Counter: It allows to differentiate what happened to the events + */ +export enum TelemetryCounterType { + /** + * The event was accepted and will be sent to the shippers when they become available (and opt-in === true). + */ + enqueued = 'enqueued', + /** + * The event was sent to at least one shipper. + */ + sent_to_shipper = 'sent_to_shipper', + /** + * The event was successfully sent by the shipper. + */ + succeeded = 'succeeded', + /** + * There was an error when processing/shipping the event. + * Refer to the Telemetry Counter's code for the reason. + */ + failed = 'failed', + /** + * The event was dropped from the queue. + * Refer to the Telemetry Counter's code for the reason. + */ + dropped = 'dropped', +} + +/** + * Shape of the events emitted by the telemetryCounter$ observable + */ +export interface TelemetryCounter { + /** + * Indicates if the event contains data about succeeded, failed or dropped events. + */ + type: TelemetryCounterType; + /** + * Who emitted the event? It can be "client" or the name of the shipper. + */ + source: 'client' | ShipperName; + /** + * The event type the success/failure/drop event refers to. + */ + event_type: EventType; + /** + * Code to provide additional information about the success or failure. Examples are 200/400/504/ValidationError/UnknownError + */ + code: string; + /** + * The number of events that this counter refers to. + */ + count: number; +} + +/** + * Definition of the full event structure + */ +export interface Event { + /** + * The time the event was generated in ISO format. + */ + timestamp: string; + /** + * The event type. + */ + event_type: EventType; + /** + * The specific properties of the event type. + */ + properties: Record; + /** + * The {@link EventContext} enriched during the processing pipeline. + */ + context: EventContext; +} diff --git a/packages/elastic-analytics/src/index.ts b/packages/elastic-analytics/src/index.ts new file mode 100644 index 0000000000000..382974783aeb1 --- /dev/null +++ b/packages/elastic-analytics/src/index.ts @@ -0,0 +1,55 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { + AnalyticsClientInitContext, + IAnalyticsClient as AnalyticsClient, +} from './analytics_client'; +import { AnalyticsClient as AnalyticsClientClass } from './analytics_client'; + +/** + * Creates an {@link AnalyticsClient}. + * @param initContext The initial context to create the client {@link AnalyticsClientInitContext} + */ +export function createAnalytics(initContext: AnalyticsClientInitContext): AnalyticsClient { + return new AnalyticsClientClass(initContext); +} + +export type { + IAnalyticsClient as AnalyticsClient, + // Types for the constructor + AnalyticsClientInitContext, + // Types for the registerShipper API + ShipperClassConstructor, + RegisterShipperOpts, + // Types for the optIn API + OptInConfig, + OptInConfigPerType, + ShipperName, + // Types for the registerContextProvider API + ContextProviderOpts, + // Types for the registerEventType API + EventTypeOpts, +} from './analytics_client'; +export type { Event, EventContext, EventType, TelemetryCounter } from './events'; +export { TelemetryCounterType } from './events'; +export type { + RootSchema, + SchemaObject, + SchemaArray, + SchemaChildValue, + SchemaMeta, + SchemaValue, + SchemaMetaOptional, + PossibleSchemaTypes, + AllowedSchemaBooleanTypes, + AllowedSchemaNumberTypes, + AllowedSchemaStringTypes, + AllowedSchemaTypes, +} from './schema'; +export type { IShipper } from './shippers'; diff --git a/packages/elastic-analytics/src/mocks.ts b/packages/elastic-analytics/src/mocks.ts new file mode 100644 index 0000000000000..84a8f0854773a --- /dev/null +++ b/packages/elastic-analytics/src/mocks.ts @@ -0,0 +1,10 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +export { shippersMock } from './shippers/mocks'; +export { analyticsClientMock } from './analytics_client/mocks'; diff --git a/packages/elastic-analytics/src/schema/index.ts b/packages/elastic-analytics/src/schema/index.ts new file mode 100644 index 0000000000000..e351a785c13ba --- /dev/null +++ b/packages/elastic-analytics/src/schema/index.ts @@ -0,0 +1,22 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +export type { + RootSchema, + SchemaObject, + SchemaArray, + SchemaChildValue, + SchemaMeta, + SchemaValue, + SchemaMetaOptional, + PossibleSchemaTypes, + AllowedSchemaBooleanTypes, + AllowedSchemaNumberTypes, + AllowedSchemaStringTypes, + AllowedSchemaTypes, +} from './types'; diff --git a/packages/elastic-analytics/src/schema/types.test.ts b/packages/elastic-analytics/src/schema/types.test.ts new file mode 100644 index 0000000000000..3ed25e46d6dc9 --- /dev/null +++ b/packages/elastic-analytics/src/schema/types.test.ts @@ -0,0 +1,548 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { PossibleSchemaTypes, RootSchema, SchemaValue } from './types'; + +describe('schema types', () => { + describe('PossibleSchemaTypes', () => { + test('it should only allow "string" types', () => { + let valueType: PossibleSchemaTypes = 'keyword'; + valueType = 'text'; + valueType = 'date'; + + // @ts-expect-error + valueType = 'boolean'; + // @ts-expect-error + valueType = 'long'; + // @ts-expect-error + valueType = 'integer'; + // @ts-expect-error + valueType = 'short'; + // @ts-expect-error + valueType = 'byte'; + // @ts-expect-error + valueType = 'double'; + // @ts-expect-error + valueType = 'float'; + + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + test('it should only allow "number" types', () => { + let valueType: PossibleSchemaTypes = 'long'; + valueType = 'integer'; + valueType = 'short'; + valueType = 'byte'; + valueType = 'double'; + valueType = 'float'; + valueType = 'date'; + + // @ts-expect-error + valueType = 'boolean'; + // @ts-expect-error + valueType = 'keyword'; + + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + test('it should only allow "boolean" types', () => { + let valueType: PossibleSchemaTypes = 'boolean'; + // @ts-expect-error + valueType = 'integer'; + // @ts-expect-error + valueType = 'short'; + // @ts-expect-error + valueType = 'byte'; + // @ts-expect-error + valueType = 'double'; + // @ts-expect-error + valueType = 'float'; + // @ts-expect-error + valueType = 'date'; + + // @ts-expect-error + valueType = 'keyword'; + + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + }); + + describe('SchemaValue', () => { + describe('Pass Through', () => { + test('it should allow "pass_through" and enforce the _meta.description', () => { + let valueType: SchemaValue = { + type: 'pass_through', + _meta: { + description: 'Some description', + }, + }; + + valueType = { + type: 'pass_through', + _meta: { + description: 'Some description', + optional: false, + }, + }; + + valueType = { + type: 'pass_through', + _meta: { + description: 'Some description', + // @ts-expect-error optional can't be true when the types don't set the value as optional + optional: true, + }, + }; + + // @ts-expect-error because it's missing the _meta.description + valueType = { type: 'pass_through' }; + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + test('it should enforce `_meta.optional: true`', () => { + let valueType: SchemaValue = { + type: 'pass_through', + _meta: { + description: 'Some description', + optional: true, + }, + }; + + valueType = { + type: 'pass_through', + _meta: { + description: 'Some description', + // @ts-expect-error because optional can't be false when the value can be undefined + optional: false, + }, + }; + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + }); + + describe('Plain value', () => { + test('it should allow the correct type and enforce the _meta.description', () => { + let valueType: SchemaValue = { + type: 'keyword', + _meta: { + description: 'Some description', + }, + }; + + valueType = { + type: 'keyword', + _meta: { + description: 'Some description', + optional: false, + }, + }; + + valueType = { + // @ts-expect-error because the type does not match + type: 'long', + _meta: { + description: 'Some description', + optional: false, + }, + }; + + valueType = { + type: 'keyword', + _meta: { + description: 'Some description', + // @ts-expect-error optional can't be true when the types don't set the value as optional + optional: true, + }, + }; + + // @ts-expect-error because it's missing the _meta.description + valueType = { type: 'keyword' }; + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + test('it should enforce `_meta.optional: true`', () => { + let valueType: SchemaValue = { + type: 'keyword', + _meta: { + description: 'Some description', + optional: true, + }, + }; + + valueType = { + type: 'keyword', + _meta: { + description: 'Some description', + // @ts-expect-error because optional can't be false when the value can be undefined + optional: false, + }, + }; + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + }); + + describe('Object value', () => { + test('it should allow "pass_through" and enforce the _meta.description', () => { + let valueType: SchemaValue<{ a_value: string }> = { + type: 'pass_through', + _meta: { + description: 'Some description', + }, + }; + + // @ts-expect-error because it's missing the _meta.description + valueType = { type: 'pass_through' }; + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + + test('it should expect the proper object-schema definition, and allows some _meta at the object level as well', () => { + let valueType: SchemaValue<{ a_value: string }> = { + properties: { + a_value: { + type: 'keyword', + _meta: { + description: 'Some description', + }, + }, + }, + }; + + valueType = { + properties: { + a_value: { + type: 'keyword', + _meta: { + description: 'Some description', + optional: false, + }, + }, + }, + _meta: { + description: 'Description at the object level', + }, + }; + + valueType = { + properties: { + a_value: { + type: 'keyword', + _meta: { + description: 'Some description', + optional: false, + }, + }, + // @ts-expect-error b_value does not exist in the object definition + b_value: { + type: 'keyword', + _meta: { + description: 'Some description', + optional: true, + }, + }, + }, + _meta: { + description: 'Description at the object level', + }, + }; + + // @ts-expect-error because it's missing object properties + valueType = { properties: {} }; + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + + test('it should enforce `_meta.optional: true`', () => { + const objectValueType: SchemaValue<{ a_value: string } | undefined> = { + properties: { + a_value: { + type: 'keyword', + _meta: { + description: 'Some description', + }, + }, + }, + _meta: { + description: 'Optional object', + optional: true, + }, + }; + expect(objectValueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + + let valueType: SchemaValue<{ a_value?: string }> = { + properties: { + a_value: { + type: 'keyword', + _meta: { + description: 'Some description', + optional: true, + }, + }, + }, + }; + + valueType = { + properties: { + a_value: { + type: 'keyword', + // @ts-expect-error because it should provide optional: true + _meta: { + description: 'Some description', + }, + }, + }, + }; + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + }); + + describe('Array value', () => { + test('it should allow "pass_through" and enforce the _meta.description', () => { + let valueType: SchemaValue> = { + type: 'pass_through', + _meta: { + description: 'Some description', + }, + }; + + // @ts-expect-error because it's missing the _meta.description + valueType = { type: 'pass_through' }; + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + + test('it should expect the proper array-schema definition, and allows some _meta at the object level as well', () => { + let valueType: SchemaValue> = { + type: 'array', + items: { + properties: { + a_value: { + type: 'keyword', + _meta: { + description: 'Some description', + }, + }, + }, + }, + }; + + valueType = { + type: 'array', + items: { + properties: { + a_value: { + type: 'keyword', + _meta: { + description: 'Some description', + optional: false, + }, + }, + }, + _meta: { + description: 'Description at the object level', + }, + }, + }; + + // @ts-expect-error because it's missing the items definition + valueType = { type: 'array' }; + // @ts-expect-error because it's missing the items definition + valueType = { type: 'array', items: {} }; + // @ts-expect-error because it's missing the items' properties definition + valueType = { type: 'array', items: { properties: {} } }; + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + + test('it should enforce `_meta.optional: true`', () => { + const arrayValueType: SchemaValue | undefined> = { + type: 'array', + items: { + properties: { + a_value: { + type: 'keyword', + _meta: { + description: 'Some description', + }, + }, + }, + }, + _meta: { + description: 'Optional object', + optional: true, + }, + }; + expect(arrayValueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + + const objectValueType: SchemaValue> = { + type: 'array', + items: { + properties: { + a_value: { + type: 'keyword', + _meta: { + description: 'Some description', + }, + }, + }, + _meta: { + description: 'Optional object', + optional: true, + }, + }, + }; + expect(objectValueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + + let valueType: SchemaValue> = { + type: 'array', + items: { + properties: { + a_value: { + type: 'keyword', + _meta: { + description: 'Some description', + optional: true, + }, + }, + }, + }, + }; + + valueType = { + type: 'array', + items: { + properties: { + a_value: { + type: 'keyword', + // @ts-expect-error because it should provide optional: true + _meta: { + description: 'Some description', + }, + }, + }, + }, + }; + expect(valueType).not.toBeUndefined(); // <-- Only to stop the var-not-used complain + }); + }); + }); + + describe('RootSchema', () => { + const registerSchema = (schema: RootSchema) => schema; + test('it works with the explicit types', () => { + registerSchema<{ + my_keyword: string; + my_number?: number; + my_complex_unknown_meta_object: Record; + my_array_of_str: string[]; + my_object: { my_timestamp: string }; + my_array_of_objects: Array<{ my_bool_prop: boolean }>; + }>({ + my_keyword: { + type: 'keyword', + _meta: { + description: 'Represents the key property...', + }, + }, + my_number: { + type: 'long', + _meta: { + description: 'Indicates the number of times...', + optional: true, + }, + }, + my_complex_unknown_meta_object: { + type: 'pass_through', + _meta: { + description: 'Unknown object that contains the key-values...', + }, + }, + my_array_of_str: { + type: 'array', + items: { + type: 'text', + _meta: { + description: 'List of tags...', + }, + }, + }, + my_object: { + properties: { + my_timestamp: { + type: 'date', + _meta: { + description: 'timestamp when the user...', + }, + }, + }, + }, + my_array_of_objects: { + type: 'array', + items: { + properties: { + my_bool_prop: { + type: 'boolean', + _meta: { + description: '`true` when...', + }, + }, + }, + }, + }, + }); + }); + test('it works with implicit types', () => { + registerSchema({}); + registerSchema({ + my_keyword: { + type: 'keyword', + _meta: { + description: 'Represents the key property...', + }, + }, + my_number: { + type: 'long', + _meta: { + description: 'Indicates the number of times...', + optional: true, + }, + }, + my_complex_unknown_meta_object: { + type: 'pass_through', + _meta: { + description: 'Unknown object that contains the key-values...', + }, + }, + my_array_of_str: { + type: 'array', + items: { + type: 'text', + _meta: { + description: 'List of tags...', + }, + }, + }, + my_object: { + properties: { + my_timestamp: { + type: 'date', + _meta: { + description: 'timestamp when the user...', + }, + }, + }, + }, + my_array_of_objects: { + type: 'array', + items: { + properties: { + my_bool_prop: { + type: 'boolean', + _meta: { + description: '`true` when...', + }, + }, + }, + }, + }, + }); + }); + }); +}); diff --git a/packages/elastic-analytics/src/schema/types.ts b/packages/elastic-analytics/src/schema/types.ts new file mode 100644 index 0000000000000..8bac1ceaad620 --- /dev/null +++ b/packages/elastic-analytics/src/schema/types.ts @@ -0,0 +1,166 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** Types matching number values **/ +export type AllowedSchemaNumberTypes = + | 'long' + | 'integer' + | 'short' + | 'byte' + | 'double' + | 'float' + | 'date'; +/** Types matching string values **/ +export type AllowedSchemaStringTypes = 'keyword' | 'text' | 'date'; +/** Types matching boolean values **/ +export type AllowedSchemaBooleanTypes = 'boolean'; + +/** + * Possible type values in the schema + */ +export type AllowedSchemaTypes = + | AllowedSchemaNumberTypes + | AllowedSchemaStringTypes + | AllowedSchemaBooleanTypes; + +/** + * Helper to ensure the declared types match the schema types + */ +export type PossibleSchemaTypes = Value extends string + ? AllowedSchemaStringTypes + : Value extends number + ? AllowedSchemaNumberTypes + : Value extends boolean + ? AllowedSchemaBooleanTypes + : // allow any schema type from the union if typescript is unable to resolve the exact U type + AllowedSchemaTypes; + +export interface SchemaChildValue { + type: PossibleSchemaTypes>; + _meta: { + description: string; // Intentionally enforcing the descriptions here + } & SchemaMetaOptional; +} + +/** + * Type that defines all the possible values that the Schema accepts. + * These types definitions are helping to identify earlier the possible missing `properties` nesting when + * manually defining the schemas. + */ +export type SchemaValue = + // Always allow the pass_through no matter what the value is + | { + type: 'pass_through'; + _meta: { + description: string; // Intentionally enforcing the descriptions here + } & SchemaMetaOptional; + } + | (unknown extends Value + ? // If the Value is unknown (TS can't infer the type), allow any type of schema + SchemaArray | SchemaObject | SchemaChildValue + : // Otherwise, try to infer the type and enforce the schema + NonNullable extends Array + ? SchemaArray + : NonNullable extends object + ? SchemaObject + : SchemaChildValue); + +/** + * Enforces { optional: true } if the value can be undefined + */ +export type SchemaMetaOptional = unknown extends Value + ? { optional?: boolean } + : undefined extends Value + ? { optional: true } + : { optional?: false }; + +/** + * Schema meta with optional description + */ +export interface SchemaMeta { + _meta?: { + description?: string; + } & SchemaMetaOptional; +} + +/** + * Schema to represent an array + */ +export interface SchemaArray extends SchemaMeta { + type: 'array'; + items: SchemaValue; +} + +/** + * Schema to represent an object + */ +export interface SchemaObject extends SchemaMeta { + properties: { + [Key in keyof Required]: SchemaValue; + }; +} + +/** + * Schema definition to match the structure of the properties provided. + * + * @example + * { + * my_keyword: { + * type: 'keyword', + * _meta: { + * description: 'Represents the key property...' + * } + * }, + * my_number: { + * type: 'long', + * _meta: { + * description: 'Indicates the number of times...', + * optional: true + * } + * }, + * my_complex_unknown_meta_object: { + * type: 'pass_through', + * _meta: { + * description: 'Unknown object that contains the key-values...' + * } + * }, + * my_array_of_str: { + * type: 'array', + * items: { + * type: 'text', + * _meta: { + * description: 'List of tags...' + * } + * } + * }, + * my_object: { + * properties: { + * my_timestamp: { + * type: 'date', + * _meta: { + * description: 'timestamp when the user...' + * } + * } + * } + * }, + * my_array_of_objects: { + * type: 'array', + * items: { + * properties: { + * my_bool_prop: { + * type: 'boolean', + * _meta: { + * description: '`true` when...' + * } + * } + * } + * } + * } + * } + */ +export type RootSchema = SchemaObject['properties']; diff --git a/packages/elastic-analytics/src/shippers/index.ts b/packages/elastic-analytics/src/shippers/index.ts new file mode 100644 index 0000000000000..7a4ab7d85b9f2 --- /dev/null +++ b/packages/elastic-analytics/src/shippers/index.ts @@ -0,0 +1,9 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +export type { IShipper } from './types'; diff --git a/packages/elastic-analytics/src/shippers/mocks.ts b/packages/elastic-analytics/src/shippers/mocks.ts new file mode 100644 index 0000000000000..6f80d91675c97 --- /dev/null +++ b/packages/elastic-analytics/src/shippers/mocks.ts @@ -0,0 +1,31 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { Subject } from 'rxjs'; +import type { IShipper } from './types'; +import type { TelemetryCounter } from '../events'; + +function createShipper(): jest.Mocked { + return new MockedShipper(); +} + +class MockedShipper implements IShipper { + public static shipperName = 'mocked-shipper'; + + constructor() {} + + public optIn = jest.fn(); + public reportEvents = jest.fn(); + public extendContext = jest.fn(); + public telemetryCounter$ = new Subject(); +} + +export const shippersMock = { + createShipper, + MockedShipper, +}; diff --git a/packages/elastic-analytics/src/shippers/types.ts b/packages/elastic-analytics/src/shippers/types.ts new file mode 100644 index 0000000000000..945ea08dae58a --- /dev/null +++ b/packages/elastic-analytics/src/shippers/types.ts @@ -0,0 +1,35 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { Observable } from 'rxjs'; +import { Event, EventContext, TelemetryCounter } from '../events'; + +/** + * Basic structure of a Shipper + */ +export interface IShipper { + /** + * Adapts and ships the event to the persisting/analytics solution. + * @param events batched events {@link Event} + */ + reportEvents: (events: Event[]) => void; + /** + * Stops/restarts the shipping mechanism based on the value of isOptedIn + * @param isOptedIn `true` for resume sending events. `false` to stop. + */ + optIn: (isOptedIn: boolean) => void; + /** + * Perform any necessary calls to the persisting/analytics solution to set the event's context. + * @param newContext + */ + extendContext?: (newContext: EventContext) => void; + /** + * Observable to emit the stats of the processed events. + */ + telemetryCounter$?: Observable; +} diff --git a/packages/elastic-analytics/tsconfig.json b/packages/elastic-analytics/tsconfig.json new file mode 100644 index 0000000000000..139f53ae99db6 --- /dev/null +++ b/packages/elastic-analytics/tsconfig.json @@ -0,0 +1,18 @@ +{ + "extends": "../../tsconfig.bazel.json", + "compilerOptions": { + "declaration": true, + "emitDeclarationOnly": true, + "isolatedModules": true, + "outDir": "target_types", + "rootDir": "src", + "stripInternal": false, + "types": [ + "jest", + "node" + ] + }, + "include": [ + "src/**/*" + ] +} diff --git a/src/core/public/analytics/analytics_service.mock.ts b/src/core/public/analytics/analytics_service.mock.ts new file mode 100644 index 0000000000000..c14d4a8216850 --- /dev/null +++ b/src/core/public/analytics/analytics_service.mock.ts @@ -0,0 +1,50 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { Subject } from 'rxjs'; +import type { PublicMethodsOf } from '@kbn/utility-types'; +import type { + AnalyticsService, + AnalyticsServiceSetup, + AnalyticsServiceStart, +} from './analytics_service'; + +type AnalyticsServiceContract = PublicMethodsOf; + +const createAnalyticsServiceSetup = (): jest.Mocked => { + return { + optIn: jest.fn(), + reportEvent: jest.fn(), + registerEventType: jest.fn(), + registerContextProvider: jest.fn(), + removeContextProvider: jest.fn(), + registerShipper: jest.fn(), + telemetryCounter$: new Subject(), + }; +}; + +const createAnalyticsServiceStart = (): jest.Mocked => { + return { + optIn: jest.fn(), + reportEvent: jest.fn(), + telemetryCounter$: new Subject(), + }; +}; + +const createAnalyticsServiceMock = (): jest.Mocked => { + return { + setup: jest.fn().mockImplementation(createAnalyticsServiceSetup), + start: jest.fn().mockImplementation(createAnalyticsServiceStart), + }; +}; + +export const analyticsServiceMock = { + create: createAnalyticsServiceMock, + createAnalyticsServiceSetup, + createAnalyticsServiceStart, +}; diff --git a/src/core/public/analytics/analytics_service.ts b/src/core/public/analytics/analytics_service.ts new file mode 100644 index 0000000000000..ab17eb46192ae --- /dev/null +++ b/src/core/public/analytics/analytics_service.ts @@ -0,0 +1,61 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { AnalyticsClient } from '@elastic/analytics'; +import { createAnalytics } from '@elastic/analytics'; +import { CoreContext } from '../core_system'; +import { createLogger } from './logger'; + +/** + * Exposes the public APIs of the AnalyticsClient during the setup phase. + * {@link AnalyticsClient} + * @public + */ +export type AnalyticsServiceSetup = AnalyticsClient; +/** + * Exposes the public APIs of the AnalyticsClient during the start phase + * {@link AnalyticsClient} + * @public + */ +export type AnalyticsServiceStart = Pick< + AnalyticsClient, + 'optIn' | 'reportEvent' | 'telemetryCounter$' +>; + +export class AnalyticsService { + private readonly analyticsClient: AnalyticsClient; + + constructor(core: CoreContext) { + this.analyticsClient = createAnalytics({ + isDev: core.env.mode.dev, + logger: createLogger(core.env.mode.dev), + // TODO: We need to be able to edit sendTo once we resolve the telemetry config. + // For now, we are relying on whether it's a distributable or running from source. + sendTo: core.env.packageInfo.dist ? 'production' : 'staging', + }); + } + + public setup(): AnalyticsServiceSetup { + return { + optIn: this.analyticsClient.optIn, + registerContextProvider: this.analyticsClient.registerContextProvider, + removeContextProvider: this.analyticsClient.removeContextProvider, + registerEventType: this.analyticsClient.registerEventType, + registerShipper: this.analyticsClient.registerShipper, + reportEvent: this.analyticsClient.reportEvent, + telemetryCounter$: this.analyticsClient.telemetryCounter$, + }; + } + public start(): AnalyticsServiceStart { + return { + optIn: this.analyticsClient.optIn, + reportEvent: this.analyticsClient.reportEvent, + telemetryCounter$: this.analyticsClient.telemetryCounter$, + }; + } +} diff --git a/src/core/public/analytics/index.ts b/src/core/public/analytics/index.ts new file mode 100644 index 0000000000000..c371955123059 --- /dev/null +++ b/src/core/public/analytics/index.ts @@ -0,0 +1,25 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +export { AnalyticsService } from './analytics_service'; +export type { AnalyticsServiceSetup, AnalyticsServiceStart } from './analytics_service'; + +export type { + AnalyticsClient, + Event, + EventContext, + EventType, + EventTypeOpts, + IShipper, + ShipperClassConstructor, + OptInConfig, + ContextProviderOpts, + TelemetryCounter, +} from '@elastic/analytics'; + +export { TelemetryCounterType } from '@elastic/analytics'; diff --git a/src/core/public/analytics/logger.ts b/src/core/public/analytics/logger.ts new file mode 100644 index 0000000000000..869fdbbd9fd85 --- /dev/null +++ b/src/core/public/analytics/logger.ts @@ -0,0 +1,37 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { Logger } from '@kbn/logging'; + +/** + * Create custom logger until we have a proper logging solution: https://github.com/elastic/kibana/issues/33796 + * @param isDev Is Kibana running in Dev Mode? + */ +export function createLogger(isDev: boolean): Logger { + // TODO: Replace with a core logger once we implement it in https://github.com/elastic/kibana/issues/33796 + // For now, it logs only in dev mode + const logger: Logger = { + // eslint-disable-next-line no-console + fatal: (...args) => (isDev ? console.error(...args) : void 0), + // eslint-disable-next-line no-console + error: (...args) => (isDev ? console.error(...args) : void 0), + // eslint-disable-next-line no-console + warn: (...args) => (isDev ? console.warn(...args) : void 0), + // eslint-disable-next-line no-console + info: (...args) => (isDev ? console.info(...args) : void 0), + // eslint-disable-next-line no-console + debug: (...args) => (isDev ? console.debug(...args) : void 0), + // eslint-disable-next-line no-console + trace: (...args) => (isDev ? console.trace(...args) : void 0), + // eslint-disable-next-line no-console + log: (...args) => (isDev ? console.log(...args) : void 0), + get: () => logger, + }; + + return logger; +} diff --git a/src/core/public/core_system.test.ts b/src/core/public/core_system.test.ts index 74e8782d33739..553c1668951e8 100644 --- a/src/core/public/core_system.test.ts +++ b/src/core/public/core_system.test.ts @@ -48,6 +48,16 @@ const defaultCoreSystemParams = { csp: { warnLegacyBrowsers: true, }, + env: { + mode: { + name: 'development', + dev: true, + prod: false, + }, + packageInfo: { + dist: false, + }, + }, version: 'version', } as any, }; @@ -83,7 +93,7 @@ describe('constructor', () => { }); it('passes injectedMetadata param to InjectedMetadataService', () => { - const injectedMetadata = { injectedMetadata: true } as any; + const injectedMetadata = { env: { mode: { dev: true }, packageInfo: { dist: false } } } as any; createCoreSystem({ injectedMetadata, diff --git a/src/core/public/core_system.ts b/src/core/public/core_system.ts index ee36ae4a728cd..726f53a345208 100644 --- a/src/core/public/core_system.ts +++ b/src/core/public/core_system.ts @@ -32,6 +32,7 @@ import { ThemeService } from './theme'; import { CoreApp } from './core_app'; import type { InternalApplicationSetup, InternalApplicationStart } from './application/types'; import { ExecutionContextService } from './execution_context'; +import { AnalyticsService } from './analytics'; interface Params { rootDomElement: HTMLElement; @@ -69,6 +70,7 @@ export interface InternalCoreStart extends Omit { * @internal */ export class CoreSystem { + private readonly analytics: AnalyticsService; private readonly fatalErrors: FatalErrorsService; private readonly injectedMetadata: InjectedMetadataService; private readonly notifications: NotificationsService; @@ -103,6 +105,8 @@ export class CoreSystem { }); this.coreContext = { coreId: Symbol('core'), env: injectedMetadata.env }; + this.analytics = new AnalyticsService(this.coreContext); + this.fatalErrors = new FatalErrorsService(rootDomElement, () => { // Stop Core before rendering any fatal errors into the DOM this.stop(); @@ -144,6 +148,8 @@ export class CoreSystem { await this.integrations.setup(); this.docLinks.setup(); + const analytics = this.analytics.setup(); + const executionContext = this.executionContext.setup(); const http = this.http.setup({ injectedMetadata, @@ -157,6 +163,7 @@ export class CoreSystem { this.coreApp.setup({ application, http, injectedMetadata, notifications }); const core: InternalCoreSetup = { + analytics, application, fatalErrors: this.fatalErrorsSetup, http, @@ -184,6 +191,7 @@ export class CoreSystem { public async start() { try { + const analytics = this.analytics.start(); const injectedMetadata = await this.injectedMetadata.start(); const uiSettings = await this.uiSettings.start(); const docLinks = this.docLinks.start({ injectedMetadata }); @@ -230,6 +238,7 @@ export class CoreSystem { this.coreApp.start({ application, docLinks, http, notifications, uiSettings }); const core: InternalCoreStart = { + analytics, application, chrome, docLinks, diff --git a/src/core/public/index.ts b/src/core/public/index.ts index d62df68cf827d..9291201237279 100644 --- a/src/core/public/index.ts +++ b/src/core/public/index.ts @@ -60,6 +60,7 @@ import { SavedObjectsStart } from './saved_objects'; import { DeprecationsServiceStart } from './deprecations'; import type { ThemeServiceSetup, ThemeServiceStart } from './theme'; import { ExecutionContextSetup, ExecutionContextStart } from './execution_context'; +import type { AnalyticsServiceSetup, AnalyticsServiceStart } from './analytics'; export type { PackageInfo, @@ -71,6 +72,22 @@ export type { CoreContext, CoreSystem } from './core_system'; export { DEFAULT_APP_CATEGORIES, APP_WRAPPER_CLASS } from '../utils'; export type { AppCategory, UiSettingsParams, UserProvidedValues, UiSettingsType } from '../types'; +export type { + AnalyticsServiceSetup, + AnalyticsServiceStart, + AnalyticsClient, + Event, + EventContext, + EventType, + EventTypeOpts, + IShipper, + ShipperClassConstructor, + OptInConfig, + ContextProviderOpts, + TelemetryCounter, +} from './analytics'; +export { TelemetryCounterType } from './analytics'; + export { AppNavLinkStatus, AppStatus, ScopedHistory } from './application'; export type { ApplicationSetup, @@ -211,6 +228,8 @@ export type { * https://github.com/Microsoft/web-build-tools/issues/1237 */ export interface CoreSetup { + /** {@link AnalyticsServiceSetup} */ + analytics: AnalyticsServiceSetup; /** {@link ApplicationSetup} */ application: ApplicationSetup; /** {@link FatalErrorsSetup} */ @@ -261,6 +280,8 @@ export type StartServicesAccessor< * https://github.com/Microsoft/web-build-tools/issues/1237 */ export interface CoreStart { + /** {@link AnalyticsServiceStart} */ + analytics: AnalyticsServiceStart; /** {@link ApplicationStart} */ application: ApplicationStart; /** {@link ChromeStart} */ diff --git a/src/core/public/mocks.ts b/src/core/public/mocks.ts index 855e3e6c18345..c755c6626de01 100644 --- a/src/core/public/mocks.ts +++ b/src/core/public/mocks.ts @@ -13,6 +13,7 @@ import { CoreContext, PluginInitializerContext, AppMountParameters } from '.'; // Import values from their individual modules instead. import { ScopedHistory } from './application'; +import { analyticsServiceMock } from './analytics/analytics_service.mock'; import { applicationServiceMock } from './application/application_service.mock'; import { chromeServiceMock } from './chrome/chrome_service.mock'; import { docLinksServiceMock } from './doc_links/doc_links_service.mock'; @@ -31,6 +32,7 @@ import { executionContextServiceMock } from './execution_context/execution_conte export { chromeServiceMock } from './chrome/chrome_service.mock'; export { docLinksServiceMock } from './doc_links/doc_links_service.mock'; export { executionContextServiceMock } from './execution_context/execution_context_service.mock'; +export { analyticsServiceMock } from './analytics/analytics_service.mock'; export { fatalErrorsServiceMock } from './fatal_errors/fatal_errors_service.mock'; export { httpServiceMock } from './http/http_service.mock'; export { i18nServiceMock } from './i18n/i18n_service.mock'; @@ -54,6 +56,7 @@ function createCoreSetupMock({ pluginStartContract?: any; } = {}) { const mock = { + analytics: analyticsServiceMock.createAnalyticsServiceSetup(), application: applicationServiceMock.createSetupContract(), docLinks: docLinksServiceMock.createSetupContract(), executionContext: executionContextServiceMock.createSetupContract(), @@ -76,6 +79,7 @@ function createCoreSetupMock({ function createCoreStartMock({ basePath = '' } = {}) { const mock = { + analytics: analyticsServiceMock.createAnalyticsServiceStart(), application: applicationServiceMock.createStartContract(), chrome: chromeServiceMock.createStartContract(), docLinks: docLinksServiceMock.createStartContract(), diff --git a/src/core/public/plugins/plugin_context.ts b/src/core/public/plugins/plugin_context.ts index 8c085d3de2369..0311006fc44a3 100644 --- a/src/core/public/plugins/plugin_context.ts +++ b/src/core/public/plugins/plugin_context.ts @@ -83,6 +83,7 @@ export function createPluginSetupContext< plugin: PluginWrapper ): CoreSetup { return { + analytics: deps.analytics, application: { register: (app) => deps.application.register(plugin.opaqueId, app), registerAppUpdater: (statusUpdater$) => deps.application.registerAppUpdater(statusUpdater$), @@ -121,6 +122,7 @@ export function createPluginStartContext< plugin: PluginWrapper ): CoreStart { return { + analytics: deps.analytics, application: { applications$: deps.application.applications$, currentAppId$: deps.application.currentAppId$, diff --git a/src/core/public/plugins/plugins_service.test.ts b/src/core/public/plugins/plugins_service.test.ts index 390cba409257f..63997d65c7d7b 100644 --- a/src/core/public/plugins/plugins_service.test.ts +++ b/src/core/public/plugins/plugins_service.test.ts @@ -37,6 +37,7 @@ import { savedObjectsServiceMock } from '../saved_objects/saved_objects_service. import { deprecationsServiceMock } from '../deprecations/deprecations_service.mock'; import { themeServiceMock } from '../theme/theme_service.mock'; import { executionContextServiceMock } from '../execution_context/execution_context_service.mock'; +import { analyticsServiceMock } from '../analytics/analytics_service.mock'; export let mockPluginInitializers: Map; @@ -84,6 +85,7 @@ describe('PluginsService', () => { }, ]; mockSetupDeps = { + analytics: analyticsServiceMock.createAnalyticsServiceSetup(), application: applicationServiceMock.createInternalSetupContract(), fatalErrors: fatalErrorsServiceMock.createSetupContract(), executionContext: executionContextServiceMock.createSetupContract(), @@ -100,6 +102,7 @@ describe('PluginsService', () => { injectedMetadata: pick(mockSetupDeps.injectedMetadata, 'getInjectedVar'), }; mockStartDeps = { + analytics: analyticsServiceMock.createAnalyticsServiceStart(), application: applicationServiceMock.createInternalStartContract(), docLinks: docLinksServiceMock.createStartContract(), executionContext: executionContextServiceMock.createStartContract(), diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md index b60e26d282dc3..c68e2b40d1dd3 100644 --- a/src/core/public/public.api.md +++ b/src/core/public/public.api.md @@ -7,11 +7,13 @@ /// import { Action } from 'history'; +import { AnalyticsClient } from '@elastic/analytics'; import Boom from '@hapi/boom'; import type { ButtonColor } from '@elastic/eui'; import { ByteSizeValue } from '@kbn/config-schema'; import type { Client } from '@elastic/elasticsearch'; import { ConfigPath } from '@kbn/config'; +import { ContextProviderOpts } from '@elastic/analytics'; import { DetailedPeerCertificate } from 'tls'; import type { DocLinks } from '@kbn/doc-links'; import { EnvironmentMode } from '@kbn/config'; @@ -22,10 +24,15 @@ import { EuiConfirmModalProps } from '@elastic/eui'; import { EuiFlyoutSize } from '@elastic/eui'; import { EuiGlobalToastListToast } from '@elastic/eui'; import { EuiOverlayMaskProps } from '@elastic/eui'; +import { Event as Event_2 } from '@elastic/analytics'; +import { EventContext } from '@elastic/analytics'; +import { EventType } from '@elastic/analytics'; +import { EventTypeOpts } from '@elastic/analytics'; import { History as History_2 } from 'history'; import { Href } from 'history'; import { IconType } from '@elastic/eui'; import { IncomingHttpHeaders } from 'http'; +import { IShipper } from '@elastic/analytics'; import { Location as Location_2 } from 'history'; import { LocationDescriptorObject } from 'history'; import { Logger } from '@kbn/logging'; @@ -33,6 +40,7 @@ import { LogMeta } from '@kbn/logging'; import { MaybePromise } from '@kbn/utility-types'; import { ObjectType } from '@kbn/config-schema'; import { Observable } from 'rxjs'; +import { OptInConfig } from '@elastic/analytics'; import { PackageInfo } from '@kbn/config'; import { Path } from 'history'; import { PeerCertificate } from 'tls'; @@ -43,6 +51,9 @@ import { RecursiveReadonly } from '@kbn/utility-types'; import { Request as Request_2 } from '@hapi/hapi'; import * as Rx from 'rxjs'; import { SchemaTypeError } from '@kbn/config-schema'; +import { ShipperClassConstructor } from '@elastic/analytics'; +import { TelemetryCounter } from '@elastic/analytics'; +import { TelemetryCounterType } from '@elastic/analytics'; import type { ThemeVersion } from '@kbn/ui-shared-deps-npm'; import { TransitionPromptHook } from 'history'; import { Type } from '@kbn/config-schema'; @@ -55,6 +66,18 @@ import { UserProvidedValues as UserProvidedValues_2 } from 'src/core/server/type // @internal (undocumented) export function __kbnBootstrap__(): Promise; +export { AnalyticsClient } + +// Warning: (ae-unresolved-link) The @link reference could not be resolved: This type of declaration is not supported yet by the resolver +// +// @public +export type AnalyticsServiceSetup = AnalyticsClient; + +// Warning: (ae-unresolved-link) The @link reference could not be resolved: This type of declaration is not supported yet by the resolver +// +// @public +export type AnalyticsServiceStart = Pick; + // @public (undocumented) export interface App extends AppNavOptions { appRoute?: string; @@ -373,6 +396,8 @@ export interface ChromeUserBanner { content: MountPoint; } +export { ContextProviderOpts } + // @internal (undocumented) export interface CoreContext { // Warning: (ae-forgotten-export) The symbol "CoreId" needs to be exported by the entry point index.d.ts @@ -388,6 +413,8 @@ export interface CoreContext { // @public export interface CoreSetup { + // (undocumented) + analytics: AnalyticsServiceSetup; // (undocumented) application: ApplicationSetup; // (undocumented) @@ -412,6 +439,8 @@ export interface CoreSetup { readonly response?: Readonly; } +export { IShipper } + // @public export type IToasts = Pick; @@ -805,6 +844,8 @@ export interface NotificationsStart { toasts: ToastsStart; } +export { OptInConfig } + // @public (undocumented) export interface OverlayBannersStart { add(mount: MountPoint, priority?: number): string; @@ -1398,6 +1439,8 @@ export class ScopedHistory implements History_2< replace: (pathOrLocation: Path | LocationDescriptorObject, state?: HistoryLocationState | undefined) => void; } +export { ShipperClassConstructor } + // @public export class SimpleSavedObject { constructor(client: SavedObjectsClientContract, { id, type, version, attributes, error, references, migrationVersion, coreMigrationVersion, namespaces, updated_at: updatedAt, }: SavedObject); @@ -1435,6 +1478,10 @@ export class SimpleSavedObject { // @public export type StartServicesAccessor = () => Promise<[CoreStart, TPluginsStart, TStart]>; +export { TelemetryCounter } + +export { TelemetryCounterType } + // @public (undocumented) export interface ThemeServiceSetup { // (undocumented) @@ -1543,6 +1590,6 @@ export interface UserProvidedValues { // Warnings were encountered during analysis: // -// src/core/public/core_system.ts:185:21 - (ae-forgotten-export) The symbol "InternalApplicationStart" needs to be exported by the entry point index.d.ts +// src/core/public/core_system.ts:192:21 - (ae-forgotten-export) The symbol "InternalApplicationStart" needs to be exported by the entry point index.d.ts ``` diff --git a/src/core/server/analytics/analytics_service.mock.ts b/src/core/server/analytics/analytics_service.mock.ts new file mode 100644 index 0000000000000..74f675ac37b8f --- /dev/null +++ b/src/core/server/analytics/analytics_service.mock.ts @@ -0,0 +1,65 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { PublicMethodsOf } from '@kbn/utility-types'; +import type { + AnalyticsService, + AnalyticsServicePreboot, + AnalyticsServiceSetup, + AnalyticsServiceStart, +} from './analytics_service'; +import { Subject } from 'rxjs'; + +type AnalyticsServiceContract = PublicMethodsOf; + +const createAnalyticsServicePreboot = (): jest.Mocked => { + return { + optIn: jest.fn(), + reportEvent: jest.fn(), + registerEventType: jest.fn(), + registerContextProvider: jest.fn(), + removeContextProvider: jest.fn(), + registerShipper: jest.fn(), + telemetryCounter$: new Subject(), + }; +}; + +const createAnalyticsServiceSetup = (): jest.Mocked => { + return { + optIn: jest.fn(), + reportEvent: jest.fn(), + registerEventType: jest.fn(), + registerContextProvider: jest.fn(), + removeContextProvider: jest.fn(), + registerShipper: jest.fn(), + telemetryCounter$: new Subject(), + }; +}; + +const createAnalyticsServiceStart = (): jest.Mocked => { + return { + optIn: jest.fn(), + reportEvent: jest.fn(), + telemetryCounter$: new Subject(), + }; +}; + +const createAnalyticsServiceMock = (): jest.Mocked => { + return { + preboot: jest.fn().mockImplementation(createAnalyticsServicePreboot), + setup: jest.fn().mockImplementation(createAnalyticsServiceSetup), + start: jest.fn().mockImplementation(createAnalyticsServiceStart), + }; +}; + +export const analyticsServiceMock = { + create: createAnalyticsServiceMock, + createAnalyticsServicePreboot, + createAnalyticsServiceSetup, + createAnalyticsServiceStart, +}; diff --git a/src/core/server/analytics/analytics_service.ts b/src/core/server/analytics/analytics_service.ts new file mode 100644 index 0000000000000..1d3d5e88f64a2 --- /dev/null +++ b/src/core/server/analytics/analytics_service.ts @@ -0,0 +1,77 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { AnalyticsClient } from '@elastic/analytics'; +import { createAnalytics } from '@elastic/analytics'; +import type { CoreContext } from '../core_context'; + +/** + * Exposes the public APIs of the AnalyticsClient during the preboot phase + * {@link AnalyticsClient} + * @public + */ +export type AnalyticsServicePreboot = AnalyticsClient; +/** + * Exposes the public APIs of the AnalyticsClient during the setup phase. + * {@link AnalyticsClient} + * @public + */ +export type AnalyticsServiceSetup = AnalyticsClient; +/** + * Exposes the public APIs of the AnalyticsClient during the start phase + * {@link AnalyticsClient} + * @public + */ +export type AnalyticsServiceStart = Pick< + AnalyticsClient, + 'optIn' | 'reportEvent' | 'telemetryCounter$' +>; + +export class AnalyticsService { + private readonly analyticsClient: AnalyticsClient; + + constructor(core: CoreContext) { + this.analyticsClient = createAnalytics({ + isDev: core.env.mode.dev, + logger: core.logger.get('analytics'), + // TODO: We need to be able to edit sendTo once we resolve the telemetry config. + // For now, we are relying on whether it's a distributable or running from source. + sendTo: core.env.packageInfo.dist ? 'production' : 'staging', + }); + } + + public preboot(): AnalyticsServicePreboot { + return { + optIn: this.analyticsClient.optIn, + registerContextProvider: this.analyticsClient.registerContextProvider, + removeContextProvider: this.analyticsClient.removeContextProvider, + registerEventType: this.analyticsClient.registerEventType, + registerShipper: this.analyticsClient.registerShipper, + reportEvent: this.analyticsClient.reportEvent, + telemetryCounter$: this.analyticsClient.telemetryCounter$, + }; + } + public setup(): AnalyticsServiceSetup { + return { + optIn: this.analyticsClient.optIn, + registerContextProvider: this.analyticsClient.registerContextProvider, + removeContextProvider: this.analyticsClient.removeContextProvider, + registerEventType: this.analyticsClient.registerEventType, + registerShipper: this.analyticsClient.registerShipper, + reportEvent: this.analyticsClient.reportEvent, + telemetryCounter$: this.analyticsClient.telemetryCounter$, + }; + } + public start(): AnalyticsServiceStart { + return { + optIn: this.analyticsClient.optIn, + reportEvent: this.analyticsClient.reportEvent, + telemetryCounter$: this.analyticsClient.telemetryCounter$, + }; + } +} diff --git a/src/core/server/analytics/index.ts b/src/core/server/analytics/index.ts new file mode 100644 index 0000000000000..854859cba2406 --- /dev/null +++ b/src/core/server/analytics/index.ts @@ -0,0 +1,29 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +export { AnalyticsService } from './analytics_service'; +export type { + AnalyticsServicePreboot, + AnalyticsServiceSetup, + AnalyticsServiceStart, +} from './analytics_service'; + +export type { + AnalyticsClient, + Event, + EventContext, + EventType, + EventTypeOpts, + IShipper, + ShipperClassConstructor, + OptInConfig, + ContextProviderOpts, + TelemetryCounter, +} from '@elastic/analytics'; + +export { TelemetryCounterType } from '@elastic/analytics'; diff --git a/src/core/server/index.ts b/src/core/server/index.ts index 3912585b7b697..b23fffee71373 100644 --- a/src/core/server/index.ts +++ b/src/core/server/index.ts @@ -83,6 +83,11 @@ export type { }; import type { ExecutionContextSetup, ExecutionContextStart } from './execution_context'; +import type { + AnalyticsServicePreboot, + AnalyticsServiceSetup, + AnalyticsServiceStart, +} from './analytics'; export type { IExecutionContextContainer, KibanaExecutionContext } from './execution_context'; @@ -443,6 +448,23 @@ export type { export type { DocLinksServiceSetup, DocLinksServiceStart } from './doc_links'; +export type { + AnalyticsServiceSetup, + AnalyticsServicePreboot, + AnalyticsServiceStart, + AnalyticsClient, + Event, + EventContext, + EventType, + EventTypeOpts, + IShipper, + ContextProviderOpts, + OptInConfig, + ShipperClassConstructor, + TelemetryCounter, +} from './analytics'; +export { TelemetryCounterType } from './analytics'; + /** * Plugin specific context passed to a route handler. * @@ -484,6 +506,8 @@ export interface RequestHandlerContext { * @public */ export interface CorePreboot { + /** {@link AnalyticsServicePreboot} */ + analytics: AnalyticsServicePreboot; /** {@link ElasticsearchServicePreboot} */ elasticsearch: ElasticsearchServicePreboot; /** {@link HttpServicePreboot} */ @@ -502,6 +526,8 @@ export interface CorePreboot { * @public */ export interface CoreSetup { + /** {@link AnalyticsServiceSetup} */ + analytics: AnalyticsServiceSetup; /** {@link CapabilitiesSetup} */ capabilities: CapabilitiesSetup; /** {@link ContextSetup} */ @@ -556,6 +582,8 @@ export type StartServicesAccessor< * @public */ export interface CoreStart { + /** {@link AnalyticsServiceStart} */ + analytics: AnalyticsServiceStart; /** {@link CapabilitiesStart} */ capabilities: CapabilitiesStart; /** {@link DocLinksServiceStart} */ diff --git a/src/core/server/internal_types.ts b/src/core/server/internal_types.ts index ab58602057b09..080e4e61dadb7 100644 --- a/src/core/server/internal_types.ts +++ b/src/core/server/internal_types.ts @@ -45,9 +45,15 @@ import type { } from './execution_context'; import { InternalPrebootServicePreboot } from './preboot'; import { DocLinksServiceSetup, DocLinksServiceStart } from './doc_links'; +import type { + AnalyticsServicePreboot, + AnalyticsServiceSetup, + AnalyticsServiceStart, +} from './analytics'; /** @internal */ export interface InternalCorePreboot { + analytics: AnalyticsServicePreboot; context: InternalContextPreboot; http: InternalHttpServicePreboot; elasticsearch: InternalElasticsearchServicePreboot; @@ -59,6 +65,7 @@ export interface InternalCorePreboot { /** @internal */ export interface InternalCoreSetup { + analytics: AnalyticsServiceSetup; capabilities: CapabilitiesSetup; context: ContextSetup; docLinks: DocLinksServiceSetup; @@ -82,6 +89,7 @@ export interface InternalCoreSetup { * @internal */ export interface InternalCoreStart { + analytics: AnalyticsServiceStart; capabilities: CapabilitiesStart; elasticsearch: InternalElasticsearchServiceStart; docLinks: DocLinksServiceStart; diff --git a/src/core/server/mocks.ts b/src/core/server/mocks.ts index 32c0729dcae34..0e5821bcc1c23 100644 --- a/src/core/server/mocks.ts +++ b/src/core/server/mocks.ts @@ -10,7 +10,7 @@ import { of } from 'rxjs'; import { duration } from 'moment'; import { ByteSizeValue } from '@kbn/config-schema'; import type { MockedKeys } from '@kbn/utility-types/jest'; -import { +import type { PluginInitializerContext, CoreSetup, CoreStart, @@ -39,6 +39,7 @@ import { deprecationsServiceMock } from './deprecations/deprecations_service.moc import { executionContextServiceMock } from './execution_context/execution_context_service.mock'; import { prebootServiceMock } from './preboot/preboot_service.mock'; import { docLinksServiceMock } from './doc_links/doc_links_service.mock'; +import { analyticsServiceMock } from './analytics/analytics_service.mock'; export { configServiceMock, configDeprecationsMock } from './config/mocks'; export { httpServerMock } from './http/http_server.mocks'; @@ -49,6 +50,7 @@ export { httpServiceMock } from './http/http_service.mock'; export { loggingSystemMock } from './logging/logging_system.mock'; export { savedObjectsRepositoryMock } from './saved_objects/service/lib/repository.mock'; export { savedObjectsServiceMock } from './saved_objects/saved_objects_service.mock'; +export { savedObjectsClientMock } from './saved_objects/service/saved_objects_client.mock'; export { migrationMocks } from './saved_objects/migrations/mocks'; export { typeRegistryMock as savedObjectsTypeRegistryMock } from './saved_objects/saved_objects_type_registry.mock'; export { uiSettingsServiceMock } from './ui_settings/ui_settings_service.mock'; @@ -62,6 +64,7 @@ export { i18nServiceMock } from './i18n/i18n_service.mock'; export { deprecationsServiceMock } from './deprecations/deprecations_service.mock'; export { executionContextServiceMock } from './execution_context/execution_context_service.mock'; export { docLinksServiceMock } from './doc_links/doc_links_service.mock'; +export { analyticsServiceMock } from './analytics/analytics_service.mock'; export type { ElasticsearchClientMock } from './elasticsearch/client/mocks'; @@ -128,6 +131,7 @@ type CorePrebootMockType = MockedKeys & { function createCorePrebootMock() { const mock: CorePrebootMockType = { + analytics: analyticsServiceMock.createAnalyticsServicePreboot(), elasticsearch: elasticsearchServiceMock.createPreboot(), http: httpServiceMock.createPrebootContract(), preboot: prebootServiceMock.createPrebootContract(), @@ -158,6 +162,7 @@ function createCoreSetupMock({ }; const mock: CoreSetupMockType = { + analytics: analyticsServiceMock.createAnalyticsServiceSetup(), capabilities: capabilitiesServiceMock.createSetupContract(), context: contextServiceMock.createSetupContract(), docLinks: docLinksServiceMock.createSetupContract(), @@ -184,6 +189,7 @@ function createCoreSetupMock({ function createCoreStartMock() { const mock: MockedKeys = { + analytics: analyticsServiceMock.createAnalyticsServiceStart(), capabilities: capabilitiesServiceMock.createStartContract(), docLinks: docLinksServiceMock.createStartContract(), elasticsearch: elasticsearchServiceMock.createStart(), @@ -200,6 +206,7 @@ function createCoreStartMock() { function createInternalCorePrebootMock() { const prebootDeps = { + analytics: analyticsServiceMock.createAnalyticsServicePreboot(), context: contextServiceMock.createPrebootContract(), elasticsearch: elasticsearchServiceMock.createInternalPreboot(), http: httpServiceMock.createInternalPrebootContract(), @@ -213,6 +220,7 @@ function createInternalCorePrebootMock() { function createInternalCoreSetupMock() { const setupDeps = { + analytics: analyticsServiceMock.createAnalyticsServiceSetup(), capabilities: capabilitiesServiceMock.createSetupContract(), context: contextServiceMock.createSetupContract(), docLinks: docLinksServiceMock.createSetupContract(), @@ -236,6 +244,7 @@ function createInternalCoreSetupMock() { function createInternalCoreStartMock() { const startDeps = { + analytics: analyticsServiceMock.createAnalyticsServiceStart(), capabilities: capabilitiesServiceMock.createStartContract(), docLinks: docLinksServiceMock.createStartContract(), elasticsearch: elasticsearchServiceMock.createInternalStart(), @@ -281,5 +290,3 @@ export const coreMock = { createPluginInitializerContext: pluginInitializerContextMock, createRequestHandlerContext: createCoreRequestHandlerContextMock, }; - -export { savedObjectsClientMock }; diff --git a/src/core/server/plugins/plugin_context.ts b/src/core/server/plugins/plugin_context.ts index 56d749b79289f..4272a9767b90e 100644 --- a/src/core/server/plugins/plugin_context.ts +++ b/src/core/server/plugins/plugin_context.ts @@ -108,6 +108,15 @@ export function createPluginPrebootSetupContext( plugin: PluginWrapper ): CorePreboot { return { + analytics: { + optIn: deps.analytics.optIn, + registerContextProvider: deps.analytics.registerContextProvider, + removeContextProvider: deps.analytics.removeContextProvider, + registerEventType: deps.analytics.registerEventType, + registerShipper: deps.analytics.registerShipper, + reportEvent: deps.analytics.reportEvent, + telemetryCounter$: deps.analytics.telemetryCounter$, + }, elasticsearch: { config: deps.elasticsearch.config, createClient: deps.elasticsearch.createClient, @@ -147,6 +156,15 @@ export function createPluginSetupContext( const router = deps.http.createRouter('', plugin.opaqueId); return { + analytics: { + optIn: deps.analytics.optIn, + registerContextProvider: deps.analytics.registerContextProvider, + removeContextProvider: deps.analytics.removeContextProvider, + registerEventType: deps.analytics.registerEventType, + registerShipper: deps.analytics.registerShipper, + reportEvent: deps.analytics.reportEvent, + telemetryCounter$: deps.analytics.telemetryCounter$, + }, capabilities: { registerProvider: deps.capabilities.registerProvider, registerSwitcher: deps.capabilities.registerSwitcher, @@ -235,6 +253,11 @@ export function createPluginStartContext( plugin: PluginWrapper ): CoreStart { return { + analytics: { + optIn: deps.analytics.optIn, + reportEvent: deps.analytics.reportEvent, + telemetryCounter$: deps.analytics.telemetryCounter$, + }, capabilities: { resolveCapabilities: deps.capabilities.resolveCapabilities, }, diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md index 7337a3809172e..1f48d9b053bf2 100644 --- a/src/core/server/server.api.md +++ b/src/core/server/server.api.md @@ -7,6 +7,7 @@ /// import { AddConfigDeprecation } from '@kbn/config'; +import { AnalyticsClient } from '@elastic/analytics'; import apm from 'elastic-apm-node'; import Boom from '@hapi/boom'; import { ByteSizeValue } from '@kbn/config-schema'; @@ -20,6 +21,7 @@ import { ConfigDeprecationFactory } from '@kbn/config'; import { ConfigDeprecationProvider } from '@kbn/config'; import { ConfigPath } from '@kbn/config'; import { ConfigService } from '@kbn/config'; +import { ContextProviderOpts } from '@elastic/analytics'; import { DetailedPeerCertificate } from 'tls'; import type { DocLinks } from '@kbn/doc-links'; import { Duration } from 'moment'; @@ -32,7 +34,12 @@ import { EcsEventType } from '@kbn/logging'; import { EnvironmentMode } from '@kbn/config'; import { errors } from '@elastic/elasticsearch'; import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; +import { Event as Event_2 } from '@elastic/analytics'; +import { EventContext } from '@elastic/analytics'; +import { EventType } from '@elastic/analytics'; +import { EventTypeOpts } from '@elastic/analytics'; import { IncomingHttpHeaders } from 'http'; +import { IShipper } from '@elastic/analytics'; import { Logger } from '@kbn/logging'; import { LoggerFactory } from '@kbn/logging'; import { LogLevel as LogLevel_2 } from '@kbn/logging'; @@ -41,6 +48,7 @@ import { LogRecord } from '@kbn/logging'; import { MaybePromise } from '@kbn/utility-types'; import { ObjectType } from '@kbn/config-schema'; import { Observable } from 'rxjs'; +import { OptInConfig } from '@elastic/analytics'; import { PackageInfo } from '@kbn/config'; import { PathConfigType } from '@kbn/utils'; import { PeerCertificate } from 'tls'; @@ -53,7 +61,10 @@ import { ResponseObject } from '@hapi/hapi'; import { ResponseToolkit } from '@hapi/hapi'; import { SchemaTypeError } from '@kbn/config-schema'; import { ShallowPromise } from '@kbn/utility-types'; +import { ShipperClassConstructor } from '@elastic/analytics'; import { Stream } from 'stream'; +import { TelemetryCounter } from '@elastic/analytics'; +import { TelemetryCounterType } from '@elastic/analytics'; import { Type } from '@kbn/config-schema'; import { TypeOf } from '@kbn/config-schema'; import { UiCounterMetricType } from '@kbn/analytics'; @@ -61,6 +72,23 @@ import { URL as URL_2 } from 'url'; export { AddConfigDeprecation } +export { AnalyticsClient } + +// Warning: (ae-unresolved-link) The @link reference could not be resolved: This type of declaration is not supported yet by the resolver +// +// @public +export type AnalyticsServicePreboot = AnalyticsClient; + +// Warning: (ae-unresolved-link) The @link reference could not be resolved: This type of declaration is not supported yet by the resolver +// +// @public +export type AnalyticsServiceSetup = AnalyticsClient; + +// Warning: (ae-unresolved-link) The @link reference could not be resolved: This type of declaration is not supported yet by the resolver +// +// @public +export type AnalyticsServiceStart = Pick; + // @public export const APP_WRAPPER_CLASS = "kbnAppWrapper"; @@ -294,6 +322,8 @@ export { ConfigService } // @internal export type ConfigUsageData = Record; +export { ContextProviderOpts } + // @public export interface ContextSetup { createContextContainer(): IContextContainer; @@ -407,6 +437,8 @@ export type CoreIncrementUsageCounter = (params: CoreIncrementCounterParams) => // @public export interface CorePreboot { + // (undocumented) + analytics: AnalyticsServicePreboot; // (undocumented) elasticsearch: ElasticsearchServicePreboot; // (undocumented) @@ -438,6 +470,8 @@ export interface CoreServicesUsageData { // @public export interface CoreSetup { + // (undocumented) + analytics: AnalyticsServiceSetup; // (undocumented) capabilities: CapabilitiesSetup; // (undocumented) @@ -474,6 +508,8 @@ export interface CoreSetup(key: string) => Promise; @@ -1636,6 +1682,8 @@ export interface OpsServerMetrics { }; } +export { OptInConfig } + export { PackageInfo } // @public @@ -3055,6 +3103,8 @@ export type SharedGlobalConfig = RecursiveReadonly<{ savedObjects: Pick; }>; +export { ShipperClassConstructor } + // @public export type StartServicesAccessor = () => Promise<[CoreStart, TPluginsStart, TStart]>; @@ -3072,6 +3122,10 @@ export interface StatusServiceSetup { set(status$: Observable): void; } +export { TelemetryCounter } + +export { TelemetryCounterType } + // @public export interface UiSettingsParams { category?: string[]; diff --git a/src/core/server/server.ts b/src/core/server/server.ts index 5563385d8b8c7..dc19f5eeea198 100644 --- a/src/core/server/server.ts +++ b/src/core/server/server.ts @@ -57,12 +57,14 @@ import { config as executionContextConfig } from './execution_context'; import { PrebootCoreRouteHandlerContext } from './preboot_core_route_handler_context'; import { PrebootService } from './preboot'; import { DiscoveredPlugins } from './plugins'; +import { AnalyticsService } from './analytics'; const coreId = Symbol('core'); const rootConfigPath = ''; export class Server { public readonly configService: ConfigService; + private readonly analytics: AnalyticsService; private readonly capabilities: CapabilitiesService; private readonly context: ContextService; private readonly elasticsearch: ElasticsearchService; @@ -103,6 +105,7 @@ export class Server { this.configService = new ConfigService(rawConfigProvider, env, this.logger); const core = { coreId, configService: this.configService, env, logger: this.logger }; + this.analytics = new AnalyticsService(core); this.context = new ContextService(core); this.http = new HttpService(core); this.rendering = new RenderingService(core); @@ -133,6 +136,8 @@ export class Server { this.log.debug('prebooting server'); const prebootTransaction = apm.startTransaction('server-preboot', 'kibana-platform'); + const analyticsPreboot = this.analytics.preboot(); + const environmentPreboot = await this.environment.preboot(); // Discover any plugins before continuing. This allows other systems to utilize the plugin dependency graph. @@ -164,6 +169,7 @@ export class Server { const loggingPreboot = this.logging.preboot({ loggingSystem: this.loggingSystem }); const corePreboot: InternalCorePreboot = { + analytics: analyticsPreboot, context: contextServicePreboot, elasticsearch: elasticsearchServicePreboot, http: httpPreboot, @@ -189,6 +195,8 @@ export class Server { this.log.debug('setting up server'); const setupTransaction = apm.startTransaction('server-setup', 'kibana-platform'); + const analyticsSetup = this.analytics.setup(); + const environmentSetup = this.environment.setup(); // Configuration could have changed after preboot. @@ -265,6 +273,7 @@ export class Server { const loggingSetup = this.logging.setup(); const coreSetup: InternalCoreSetup = { + analytics: analyticsSetup, capabilities: capabilitiesSetup, context: contextServiceSetup, docLinks: docLinksSetup, @@ -298,6 +307,7 @@ export class Server { this.log.debug('starting server'); const startTransaction = apm.startTransaction('server-start', 'kibana-platform'); + const analyticsStart = this.analytics.start(); const executionContextStart = this.executionContext.start(); const docLinkStart = this.docLinks.start(); const elasticsearchStart = await this.elasticsearch.start(); @@ -323,6 +333,7 @@ export class Server { this.status.start(); this.coreStart = { + analytics: analyticsStart, capabilities: capabilitiesStart, docLinks: docLinkStart, elasticsearch: elasticsearchStart, diff --git a/src/plugins/usage_collection/server/collector/types.ts b/src/plugins/usage_collection/server/collector/types.ts index 8d427d211a191..141faf0ef2f6b 100644 --- a/src/plugins/usage_collection/server/collector/types.ts +++ b/src/plugins/usage_collection/server/collector/types.ts @@ -8,39 +8,15 @@ import type { ElasticsearchClient, SavedObjectsClientContract, Logger } from 'src/core/server'; -/** Types matching number values **/ -export type AllowedSchemaNumberTypes = - | 'long' - | 'integer' - | 'short' - | 'byte' - | 'double' - | 'float' - | 'date'; -/** Types matching string values **/ -export type AllowedSchemaStringTypes = 'keyword' | 'text' | 'date'; -/** Types matching boolean values **/ -export type AllowedSchemaBooleanTypes = 'boolean'; +import type { PossibleSchemaTypes } from '@elastic/analytics'; -/** - * Possible type values in the schema - */ -export type AllowedSchemaTypes = - | AllowedSchemaNumberTypes - | AllowedSchemaStringTypes - | AllowedSchemaBooleanTypes; - -/** - * Helper to ensure the declared types match the schema types - */ -export type PossibleSchemaTypes = U extends string - ? AllowedSchemaStringTypes - : U extends number - ? AllowedSchemaNumberTypes - : U extends boolean - ? AllowedSchemaBooleanTypes - : // allow any schema type from the union if typescript is unable to resolve the exact U type - AllowedSchemaTypes; +export type { + AllowedSchemaTypes, + AllowedSchemaStringTypes, + AllowedSchemaBooleanTypes, + AllowedSchemaNumberTypes, + PossibleSchemaTypes, +} from '@elastic/analytics'; /** * Helper to find out whether to keep recursively looking or if we are on an end value diff --git a/test/analytics/README.md b/test/analytics/README.md new file mode 100644 index 0000000000000..bf2f9bb2f17b5 --- /dev/null +++ b/test/analytics/README.md @@ -0,0 +1,21 @@ +# FTR tests for the `core.analytics` service + +This suite allows us to test the event-based telemetry client provided by the `core.analytics` service. + +## How to add my own tests + +Implement your own tests in the `tests/instrumented_events/(from_the_browser|from_the_server)/` directory and list it in the `tests/instrumented_events/(from_the_browser|from_the_server)/index.ts` file. + +There are 2 FTR helpers to allow you to retrieve the generated events: + +1. For events generated in the UI, you can use `kibana_ebt_ui` to retrieve the events. +2. For events generated in the server, you can use the `kibana_ebt_server` helper. + +The API is the same for both of them: +```typescript +// To retrieve the last 2 events of type "my-event-type +const events = await getService('kibana_ebt_ui').getLastEvents(2, ['my-event-type']); +expect(events).to... +``` + +If you are reusing these helpers in another suite, please remember to make sure to optIn via `await getService('kibana_ebt_ui').setOptIn(true);` \ No newline at end of file diff --git a/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/kibana.json b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/kibana.json new file mode 100644 index 0000000000000..353ec45cdd991 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/kibana.json @@ -0,0 +1,8 @@ +{ + "id": "analyticsFtrHelpers", + "owner": { "name": "Core", "githubTeam": "kibana-core" }, + "version": "0.0.1", + "kibanaVersion": "kibana", + "server": true, + "ui": true +} diff --git a/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/package.json b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/package.json new file mode 100644 index 0000000000000..c0a0c5082d1d3 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/package.json @@ -0,0 +1,14 @@ +{ + "name": "analytics_ftr_helpers", + "version": "1.0.0", + "main": "target/test/analytics/__fixtures__/plugins/analytics_ftr_helpers", + "kibana": { + "version": "kibana", + "templateVersion": "1.0.0" + }, + "license": "SSPL-1.0 OR Elastic License 2.0", + "scripts": { + "kbn": "node ../../../../../scripts/kbn.js", + "build": "rm -rf './target' && ../../../../../node_modules/.bin/tsc" + } +} \ No newline at end of file diff --git a/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/custom_shipper.ts b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/custom_shipper.ts new file mode 100644 index 0000000000000..bda7ec2aadebb --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/custom_shipper.ts @@ -0,0 +1,23 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { Subject } from 'rxjs'; +import type { Event, IShipper } from 'src/core/public'; + +export class CustomShipper implements IShipper { + public static shipperName = 'FTR-helpers-shipper'; + + constructor(private readonly events$: Subject) {} + + public reportEvents(events: Event[]) { + events.forEach((event) => { + this.events$.next(event); + }); + } + optIn(isOptedIn: boolean) {} +} diff --git a/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/index.ts b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/index.ts new file mode 100644 index 0000000000000..24e937012e386 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/index.ts @@ -0,0 +1,13 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { AnalyticsFTRHelpers } from './plugin'; + +export function plugin() { + return new AnalyticsFTRHelpers(); +} diff --git a/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/plugin.ts b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/plugin.ts new file mode 100644 index 0000000000000..463cb6f8d6172 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/plugin.ts @@ -0,0 +1,42 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { ReplaySubject } from 'rxjs'; +import { filter, take, toArray } from 'rxjs/operators'; +import type { Plugin, CoreSetup, Event } from 'src/core/public'; +import { CustomShipper } from './custom_shipper'; +import './types'; + +export class AnalyticsFTRHelpers implements Plugin { + private readonly events$ = new ReplaySubject(); + + public setup({ analytics }: CoreSetup) { + analytics.registerShipper(CustomShipper, this.events$); + + window.__analytics_ftr_helpers__ = { + setOptIn(optIn: boolean) { + analytics.optIn({ global: { enabled: optIn } }); + }, + getLastEvents: async (takeNumberOfEvents, eventTypes = []) => + this.events$ + .pipe( + filter((event) => { + if (eventTypes.length > 0) { + return eventTypes.includes(event.event_type); + } + return true; + }), + take(takeNumberOfEvents), + toArray() + ) + .toPromise(), + }; + } + public start() {} + public stop() {} +} diff --git a/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/types.ts b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/types.ts new file mode 100644 index 0000000000000..413335ee8293f --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/public/types.ts @@ -0,0 +1,18 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { Event, EventType } from 'src/core/public'; + +declare global { + interface Window { + __analytics_ftr_helpers__: { + setOptIn: (optIn: boolean) => void; + getLastEvents: (takeNumberOfEvents: number, eventTypes?: EventType[]) => Promise; + }; + } +} diff --git a/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/custom_shipper.ts b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/custom_shipper.ts new file mode 100644 index 0000000000000..e9d8c3b609209 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/custom_shipper.ts @@ -0,0 +1,23 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { Subject } from 'rxjs'; +import type { IShipper, Event } from 'src/core/server'; + +export class CustomShipper implements IShipper { + public static shipperName = 'FTR-helpers-shipper'; + + constructor(private readonly events$: Subject) {} + + public reportEvents(events: Event[]) { + events.forEach((event) => { + this.events$.next(event); + }); + } + optIn(isOptedIn: boolean) {} +} diff --git a/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/index.ts b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/index.ts new file mode 100644 index 0000000000000..637348226e25c --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/index.ts @@ -0,0 +1,11 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { AnalyticsFTRHelpers } from './plugin'; + +export const plugin = () => new AnalyticsFTRHelpers(); diff --git a/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/plugin.ts b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/plugin.ts new file mode 100644 index 0000000000000..26d61e2e5355f --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/server/plugin.ts @@ -0,0 +1,76 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { ReplaySubject } from 'rxjs'; +import { schema } from '@kbn/config-schema'; +import type { Plugin, CoreSetup, Event } from 'src/core/server'; +import { filter, take, toArray } from 'rxjs/operators'; +import { CustomShipper } from './custom_shipper'; + +export class AnalyticsFTRHelpers implements Plugin { + public setup({ analytics, http }: CoreSetup, deps: {}) { + const { optIn, registerShipper } = analytics; + + const events$ = new ReplaySubject(); + registerShipper(CustomShipper, events$); + + const router = http.createRouter(); + + router.post( + { + path: '/internal/analytics_ftr_helpers/opt_in', + validate: { + query: schema.object({ + consent: schema.boolean(), + }), + }, + }, + (context, req, res) => { + const { consent } = req.query; + + optIn({ global: { enabled: consent } }); + + return res.ok(); + } + ); + + router.get( + { + path: '/internal/analytics_ftr_helpers/events', + validate: { + query: schema.object({ + takeNumberOfEvents: schema.number({ min: 1 }), + eventTypes: schema.arrayOf(schema.string()), + }), + }, + }, + async (context, req, res) => { + const { takeNumberOfEvents, eventTypes } = req.query; + + const events = await events$ + .pipe( + filter((event) => { + if (eventTypes.length > 0) { + return eventTypes.includes(event.event_type); + } + return true; + }), + take(takeNumberOfEvents), + toArray() + ) + .toPromise(); + + return res.ok({ body: events }); + } + ); + } + + public start() {} + + public stop() {} +} diff --git a/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/tsconfig.json b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/tsconfig.json new file mode 100644 index 0000000000000..d1faee2d113b6 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_ftr_helpers/tsconfig.json @@ -0,0 +1,16 @@ +{ + "extends": "../../../../../tsconfig.base.json", + "compilerOptions": { + "outDir": "./target/types", + }, + "include": [ + "index.ts", + "public/**/*.ts", + "server/**/*.ts", + "../../../../../typings/**/*", + ], + "exclude": [], + "references": [ + { "path": "../../../../../src/core/tsconfig.json" } + ] +} diff --git a/test/analytics/__fixtures__/plugins/analytics_plugin_a/kibana.json b/test/analytics/__fixtures__/plugins/analytics_plugin_a/kibana.json new file mode 100644 index 0000000000000..f666a05a64b42 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_plugin_a/kibana.json @@ -0,0 +1,8 @@ +{ + "id": "analyticsPluginA", + "owner": { "name": "Core", "githubTeam": "kibana-core" }, + "version": "0.0.1", + "kibanaVersion": "kibana", + "server": true, + "ui": true +} diff --git a/test/analytics/__fixtures__/plugins/analytics_plugin_a/package.json b/test/analytics/__fixtures__/plugins/analytics_plugin_a/package.json new file mode 100644 index 0000000000000..dcb2fbcbe81d9 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_plugin_a/package.json @@ -0,0 +1,14 @@ +{ + "name": "analytics_plugin_a", + "version": "1.0.0", + "main": "target/test/analytics/__fixtures__/plugins/analytics_plugin_a", + "kibana": { + "version": "kibana", + "templateVersion": "1.0.0" + }, + "license": "SSPL-1.0 OR Elastic License 2.0", + "scripts": { + "kbn": "node ../../../../../scripts/kbn.js", + "build": "rm -rf './target' && ../../../../../node_modules/.bin/tsc" + } +} \ No newline at end of file diff --git a/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/custom_shipper.ts b/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/custom_shipper.ts new file mode 100644 index 0000000000000..a0d943736db4f --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/custom_shipper.ts @@ -0,0 +1,43 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { Subject } from 'rxjs'; +import { TelemetryCounterType } from '@elastic/analytics'; +import type { Event, EventContext, IShipper, TelemetryCounter } from 'src/core/public'; + +export interface Action { + action: string; + meta: any; +} + +export class CustomShipper implements IShipper { + public static shipperName = 'FTR-shipper'; + + public telemetryCounter$ = new Subject(); + + constructor(private readonly actions$: Subject) {} + + public reportEvents(events: Event[]) { + this.actions$.next({ action: 'reportEvents', meta: events }); + events.forEach((event) => { + this.telemetryCounter$.next({ + type: TelemetryCounterType.succeeded, + event_type: event.event_type, + code: '200', + count: 1, + source: 'random_value', + }); + }); + } + optIn(isOptedIn: boolean) { + this.actions$.next({ action: 'optIn', meta: isOptedIn }); + } + extendContext(newContext: EventContext) { + this.actions$.next({ action: 'extendContext', meta: newContext }); + } +} diff --git a/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/index.ts b/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/index.ts new file mode 100644 index 0000000000000..75ee8354f97c9 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/index.ts @@ -0,0 +1,13 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { AnalyticsPluginA } from './plugin'; + +export function plugin() { + return new AnalyticsPluginA(); +} diff --git a/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/plugin.ts b/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/plugin.ts new file mode 100644 index 0000000000000..021a57f126612 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/plugin.ts @@ -0,0 +1,85 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { BehaviorSubject, ReplaySubject } from 'rxjs'; +import { take, toArray } from 'rxjs/operators'; +import type { Plugin, CoreSetup, TelemetryCounter, CoreStart } from 'src/core/public'; +import type { Action } from './custom_shipper'; +import { CustomShipper } from './custom_shipper'; +import './types'; + +export class AnalyticsPluginA implements Plugin { + private readonly actions$ = new ReplaySubject(); + + public setup({ analytics }: CoreSetup) { + const { + registerShipper, + registerContextProvider, + registerEventType, + reportEvent, + telemetryCounter$, + } = analytics; + registerShipper(CustomShipper, this.actions$); + + const stats: TelemetryCounter[] = []; + telemetryCounter$.subscribe((event) => stats.push(event)); + + registerEventType({ + eventType: 'test-plugin-lifecycle', + schema: { + plugin: { + type: 'keyword', + _meta: { + description: 'The ID of the plugin', + }, + }, + step: { + type: 'keyword', + _meta: { + description: 'The lifecycle step in which the plugin is', + }, + }, + }, + }); + + // Report an event before the shipper is registered + reportEvent('test-plugin-lifecycle', { + plugin: 'analyticsPluginA', + step: 'setup', + }); + + window.__analyticsPluginA__ = { + getLastActions: async (takeNumberOfActions: number) => + this.actions$.pipe(take(takeNumberOfActions), toArray()).toPromise(), + stats, + setOptIn(optIn: boolean) { + analytics.optIn({ global: { enabled: optIn } }); + }, + }; + + registerContextProvider({ + name: 'analyticsPluginA', + context$: new BehaviorSubject({ user_agent: navigator.userAgent }).asObservable(), + schema: { + user_agent: { + type: 'keyword', + _meta: { + description: 'The user agent of the browser', + }, + }, + }, + }); + } + public start({ analytics }: CoreStart) { + analytics.reportEvent('test-plugin-lifecycle', { + plugin: 'analyticsPluginA', + step: 'start', + }); + } + public stop() {} +} diff --git a/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/types.ts b/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/types.ts new file mode 100644 index 0000000000000..37203512e3674 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_plugin_a/public/types.ts @@ -0,0 +1,20 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { TelemetryCounter } from 'src/core/public'; +import type { Action } from './custom_shipper'; + +declare global { + interface Window { + __analyticsPluginA__: { + getLastActions: (takeNumberOfActions: number) => Promise; + stats: TelemetryCounter[]; + setOptIn: (optIn: boolean) => void; + }; + } +} diff --git a/test/analytics/__fixtures__/plugins/analytics_plugin_a/server/custom_shipper.ts b/test/analytics/__fixtures__/plugins/analytics_plugin_a/server/custom_shipper.ts new file mode 100644 index 0000000000000..949623314e603 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_plugin_a/server/custom_shipper.ts @@ -0,0 +1,43 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { Subject } from 'rxjs'; +import { TelemetryCounterType } from '@elastic/analytics'; +import type { IShipper, Event, EventContext, TelemetryCounter } from 'src/core/server'; + +export interface Action { + action: string; + meta: any; +} + +export class CustomShipper implements IShipper { + public static shipperName = 'FTR-shipper'; + + public telemetryCounter$ = new Subject(); + + constructor(private readonly actions$: Subject) {} + + public reportEvents(events: Event[]) { + this.actions$.next({ action: 'reportEvents', meta: events }); + events.forEach((event) => { + this.telemetryCounter$.next({ + type: TelemetryCounterType.succeeded, + event_type: event.event_type, + code: '200', + count: 1, + source: 'random_value', + }); + }); + } + optIn(isOptedIn: boolean) { + this.actions$.next({ action: 'optIn', meta: isOptedIn }); + } + extendContext(newContext: EventContext) { + this.actions$.next({ action: 'extendContext', meta: newContext }); + } +} diff --git a/test/analytics/__fixtures__/plugins/analytics_plugin_a/server/index.ts b/test/analytics/__fixtures__/plugins/analytics_plugin_a/server/index.ts new file mode 100644 index 0000000000000..65d2593c427f5 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_plugin_a/server/index.ts @@ -0,0 +1,11 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { AnalyticsPluginAPlugin } from './plugin'; + +export const plugin = () => new AnalyticsPluginAPlugin(); diff --git a/test/analytics/__fixtures__/plugins/analytics_plugin_a/server/plugin.ts b/test/analytics/__fixtures__/plugins/analytics_plugin_a/server/plugin.ts new file mode 100644 index 0000000000000..1abb73c09b37a --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_plugin_a/server/plugin.ts @@ -0,0 +1,114 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { BehaviorSubject, ReplaySubject } from 'rxjs'; +import { take, toArray } from 'rxjs/operators'; +import { schema } from '@kbn/config-schema'; +import type { Plugin, CoreSetup, CoreStart, TelemetryCounter } from 'src/core/server'; +import type { Action } from './custom_shipper'; +import { CustomShipper } from './custom_shipper'; + +export class AnalyticsPluginAPlugin implements Plugin { + public setup({ analytics, http }: CoreSetup, deps: {}) { + const { + registerContextProvider, + registerEventType, + registerShipper, + reportEvent, + telemetryCounter$, + } = analytics; + + const stats: TelemetryCounter[] = []; + telemetryCounter$.subscribe((event) => stats.push(event)); + + registerEventType({ + eventType: 'test-plugin-lifecycle', + schema: { + plugin: { + type: 'keyword', + _meta: { + description: 'The ID of the plugin', + }, + }, + step: { + type: 'keyword', + _meta: { + description: 'The lifecycle step in which the plugin is', + }, + }, + }, + }); + + // Report an event before the shipper is registered + reportEvent('test-plugin-lifecycle', { + plugin: 'analyticsPluginA', + step: 'setup', + }); + + const actions$ = new ReplaySubject(); + registerShipper(CustomShipper, actions$); + + const router = http.createRouter(); + + router.get( + { + path: '/internal/analytics_plugin_a/stats', + validate: { + query: schema.object({ + takeNumberOfCounters: schema.number({ min: 1 }), + }), + }, + }, + async (context, req, res) => { + const { takeNumberOfCounters } = req.query; + + return res.ok({ body: stats.slice(-takeNumberOfCounters) }); + } + ); + + router.get( + { + path: '/internal/analytics_plugin_a/actions', + validate: { + query: schema.object({ + takeNumberOfActions: schema.number({ min: 1 }), + }), + }, + }, + async (context, req, res) => { + const { takeNumberOfActions } = req.query; + + const actions = await actions$.pipe(take(takeNumberOfActions), toArray()).toPromise(); + + return res.ok({ body: actions }); + } + ); + + registerContextProvider({ + name: 'analyticsPluginA', + context$: new BehaviorSubject({ pid: process.pid }), + schema: { + pid: { + type: 'short', + _meta: { + description: 'The Kibana process ID', + }, + }, + }, + }); + } + + public start({ analytics }: CoreStart) { + analytics.reportEvent('test-plugin-lifecycle', { + plugin: 'analyticsPluginA', + step: 'start', + }); + } + + public stop() {} +} diff --git a/test/analytics/__fixtures__/plugins/analytics_plugin_a/tsconfig.json b/test/analytics/__fixtures__/plugins/analytics_plugin_a/tsconfig.json new file mode 100644 index 0000000000000..d1faee2d113b6 --- /dev/null +++ b/test/analytics/__fixtures__/plugins/analytics_plugin_a/tsconfig.json @@ -0,0 +1,16 @@ +{ + "extends": "../../../../../tsconfig.base.json", + "compilerOptions": { + "outDir": "./target/types", + }, + "include": [ + "index.ts", + "public/**/*.ts", + "server/**/*.ts", + "../../../../../typings/**/*", + ], + "exclude": [], + "references": [ + { "path": "../../../../../src/core/tsconfig.json" } + ] +} diff --git a/test/analytics/config.ts b/test/analytics/config.ts new file mode 100644 index 0000000000000..46fa5d892997a --- /dev/null +++ b/test/analytics/config.ts @@ -0,0 +1,42 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import path from 'path'; +import { FtrConfigProviderContext } from '@kbn/test'; +import { services } from './services'; + +/* + * These tests exist in a separate configuration because: + * 1) The FTR does not support building and installing plugins against built Kibana. + * This test must be run against source only in order to build the fixture plugins. + * 2) It provides a specific service to make EBT testing easier. + * 3) The intention is to grow this suite as more developers use this feature. + */ +export default async function ({ readConfigFile }: FtrConfigProviderContext) { + const commonConfig = await readConfigFile(require.resolve('../common/config')); + const functionalConfig = await readConfigFile(require.resolve('../functional/config')); + + return { + testFiles: [require.resolve('./tests')], + services, + pageObjects: functionalConfig.get('pageObjects'), + servers: commonConfig.get('servers'), + junit: { + reportName: 'Analytics Integration Tests', + }, + esTestCluster: functionalConfig.get('esTestCluster'), + kbnTestServer: { + ...functionalConfig.get('kbnTestServer'), + serverArgs: [ + ...functionalConfig.get('kbnTestServer.serverArgs'), + `--plugin-path=${path.resolve(__dirname, './__fixtures__/plugins/analytics_plugin_a')}`, + `--plugin-path=${path.resolve(__dirname, './__fixtures__/plugins/analytics_ftr_helpers')}`, + ], + }, + }; +} diff --git a/test/analytics/services/index.ts b/test/analytics/services/index.ts new file mode 100644 index 0000000000000..0c75df9bc2050 --- /dev/null +++ b/test/analytics/services/index.ts @@ -0,0 +1,23 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { GenericFtrProviderContext } from '@kbn/test'; +import { services as commonServices } from '../../common/services'; +import { services as functionalServices } from '../../functional/services'; +import { pageObjects } from '../../functional/page_objects'; + +import { KibanaEBTServerProvider, KibanaEBTUIProvider } from './kibana_ebt'; + +export const services = { + ...commonServices, + ...functionalServices, + kibana_ebt_server: KibanaEBTServerProvider, + kibana_ebt_ui: KibanaEBTUIProvider, +}; + +export type FtrProviderContext = GenericFtrProviderContext; diff --git a/test/analytics/services/kibana_ebt.ts b/test/analytics/services/kibana_ebt.ts new file mode 100644 index 0000000000000..cdb6e5ae28d95 --- /dev/null +++ b/test/analytics/services/kibana_ebt.ts @@ -0,0 +1,74 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { FtrProviderContext } from 'test/functional/ftr_provider_context'; +import '../__fixtures__/plugins/analytics_ftr_helpers/public/types'; + +export function KibanaEBTServerProvider({ getService }: FtrProviderContext) { + const supertest = getService('supertest'); + + return { + /** + * Change the opt-in state of the Kibana EBT client. + * @param optIn `true` to opt-in, `false` to opt-out. + */ + setOptIn: async (optIn: boolean) => { + await supertest + .post(`/internal/analytics_ftr_helpers/opt_in`) + .set('kbn-xsrf', 'xxx') + .query({ consent: optIn }) + .expect(200); + }, + /** + * Returns the last events of the specified types. + * @param numberOfEvents - number of events to return + * @param eventTypes (Optional) array of event types to return + */ + getLastEvents: async (takeNumberOfEvents: number, eventTypes: string[] = []) => { + const resp = await supertest + .get(`/internal/analytics_ftr_helpers/events`) + .query({ takeNumberOfEvents, eventTypes: JSON.stringify(eventTypes) }) + .set('kbn-xsrf', 'xxx') + .expect(200); + + return resp.body; + }, + }; +} + +export function KibanaEBTUIProvider({ getService, getPageObjects }: FtrProviderContext) { + const { common } = getPageObjects(['common']); + const browser = getService('browser'); + + return { + /** + * Change the opt-in state of the Kibana EBT client. + * @param optIn `true` to opt-in, `false` to opt-out. + */ + setOptIn: async (optIn: boolean) => { + await common.navigateToApp('home'); + await browser.execute((isOptIn) => window.__analytics_ftr_helpers__.setOptIn(isOptIn), optIn); + }, + /** + * Returns the last events of the specified types. + * @param numberOfEvents - number of events to return + * @param eventTypes (Optional) array of event types to return + */ + getLastEvents: async (numberOfEvents: number, eventTypes: string[] = []) => { + const events = await browser.execute( + ({ eventTypes: _eventTypes, numberOfEvents: _numberOfEvents }) => + window.__analytics_ftr_helpers__.getLastEvents(_numberOfEvents, _eventTypes), + { + eventTypes, + numberOfEvents, + } + ); + return events; + }, + }; +} diff --git a/test/analytics/tests/analytics_from_the_browser.ts b/test/analytics/tests/analytics_from_the_browser.ts new file mode 100644 index 0000000000000..9c866204ce18e --- /dev/null +++ b/test/analytics/tests/analytics_from_the_browser.ts @@ -0,0 +1,137 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import expect from '@kbn/expect'; +import type { TelemetryCounter } from 'src/core/server'; +import { FtrProviderContext } from '../services'; +import { Action } from '../__fixtures__/plugins/analytics_plugin_a/server/custom_shipper'; +import '../__fixtures__/plugins/analytics_plugin_a/public/types'; + +export default function ({ getService, getPageObjects }: FtrProviderContext) { + const { common } = getPageObjects(['common']); + const browser = getService('browser'); + const ebtUIHelper = getService('kibana_ebt_ui'); + + describe('analytics service: public side', () => { + const getTelemetryCounters = async ( + _takeNumberOfCounters: number + ): Promise => { + return await browser.execute( + ({ takeNumberOfCounters }) => + window.__analyticsPluginA__.stats.slice(-takeNumberOfCounters), + { takeNumberOfCounters: _takeNumberOfCounters } + ); + }; + + const getActions = async (takeNumberOfActions: number): Promise => { + return await browser.execute( + (count) => window.__analyticsPluginA__.getLastActions(count), + takeNumberOfActions + ); + }; + + beforeEach(async () => { + await common.navigateToApp('home'); + }); + + // this test should run first because it depends on optInConfig being undefined + it('should have internally enqueued the "lifecycle" events but not handed over to the shipper yet', async () => { + const telemetryCounters = await getTelemetryCounters(2); + expect(telemetryCounters).to.eql([ + { + type: 'enqueued', + event_type: 'test-plugin-lifecycle', + source: 'client', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + event_type: 'test-plugin-lifecycle', + source: 'client', + code: 'enqueued', + count: 1, + }, + ]); + }); + + it('after setting opt-in, it should extend the contexts and send the events', async () => { + await ebtUIHelper.setOptIn(true); + + const actions = await getActions(3); + + // Validating the remote user_agent because that's the only field that it's added by the FTR plugin. + const context = actions[1].meta; + expect(context).to.have.property('user_agent'); + expect(context.user_agent).to.be.a('string'); + + expect(actions).to.eql([ + { action: 'optIn', meta: true }, + { action: 'extendContext', meta: context }, + { + action: 'reportEvents', + meta: [ + { + timestamp: actions[2].meta[0].timestamp, + event_type: 'test-plugin-lifecycle', + context: {}, + properties: { plugin: 'analyticsPluginA', step: 'setup' }, + }, + { + timestamp: actions[2].meta[1].timestamp, + event_type: 'test-plugin-lifecycle', + context, + properties: { plugin: 'analyticsPluginA', step: 'start' }, + }, + ], + }, + ]); + + // Testing the FTR helper as well + expect(await ebtUIHelper.getLastEvents(2, ['test-plugin-lifecycle'])).to.eql([ + { + timestamp: actions[2].meta[0].timestamp, + event_type: 'test-plugin-lifecycle', + context: {}, + properties: { plugin: 'analyticsPluginA', step: 'setup' }, + }, + { + timestamp: actions[2].meta[1].timestamp, + event_type: 'test-plugin-lifecycle', + context, + properties: { plugin: 'analyticsPluginA', step: 'start' }, + }, + ]); + + const telemetryCounters = await getTelemetryCounters(3); + expect(telemetryCounters).to.eql([ + { + type: 'succeeded', + event_type: 'test-plugin-lifecycle', + source: 'FTR-shipper', + code: '200', + count: 1, + }, + { + type: 'succeeded', + event_type: 'test-plugin-lifecycle', + source: 'FTR-shipper', + code: '200', + count: 1, + }, + { + type: 'sent_to_shipper', + event_type: 'test-plugin-lifecycle', + source: 'client', + code: 'OK', + count: 2, + }, + ]); + }); + }); +} diff --git a/test/analytics/tests/analytics_from_the_server.ts b/test/analytics/tests/analytics_from_the_server.ts new file mode 100644 index 0000000000000..8555d91031d27 --- /dev/null +++ b/test/analytics/tests/analytics_from_the_server.ts @@ -0,0 +1,136 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import expect from '@kbn/expect'; +import type { TelemetryCounter } from 'src/core/server'; +import { FtrProviderContext } from '../services'; +import { Action } from '../__fixtures__/plugins/analytics_plugin_a/server/custom_shipper'; + +export default function ({ getService }: FtrProviderContext) { + const supertest = getService('supertest'); + const ebtServerHelper = getService('kibana_ebt_server'); + + const getTelemetryCounters = async ( + takeNumberOfCounters: number + ): Promise => { + const resp = await supertest + .get(`/internal/analytics_plugin_a/stats`) + .query({ takeNumberOfCounters }) + .set('kbn-xsrf', 'xxx') + .expect(200); + + return resp.body; + }; + + const getActions = async (takeNumberOfActions: number): Promise => { + const resp = await supertest + .get(`/internal/analytics_plugin_a/actions`) + .query({ takeNumberOfActions }) + .set('kbn-xsrf', 'xxx') + .expect(200); + + return resp.body; + }; + + describe('analytics service: server side', () => { + // this test should run first because it depends on optInConfig being undefined + it('should have internally enqueued the "lifecycle" events but not handed over to the shipper yet', async () => { + const telemetryCounters = await getTelemetryCounters(2); + expect(telemetryCounters).to.eql([ + { + type: 'enqueued', + event_type: 'test-plugin-lifecycle', + source: 'client', + code: 'enqueued', + count: 1, + }, + { + type: 'enqueued', + event_type: 'test-plugin-lifecycle', + source: 'client', + code: 'enqueued', + count: 1, + }, + ]); + }); + + it('after setting opt-in, it should extend the contexts and send the events', async () => { + await ebtServerHelper.setOptIn(true); + + const actions = await getActions(3); + // Validating the remote PID because that's the only field that it's added by the FTR plugin. + const context = actions[1].meta; + expect(context).to.have.property('pid'); + expect(context.pid).to.be.a('number'); + + expect(actions).to.eql([ + { action: 'optIn', meta: true }, + { action: 'extendContext', meta: context }, + { + action: 'reportEvents', + meta: [ + { + timestamp: actions[2].meta[0].timestamp, + event_type: 'test-plugin-lifecycle', + context: {}, + properties: { plugin: 'analyticsPluginA', step: 'setup' }, + }, + { + timestamp: actions[2].meta[1].timestamp, + event_type: 'test-plugin-lifecycle', + context, + properties: { plugin: 'analyticsPluginA', step: 'start' }, + }, + ], + }, + ]); + + // This helps us to also test the helpers + const events = await ebtServerHelper.getLastEvents(2, ['test-plugin-lifecycle']); + expect(events).to.eql([ + { + timestamp: actions[2].meta[0].timestamp, + event_type: 'test-plugin-lifecycle', + context: {}, + properties: { plugin: 'analyticsPluginA', step: 'setup' }, + }, + { + timestamp: actions[2].meta[1].timestamp, + event_type: 'test-plugin-lifecycle', + context, + properties: { plugin: 'analyticsPluginA', step: 'start' }, + }, + ]); + + const telemetryCounters = await getTelemetryCounters(3); + expect(telemetryCounters).to.eql([ + { + type: 'succeeded', + event_type: 'test-plugin-lifecycle', + source: 'FTR-shipper', + code: '200', + count: 1, + }, + { + type: 'succeeded', + event_type: 'test-plugin-lifecycle', + source: 'FTR-shipper', + code: '200', + count: 1, + }, + { + type: 'sent_to_shipper', + event_type: 'test-plugin-lifecycle', + source: 'client', + code: 'OK', + count: 2, + }, + ]); + }); + }); +} diff --git a/test/analytics/tests/index.ts b/test/analytics/tests/index.ts new file mode 100644 index 0000000000000..6744580200928 --- /dev/null +++ b/test/analytics/tests/index.ts @@ -0,0 +1,24 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { FtrProviderContext } from '../services'; + +export default function ({ loadTestFile }: FtrProviderContext) { + describe('analytics', () => { + // These tests need to run before the other tests because they require the initial `unknown` opt-in state + describe('analytics service', () => { + loadTestFile(require.resolve('./analytics_from_the_browser')); + loadTestFile(require.resolve('./analytics_from_the_server')); + }); + + describe('instrumented events', () => { + loadTestFile(require.resolve('./instrumented_events/from_the_browser')); + loadTestFile(require.resolve('./instrumented_events/from_the_server')); + }); + }); +} diff --git a/test/analytics/tests/instrumented_events/from_the_browser/index.ts b/test/analytics/tests/instrumented_events/from_the_browser/index.ts new file mode 100644 index 0000000000000..daf21180d2328 --- /dev/null +++ b/test/analytics/tests/instrumented_events/from_the_browser/index.ts @@ -0,0 +1,20 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { FtrProviderContext } from '../../../services'; + +export default function ({ getService }: FtrProviderContext) { + describe('from the browser', () => { + beforeEach(async () => { + await getService('kibana_ebt_ui').setOptIn(true); + }); + + // Add tests for UI-instrumented events here: + // loadTestFile(require.resolve('./some_event')); + }); +} diff --git a/test/analytics/tests/instrumented_events/from_the_server/index.ts b/test/analytics/tests/instrumented_events/from_the_server/index.ts new file mode 100644 index 0000000000000..8961b9e92994c --- /dev/null +++ b/test/analytics/tests/instrumented_events/from_the_server/index.ts @@ -0,0 +1,20 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { FtrProviderContext } from '../../../services'; + +export default function ({ getService }: FtrProviderContext) { + describe('from the server', () => { + beforeEach(async () => { + await getService('kibana_ebt_server').setOptIn(true); + }); + + // Add tests for UI-instrumented events here: + // loadTestFile(require.resolve('./some_event')); + }); +} diff --git a/test/tsconfig.json b/test/tsconfig.json index e870042ec2e02..2808da484bcca 100644 --- a/test/tsconfig.json +++ b/test/tsconfig.json @@ -18,6 +18,7 @@ ], "exclude": [ "target/**/*", + "analytics/__fixtures__/plugins/**/*", "interpreter_functional/plugins/**/*", "plugin_functional/plugins/**/*", "server_integration/__fixtures__/plugins/**/*", @@ -54,6 +55,8 @@ { "path": "../src/plugins/usage_collection/tsconfig.json" }, { "path": "../src/plugins/data_view_management/tsconfig.json" }, { "path": "../src/plugins/visualizations/tsconfig.json" }, + { "path": "analytics/__fixtures__/plugins/analytics_ftr_helpers/tsconfig.json"}, + { "path": "analytics/__fixtures__/plugins/analytics_plugin_a/tsconfig.json"}, { "path": "interactive_setup_api_integration/fixtures/test_endpoints/tsconfig.json" }, { "path": "plugin_functional/plugins/core_app_status/tsconfig.json" }, { "path": "plugin_functional/plugins/core_provider_plugin/tsconfig.json" }, diff --git a/x-pack/plugins/fleet/.storybook/context/index.tsx b/x-pack/plugins/fleet/.storybook/context/index.tsx index fbcbd4fd3a081..4f21614a00849 100644 --- a/x-pack/plugins/fleet/.storybook/context/index.tsx +++ b/x-pack/plugins/fleet/.storybook/context/index.tsx @@ -52,6 +52,14 @@ export const StorybookContext: React.FC<{ storyContext?: StoryContext }> = ({ const startServices: FleetStartServices = useMemo( () => ({ ...stubbedStartServices, + analytics: { + registerContextProvider: () => {}, + registerEventType: () => {}, + registerShipper: () => {}, + reportEvent: () => {}, + optIn: () => {}, + telemetryCounter$: EMPTY, + }, application: getApplication(), executionContext: getExecutionContext(), chrome: getChrome(), diff --git a/yarn.lock b/yarn.lock index c46f654860264..9fe698e72a7d0 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1407,6 +1407,10 @@ dependencies: tslib "^2.0.0" +"@elastic/analytics@link:bazel-bin/packages/elastic-analytics": + version "0.0.0" + uid "" + "@elastic/apm-rum-core@^5.14.1": version "5.14.1" resolved "https://registry.yarnpkg.com/@elastic/apm-rum-core/-/apm-rum-core-5.14.1.tgz#8f65060967c8d68498f2c520e4169ec07eb3b5bb" @@ -5532,6 +5536,10 @@ resolved "https://registry.yarnpkg.com/@types/ejs/-/ejs-3.0.6.tgz#aca442289df623bfa8e47c23961f0357847b83fe" integrity sha512-fj1hi+ZSW0xPLrJJD+YNwIh9GZbyaIepG26E/gXvp8nCa2pYokxUYO1sK9qjGxp2g8ryZYuon7wmjpwE2cyASQ== +"@types/elastic__analytics@link:bazel-bin/packages/elastic-analytics/npm_module_types": + version "0.0.0" + uid "" + "@types/elastic__apm-synthtrace@link:bazel-bin/packages/elastic-apm-synthtrace/npm_module_types": version "0.0.0" uid "" From 4115a86afad4b02c82af6f087c864d8e92bbca2a Mon Sep 17 00:00:00 2001 From: Sander Philipse <94373878+sphilipse@users.noreply.github.com> Date: Tue, 5 Apr 2022 17:40:14 +0200 Subject: [PATCH 04/47] [Workplace Search] Fix add connector state machine (#129377) * [Workplace Search] Fix add connector state machine Co-authored-by: Byron Hulcher --- .../external_connector_config.test.tsx | 2 - .../external_connector_config.tsx | 8 +- .../external_connector_form_fields.test.tsx | 1 + .../external_connector_form_fields.tsx | 8 +- .../external_connector_logic.test.ts | 12 +- .../external_connector_logic.ts | 4 +- .../components/add_source/add_source.test.tsx | 28 +-- .../components/add_source/add_source.tsx | 21 +- .../add_source/add_source_logic.test.ts | 211 ++++++++++++++++-- .../components/add_source/add_source_logic.ts | 65 ++++-- .../add_source/save_config.test.tsx | 16 ++ .../components/add_source/save_config.tsx | 4 +- .../views/content_sources/source_data.tsx | 1 + .../content_sources/sources_router.test.tsx | 2 +- 14 files changed, 279 insertions(+), 104 deletions(-) diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_config.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_config.test.tsx index 4917877c0ec30..2d8b5192fd3b1 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_config.test.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_config.test.tsx @@ -30,7 +30,6 @@ describe('ExternalConnectorConfig', () => { const setExternalConnectorApiKey = jest.fn(); const setExternalConnectorUrl = jest.fn(); const saveExternalConnectorConfig = jest.fn(); - const fetchExternalSource = jest.fn(); const props = { sourceData: staticSourceData[0], @@ -53,7 +52,6 @@ describe('ExternalConnectorConfig', () => { setExternalConnectorApiKey, setExternalConnectorUrl, saveExternalConnectorConfig, - fetchExternalSource, }); setMockValues({ ...values }); }); diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_config.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_config.tsx index 002cafa2e3229..97225144a3324 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_config.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_config.tsx @@ -5,7 +5,7 @@ * 2.0. */ -import React, { FormEvent, useEffect } from 'react'; +import React, { FormEvent } from 'react'; import { useActions, useValues } from 'kea'; @@ -50,7 +50,7 @@ export const ExternalConnectorConfig: React.FC = ({ onDeleteConfig, }) => { const serviceType = 'external'; - const { fetchExternalSource, saveExternalConnectorConfig } = useActions(ExternalConnectorLogic); + const { saveExternalConnectorConfig } = useActions(ExternalConnectorLogic); const { formDisabled, @@ -61,10 +61,6 @@ export const ExternalConnectorConfig: React.FC = ({ urlValid, } = useValues(ExternalConnectorLogic); - useEffect(() => { - fetchExternalSource(); - }, []); - const handleFormSubmission = (e: FormEvent) => { e.preventDefault(); saveExternalConnectorConfig({ url: externalConnectorUrl, apiKey: externalConnectorApiKey }); diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_form_fields.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_form_fields.test.tsx index 45a7dd122eabf..9d73dc5046810 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_form_fields.test.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_form_fields.test.tsx @@ -45,6 +45,7 @@ describe('ExternalConnectorConfig', () => { expect(wrapper.find(EuiFormRow)).toHaveLength(2); expect(wrapper.find(EuiCallOut)).toHaveLength(0); + expect(fetchExternalSource).toHaveBeenCalled(); }); it('handles url change', () => { const wrapper = shallow(); diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_form_fields.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_form_fields.tsx index 2f987f9266223..f55018dda93c2 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_form_fields.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_form_fields.tsx @@ -5,7 +5,7 @@ * 2.0. */ -import React from 'react'; +import React, { useEffect } from 'react'; import { useActions, useValues } from 'kea'; @@ -22,9 +22,11 @@ export const ExternalConnectorFormFields: React.FC = () => { formDisabled, showInsecureUrlCallout, } = useValues(ExternalConnectorLogic); - const { validateUrl, setExternalConnectorApiKey, setExternalConnectorUrl } = + const { fetchExternalSource, validateUrl, setExternalConnectorApiKey, setExternalConnectorUrl } = useActions(ExternalConnectorLogic); - + useEffect(() => { + fetchExternalSource(); + }, []); return ( <> {showInsecureUrlCallout && ( diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_logic.test.ts index 1f15ef2ae7b67..fb09695a3529d 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_logic.test.ts +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_logic.test.ts @@ -21,7 +21,7 @@ jest.mock('../../../../../app_logic', () => ({ AppLogic: { values: { isOrganization: true } }, })); -import { AddSourceLogic, SourceConfigData } from '../add_source_logic'; +import { SourceConfigData } from '../add_source_logic'; import { ExternalConnectorLogic, ExternalConnectorValues } from './external_connector_logic'; @@ -190,16 +190,6 @@ describe('ExternalConnectorLogic', () => { }); describe('listeners', () => { - describe('AddSourceLogic.actions.setSourceConfigData', () => { - it('dispatches success action', () => { - const fetchExternalSourceSuccess = jest.spyOn( - ExternalConnectorLogic.actions, - 'fetchExternalSourceSuccess' - ); - AddSourceLogic.actions.setSourceConfigData(sourceConfigData); - expect(fetchExternalSourceSuccess).toHaveBeenCalledWith(sourceConfigData); - }); - }); describe('fetchExternalSource', () => { it('retrieves config info on the "external" connector', () => { const promise = Promise.resolve(); diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_logic.ts index ecb139ede3132..d1e4cf7f4f008 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_logic.ts +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_external_connector/external_connector_logic.ts @@ -20,7 +20,7 @@ import { AppLogic } from '../../../../../app_logic'; import { getAddPath, getSourcesPath } from '../../../../../routes'; -import { AddSourceLogic, SourceConfigData } from '../add_source_logic'; +import { SourceConfigData } from '../add_source_logic'; export interface ExternalConnectorActions { fetchExternalSource: () => true; @@ -121,8 +121,6 @@ export const ExternalConnectorLogic = kea< ], }, listeners: ({ actions, values }) => ({ - [AddSourceLogic.actionTypes.setSourceConfigData]: (sourceConfigData) => - actions.fetchExternalSourceSuccess(sourceConfigData), fetchExternalSource: async () => { const route = '/internal/workplace_search/org/settings/connectors/external'; diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source.test.tsx index da42844de56dc..a7cfa81d30021 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source.test.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source.test.tsx @@ -71,33 +71,7 @@ describe('AddSourceList', () => { wrapper.find(ConfigurationIntro).prop('advanceStep')(); expect(setAddSourceStep).toHaveBeenCalledWith(AddSourceSteps.SaveConfigStep); - }); - - it('renders default state correctly when there are multiple connector options, but all connectors have been configured', () => { - setMockValues({ ...mockValues, externalConfigured: true }); - const sourceData = { - ...staticSourceData[0], - externalConnectorAvailable: true, - configured: true, - }; - shallow(); - expect(initializeAddSource).toHaveBeenNthCalledWith( - 2, - expect.objectContaining({ connect: true }) - ); - }); - - it('renders default state correctly when there are not multiple connector options, and the connector has been configured', () => { - const sourceData = { - ...staticSourceData[0], - externalConnectorAvailable: false, - configured: true, - }; - shallow(); - expect(initializeAddSource).toHaveBeenNthCalledWith( - 2, - expect.objectContaining({ connect: true }) - ); + expect(initializeAddSource).toHaveBeenCalled(); }); it('renders default state correctly when there are multiple connector options', () => { diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source.tsx index fdddbe4984a05..4bdf8db217a7b 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source.tsx @@ -41,28 +41,17 @@ export const AddSource: React.FC = (props) => { const { initializeAddSource, setAddSourceStep, saveSourceConfig, resetSourceState } = useActions(AddSourceLogic); const { addSourceCurrentStep, sourceConfigData, dataLoading } = useValues(AddSourceLogic); - const { - name, - categories, - needsPermissions, - accountContextOnly, - privateSourcesEnabled, - configured, - } = sourceConfigData; - const { serviceType, configuration, features, objTypes, externalConnectorAvailable } = - props.sourceData; + const { name, categories, needsPermissions, accountContextOnly, privateSourcesEnabled } = + sourceConfigData; + const { serviceType, configuration, features, objTypes } = props.sourceData; const addPath = getAddPath(serviceType); const { isOrganization } = useValues(AppLogic); const { externalConfigured } = useValues(SourcesLogic); useEffect(() => { - // We can land on this page from a choice page for multiple types of connectors - // If that's the case we want to skip the intro and configuration, if the external & internal connector have already been configured - // Otherwise, we skip to connect if the source is already configured - const goToConnect = externalConnectorAvailable ? externalConfigured && configured : configured; - initializeAddSource(goToConnect ? { ...props, connect: true } : props); + initializeAddSource(props); return resetSourceState; - }, [configured]); + }, []); const goToConfigurationIntro = () => setAddSourceStep(AddSourceSteps.ConfigIntroStep); const goToSaveConfig = () => setAddSourceStep(AddSourceSteps.SaveConfigStep); diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.test.ts index 56468ae26dea3..88ca96b8c0fbf 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.test.ts +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.test.ts @@ -42,7 +42,6 @@ import { describe('AddSourceLogic', () => { const { mount } = new LogicMounter(AddSourceLogic); - const { mount: mountExternalConnectorLogic } = new LogicMounter(ExternalConnectorLogic); const { http } = mockHttpValues; const { navigateToUrl } = mockKibanaValues; const { clearFlashMessages, flashAPIErrors, setErrorMessage } = mockFlashMessageHelpers; @@ -111,8 +110,9 @@ describe('AddSourceLogic', () => { beforeEach(() => { jest.clearAllMocks(); + ExternalConnectorLogic.mount(); + SourcesLogic.mount(); mount(); - mountExternalConnectorLogic(); }); it('has expected default values', () => { @@ -290,20 +290,25 @@ describe('AddSourceLogic', () => { const addSourceProps = { sourceData: DEFAULT_SERVICE_TYPE }; const getSourceConfigDataSpy = jest.spyOn(AddSourceLogic.actions, 'getSourceConfigData'); const setAddSourcePropsSpy = jest.spyOn(AddSourceLogic.actions, 'setAddSourceProps'); - const setAddSourceStepSpy = jest.spyOn(AddSourceLogic.actions, 'setAddSourceStep'); AddSourceLogic.actions.initializeAddSource(addSourceProps); expect(setAddSourcePropsSpy).toHaveBeenCalledWith({ addSourceProps }); - expect(setAddSourceStepSpy).toHaveBeenCalledWith(AddSourceSteps.ConfigIntroStep); - expect(getSourceConfigDataSpy).toHaveBeenCalledWith('box'); + expect(getSourceConfigDataSpy).toHaveBeenCalledWith('box', addSourceProps); }); - describe('getFirstStep', () => { + describe('setFirstStep', () => { + it('sets intro as first step', () => { + const setAddSourceStepSpy = jest.spyOn(AddSourceLogic.actions, 'setAddSourceStep'); + const addSourceProps = { sourceData: DEFAULT_SERVICE_TYPE }; + AddSourceLogic.actions.setFirstStep(addSourceProps); + + expect(setAddSourceStepSpy).toHaveBeenCalledWith(AddSourceSteps.ConfigIntroStep); + }); it('sets connect as first step', () => { const setAddSourceStepSpy = jest.spyOn(AddSourceLogic.actions, 'setAddSourceStep'); const addSourceProps = { sourceData: DEFAULT_SERVICE_TYPE, connect: true }; - AddSourceLogic.actions.initializeAddSource(addSourceProps); + AddSourceLogic.actions.setFirstStep(addSourceProps); expect(setAddSourceStepSpy).toHaveBeenCalledWith(AddSourceSteps.ConnectInstanceStep); }); @@ -311,7 +316,7 @@ describe('AddSourceLogic', () => { it('sets configure as first step', () => { const setAddSourceStepSpy = jest.spyOn(AddSourceLogic.actions, 'setAddSourceStep'); const addSourceProps = { sourceData: DEFAULT_SERVICE_TYPE, configure: true }; - AddSourceLogic.actions.initializeAddSource(addSourceProps); + AddSourceLogic.actions.setFirstStep(addSourceProps); expect(setAddSourceStepSpy).toHaveBeenCalledWith(AddSourceSteps.ConfigureOauthStep); }); @@ -319,7 +324,7 @@ describe('AddSourceLogic', () => { it('sets reAuthenticate as first step', () => { const setAddSourceStepSpy = jest.spyOn(AddSourceLogic.actions, 'setAddSourceStep'); const addSourceProps = { sourceData: DEFAULT_SERVICE_TYPE, reAuthenticate: true }; - AddSourceLogic.actions.initializeAddSource(addSourceProps); + AddSourceLogic.actions.setFirstStep(addSourceProps); expect(setAddSourceStepSpy).toHaveBeenCalledWith(AddSourceSteps.ReauthenticateStep); }); @@ -331,13 +336,99 @@ describe('AddSourceLogic', () => { serviceType: 'external', }, }; - AddSourceLogic.actions.initializeAddSource(addSourceProps); + AddSourceLogic.actions.setFirstStep(addSourceProps); expect(setAddSourceStepSpy).toHaveBeenCalledWith(AddSourceSteps.SaveConfigStep); }); + it('sets SaveConfigStep for when external connector is available and configured', () => { + const setAddSourceStepSpy = jest.spyOn(AddSourceLogic.actions, 'setAddSourceStep'); + const addSourceProps = { + sourceData: { + ...DEFAULT_SERVICE_TYPE, + externalConnectorAvailable: true, + }, + }; + AddSourceLogic.actions.setSourceConfigData({ + ...sourceConfigData, + serviceType: 'external', + configured: false, + }); + SourcesLogic.mount(); + SourcesLogic.actions.onInitializeSources({ + contentSources: [], + serviceTypes: [ + { + serviceType: 'external', + configured: true, + }, + ], + } as any); + AddSourceLogic.actions.setFirstStep(addSourceProps); + + expect(setAddSourceStepSpy).toHaveBeenCalledWith(AddSourceSteps.SaveConfigStep); + }); + it('sets Connect step when configured and external connector is available and configured', () => { + const setAddSourceStepSpy = jest.spyOn(AddSourceLogic.actions, 'setAddSourceStep'); + const addSourceProps = { + sourceData: { + ...DEFAULT_SERVICE_TYPE, + externalConnectorAvailable: true, + configured: true, + }, + }; + AddSourceLogic.actions.setSourceConfigData({ + ...sourceConfigData, + serviceType: 'external', + configured: true, + }); + SourcesLogic.mount(); + SourcesLogic.actions.onInitializeSources({ + contentSources: [], + serviceTypes: [ + { + serviceType: 'external', + configured: true, + }, + ], + } as any); + AddSourceLogic.actions.setFirstStep(addSourceProps); + + expect(setAddSourceStepSpy).toHaveBeenCalledWith(AddSourceSteps.ConnectInstanceStep); + }); + it('sets Connect step when external and fully configured', () => { + const setAddSourceStepSpy = jest.spyOn(AddSourceLogic.actions, 'setAddSourceStep'); + const addSourceProps = { + sourceData: { + ...DEFAULT_SERVICE_TYPE, + serviceType: 'external', + }, + }; + AddSourceLogic.actions.setSourceConfigData({ + ...sourceConfigData, + configured: true, + serviceType: 'external', + configuredFields: { clientId: 'a', clientSecret: 'b' }, + }); + SourcesLogic.mount(); + SourcesLogic.actions.onInitializeSources({ + contentSources: [], + serviceTypes: [ + { + serviceType: 'external', + configured: true, + }, + ], + } as any); + AddSourceLogic.actions.setFirstStep(addSourceProps); + + expect(setAddSourceStepSpy).toHaveBeenCalledWith(AddSourceSteps.ConnectInstanceStep); + }); }); describe('saveSourceParams', () => { + beforeEach(() => { + SourcesLogic.mount(); + }); const params = { code: 'code123', session_state: 'session_state123', @@ -350,10 +441,6 @@ describe('AddSourceLogic', () => { const response = { serviceName: 'name', indexPermissions: false, serviceType: 'zendesk' }; - beforeEach(() => { - SourcesLogic.mount(); - }); - it('sends params to server and calls correct methods', async () => { const setAddedSourceSpy = jest.spyOn(SourcesLogic.actions, 'setAddedSource'); const { serviceName, indexPermissions, serviceType } = response; @@ -461,6 +548,20 @@ describe('AddSourceLogic', () => { await nextTick(); expect(setSourceConfigDataSpy).toHaveBeenCalledWith(sourceConfigData); }); + it('calls API and sets values and calls setFirstStep if AddSourceProps is provided', async () => { + const setSourceConfigDataSpy = jest.spyOn(AddSourceLogic.actions, 'setSourceConfigData'); + const setFirstStepSpy = jest.spyOn(AddSourceLogic.actions, 'setFirstStep'); + const addSourceProps = { sourceData: DEFAULT_SERVICE_TYPE }; + http.get.mockReturnValue(Promise.resolve(sourceConfigData)); + + AddSourceLogic.actions.getSourceConfigData('github', addSourceProps); + expect(http.get).toHaveBeenCalledWith( + '/internal/workplace_search/org/settings/connectors/github' + ); + await nextTick(); + expect(setSourceConfigDataSpy).toHaveBeenCalledWith(sourceConfigData); + expect(setFirstStepSpy).toHaveBeenCalledWith(addSourceProps); + }); itShowsServerErrorAsFlashMessage(http.get, () => { AddSourceLogic.actions.getSourceConfigData('github'); @@ -568,6 +669,9 @@ describe('AddSourceLogic', () => { let params: any; beforeEach(() => { + ExternalConnectorLogic.mount(); + ExternalConnectorLogic.actions.setExternalConnectorApiKey('asdf1234'); + ExternalConnectorLogic.actions.setExternalConnectorUrl('https://www.elastic.co'); AddSourceLogic.actions.setSourceConfigData(sourceConfigData); params = { @@ -578,8 +682,6 @@ describe('AddSourceLogic', () => { private_key: sourceConfigData.configuredFields?.privateKey, public_key: sourceConfigData.configuredFields?.publicKey, consumer_key: sourceConfigData.configuredFields?.consumerKey, - external_connector_url: sourceConfigData.configuredFields?.externalConnectorUrl, - external_connector_api_key: sourceConfigData.configuredFields?.externalConnectorApiKey, }; }); @@ -595,12 +697,85 @@ describe('AddSourceLogic', () => { expect(AddSourceLogic.values.buttonLoading).toEqual(true); expect(http.put).toHaveBeenCalledWith( `/internal/workplace_search/org/settings/connectors/${sourceConfigData.serviceType}`, - { body: JSON.stringify(params) } + { + body: JSON.stringify(params), + } + ); + + await nextTick(); + expect(successCallback).toHaveBeenCalled(); + expect(setSourceConfigDataSpy).toHaveBeenCalledWith({ + sourceConfigData: { + ...sourceConfigData, + external_connector_url: undefined, + external_connector_api_key: undefined, + }, + }); + expect(setButtonNotLoadingSpy).toHaveBeenCalled(); + }); + + it('calls API and sets values when updating external source', async () => { + ExternalConnectorLogic.actions.setExternalConnectorApiKey('asdf1234'); + ExternalConnectorLogic.actions.setExternalConnectorUrl('https://www.elastic.co'); + AddSourceLogic.actions.setSourceConfigData({ + ...sourceConfigData, + serviceType: 'external', + }); + const successCallback = jest.fn(); + const setButtonNotLoadingSpy = jest.spyOn(AddSourceLogic.actions, 'setButtonNotLoading'); + const setSourceConfigDataSpy = jest.spyOn(AddSourceLogic.actions, 'setSourceConfigData'); + http.put.mockReturnValue( + Promise.resolve({ sourceConfigData: { ...sourceConfigData, serviceType: 'external' } }) + ); + + AddSourceLogic.actions.saveSourceConfig(true, successCallback); + + expect(clearFlashMessages).toHaveBeenCalled(); + expect(AddSourceLogic.values.buttonLoading).toEqual(true); + expect(http.put).toHaveBeenCalledWith( + '/internal/workplace_search/org/settings/connectors/external', + { + body: JSON.stringify({ + ...params, + service_type: 'external', + external_connector_url: sourceConfigData.configuredFields?.externalConnectorUrl, + external_connector_api_key: + sourceConfigData.configuredFields?.externalConnectorApiKey, + }), + } ); await nextTick(); expect(successCallback).toHaveBeenCalled(); - expect(setSourceConfigDataSpy).toHaveBeenCalledWith({ sourceConfigData }); + expect(setSourceConfigDataSpy).toHaveBeenCalledWith({ + sourceConfigData: { ...sourceConfigData, serviceType: 'external' }, + }); + expect(setButtonNotLoadingSpy).toHaveBeenCalled(); + }); + + it('does not call API when updating external source with invalid URL', async () => { + ExternalConnectorLogic.actions.setExternalConnectorApiKey('asdf1234'); + ExternalConnectorLogic.actions.setExternalConnectorUrl('noUrl'); + AddSourceLogic.actions.setSourceConfigData({ + ...sourceConfigData, + serviceType: 'external', + }); + const successCallback = jest.fn(); + const setButtonNotLoadingSpy = jest.spyOn(AddSourceLogic.actions, 'setButtonNotLoading'); + const setSourceConfigDataSpy = jest.spyOn(AddSourceLogic.actions, 'setSourceConfigData'); + http.put.mockReturnValue( + Promise.resolve({ sourceConfigData: { ...sourceConfigData, serviceType: 'external' } }) + ); + + AddSourceLogic.actions.saveSourceConfig(true, successCallback); + + expect(clearFlashMessages).toHaveBeenCalled(); + expect(AddSourceLogic.values.buttonLoading).toEqual(false); + expect(http.put).not.toHaveBeenCalled(); + + await nextTick(); + expect(successCallback).not.toHaveBeenCalled(); + expect(setSourceConfigDataSpy).not.toHaveBeenCalled(); expect(setButtonNotLoadingSpy).toHaveBeenCalled(); }); diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts index 631789e591635..97a58966ad76a 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts @@ -89,7 +89,10 @@ export interface AddSourceActions { params: OauthParams, isOrganization: boolean ): { search: Search; params: OauthParams; isOrganization: boolean }; - getSourceConfigData(serviceType: string): { serviceType: string }; + getSourceConfigData( + serviceType: string, + addSourceProps?: AddSourceProps + ): { serviceType: string; addSourceProps: AddSourceProps | undefined }; getSourceConnectData( serviceType: string, successCallback: (oauthUrl: string) => void @@ -97,6 +100,7 @@ export interface AddSourceActions { getSourceReConnectData(sourceId: string): { sourceId: string }; getPreContentSourceConfigData(): void; setButtonNotLoading(): void; + setFirstStep(addSourceProps: AddSourceProps): { addSourceProps: AddSourceProps }; } export interface SourceConfigData { @@ -107,9 +111,9 @@ export interface SourceConfigData { needsPermissions?: boolean; privateSourcesEnabled: boolean; configuredFields: { - publicKey: string; - privateKey: string; - consumerKey: string; + publicKey?: string; + privateKey?: string; + consumerKey?: string; baseUrl?: string; clientId?: string; clientSecret?: string; @@ -177,7 +181,10 @@ export const AddSourceLogic = kea data, setPreContentSourceId: (preContentSourceId: string) => preContentSourceId, setSelectedGithubOrganizations: (option: string) => option, - getSourceConfigData: (serviceType: string) => ({ serviceType }), + getSourceConfigData: (serviceType: string, addSourceProps?: AddSourceProps) => ({ + serviceType, + addSourceProps, + }), getSourceConnectData: (serviceType: string, successCallback: (oauthUrl: string) => string) => ({ serviceType, successCallback, @@ -200,6 +207,7 @@ export const AddSourceLogic = kea ({ serviceType, successCallback, errorCallback }), resetSourceState: () => true, setButtonNotLoading: () => false, + setFirstStep: (addSourceProps) => ({ addSourceProps }), }, reducers: { addSourceProps: [ @@ -355,15 +363,17 @@ export const AddSourceLogic = kea { const { serviceType } = addSourceProps.sourceData; actions.setAddSourceProps({ addSourceProps }); - actions.setAddSourceStep(getFirstStep(addSourceProps)); - actions.getSourceConfigData(serviceType); + actions.getSourceConfigData(serviceType, addSourceProps); }, - getSourceConfigData: async ({ serviceType }) => { + getSourceConfigData: async ({ serviceType, addSourceProps }) => { const route = `/internal/workplace_search/org/settings/connectors/${serviceType}`; try { const response = await HttpLogic.values.http.get(route); actions.setSourceConfigData(response); + if (addSourceProps) { + actions.setFirstStep(addSourceProps); + } } catch (e) { flashAPIErrors(e); } @@ -462,8 +472,9 @@ export const AddSourceLogic = kea { + const firstStep = getFirstStep( + addSourceProps, + values.sourceConfigData, + SourcesLogic.values.externalConfigured + ); + actions.setAddSourceStep(firstStep); + }, createContentSource: async ({ serviceType, successCallback, errorCallback }) => { clearFlashMessages(); const { isOrganization } = AppLogic.values; @@ -579,18 +598,34 @@ export const AddSourceLogic = kea { +const getFirstStep = ( + props: AddSourceProps, + sourceConfigData: SourceConfigData, + externalConfigured: boolean +): AddSourceSteps => { const { connect, configure, reAuthenticate, - sourceData: { serviceType }, + sourceData: { serviceType, externalConnectorAvailable }, } = props; + // We can land on this page from a choice page for multiple types of connectors + // If that's the case we want to skip the intro and configuration, if the external & internal connector have already been configured + const { configuredFields, configured } = sourceConfigData; + if (externalConnectorAvailable && configured && externalConfigured) + return AddSourceSteps.ConnectInstanceStep; + if (externalConnectorAvailable && !configured && externalConfigured) + return AddSourceSteps.SaveConfigStep; + if (serviceType === 'external') { + // external connectors can be partially configured, so we need to check which fields are filled + if (configuredFields?.clientId && configuredFields?.clientSecret) { + return AddSourceSteps.ConnectInstanceStep; + } + // Unconfigured external connectors have already shown the intro step before the choice page, so we don't want to show it again + return AddSourceSteps.SaveConfigStep; + } if (connect) return AddSourceSteps.ConnectInstanceStep; if (configure) return AddSourceSteps.ConfigureOauthStep; if (reAuthenticate) return AddSourceSteps.ReauthenticateStep; - // TODO: Re-do this once we have more than one external connector type - // External connectors have already shown the intro step before the choice page, so we don't want to show it again - if (serviceType === 'external') return AddSourceSteps.SaveConfigStep; return AddSourceSteps.ConfigIntroStep; }; diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/save_config.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/save_config.test.tsx index 3e35c608fcee8..5d5faf4816706 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/save_config.test.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/save_config.test.tsx @@ -133,6 +133,22 @@ describe('SaveConfig', () => { expect(steps.dive().find(ConfigDocsLinks)).toHaveLength(1); }); + it('renders empty ApiKeys', () => { + setMockValues({ + ...values, + sourceConfigData: { + ...values.sourceConfigData, + configuredFields: {}, + }, + }); + + const wrapper = shallow(); + const steps = wrapper.find(EuiSteps); + + expect(steps.dive().find(ApiKey).at(0).prop('apiKey')).toEqual(''); + expect(steps.dive().find(ApiKey).at(1).prop('apiKey')).toEqual(''); + }); + it('handles Base URI change', () => { const wrapper = shallow(); const steps = wrapper.find(EuiSteps); diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/save_config.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/save_config.tsx index eb887a9f8cc42..f44cbb5774967 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/save_config.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/save_config.tsx @@ -121,10 +121,10 @@ export const SaveConfig: React.FC = ({ - + - + diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_data.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_data.tsx index 3cd8fb2bbcd33..258fa97da6e7e 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_data.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/source_data.tsx @@ -260,6 +260,7 @@ export const staticSourceData: SourceDataItem[] = [ platinumPrivateContext: [FeatureIds.Remote, FeatureIds.Private, FeatureIds.SearchableContent], }, accountContextOnly: true, + internalConnectorAvailable: true, }, { name: SOURCE_NAMES.GOOGLE_DRIVE, diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/sources_router.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/sources_router.test.tsx index 49c8ebbbebc08..c380c18b8c51b 100644 --- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/sources_router.test.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/sources_router.test.tsx @@ -34,7 +34,7 @@ describe('SourcesRouter', () => { }); it('renders sources routes', () => { - const TOTAL_ROUTES = 86; + const TOTAL_ROUTES = 87; const wrapper = shallow(); expect(wrapper.find(Switch)).toHaveLength(1); From c56c45c942ce81bb5082b115e368553ed8aff4fe Mon Sep 17 00:00:00 2001 From: Devon Thomson Date: Tue, 5 Apr 2022 11:47:58 -0400 Subject: [PATCH 05/47] Fix removal of blank string titles in lens and maps (#129404) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> --- x-pack/plugins/lens/public/embeddable/embeddable.tsx | 2 +- x-pack/plugins/maps/public/embeddable/map_embeddable.tsx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/x-pack/plugins/lens/public/embeddable/embeddable.tsx b/x-pack/plugins/lens/public/embeddable/embeddable.tsx index cf126721a7c91..77fcaedf75182 100644 --- a/x-pack/plugins/lens/public/embeddable/embeddable.tsx +++ b/x-pack/plugins/lens/public/embeddable/embeddable.tsx @@ -752,7 +752,7 @@ export class Embeddable this.logError('validation'); } - const title = input.hidePanelTitles ? '' : input.title || this.savedVis.title; + const title = input.hidePanelTitles ? '' : input.title ?? this.savedVis.title; const savedObjectId = (input as LensByReferenceInput).savedObjectId; this.updateOutput({ ...this.getOutput(), diff --git a/x-pack/plugins/maps/public/embeddable/map_embeddable.tsx b/x-pack/plugins/maps/public/embeddable/map_embeddable.tsx index 5485e6e7ce73e..d572734e816a9 100644 --- a/x-pack/plugins/maps/public/embeddable/map_embeddable.tsx +++ b/x-pack/plugins/maps/public/embeddable/map_embeddable.tsx @@ -192,7 +192,7 @@ export class MapEmbeddable ? this._savedMap.getAttributes().title : ''; const input = this.getInput(); - const title = input.hidePanelTitles ? '' : input.title || savedMapTitle; + const title = input.hidePanelTitles ? '' : input.title ?? savedMapTitle; const savedObjectId = 'savedObjectId' in input ? input.savedObjectId : undefined; this.updateOutput({ ...this.getOutput(), From 07cfac919242664ba4ec8fa58bdad8fbf7ddab15 Mon Sep 17 00:00:00 2001 From: Jack Date: Tue, 5 Apr 2022 11:51:40 -0400 Subject: [PATCH 06/47] [8.2] [Session view] Only return default value when process is undefined (#129429) --- .../detail_panel_process_tab/index.test.tsx | 4 +- .../session_view_detail_panel/helpers.ts | 37 ++++++++----------- x-pack/plugins/session_view/public/types.ts | 6 +-- 3 files changed, 21 insertions(+), 26 deletions(-) diff --git a/x-pack/plugins/session_view/public/components/detail_panel_process_tab/index.test.tsx b/x-pack/plugins/session_view/public/components/detail_panel_process_tab/index.test.tsx index 46dc5696e88d2..0a514e178b4b5 100644 --- a/x-pack/plugins/session_view/public/components/detail_panel_process_tab/index.test.tsx +++ b/x-pack/plugins/session_view/public/components/detail_panel_process_tab/index.test.tsx @@ -76,14 +76,14 @@ describe('DetailPanelProcessTab component', () => { expect(renderResult.queryByText(TEST_PROCESS_DETAIL.id)).toBeVisible(); expect(renderResult.queryByText(TEST_PROCESS_DETAIL.start)).toBeVisible(); expect(renderResult.queryByText(TEST_PROCESS_DETAIL.end)).toBeVisible(); - expect(renderResult.queryByText(TEST_PROCESS_DETAIL.exit_code)).toBeVisible(); + expect(renderResult.queryByText(TEST_PROCESS_DETAIL.exit_code!)).toBeVisible(); expect(renderResult.queryByText(TEST_PROCESS_DETAIL.userName)).toBeVisible(); expect(renderResult.queryByText(`['vi', 'test.txt']`)).toBeVisible(); expect(renderResult.queryAllByText('test-executable-cmd')).toHaveLength(3); expect(renderResult.queryByText('(fork)')).toBeVisible(); expect(renderResult.queryByText('(exec)')).toBeVisible(); expect(renderResult.queryByText('(end)')).toBeVisible(); - expect(renderResult.queryByText(TEST_PROCESS_DETAIL.pid)).toBeVisible(); + expect(renderResult.queryByText(TEST_PROCESS_DETAIL.pid!)).toBeVisible(); // Process tab accordions rendered correctly // TODO: revert back when we have jump to leaders button working diff --git a/x-pack/plugins/session_view/public/components/session_view_detail_panel/helpers.ts b/x-pack/plugins/session_view/public/components/session_view_detail_panel/helpers.ts index 8ee751cfcbeee..05fa1a68b69c9 100644 --- a/x-pack/plugins/session_view/public/components/session_view_detail_panel/helpers.ts +++ b/x-pack/plugins/session_view/public/components/session_view_detail_panel/helpers.ts @@ -14,12 +14,10 @@ const DEFAULT_PROCESS_DATA = { name: '', start: '', end: '', - exit_code: -1, userName: '', groupName: '', working_directory: '', args: [], - pid: -1, entryMetaType: '', entryMetaSourceIp: '', executable: '', @@ -31,7 +29,6 @@ const getDetailPanelProcessLeader = (leader: ProcessFields | undefined) => ({ start: leader?.start ?? DEFAULT_PROCESS_DATA.start, working_directory: leader?.working_directory ?? DEFAULT_PROCESS_DATA.working_directory, args: leader?.args ?? DEFAULT_PROCESS_DATA.args, - pid: leader?.pid ?? DEFAULT_PROCESS_DATA.pid, executable: leader?.executable ?? DEFAULT_PROCESS_DATA.executable, id: leader?.entity_id ?? DEFAULT_PROCESS_DATA.id, entryMetaType: leader?.entry_meta?.type ?? DEFAULT_PROCESS_DATA.entryMetaType, @@ -41,24 +38,22 @@ const getDetailPanelProcessLeader = (leader: ProcessFields | undefined) => ({ }); export const getDetailPanelProcess = (process: Process | undefined) => { - const processData = { - id: DEFAULT_PROCESS_DATA.id, - start: DEFAULT_PROCESS_DATA.start, - end: DEFAULT_PROCESS_DATA.end, - exit_code: DEFAULT_PROCESS_DATA.exit_code, - userName: DEFAULT_PROCESS_DATA.userName, - groupName: DEFAULT_PROCESS_DATA.groupName, - args: DEFAULT_PROCESS_DATA.args, - executable: [], - working_directory: DEFAULT_PROCESS_DATA.working_directory, - pid: DEFAULT_PROCESS_DATA.pid, - entryLeader: DEFAULT_PROCESS_DATA, - sessionLeader: DEFAULT_PROCESS_DATA, - groupLeader: DEFAULT_PROCESS_DATA, - parent: DEFAULT_PROCESS_DATA, - } as DetailPanelProcess; + const processData = {} as DetailPanelProcess; if (!process) { - return processData; + return { + id: DEFAULT_PROCESS_DATA.id, + start: DEFAULT_PROCESS_DATA.start, + end: DEFAULT_PROCESS_DATA.end, + userName: DEFAULT_PROCESS_DATA.userName, + groupName: DEFAULT_PROCESS_DATA.groupName, + args: DEFAULT_PROCESS_DATA.args, + executable: [], + working_directory: DEFAULT_PROCESS_DATA.working_directory, + entryLeader: DEFAULT_PROCESS_DATA, + sessionLeader: DEFAULT_PROCESS_DATA, + groupLeader: DEFAULT_PROCESS_DATA, + parent: DEFAULT_PROCESS_DATA, + }; } processData.id = process.id; @@ -75,7 +70,7 @@ export const getDetailPanelProcess = (process: Process | undefined) => { processData.groupName = event.group?.name ?? ''; } if (!processData.pid) { - processData.pid = event.process?.pid ?? -1; + processData.pid = event.process?.pid; } if (!processData.working_directory) { processData.working_directory = event.process?.working_directory ?? ''; diff --git a/x-pack/plugins/session_view/public/types.ts b/x-pack/plugins/session_view/public/types.ts index ae450bb0c213e..043d3788ca258 100644 --- a/x-pack/plugins/session_view/public/types.ts +++ b/x-pack/plugins/session_view/public/types.ts @@ -38,14 +38,14 @@ export interface DetailPanelProcess { id: string; start: string; end: string; - exit_code: number; + exit_code?: number; userName: string; groupName: string; args: string[]; executable: string[][]; working_directory: string; tty?: Teletype; - pid: number; + pid?: number; entryLeader: DetailPanelProcessLeader; sessionLeader: DetailPanelProcessLeader; groupLeader: DetailPanelProcessLeader; @@ -63,7 +63,7 @@ export interface DetailPanelProcessLeader { working_directory: string; tty?: Teletype; args: string[]; - pid: number; + pid?: number; entryMetaType: string; entryMetaSourceIp: string; executable: string; From 1b683cdd28fb02b2c2407b51a36636a0cb6f43c0 Mon Sep 17 00:00:00 2001 From: Kaarina Tungseth Date: Tue, 5 Apr 2022 10:55:07 -0500 Subject: [PATCH 07/47] [DOCS] Adds the TSVB to Lens docs (#129129) * [DOCS] Adds the TSVB to Lens docs * Review comments Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> --- docs/user/dashboard/dashboard.asciidoc | 2 +- .../make-dashboards-interactive.asciidoc | 2 +- docs/user/dashboard/tsvb.asciidoc | 22 ++++++++++++++++++- docs/user/dashboard/vega.asciidoc | 2 +- 4 files changed, 24 insertions(+), 4 deletions(-) diff --git a/docs/user/dashboard/dashboard.asciidoc b/docs/user/dashboard/dashboard.asciidoc index 364a7d9e53ddd..b63bbdc75e9f9 100644 --- a/docs/user/dashboard/dashboard.asciidoc +++ b/docs/user/dashboard/dashboard.asciidoc @@ -87,7 +87,7 @@ To create panels from the dashboard toolbar, use one of the following options: * *Create visualization* — Opens the drag-and-drop editor, which is the recommended way to create visualization panels. -* *All types* — Opens the menu for all of the editors and panel types. +* *Select type* — Opens the menu for all of the editors and panel types. To create panels from the *Visualize Library*: diff --git a/docs/user/dashboard/make-dashboards-interactive.asciidoc b/docs/user/dashboard/make-dashboards-interactive.asciidoc index 2c6fff7157b92..2cb750afbe7d5 100644 --- a/docs/user/dashboard/make-dashboards-interactive.asciidoc +++ b/docs/user/dashboard/make-dashboards-interactive.asciidoc @@ -44,7 +44,7 @@ image::images/dashboard-controls.png[] To create *Controls* panels: -. On the dashboard, click *All types*, then select *Controls*. +. On the dashboard, click *Select type*, then select *Controls*. . Select the control panel type from the dropdown, then click *Add*. diff --git a/docs/user/dashboard/tsvb.asciidoc b/docs/user/dashboard/tsvb.asciidoc index 56e3606c18b72..07bb653af9750 100644 --- a/docs/user/dashboard/tsvb.asciidoc +++ b/docs/user/dashboard/tsvb.asciidoc @@ -35,7 +35,7 @@ When you use only {data-sources}, you are able to: IMPORTANT: Creating *TSVB* visualizations with an {es} index string is deprecated and will be removed in a future release. By default, you create *TSVB* visualizations with only {data-sources}. To use an {es} index string, contact your administrator, or go to <> and set `metrics:allowStringIndices` to `true`. -. On the dashboard, click *All types*, then select *TSVB*. +. On the dashboard, click *Select type*, then select *TSVB*. . In *TSVB*, click *Panel options*, then specify the *Data* settings. @@ -132,6 +132,26 @@ To change this behavior, click *Panel options*, then specify a URL in the *Item The *Markdown* visualization supports Markdown with Handlebar (mustache) syntax to insert dynamic data, and supports custom CSS. +[float] +[[edit-visualizations-in-lens]] +==== Edit visualizations in Lens + +Open and edit your Time Series *TSVB* visualizations in *Lens*, which is the drag-and-drop visualization editor that provides you with additional visualization types, reference lines, and more. + +To get started, click *Edit visualization in Lens* in the toolbar. + +For more information, check out <>. + +[float] +[[view-data-and-requests-tsvb]] +==== View the visualization data requests + +View the requests that collect the visualization data. + +. In the toolbar, click *Inspect*. + +. From the *Request* dropdown, select the series you want to view. + [float] [[save-the-tsvb-panel]] ==== Save and add the panel diff --git a/docs/user/dashboard/vega.asciidoc b/docs/user/dashboard/vega.asciidoc index fd2055a085c5e..9c58b9d0ecf49 100644 --- a/docs/user/dashboard/vega.asciidoc +++ b/docs/user/dashboard/vega.asciidoc @@ -53,7 +53,7 @@ Before starting, add the eCommerce sample data that you'll use in your spec, the Open *Vega-Lite* and change the time range. -. On the dashboard, click *All types*, then select *Custom visualization*. +. On the dashboard, click *Select type*, then select *Custom visualization*. + A pre-populated line chart displays the total number of documents. From 2fd67721e58d295cf27a55aa0eef230889ebcd0a Mon Sep 17 00:00:00 2001 From: Jiawei Wu <74562234+JiaweiWu@users.noreply.github.com> Date: Tue, 5 Apr 2022 09:20:18 -0700 Subject: [PATCH 08/47] [RAM} Add refine search prompt to rule execution log (#128982) * Refine search prompt * Add refine prompt to error log table Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> --- .../components/rule_error_log.test.tsx | 40 +++++++++++++ .../components/rule_error_log.tsx | 5 ++ .../components/rule_event_log_list.test.tsx | 40 +++++++++++++ .../components/rule_event_log_list.tsx | 5 ++ .../rule_details/refine_search_prompt.tsx | 58 +++++++++++++++++++ 5 files changed, 148 insertions(+) create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/refine_search_prompt.tsx diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.test.tsx index e37f9abf67de3..ab390f82d022e 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.test.tsx @@ -12,6 +12,7 @@ import { useKibana } from '../../../../common/lib/kibana'; import { EuiSuperDatePicker } from '@elastic/eui'; import { Rule } from '../../../../types'; +import { RefineSearchPrompt } from '../refine_search_prompt'; import { RuleErrorLog } from './rule_error_log'; const useKibanaMock = useKibana as jest.Mocked; @@ -309,4 +310,43 @@ describe('rule_error_log', () => { nowMock.mockRestore(); }); + + it('does not show the refine search prompt normally', async () => { + const wrapper = mountWithIntl( + + ); + + await act(async () => { + await nextTick(); + wrapper.update(); + }); + + expect(wrapper.find(RefineSearchPrompt).text()).toBeFalsy(); + }); + + it('shows the refine search prompt when our queries return too much data', async () => { + loadExecutionLogAggregationsMock.mockResolvedValue({ + ...mockLogResponse, + totalErrors: 1000, + }); + + const wrapper = mountWithIntl( + + ); + + await act(async () => { + await nextTick(); + wrapper.update(); + }); + + expect(wrapper.find(RefineSearchPrompt).text()).toEqual( + 'These are the first 1000 matching your search, refine your search to see others. Back to top.' + ); + }); }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.tsx index e47c65ff4e3e9..6eb6c732665e3 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.tsx @@ -22,6 +22,7 @@ import { } from '@elastic/eui'; import { useKibana } from '../../../../common/lib/kibana'; +import { RefineSearchPrompt } from '../refine_search_prompt'; import { LoadExecutionLogAggregationsProps } from '../../../lib/rule_api'; import { Rule } from '../../../../types'; import { IExecutionErrors } from '../../../../../../alerting/common'; @@ -256,6 +257,10 @@ export const RuleErrorLog = (props: RuleErrorLogProps) => { } }} /> + ); }; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.test.tsx index 008e19bcb99bf..364afd22586e4 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.test.tsx @@ -14,6 +14,7 @@ import { useKibana } from '../../../../common/lib/kibana'; import { EuiSuperDatePicker, EuiDataGrid } from '@elastic/eui'; import { RuleEventLogListStatusFilter } from './rule_event_log_list_status_filter'; import { RuleEventLogList } from './rule_event_log_list'; +import { RefineSearchPrompt } from '../refine_search_prompt'; import { RULE_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS } from '../../../constants'; import { Rule } from '../../../../types'; @@ -501,4 +502,43 @@ describe('rule_event_log_list', () => { ) ).toEqual([...RULE_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS, 'num_active_alerts']); }); + + it('does not show the refine search prompt normally', async () => { + const wrapper = mountWithIntl( + + ); + + await act(async () => { + await nextTick(); + wrapper.update(); + }); + + expect(wrapper.find(RefineSearchPrompt).text()).toBeFalsy(); + }); + + it('shows the refine search prompt when our queries return too much data', async () => { + loadExecutionLogAggregationsMock.mockResolvedValue({ + ...mockLogResponse, + total: 1000, + }); + + const wrapper = mountWithIntl( + + ); + + await act(async () => { + await nextTick(); + wrapper.update(); + }); + + expect(wrapper.find(RefineSearchPrompt).text()).toEqual( + 'These are the first 1000 matching your search, refine your search to see others. Back to top.' + ); + }); }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.tsx index cc3bb0b20a203..852ad9e7c8024 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.tsx @@ -25,6 +25,7 @@ import { RULE_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS } from '../../../constan import { RuleEventLogListStatusFilter } from './rule_event_log_list_status_filter'; import { RuleEventLogListCellRenderer, ColumnId } from './rule_event_log_list_cell_renderer'; +import { RefineSearchPrompt } from '../refine_search_prompt'; import { LoadExecutionLogAggregationsProps } from '../../../lib/rule_api'; import { Rule } from '../../../../types'; import { @@ -459,6 +460,10 @@ export const RuleEventLogList = (props: RuleEventLogListProps) => { sorting={sortingProps} pagination={paginationProps} /> + ); }; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/refine_search_prompt.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/refine_search_prompt.tsx new file mode 100644 index 0000000000000..2dba47ecdc168 --- /dev/null +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/refine_search_prompt.tsx @@ -0,0 +1,58 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React, { useMemo } from 'react'; +import { EuiLink, EuiText, useEuiTheme } from '@elastic/eui'; +import { FormattedMessage } from '@kbn/i18n-react'; + +interface RefineSearchFooterProps { + documentSize: number; + visibleDocumentSize?: number; + backToTopAnchor: string; +} + +const DEFAULT_VISIBLE_THRESHOLD = 500; + +export const RefineSearchPrompt = (props: RefineSearchFooterProps) => { + const { + documentSize = 0, + visibleDocumentSize = DEFAULT_VISIBLE_THRESHOLD, + backToTopAnchor, + } = props; + + const { euiTheme } = useEuiTheme(); + + const textStyles = useMemo( + () => ({ + backgroundColor: euiTheme.colors.lightestShade, + padding: `${euiTheme.size.m} ${euiTheme.size.base}`, + marginTop: `${euiTheme.size.xs}`, + }), + [euiTheme] + ); + + if (documentSize < visibleDocumentSize) { + return null; + } + + return ( + + +   + + + + + ); +}; From fc33bb614c38e54bccc07d2d07e01b5c8d1aa039 Mon Sep 17 00:00:00 2001 From: Jiawei Wu <74562234+JiaweiWu@users.noreply.github.com> Date: Tue, 5 Apr 2022 09:21:44 -0700 Subject: [PATCH 09/47] Fix flaky rule details E2E test (#129230) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> --- .../apps/triggers_actions_ui/details.ts | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts index 3813a8686826e..4069f2f64c027 100644 --- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts +++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts @@ -327,8 +327,10 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { const toastTitle = await pageObjects.common.closeToast(); expect(toastTitle).to.eql(`Updated '${updatedRuleName}'`); - const headingText = await pageObjects.ruleDetailsUI.getHeadingText(); - expect(headingText.includes(updatedRuleName)).to.be(true); + await retry.tryForTime(30 * 1000, async () => { + const headingText = await pageObjects.ruleDetailsUI.getHeadingText(); + expect(headingText.includes(updatedRuleName)).to.be(true); + }); }); it('should reset rule when canceling an edit', async () => { From 730245e6de023bceb2d4ce11e35088845dd9236a Mon Sep 17 00:00:00 2001 From: Jonathan Budzenski Date: Tue, 5 Apr 2022 11:28:55 -0500 Subject: [PATCH 10/47] [build] Update artifact checksums to sha512, properly format file (#129485) * [build] Update artifact checksums to sha512, properly format file This updates the checksum algorithm from sha1 to sha512 to be consistent with the checksums shared on our downloads page. It also formats the file to include the file name after the checksum so we can perform validation via the `shasum` cli. * basename * formatting --- src/dev/build/tasks/write_sha_sums_task.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/dev/build/tasks/write_sha_sums_task.ts b/src/dev/build/tasks/write_sha_sums_task.ts index 918847854389e..92d72f1370f48 100644 --- a/src/dev/build/tasks/write_sha_sums_task.ts +++ b/src/dev/build/tasks/write_sha_sums_task.ts @@ -6,6 +6,7 @@ * Side Public License, v 1. */ +import path from 'path'; import globby from 'globby'; import { getFileHash, write, GlobalTask } from '../lib'; @@ -21,7 +22,10 @@ export const WriteShaSums: GlobalTask = { }); for (const artifact of artifacts) { - await write(`${artifact}.sha1.txt`, await getFileHash(artifact, 'sha1')); + await write( + `${artifact}.sha512.txt`, + `${await getFileHash(artifact, 'sha512')} ${path.basename(artifact)}` + ); } }, }; From 1c0ba2ffae8e749c417b5d42da0d38f154bd3a29 Mon Sep 17 00:00:00 2001 From: Andrew Goldstein Date: Tue, 5 Apr 2022 11:14:00 -0600 Subject: [PATCH 11/47] [Security Solution] fixes: Timeline's pinned events tab displays a subset of pinned events for some timelines when re-opened (#128852) ## [Security Solution] fixes: Timeline's pinned events tab displays a subset of pinned events for some timelines when re-opened This PR implements a fix for https://github.com/elastic/kibana/issues/128851 where Timeline's pinned events tab displays a subset of pinned events for some timelines when re-opened. The pinned events tab displays the full set of pinned events when the timeline is created. But if more than 20 events are pinned, only 20 pinned events are displayed when the timeline is closed and later re-opened. - At creation time, each pinned event id is (correctly) stored in a separate saved object that references the timeline saved object - The pinned event ids associated with timelines created before the fix (still) exist in the saved object repository - When a timeline is re-opened, the `getAllPinnedEventsByTimelineId` function uses the Saved Object service's [`find`](https://github.com/elastic/kibana/blob/06ac35eab3a5b51994a2a8d097dd1e5be4b4ef5f/src/core/server/saved_objects/service/lib/repository.ts#L908) function, defined (outside of the Security Solution) in `src/core/server/saved_objects/service/lib/repository.ts`: ```ts async find( options: SavedObjectsFindOptions ): Promise> { const { search, // ... perPage = FIND_DEFAULT_PER_PAGE, ``` The `perPage` parameter in the [`find`](https://github.com/elastic/kibana/blob/06ac35eab3a5b51994a2a8d097dd1e5be4b4ef5f/src/core/server/saved_objects/service/lib/repository.ts#L908) function above defaults to `20` via the `FIND_DEFAULT_PER_PAGE` constant. To fix this issue, the default `perPage` option is overridden to retrieve the full set of pinned events when a timeline is re-opened. ### Testing 1. Create a new timeline with an arbitrary query, e.g. `_id : *` 2. Pin 22 individual events **Expected result** - The `Pinned` tab displays `22` events 3. Give the timeline a name, e.g. `This has 22 events` to save it 4. Click the `+` button and choose `Create new timeline` in the popover to create a new, empty timeline 5. Once again, click the `+` button and choose `Open Timeline...` from the popover 6. In the `Open` dialog, choose the timeline you previously created **Expected result** - The `Pinned` tab displays `22` events --- .../saved_object/pinned_events/index.test.ts | 43 +++++++++++++++++++ .../saved_object/pinned_events/index.ts | 3 ++ 2 files changed, 46 insertions(+) create mode 100644 x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.test.ts diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.test.ts new file mode 100644 index 0000000000000..4e77aeb474757 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.test.ts @@ -0,0 +1,43 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { FrameworkRequest } from '../../../framework'; + +import { getAllPinnedEventsByTimelineId, PINNED_EVENTS_PER_PAGE } from '.'; + +describe('pinned events', () => { + let mockFindSavedObject: jest.Mock; + let mockRequest: FrameworkRequest; + + beforeEach(() => { + jest.clearAllMocks(); + + mockFindSavedObject = jest.fn().mockResolvedValue({ saved_objects: [], total: 0 }); + mockRequest = { + user: { + username: 'username', + }, + context: { + core: { + savedObjects: { + client: { + find: mockFindSavedObject, + }, + }, + }, + }, + } as unknown as FrameworkRequest; + }); + + describe('getAllPinnedEventsByTimelineId', () => { + it(`overrides the saved object service's FIND_DEFAULT_PER_PAGE default for the perPage option`, async () => { + await getAllPinnedEventsByTimelineId(mockRequest, 'test'); + + expect(mockFindSavedObject.mock.calls[0][0].perPage).toEqual(PINNED_EVENTS_PER_PAGE); + }); + }); +}); diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.ts index 260531e1106bf..f413c39306bb5 100644 --- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.ts +++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/pinned_events/index.ts @@ -104,6 +104,8 @@ export const getPinnedEvent = async ( return getSavedPinnedEvent(request, pinnedEventId); }; +export const PINNED_EVENTS_PER_PAGE = 10000; // overrides the saved object client's FIND_DEFAULT_PER_PAGE (20) + export const getAllPinnedEventsByTimelineId = async ( request: FrameworkRequest, timelineId: string @@ -111,6 +113,7 @@ export const getAllPinnedEventsByTimelineId = async ( const options: SavedObjectsFindOptions = { type: pinnedEventSavedObjectType, hasReference: { type: timelineSavedObjectType, id: timelineId }, + perPage: PINNED_EVENTS_PER_PAGE, }; return getAllSavedPinnedEvents(request, options); }; From e5b8807fde05f5a40ed6b4ff64c5814e4c7d246b Mon Sep 17 00:00:00 2001 From: Rickyanto Ang Date: Tue, 5 Apr 2022 10:37:40 -0700 Subject: [PATCH 12/47] [Session View] Update/fix for process.end field on Details panel (#129417) * Update/fix for process.end field on Details panel * removed previous logic and added it as function on ProcessImpl as per PR comment --- .../session_view/public/components/process_tree/hooks.ts | 8 ++++++++ .../components/session_view_detail_panel/helpers.ts | 6 +++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/x-pack/plugins/session_view/public/components/process_tree/hooks.ts b/x-pack/plugins/session_view/public/components/process_tree/hooks.ts index cb881220918b7..4898ea0ec442c 100644 --- a/x-pack/plugins/session_view/public/components/process_tree/hooks.ts +++ b/x-pack/plugins/session_view/public/components/process_tree/hooks.ts @@ -134,6 +134,14 @@ export class ProcessImpl implements Process { return ''; } + getEndTime() { + const endEvent = this.filterEventsByAction(this.events, EventAction.end); + if (endEvent.length === 0) { + return ''; + } + return endEvent[endEvent.length - 1]['@timestamp']; + } + // isUserEntered is a best guess at which processes were initiated by a real person // In most situations a user entered command in a shell such as bash, will cause bash // to fork, create a new process group, and exec the command (e.g ls). If the session diff --git a/x-pack/plugins/session_view/public/components/session_view_detail_panel/helpers.ts b/x-pack/plugins/session_view/public/components/session_view_detail_panel/helpers.ts index 05fa1a68b69c9..a96330a35b084 100644 --- a/x-pack/plugins/session_view/public/components/session_view_detail_panel/helpers.ts +++ b/x-pack/plugins/session_view/public/components/session_view_detail_panel/helpers.ts @@ -6,6 +6,7 @@ */ import { EventAction, Process, ProcessFields } from '../../../common/types/process_tree'; import { DetailPanelProcess, EuiTabProps } from '../../types'; +import { ProcessImpl } from '../process_tree/hooks'; const FILTER_FORKS_EXECS = [EventAction.fork, EventAction.exec]; @@ -56,9 +57,10 @@ export const getDetailPanelProcess = (process: Process | undefined) => { }; } + const endProcesses = new ProcessImpl(process.id); + processData.id = process.id; processData.start = process.events[0]?.['@timestamp'] ?? ''; - processData.end = process.events[process.events.length - 1]?.['@timestamp'] ?? ''; processData.args = []; processData.executable = []; @@ -92,8 +94,10 @@ export const getDetailPanelProcess = (process: Process | undefined) => { if (event.process?.exit_code !== undefined) { processData.exit_code = event.process.exit_code; } + endProcesses.addEvent(event); }); + processData.end = endProcesses.getEndTime() as string; processData.entryLeader = getDetailPanelProcessLeader(process.events[0]?.process?.entry_leader); processData.sessionLeader = getDetailPanelProcessLeader( process.events[0]?.process?.session_leader From bc413c6e7fa213cd3285a0116efe600b7c2e237e Mon Sep 17 00:00:00 2001 From: Garrett Spong Date: Tue, 5 Apr 2022 11:54:53 -0600 Subject: [PATCH 13/47] [Security Solution][Detections] Rule Execution Log Feedback and Fixes (#129003) ## Summary Addresses feedback and fixes identified in https://github.com/elastic/kibana/pull/126215 Feedback addressed includes: * Adds route validation via io-ts decode and schema tests * Fixed styling of max execution events error by wrapping text (https://github.com/elastic/kibana/issues/129321) * Fixed types within `view alerts for execution` action onClick * Caps auto-refresh minimum to `1min` (https://github.com/elastic/kibana/issues/129332) * Adds cardinality aggs to initial `execution_uuid` query to properly report total counts when filtering by status * Disabled `View Alerts from Execution` action as current UX was too cumbersome with erasing users existing filters --- Additional follow-ups for another PR: - [ ] UI Unit tests - [ ] Finalize API Integration tests for gap remediation events - [ ] Persist table state (DatePicker/StatusFilter/SortField/SortOrder/Pagination) when navigating to other tabs on the same page - [ ] Update global DatePicker to daterange of execution for `view alerts for execution` action (and clear all other filters) - [ ] Support `disabled rule` platform error https://github.com/elastic/kibana/pull/126215#discussion_r834364979 - [ ] Verify StatusFilter issue https://github.com/elastic/kibana/pull/126215#issuecomment-1080976155 --- ### Checklist Delete any items that are not applicable to this PR. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/)) - [X] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server)) --- .../schemas/common/rule_monitoring.ts | 13 ++ .../get_rule_execution_events_schema.test.ts | 117 ++++++++++++++++++ .../get_rule_execution_events_schema.ts | 90 ++++++++++++-- .../common/components/utility_bar/styles.tsx | 6 +- .../utility_bar/utility_bar_text.tsx | 11 +- .../containers/detection_engine/rules/api.ts | 4 +- .../rules/use_rule_execution_events.tsx | 20 +-- .../execution_log_table.test.tsx.snap | 27 +--- .../execution_log_search_bar.test.tsx | 9 +- .../execution_log_search_bar.tsx | 7 ++ .../execution_log_table.test.tsx | 1 + .../execution_log_table.tsx | 67 ++++++---- .../execution_log_table/translations.ts | 14 +++ .../routes/__mocks__/request_responses.ts | 6 +- .../rules/get_rule_execution_events_route.ts | 14 +-- .../client_for_routes/client_interface.ts | 9 +- .../event_log/event_log_reader.ts | 32 ++--- .../index.test.ts | 6 +- .../get_execution_event_aggregation/index.ts | 14 ++- .../get_execution_event_aggregation/types.ts | 3 + 20 files changed, 356 insertions(+), 114 deletions(-) create mode 100644 x-pack/plugins/security_solution/common/detection_engine/schemas/request/get_rule_execution_events_schema.test.ts diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/rule_monitoring.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/rule_monitoring.ts index 19369ca32f415..f73e60487a4a8 100644 --- a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/rule_monitoring.ts +++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/rule_monitoring.ts @@ -53,6 +53,8 @@ export enum RuleExecutionStatus { export const ruleExecutionStatus = enumeration('RuleExecutionStatus', RuleExecutionStatus); +export type RuleExecutionStatusType = t.TypeOf; + export const ruleExecutionStatusOrder = PositiveInteger; export type RuleExecutionStatusOrder = t.TypeOf; @@ -134,3 +136,14 @@ export const aggregateRuleExecutionEvent = t.type({ }); export type AggregateRuleExecutionEvent = t.TypeOf; + +export const executionLogTableSortColumns = t.keyof({ + timestamp: IsoDateString, + duration_ms: t.number, + gap_duration_ms: t.number, + indexing_duration_ms: t.number, + search_duration_ms: t.number, + schedule_delay_ms: t.number, +}); + +export type ExecutionLogTableSortColumns = t.TypeOf; diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/get_rule_execution_events_schema.test.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/get_rule_execution_events_schema.test.ts new file mode 100644 index 0000000000000..05a3c6123c256 --- /dev/null +++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/get_rule_execution_events_schema.test.ts @@ -0,0 +1,117 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { pipe } from 'fp-ts/lib/pipeable'; +import { left } from 'fp-ts/lib/Either'; +import { foldLeftRight, getPaths } from '@kbn/securitysolution-io-ts-utils'; +import { + DefaultSortField, + DefaultSortOrder, + DefaultStatusFiltersStringArray, +} from './get_rule_execution_events_schema'; + +describe('get_rule_execution_events_schema', () => { + describe('DefaultStatusFiltersStringArray', () => { + test('it should validate a single ruleExecutionStatus', () => { + const payload = 'succeeded'; + const decoded = DefaultStatusFiltersStringArray.decode(payload); + const message = pipe(decoded, foldLeftRight); + + expect(getPaths(left(message.errors))).toEqual([]); + expect(message.schema).toEqual([payload]); + }); + test('it should validate an array of ruleExecutionStatus joined by "\'"', () => { + const payload = ['succeeded', 'failed']; + const decoded = DefaultStatusFiltersStringArray.decode(payload.join(',')); + const message = pipe(decoded, foldLeftRight); + + expect(getPaths(left(message.errors))).toEqual([]); + expect(message.schema).toEqual(payload); + }); + + test('it should not validate an invalid ruleExecutionStatus', () => { + const payload = ['value 1', 5].join(','); + const decoded = DefaultStatusFiltersStringArray.decode(payload); + const message = pipe(decoded, foldLeftRight); + + expect(getPaths(left(message.errors))).toEqual([ + 'Invalid value "value 1" supplied to "DefaultStatusFiltersStringArray"', + 'Invalid value "5" supplied to "DefaultStatusFiltersStringArray"', + ]); + expect(message.schema).toEqual({}); + }); + + test('it should return a default array entry', () => { + const payload = null; + const decoded = DefaultStatusFiltersStringArray.decode(payload); + const message = pipe(decoded, foldLeftRight); + + expect(getPaths(left(message.errors))).toEqual([]); + expect(message.schema).toEqual([]); + }); + }); + describe('DefaultSortField', () => { + test('it should validate a valid sort field', () => { + const payload = 'duration_ms'; + const decoded = DefaultSortField.decode(payload); + const message = pipe(decoded, foldLeftRight); + + expect(getPaths(left(message.errors))).toEqual([]); + expect(message.schema).toEqual(payload); + }); + + test('it should not validate an invalid sort field', () => { + const payload = 'es_search_duration_ms'; + const decoded = DefaultSortField.decode(payload); + const message = pipe(decoded, foldLeftRight); + + expect(getPaths(left(message.errors))).toEqual([ + 'Invalid value "es_search_duration_ms" supplied to "DefaultSortField"', + ]); + expect(message.schema).toEqual({}); + }); + + test('it should return the default sort field "timestamp"', () => { + const payload = null; + const decoded = DefaultSortField.decode(payload); + const message = pipe(decoded, foldLeftRight); + + expect(getPaths(left(message.errors))).toEqual([]); + expect(message.schema).toEqual('timestamp'); + }); + }); + describe('DefaultSortOrder', () => { + test('it should validate a valid sort order', () => { + const payload = 'asc'; + const decoded = DefaultSortOrder.decode(payload); + const message = pipe(decoded, foldLeftRight); + + expect(getPaths(left(message.errors))).toEqual([]); + expect(message.schema).toEqual(payload); + }); + + test('it should not validate an invalid sort order', () => { + const payload = 'behind_you'; + const decoded = DefaultSortOrder.decode(payload); + const message = pipe(decoded, foldLeftRight); + + expect(getPaths(left(message.errors))).toEqual([ + 'Invalid value "behind_you" supplied to "DefaultSortOrder"', + ]); + expect(message.schema).toEqual({}); + }); + + test('it should return the default sort order "desc"', () => { + const payload = null; + const decoded = DefaultSortOrder.decode(payload); + const message = pipe(decoded, foldLeftRight); + + expect(getPaths(left(message.errors))).toEqual([]); + expect(message.schema).toEqual('desc'); + }); + }); +}); diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/get_rule_execution_events_schema.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/get_rule_execution_events_schema.ts index 798e9abb5adec..4a2f483ec733a 100644 --- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/get_rule_execution_events_schema.ts +++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/get_rule_execution_events_schema.ts @@ -7,24 +7,96 @@ import * as t from 'io-ts'; -import { sortFieldOrUndefined, sortOrderOrUndefined } from '../common'; +import { DefaultPerPage, DefaultPage } from '@kbn/securitysolution-io-ts-alerting-types'; +import { DefaultEmptyString, IsoDateString } from '@kbn/securitysolution-io-ts-types'; +import { Either } from 'fp-ts/lib/Either'; +import { + ExecutionLogTableSortColumns, + executionLogTableSortColumns, + ruleExecutionStatus, + RuleExecutionStatusType, +} from '../common'; + +/** + * Types the DefaultStatusFiltersStringArray as: + * - If undefined, then a default array will be set + * - If an array is sent in, then the array will be validated to ensure all elements are a ruleExecutionStatus + */ +export const DefaultStatusFiltersStringArray = new t.Type< + RuleExecutionStatusType[], + RuleExecutionStatusType[], + unknown +>( + 'DefaultStatusFiltersStringArray', + t.array(ruleExecutionStatus).is, + (input, context): Either => { + if (input == null) { + return t.success([]); + } else if (typeof input === 'string') { + return t.array(ruleExecutionStatus).validate(input.split(','), context); + } else { + return t.array(ruleExecutionStatus).validate(input, context); + } + }, + t.identity +); + +/** + * Types the DefaultSortField as: + * - If undefined, then a default sort field of 'timestamp' will be set + * - If a string is sent in, then the string will be validated to ensure it is as valid sortFields + */ +export const DefaultSortField = new t.Type< + ExecutionLogTableSortColumns, + ExecutionLogTableSortColumns, + unknown +>( + 'DefaultSortField', + executionLogTableSortColumns.is, + (input, context): Either => + input == null ? t.success('timestamp') : executionLogTableSortColumns.validate(input, context), + t.identity +); + +const sortOrder = t.keyof({ asc: null, desc: null }); +type SortOrder = t.TypeOf; + +/** + * Types the DefaultSortOrder as: + * - If undefined, then a default sort order of 'desc' will be set + * - If a string is sent in, then the string will be validated to ensure it is as valid sortOrder + */ +export const DefaultSortOrder = new t.Type( + 'DefaultSortOrder', + sortOrder.is, + (input, context): Either => + input == null ? t.success('desc') : sortOrder.validate(input, context), + t.identity +); + +/** + * Route Request Params + */ export const GetRuleExecutionEventsRequestParams = t.exact( t.type({ ruleId: t.string, }) ); +/** + * Route Query Params (as constructed from the above codecs) + */ export const GetRuleExecutionEventsQueryParams = t.exact( t.type({ - start: t.string, - end: t.string, - query_text: t.union([t.string, t.undefined]), - status_filters: t.union([t.string, t.undefined]), - per_page: t.union([t.string, t.undefined]), - page: t.union([t.string, t.undefined]), - sort_field: sortFieldOrUndefined, - sort_order: sortOrderOrUndefined, + start: IsoDateString, + end: IsoDateString, + query_text: DefaultEmptyString, // default to "" if not sent in during decode + status_filters: DefaultStatusFiltersStringArray, // defaults to empty array if not sent in during decode + per_page: DefaultPerPage, // defaults to "20" if not sent in during decode + page: DefaultPage, // defaults to "1" if not sent in during decode + sort_field: DefaultSortField, // defaults to "desc" if not sent in during decode + sort_order: DefaultSortOrder, // defaults to "timestamp" if not sent in during decode }) ); diff --git a/x-pack/plugins/security_solution/public/common/components/utility_bar/styles.tsx b/x-pack/plugins/security_solution/public/common/components/utility_bar/styles.tsx index 72fbb32cf1efb..c8a71cc43a283 100644 --- a/x-pack/plugins/security_solution/public/common/components/utility_bar/styles.tsx +++ b/x-pack/plugins/security_solution/public/common/components/utility_bar/styles.tsx @@ -114,12 +114,12 @@ BarGroup.displayName = 'BarGroup'; export const BarText = styled.p.attrs({ className: 'siemUtilityBar__text', -})` - ${({ theme }) => css` +})<{ shouldWrap: boolean }>` + ${({ shouldWrap, theme }) => css` color: ${theme.eui.euiTextSubduedColor}; font-size: ${theme.eui.euiFontSizeXS}; line-height: ${theme.eui.euiLineHeight}; - white-space: nowrap; + white-space: ${shouldWrap ? 'normal' : 'nowrap'}; `} `; BarText.displayName = 'BarText'; diff --git a/x-pack/plugins/security_solution/public/common/components/utility_bar/utility_bar_text.tsx b/x-pack/plugins/security_solution/public/common/components/utility_bar/utility_bar_text.tsx index c0be3cbfbe202..c9e9d0a0b8769 100644 --- a/x-pack/plugins/security_solution/public/common/components/utility_bar/utility_bar_text.tsx +++ b/x-pack/plugins/security_solution/public/common/components/utility_bar/utility_bar_text.tsx @@ -12,10 +12,15 @@ import { BarText } from './styles'; export interface UtilityBarTextProps { children: string | JSX.Element; dataTestSubj?: string; + shouldWrap?: boolean; } -export const UtilityBarText = React.memo(({ children, dataTestSubj }) => ( - {children} -)); +export const UtilityBarText = React.memo( + ({ children, dataTestSubj, shouldWrap = false }) => ( + + {children} + + ) +); UtilityBarText.displayName = 'UtilityBarText'; diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts index 5006d6390f45a..a75558b8a8a1a 100644 --- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts +++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts @@ -360,8 +360,8 @@ export const fetchRuleExecutionEvents = async ({ query: { start: startDate?.utc().toISOString(), end: endDate?.utc().toISOString(), - query_text: queryText?.trim(), - status_filters: statusFilters?.trim(), + query_text: queryText, + status_filters: statusFilters, page, per_page: perPage, sort_field: sortField, diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_execution_events.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_execution_events.tsx index 33b965cab979f..f2e72858cf392 100644 --- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_execution_events.tsx +++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_execution_events.tsx @@ -39,15 +39,17 @@ export const useRuleExecutionEvents = ({ return useQuery( [ 'ruleExecutionEvents', - ruleId, - start, - end, - queryText, - statusFilters, - page, - perPage, - sortField, - sortOrder, + { + ruleId, + start, + end, + queryText, + statusFilters, + page, + perPage, + sortField, + sortOrder, + }, ], async ({ signal }) => { return fetchRuleExecutionEvents({ diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/__snapshots__/execution_log_table.test.tsx.snap b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/__snapshots__/execution_log_table.test.tsx.snap index 7a24272b9e1e6..62621e2a2e0dc 100644 --- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/__snapshots__/execution_log_table.test.tsx.snap +++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/__snapshots__/execution_log_table.test.tsx.snap @@ -14,13 +14,7 @@ exports[`ExecutionLogTable snapshots renders correctly against snapshot 1`] = ` onlyShowFilters={true} /> - + - + { describe('snapshots', () => { diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_search_bar.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_search_bar.tsx index 2c0b18828dcbc..b8c2d82ab324e 100644 --- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_search_bar.tsx +++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_search_bar.tsx @@ -59,6 +59,13 @@ interface ExecutionLogTableSearchProps { onStatusFilterChange: (statusFilters: string[]) => void; } +/** + * SearchBar + StatusFilters component to be used with the Rule Execution Log table + * NOTE: This component is currently not shown in the UI as custom search queries + * are not yet fully supported by the Rule Execution Log aggregation API since + * certain queries could result in missing data or inclusion of wrong events. + * Please see this comment for history/details: https://github.com/elastic/kibana/pull/127339/files#r825240516 + */ export const ExecutionLogSearchBar = React.memo( ({ onlyShowFilters, onSearch, onStatusFilterChange }) => { const [isPopoverOpen, setIsPopoverOpen] = useState(false); diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_table.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_table.test.tsx index 8a3bb8621f7ae..81619d01934ba 100644 --- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_table.test.tsx +++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_table.test.tsx @@ -85,6 +85,7 @@ jest.mock('../../../../../../common/lib/kibana', () => { const mockUseSourcererDataView = useSourcererDataView as jest.Mock; mockUseSourcererDataView.mockReturnValue({ + indexPattern: { fields: [] }, missingPatterns: {}, selectedPatterns: {}, scopeSelectedPatterns: {}, diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_table.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_table.tsx index 03ccd9ea5ee70..faf89afa91cd9 100644 --- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_table.tsx +++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/execution_log_table.tsx @@ -7,7 +7,6 @@ import { SortOrder } from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; import { DurationRange } from '@elastic/eui/src/components/date_picker/types'; -import { get } from 'lodash'; import styled from 'styled-components'; import React, { useCallback, useMemo, useState } from 'react'; import { @@ -48,6 +47,10 @@ const UtilitySwitch = styled(EuiSwitch)` margin-left: 17px; `; +const DatePickerEuiFlexItem = styled(EuiFlexItem)` + max-width: 582px; +`; + interface ExecutionLogTableProps { ruleId: string; selectAlertsTab: () => void; @@ -74,19 +77,19 @@ const ExecutionLogTableComponent: React.FC = ({ // Searchbar/Filter/Settings state const [queryText, setQueryText] = useState(''); - const [statusFilters, setStatusFilters] = useState(''); + const [statusFilters, setStatusFilters] = useState(undefined); const [showMetricColumns, setShowMetricColumns] = useState( storage.get(RULE_DETAILS_EXECUTION_LOG_TABLE_SHOW_METRIC_COLUMNS_STORAGE_KEY) ?? false ); // Pagination state - const [pageIndex, setPageIndex] = useState(0); + const [pageIndex, setPageIndex] = useState(1); const [pageSize, setPageSize] = useState(5); const [sortField, setSortField] = useState('timestamp'); const [sortDirection, setSortDirection] = useState('desc'); // Index for `add filter` action and toasts for errors const { indexPattern } = useSourcererDataView(SourcererScopeName.detections); - const { addError } = useAppToasts(); + const { addError, addSuccess } = useAppToasts(); // Table data state const { @@ -109,12 +112,17 @@ const ExecutionLogTableComponent: React.FC = ({ const items = events?.events ?? []; const maxEvents = events?.total ?? 0; + // Cache UUID field from data view as it can be expensive to iterate all data view fields + const uuidDataViewField = useMemo(() => { + return indexPattern.fields.find((f) => f.name === EXECUTION_UUID_FIELD_NAME); + }, [indexPattern]); + // Callbacks const onTableChangeCallback = useCallback(({ page = {}, sort = {} }) => { const { index, size } = page; const { field, direction } = sort; - setPageIndex(index); + setPageIndex(index + 1); setPageSize(size); setSortField(field); setSortDirection(direction); @@ -138,7 +146,8 @@ const ExecutionLogTableComponent: React.FC = ({ const onRefreshChangeCallback = useCallback((props: OnRefreshChangeProps) => { setIsPaused(props.isPaused); - setRefreshInterval(props.refreshInterval); + // Only support auto-refresh >= 1minute -- no current ability to limit within component + setRefreshInterval(props.refreshInterval > 60000 ? props.refreshInterval : 60000); }, []); const onRefreshCallback = useCallback( @@ -153,31 +162,37 @@ const ExecutionLogTableComponent: React.FC = ({ }, []); const onStatusFilterChangeCallback = useCallback((updatedStatusFilters: string[]) => { - setStatusFilters(updatedStatusFilters.sort().join(',')); + setStatusFilters( + updatedStatusFilters.length ? updatedStatusFilters.sort().join(',') : undefined + ); }, []); const onFilterByExecutionIdCallback = useCallback( - (executionId: string) => { - const field = indexPattern.fields.find((f) => f.name === EXECUTION_UUID_FIELD_NAME); - if (field != null) { + (executionId: string, executionStart: string) => { + if (uuidDataViewField != null) { const filter = buildFilter( indexPattern, - field, + uuidDataViewField, FILTERS.PHRASE, false, false, executionId, null ); + filterManager.removeAll(); filterManager.addFilters(filter); selectAlertsTab(); + addSuccess({ + title: i18n.ACTIONS_SEARCH_FILTERS_HAVE_BEEN_UPDATED_TITLE, + text: i18n.ACTIONS_SEARCH_FILTERS_HAVE_BEEN_UPDATED_DESCRIPTION, + }); } else { addError(i18n.ACTIONS_FIELD_NOT_FOUND_ERROR, { title: i18n.ACTIONS_FIELD_NOT_FOUND_ERROR_TITLE, }); } }, - [addError, filterManager, indexPattern, selectAlertsTab] + [addError, addSuccess, filterManager, indexPattern, selectAlertsTab, uuidDataViewField] ); const onShowMetricColumnsCallback = useCallback( @@ -191,7 +206,7 @@ const ExecutionLogTableComponent: React.FC = ({ // Memoized state const pagination = useMemo(() => { return { - pageIndex, + pageIndex: pageIndex - 1, pageSize, totalItemCount: maxEvents > MAX_EXECUTION_EVENTS_DISPLAYED ? MAX_EXECUTION_EVENTS_DISPLAYED : maxEvents, @@ -208,6 +223,8 @@ const ExecutionLogTableComponent: React.FC = ({ }; }, [sortDirection, sortField]); + // TODO: Re-add actions once alert count is displayed in table and UX is finalized + // @ts-expect-error unused constant const actions = useMemo( () => [ { @@ -222,10 +239,12 @@ const ExecutionLogTableComponent: React.FC = ({ description: i18n.COLUMN_ACTIONS_TOOLTIP, icon: 'filter', type: 'icon', - onClick: (value: object) => { - const executionId = get(value, 'execution_uuid'); - if (executionId) { - onFilterByExecutionIdCallback(executionId); + onClick: (executionEvent: AggregateRuleExecutionEvent) => { + if (executionEvent?.execution_uuid) { + onFilterByExecutionIdCallback( + executionEvent.execution_uuid, + executionEvent.timestamp + ); } }, 'data-test-subj': 'action-filter-by-execution-id', @@ -239,9 +258,9 @@ const ExecutionLogTableComponent: React.FC = ({ const executionLogColumns = useMemo( () => showMetricColumns - ? [...EXECUTION_LOG_COLUMNS, ...GET_EXECUTION_LOG_METRICS_COLUMNS(docLinks), ...actions] - : [...EXECUTION_LOG_COLUMNS, ...actions], - [actions, docLinks, showMetricColumns] + ? [...EXECUTION_LOG_COLUMNS, ...GET_EXECUTION_LOG_METRICS_COLUMNS(docLinks)] + : [...EXECUTION_LOG_COLUMNS], + [docLinks, showMetricColumns] ); return ( @@ -254,7 +273,7 @@ const ExecutionLogTableComponent: React.FC = ({ onlyShowFilters={true} /> - + = ({ recentlyUsedRanges={recentlyUsedRanges} width="full" /> - + @@ -282,8 +301,8 @@ const ExecutionLogTableComponent: React.FC = ({ {maxEvents > MAX_EXECUTION_EVENTS_DISPLAYED && ( - - + + {i18n.RULE_EXECUTION_LOG_SEARCH_LIMIT_EXCEEDED( maxEvents, diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/translations.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/translations.ts index 97ae8e42ebb61..d5d8d56664907 100644 --- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/translations.ts +++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/execution_log_table/translations.ts @@ -167,6 +167,20 @@ export const COLUMN_ACTIONS_TOOLTIP = i18n.translate( } ); +export const ACTIONS_SEARCH_FILTERS_HAVE_BEEN_UPDATED_TITLE = i18n.translate( + 'xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.actionSearchFiltersUpdatedTitle', + { + defaultMessage: 'Global search filters have been updated', + } +); + +export const ACTIONS_SEARCH_FILTERS_HAVE_BEEN_UPDATED_DESCRIPTION = i18n.translate( + 'xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.actionSearchFiltersUpdatedDescription', + { + defaultMessage: 'Search filters have been updated to show alerts from selected rule execution', + } +); + export const ACTIONS_FIELD_NOT_FOUND_ERROR_TITLE = i18n.translate( 'xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.actionFieldNotFoundErrorTitle', { diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_responses.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_responses.ts index 09e7dc543019f..94c4de459a2ea 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_responses.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_responses.ts @@ -244,10 +244,8 @@ export const getRuleExecutionEventsRequest = () => ruleId: '04128c15-0d1b-4716-a4c5-46997ac7f3bd', }, query: { - start: 'now-30', - end: 'now', - query_text: '', - status_filters: '', + start: '2022-03-31T22:02:01.622Z', + end: '2022-03-31T22:02:31.622Z', }, }); diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/get_rule_execution_events_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/get_rule_execution_events_route.ts index d74f1df329730..76088cd07b80e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/get_rule_execution_events_route.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/get_rule_execution_events_route.ts @@ -38,12 +38,12 @@ export const getRuleExecutionEventsRoute = (router: SecuritySolutionPluginRouter const { start, end, - query_text: queryText = '', - status_filters: statusFilters = '', + query_text: queryText, + status_filters: statusFilters, page, per_page: perPage, - sort_field: sortField = 'timestamp', - sort_order: sortOrder = 'desc', + sort_field: sortField, + sort_order: sortOrder, } = request.query; const siemResponse = buildSiemResponse(response); @@ -54,9 +54,9 @@ export const getRuleExecutionEventsRoute = (router: SecuritySolutionPluginRouter start, end, queryText, - statusFilters: statusFilters.length ? statusFilters.split(',') : [], - page: page != null ? parseInt(page, 10) : 0, - perPage: perPage != null ? parseInt(perPage, 10) : 10, + statusFilters, + page, + perPage, sortField, sortOrder, }); diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/client_for_routes/client_interface.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/client_for_routes/client_interface.ts index 541eaa827097d..8d0cae91f1987 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/client_for_routes/client_interface.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/client_for_routes/client_interface.ts @@ -5,8 +5,11 @@ * 2.0. */ +import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; import { + ExecutionLogTableSortColumns, RuleExecutionEvent, + RuleExecutionStatusType, RuleExecutionSummary, } from '../../../../../common/detection_engine/schemas/common'; import { GetAggregateRuleExecutionEventsResponse } from '../../../../../common/detection_engine/schemas/response'; @@ -16,11 +19,11 @@ export interface GetAggregateExecutionEventsArgs { start: string; end: string; queryText: string; - statusFilters: string[]; + statusFilters: RuleExecutionStatusType[]; page: number; perPage: number; - sortField: string; - sortOrder: string; + sortField: ExecutionLogTableSortColumns; + sortOrder: estypes.SortOrder; } /** diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/event_log_reader.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/event_log_reader.ts index 765defb803756..f2ee7fa7c3097 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/event_log_reader.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/event_log_reader.ts @@ -16,6 +16,7 @@ import { import { GetAggregateRuleExecutionEventsResponse } from '../../../../../common/detection_engine/schemas/response'; import { invariant } from '../../../../../common/utils/invariant'; import { withSecuritySpan } from '../../../../utils/with_security_span'; +import { GetAggregateExecutionEventsArgs } from '../client_for_routes/client_interface'; import { RULE_SAVED_OBJECT_TYPE, RULE_EXECUTION_LOG_PROVIDER, @@ -25,7 +26,10 @@ import { formatExecutionEventResponse, getExecutionEventAggregation, } from './get_execution_event_aggregation'; -import { ExecutionUuidAggResult } from './get_execution_event_aggregation/types'; +import { + EXECUTION_UUID_FIELD, + ExecutionUuidAggResult, +} from './get_execution_event_aggregation/types'; export interface IEventLogReader { getAggregateExecutionEvents( @@ -35,18 +39,6 @@ export interface IEventLogReader { getLastStatusChanges(args: GetLastStatusChangesArgs): Promise; } -export interface GetAggregateExecutionEventsArgs { - ruleId: string; - start: string; - end: string; - queryText: string; - statusFilters: string[]; - page: number; - perPage: number; - sortField: string; - sortOrder: string; -} - export interface GetLastStatusChangesArgs { ruleId: string; count: number; @@ -67,17 +59,22 @@ export const createEventLogReader = (eventLog: IEventLogClient): IEventLogReader // TODO: See: https://github.com/elastic/kibana/pull/127339/files#r825240516 // First fetch execution uuid's by status filter if provided let statusIds: string[] = []; + let totalExecutions: number | undefined; // If 0 or 3 statuses are selected we can search for all statuses and don't need this pre-filter by ID if (statusFilters.length > 0 && statusFilters.length < 3) { - // TODO: Add cardinality agg and pass as maxEvents in response const statusResults = await eventLog.aggregateEventsBySavedObjectIds(soType, soIds, { start, end, filter: `kibana.alert.rule.execution.status:(${statusFilters.join(' OR ')})`, aggs: { + totalExecutions: { + cardinality: { + field: EXECUTION_UUID_FIELD, + }, + }, filteredExecutionUUIDs: { terms: { - field: 'kibana.alert.rule.execution.uuid', + field: EXECUTION_UUID_FIELD, size: MAX_EXECUTION_EVENTS_DISPLAYED, }, }, @@ -86,6 +83,9 @@ export const createEventLogReader = (eventLog: IEventLogClient): IEventLogReader const filteredExecutionUUIDs = statusResults.aggregations ?.filteredExecutionUUIDs as ExecutionUuidAggResult; statusIds = filteredExecutionUUIDs?.buckets?.map((b) => b.key) ?? []; + totalExecutions = ( + statusResults.aggregations?.totalExecutions as estypes.AggregationsCardinalityAggregate + ).value; // Early return if no results based on status filter if (statusIds.length === 0) { return { @@ -111,7 +111,7 @@ export const createEventLogReader = (eventLog: IEventLogClient): IEventLogReader }), }); - return formatExecutionEventResponse(results); + return formatExecutionEventResponse(results, totalExecutions); }, async getLastStatusChanges(args) { const soType = RULE_SAVED_OBJECT_TYPE; diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/index.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/index.test.ts index d90d262688e86..baa4dd572ced0 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/index.test.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/index.test.ts @@ -40,11 +40,11 @@ describe('getExecutionEventAggregation', () => { expect(() => { getExecutionEventAggregation({ maxExecutions: 5, - page: -1, + page: 0, perPage: 10, sort: [{ timestamp: { order: 'asc' } }], }); - }).toThrowErrorMatchingInlineSnapshot(`"Invalid page field \\"-1\\" - must be greater than 0"`); + }).toThrowErrorMatchingInlineSnapshot(`"Invalid page field \\"0\\" - must be greater than 0"`); }); test('should throw error when given bad perPage field', () => { @@ -128,7 +128,7 @@ describe('getExecutionEventAggregation', () => { }, }, ], - from: 20, + from: 10, size: 10, gap_policy: 'insert_zeros', }, diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/index.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/index.ts index a66a2cccd538a..4b1bd1f185198 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/index.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/index.ts @@ -16,6 +16,7 @@ import { ExecutionEventAggregationOptions, ExecutionUuidAggResult, ExecutionUuidAggBucket, + EXECUTION_UUID_FIELD, } from './types'; // Base ECS fields @@ -31,7 +32,6 @@ const SCHEDULE_DELAY_FIELD = 'kibana.task.schedule_delay'; const ES_SEARCH_DURATION_FIELD = 'kibana.alert.rule.execution.metrics.es_search_duration_ms'; const TOTAL_ACTIONS_TRIGGERED_FIELD = 'kibana.alert.rule.execution.metrics.number_of_triggered_actions'; -const EXECUTION_UUID_FIELD = 'kibana.alert.rule.execution.uuid'; // TODO: To be added in https://github.com/elastic/kibana/pull/126210 // const TOTAL_ALERTS_CREATED: 'kibana.alert.rule.execution.metrics.total_alerts_created', // const TOTAL_ALERTS_DETECTED: 'kibana.alert.rule.execution.metrics.total_alerts_detected', @@ -76,7 +76,7 @@ export const getExecutionEventAggregation = ({ ); } - if (page < 0) { + if (page <= 0) { throw new BadRequestError(`Invalid page field "${page}" - must be greater than 0`); } @@ -114,8 +114,9 @@ export const getExecutionEventAggregation = ({ executionUuidSorted: { bucket_sort: { sort: formatSortForBucketSort(sort), - from: page * perPage, + from: (page - 1) * perPage, size: perPage, + // Must override gap_policy to not miss fields/docs, for details see: https://github.com/elastic/kibana/pull/127339/files#r825240516 gap_policy: 'insert_zeros', }, }, @@ -126,6 +127,7 @@ export const getExecutionEventAggregation = ({ actionOutcomes: { terms: { field: OUTCOME_FIELD, + // Size is 2 here as outcomes we're collating are `success` & `failed` size: 2, }, }, @@ -302,9 +304,11 @@ export const formatAggExecutionEventFromBucket = ( /** * Formats getAggregateExecutionEvents response from Elasticsearch response * @param results Elasticsearch response + * @param totalExecutions total number of executions to override from initial statusFilter query */ export const formatExecutionEventResponse = ( - results: AggregateEventsBySavedObjectResult + results: AggregateEventsBySavedObjectResult, + totalExecutions?: number ): GetAggregateRuleExecutionEventsResponse => { const { aggregations } = results; @@ -319,7 +323,7 @@ export const formatExecutionEventResponse = ( const buckets = (aggregations.executionUuid as ExecutionUuidAggResult).buckets; return { - total, + total: totalExecutions ? totalExecutions : total, events: buckets.map((b: ExecutionUuidAggBucket) => formatAggExecutionEventFromBucket(b)), }; }; diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/types.ts index bfe5f7d4e631b..f9846469181da 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/types.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/event_log/get_execution_event_aggregation/types.ts @@ -7,6 +7,9 @@ import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; +// Shared constants, consider moving to packages +export const EXECUTION_UUID_FIELD = 'kibana.alert.rule.execution.uuid'; + type AlertCounts = estypes.AggregationsMultiBucketAggregateBase & { buckets: { activeAlerts: estypes.AggregationsSingleBucketAggregateBase; From ec06440a2fbce3e46a43c531a99dc573a5572f21 Mon Sep 17 00:00:00 2001 From: Marshall Main <55718608+marshallmain@users.noreply.github.com> Date: Tue, 5 Apr 2022 11:57:24 -0700 Subject: [PATCH 14/47] [Security Solution][Alerts] Pass filters from threshold alerts to timeline (#129405) * No need to deserialize filters anymore * Fix bug with missing meta field in filters --- .../common/mock/mock_detection_alerts_aad.ts | 15 ++++++++- .../components/alerts_table/actions.test.tsx | 32 ++++++++++++++++++- .../components/alerts_table/actions.tsx | 19 ++++------- 3 files changed, 52 insertions(+), 14 deletions(-) diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts_aad.ts b/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts_aad.ts index 5417fc51c5433..598091da7efbd 100644 --- a/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts_aad.ts +++ b/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts_aad.ts @@ -48,7 +48,20 @@ export const mockAADEcsDataWithAlert: Ecs = { enabled: [true], false_positives: ['test-1'], parameters: { - filters: [], + filters: [ + { + meta: { + key: 'host.name', + negate: false, + params: '"{"query":"placeholder"}"', + type: 'phrase', + }, + query: { match_phrase: { 'host.name': 'placeholder' } }, + }, + { + query: { match_all: {} }, + }, + ], language: ['kuery'], query: ['user.id:1'], }, diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx index e75cfcd6befa9..2b54f9fe8504f 100644 --- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx +++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx @@ -547,7 +547,7 @@ describe('alert actions', () => { }); }); - test('Exceptions are included', async () => { + test('Exceptions and filters are included', async () => { mockGetExceptions.mockResolvedValue([getExceptionListItemSchemaMock()]); await sendAlertToTimelineAction({ createTimeline, @@ -584,6 +584,21 @@ describe('alert actions', () => { }, description: '_id: 1', filters: [ + { + meta: { + key: 'host.name', + negate: false, + params: '"{"query":"placeholder"}"', + type: 'phrase', + }, + query: { match_phrase: { 'host.name': 'placeholder' } }, + }, + { + // https://github.com/elastic/kibana/issues/126574 - if the provided filter has no `meta` field + // we expect an empty object to be inserted before calling `createTimeline` + meta: {}, + query: { match_all: {} }, + }, { meta: { alias: 'Exceptions', @@ -701,6 +716,21 @@ describe('alert actions', () => { ...defaultTimelineProps, timeline: { ...defaultTimelineProps.timeline, + filters: [ + { + meta: { + key: 'host.name', + negate: false, + params: '"{"query":"placeholder"}"', + type: 'phrase', + }, + query: { match_phrase: { 'host.name': 'placeholder' } }, + }, + { + meta: {}, + query: { match_all: {} }, + }, + ], dataProviders: [ { and: [], diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx index ac47032acc539..95042ac776875 100644 --- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx +++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx @@ -158,16 +158,6 @@ export const determineToAndFrom = ({ ecs }: { ecs: Ecs[] | Ecs }) => { return { to, from }; }; -const getFiltersFromRule = (filters: string[]): Filter[] => - filters.reduce((acc, filterString) => { - try { - const objFilter: Filter = JSON.parse(filterString); - return [...acc, objFilter]; - } catch (e) { - return acc; - } - }, [] as Filter[]); - const calculateFromTimeFallback = (thresholdData: Ecs, originalTime: moment.Moment) => { // relative time that the rule's time range starts at (e.g. now-1h) @@ -425,7 +415,12 @@ const createThresholdTimeline = async ( const alertDoc = formattedAlertData[0]; const params = getField(alertDoc, ALERT_RULE_PARAMETERS); - const filters = getFiltersFromRule(params.filters ?? alertDoc.signal?.rule?.filters) ?? []; + const filters: Filter[] = params.filters ?? alertDoc.signal?.rule?.filters; + // https://github.com/elastic/kibana/issues/126574 - if the provided filter has no `meta` field + // we expect an empty object to be inserted before calling `createTimeline` + const augmentedFilters = filters.map((filter) => { + return filter.meta != null ? filter : { ...filter, meta: {} }; + }); const language = params.language ?? alertDoc.signal?.rule?.language ?? 'kuery'; const query = params.query ?? alertDoc.signal?.rule?.query ?? ''; const indexNames = params.index ?? alertDoc.signal?.rule?.index ?? []; @@ -439,7 +434,7 @@ const createThresholdTimeline = async ( chunkSize: 10000, alias: 'Exceptions', }) ?? []; - const allFilters = (templateValues.filters ?? filters).concat(exceptionsFilter); + const allFilters = (templateValues.filters ?? augmentedFilters).concat(exceptionsFilter); return createTimeline({ from: thresholdFrom, From 420359bacdfb23651da3b44580a6c2f2c6507b50 Mon Sep 17 00:00:00 2001 From: Nicolas Chaulet Date: Tue, 5 Apr 2022 15:30:37 -0400 Subject: [PATCH 15/47] [Fleet] Encrypt ssl fields in logstash output (#129131) --- packages/kbn-doc-links/src/get_doc_links.ts | 1 + packages/kbn-doc-links/src/types.ts | 1 + .../fleet/common/types/models/output.ts | 1 + .../encryption_key_required_callout.tsx | 43 +++++++++++ .../edit_output_flyout/index.test.tsx | 20 +++++ .../components/edit_output_flyout/index.tsx | 10 +++ .../edit_output_flyout/use_output_form.tsx | 14 +++- x-pack/plugins/fleet/server/errors/index.ts | 2 +- x-pack/plugins/fleet/server/plugin.ts | 3 + .../fleet/server/routes/setup/handlers.ts | 10 ++- .../fleet/server/saved_objects/index.ts | 19 ++++- .../fleet/server/services/output.test.ts | 40 ++++++++++ .../plugins/fleet/server/services/output.ts | 73 ++++++++++++++----- 13 files changed, 216 insertions(+), 21 deletions(-) create mode 100644 x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/encryption_key_required_callout.tsx diff --git a/packages/kbn-doc-links/src/get_doc_links.ts b/packages/kbn-doc-links/src/get_doc_links.ts index 7d209035ab65a..7d58f177e0764 100644 --- a/packages/kbn-doc-links/src/get_doc_links.ts +++ b/packages/kbn-doc-links/src/get_doc_links.ts @@ -229,6 +229,7 @@ export const getDocLinks = ({ kibanaBranch }: GetDocLinkOptions): DocLinks => { kibana: { guide: `${KIBANA_DOCS}index.html`, autocompleteSuggestions: `${KIBANA_DOCS}kibana-concepts-analysts.html#autocomplete-suggestions`, + secureSavedObject: `${KIBANA_DOCS}xpack-security-secure-saved-objects.html`, xpackSecurity: `${KIBANA_DOCS}xpack-security.html`, }, upgradeAssistant: { diff --git a/packages/kbn-doc-links/src/types.ts b/packages/kbn-doc-links/src/types.ts index c2e485e1003e6..9a4ff1a58cf13 100644 --- a/packages/kbn-doc-links/src/types.ts +++ b/packages/kbn-doc-links/src/types.ts @@ -213,6 +213,7 @@ export interface DocLinks { readonly kibana: { readonly guide: string; readonly autocompleteSuggestions: string; + readonly secureSavedObject: string; readonly xpackSecurity: string; }; readonly upgradeAssistant: { diff --git a/x-pack/plugins/fleet/common/types/models/output.ts b/x-pack/plugins/fleet/common/types/models/output.ts index 1e22c88f64cb2..dbdde9cf34e5b 100644 --- a/x-pack/plugins/fleet/common/types/models/output.ts +++ b/x-pack/plugins/fleet/common/types/models/output.ts @@ -29,6 +29,7 @@ export interface NewOutput { export type OutputSOAttributes = NewOutput & { output_id?: string; + ssl?: string; // encrypted ssl field }; export type Output = NewOutput & { diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/encryption_key_required_callout.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/encryption_key_required_callout.tsx new file mode 100644 index 0000000000000..b4a85baa43b35 --- /dev/null +++ b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/encryption_key_required_callout.tsx @@ -0,0 +1,43 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { FormattedMessage } from '@kbn/i18n-react'; +import { EuiCallOut, EuiLink } from '@elastic/eui'; + +import { useStartServices } from '../../../../hooks'; + +export const EncryptionKeyRequiredCallout: React.FunctionComponent = () => { + const { docLinks } = useStartServices(); + return ( + + } + > + + + + ), + }} + /> + + ); +}; diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.test.tsx index 46bdc6d5b1785..c6d86a3fc4fbe 100644 --- a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.test.tsx +++ b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.test.tsx @@ -9,6 +9,7 @@ import React from 'react'; import type { Output } from '../../../../types'; import { createFleetTestRendererMock } from '../../../../../../mock'; +import { useFleetStatus } from '../../../../../../hooks/use_fleet_status'; import { EditOutputFlyout } from '.'; @@ -20,8 +21,11 @@ jest.mock('../../../../../../hooks/use_fleet_status', () => ({ FleetStatusProvider: (props: any) => { return props.children; }, + useFleetStatus: jest.fn().mockReturnValue({}), })); +const mockedUsedFleetStatus = useFleetStatus as jest.MockedFunction; + function renderFlyout(output?: Output) { const renderer = createFleetTestRendererMock(); @@ -66,4 +70,20 @@ describe('EditOutputFlyout', () => { expect(utils.queryByLabelText('Client SSL certificate')).not.toBeNull(); expect(utils.queryByLabelText('Server SSL certificate authorities')).not.toBeNull(); }); + + it('should show a callout in the flyout if the selected output is logstash and no encrypted key is set', async () => { + mockedUsedFleetStatus.mockReturnValue({ + missingRequirements: ['encrypted_saved_object_encryption_key_required'], + } as any); + const { utils } = renderFlyout({ + type: 'logstash', + name: 'logstash output', + id: 'output123', + is_default: false, + is_default_monitoring: false, + }); + + // Show logstash SSL inputs + expect(utils.getByText('Additional setup required')).not.toBeNull(); + }); }); diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.tsx index 2517d5c9e6f5c..72642e68d85c1 100644 --- a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.tsx +++ b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.tsx @@ -37,6 +37,7 @@ import { useBreadcrumbs, useStartServices } from '../../../../hooks'; import { YamlCodeEditorWithPlaceholder } from './yaml_code_editor_with_placeholder'; import { useOutputForm } from './use_output_form'; +import { EncryptionKeyRequiredCallout } from './encryption_key_required_callout'; export interface EditOutputFlyoutProps { output?: Output; @@ -60,6 +61,9 @@ export const EditOutputFlyout: React.FunctionComponent = const isLogstashOutput = inputs.typeInput.value === 'logstash'; const isESOutput = inputs.typeInput.value === 'elasticsearch'; + const showLogstashNeedEncryptedSavedObjectCallout = + isLogstashOutput && !form.hasEncryptedSavedObjectConfigured; + return ( @@ -160,6 +164,12 @@ export const EditOutputFlyout: React.FunctionComponent = )} /> + {showLogstashNeedEncryptedSavedObjectCallout && ( + <> + + + + )} {isLogstashOutput && ( <> diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/use_output_form.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/use_output_form.tsx index cd927923a4fe1..a27e9ad80ddfa 100644 --- a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/use_output_form.tsx +++ b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/use_output_form.tsx @@ -16,6 +16,7 @@ import { useSwitchInput, useStartServices, sendPutOutput, + useFleetStatus, } from '../../../../hooks'; import type { Output, PostOutputRequest } from '../../../../types'; import { useConfirmModal } from '../../hooks/use_confirm_modal'; @@ -32,6 +33,12 @@ import { import { confirmUpdate } from './confirm_update'; export function useOutputForm(onSucess: () => void, output?: Output) { + const fleetStatus = useFleetStatus(); + + const hasEncryptedSavedObjectConfigured = !fleetStatus.missingRequirements?.includes( + 'encrypted_saved_object_encryption_key_required' + ); + const [isLoading, setIsloading] = useState(false); const { notifications } = useStartServices(); const { confirm } = useConfirmModal(); @@ -234,6 +241,11 @@ export function useOutputForm(onSucess: () => void, output?: Output) { inputs, submit, isLoading, - isDisabled: isLoading || isPreconfigured || (output && !hasChanged), + hasEncryptedSavedObjectConfigured, + isDisabled: + isLoading || + isPreconfigured || + (output && !hasChanged) || + (isLogstash && !hasEncryptedSavedObjectConfigured), }; } diff --git a/x-pack/plugins/fleet/server/errors/index.ts b/x-pack/plugins/fleet/server/errors/index.ts index 41ebe9ef713f8..ca3209a58b2a5 100644 --- a/x-pack/plugins/fleet/server/errors/index.ts +++ b/x-pack/plugins/fleet/server/errors/index.ts @@ -51,7 +51,7 @@ export class HostedAgentPolicyRestrictionRelatedError extends IngestManagerError ); } } - +export class FleetEncryptedSavedObjectEncryptionKeyRequired extends IngestManagerError {} export class FleetSetupError extends IngestManagerError {} export class GenerateServiceTokenError extends IngestManagerError {} export class FleetUnauthorizedError extends IngestManagerError {} diff --git a/x-pack/plugins/fleet/server/plugin.ts b/x-pack/plugins/fleet/server/plugin.ts index 272e92fca6eae..b94c80be75c4b 100644 --- a/x-pack/plugins/fleet/server/plugin.ts +++ b/x-pack/plugins/fleet/server/plugin.ts @@ -7,6 +7,7 @@ import type { Observable } from 'rxjs'; import { BehaviorSubject } from 'rxjs'; +import { take } from 'rxjs/operators'; import { i18n } from '@kbn/i18n'; import type { @@ -416,6 +417,8 @@ export class FleetPlugin summary: 'Fleet is setting up', }); + await plugins.licensing.license$.pipe(take(1)).toPromise(); + await setupFleet( new SavedObjectsClient(core.savedObjects.createInternalRepository()), core.elasticsearch.client.asInternalUser diff --git a/x-pack/plugins/fleet/server/routes/setup/handlers.ts b/x-pack/plugins/fleet/server/routes/setup/handlers.ts index 60094c532b913..83c6a25f96b09 100644 --- a/x-pack/plugins/fleet/server/routes/setup/handlers.ts +++ b/x-pack/plugins/fleet/server/routes/setup/handlers.ts @@ -21,17 +21,25 @@ export const getFleetStatusHandler: FleetRequestHandler = async (context, reques context.core.elasticsearch.client.asInternalUser ); + let isReady = true; const missingRequirements: GetFleetStatusResponse['missing_requirements'] = []; + if (!isApiKeysEnabled) { + isReady = false; missingRequirements.push('api_keys'); } if (!isFleetServerSetup) { + isReady = false; missingRequirements.push('fleet_server'); } + if (!appContextService.getEncryptedSavedObjectsSetup()?.canEncrypt) { + missingRequirements.push('encrypted_saved_object_encryption_key_required'); + } + const body: GetFleetStatusResponse = { - isReady: missingRequirements.length === 0, + isReady, missing_requirements: missingRequirements, }; diff --git a/x-pack/plugins/fleet/server/saved_objects/index.ts b/x-pack/plugins/fleet/server/saved_objects/index.ts index 262795330deae..915d841dd287e 100644 --- a/x-pack/plugins/fleet/server/saved_objects/index.ts +++ b/x-pack/plugins/fleet/server/saved_objects/index.ts @@ -118,7 +118,7 @@ const getSavedObjectTypes = ( config: { type: 'flattened' }, config_yaml: { type: 'text' }, is_preconfigured: { type: 'boolean', index: false }, - ssl: { type: 'flattened', index: false }, + ssl: { type: 'binary' }, }, }, migrations: { @@ -310,5 +310,22 @@ export function registerSavedObjects( export function registerEncryptedSavedObjects( encryptedSavedObjects: EncryptedSavedObjectsPluginSetup ) { + encryptedSavedObjects.registerType({ + type: OUTPUT_SAVED_OBJECT_TYPE, + attributesToEncrypt: new Set([{ key: 'ssl', dangerouslyExposeValue: true }]), + attributesToExcludeFromAAD: new Set([ + 'output_id', + 'name', + 'type', + 'is_default', + 'is_default_monitoring', + 'hosts', + 'ca_sha256', + 'ca_trusted_fingerprint', + 'config', + 'config_yaml', + 'is_preconfigured', + ]), + }); // Encrypted saved objects } diff --git a/x-pack/plugins/fleet/server/services/output.test.ts b/x-pack/plugins/fleet/server/services/output.test.ts index 211abecbc4395..0a7d5393a63e1 100644 --- a/x-pack/plugins/fleet/server/services/output.test.ts +++ b/x-pack/plugins/fleet/server/services/output.test.ts @@ -161,6 +161,8 @@ function getMockedSoClient( }; }); + mockedAppContextService.getInternalUserSOClient.mockReturnValue(soClient); + return soClient; } @@ -169,6 +171,8 @@ describe('Output Service', () => { mockedAgentPolicyService.list.mockClear(); mockedAgentPolicyService.hasAPMIntegration.mockClear(); mockedAgentPolicyService.removeOutputFromAll.mockReset(); + mockedAppContextService.getInternalUserSOClient.mockReset(); + mockedAppContextService.getEncryptedSavedObjectsSetup.mockReset(); }); describe('create', () => { it('work with a predefined id', async () => { @@ -321,6 +325,42 @@ describe('Output Service', () => { { is_default: false } ); }); + + // With logstash output + it('should throw if encryptedSavedObject is not configured', async () => { + const soClient = getMockedSoClient({}); + + await expect( + outputService.create( + soClient, + { + is_default: false, + is_default_monitoring: false, + name: 'Test', + type: 'logstash', + }, + { id: 'output-test' } + ) + ).rejects.toThrow(`Logstash output needs encrypted saved object api key to be set`); + }); + + it('should work if encryptedSavedObject is configured', async () => { + const soClient = getMockedSoClient({}); + mockedAppContextService.getEncryptedSavedObjectsSetup.mockReturnValue({ + canEncrypt: true, + } as any); + await outputService.create( + soClient, + { + is_default: false, + is_default_monitoring: false, + name: 'Test', + type: 'logstash', + }, + { id: 'output-test' } + ); + expect(soClient.create).toBeCalled(); + }); }); describe('update', () => { diff --git a/x-pack/plugins/fleet/server/services/output.ts b/x-pack/plugins/fleet/server/services/output.ts index 3d2f5de0339ca..4aecbd6e03349 100644 --- a/x-pack/plugins/fleet/server/services/output.ts +++ b/x-pack/plugins/fleet/server/services/output.ts @@ -5,8 +5,9 @@ * 2.0. */ -import type { SavedObject, SavedObjectsClientContract } from 'src/core/server'; +import type { KibanaRequest, SavedObject, SavedObjectsClientContract } from 'src/core/server'; import uuid from 'uuid/v5'; +import { omit } from 'lodash'; import type { NewOutput, Output, OutputSOAttributes } from '../types'; import { @@ -16,7 +17,11 @@ import { AGENT_POLICY_SAVED_OBJECT_TYPE, } from '../constants'; import { decodeCloudId, normalizeHostsForAgents, SO_SEARCH_LIMIT, outputType } from '../../common'; -import { OutputUnauthorizedError, OutputInvalidError } from '../errors'; +import { + OutputUnauthorizedError, + OutputInvalidError, + FleetEncryptedSavedObjectEncryptionKeyRequired, +} from '../errors'; import { agentPolicyService } from './agent_policy'; import { appContextService } from './app_context'; @@ -27,6 +32,21 @@ const SAVED_OBJECT_TYPE = OUTPUT_SAVED_OBJECT_TYPE; const DEFAULT_ES_HOSTS = ['http://localhost:9200']; +const fakeRequest = { + headers: {}, + getBasePath: () => '', + path: '/', + route: { settings: {} }, + url: { + href: '/', + }, + raw: { + req: { + url: '/', + }, + }, +} as unknown as KibanaRequest; + // differentiate function isUUID(val: string) { return ( @@ -45,10 +65,12 @@ export function outputIdToUuid(id: string) { } function outputSavedObjectToOutput(so: SavedObject) { - const { output_id: outputId, ...atributes } = so.attributes; + const { output_id: outputId, ssl, ...atributes } = so.attributes; + return { id: outputId ?? so.id, ...atributes, + ...(ssl ? { ssl: JSON.parse(ssl as string) } : {}), }; } @@ -86,8 +108,12 @@ async function validateLogstashOutputNotUsedInAPMPolicy( } class OutputService { + private get encryptedSoClient() { + return appContextService.getInternalUserSOClient(fakeRequest); + } + private async _getDefaultDataOutputsSO(soClient: SavedObjectsClientContract) { - return await soClient.find({ + return await this.encryptedSoClient.find({ type: OUTPUT_SAVED_OBJECT_TYPE, searchFields: ['is_default'], search: 'true', @@ -95,7 +121,7 @@ class OutputService { } private async _getDefaultMonitoringOutputsSO(soClient: SavedObjectsClientContract) { - return await soClient.find({ + return await this.encryptedSoClient.find({ type: OUTPUT_SAVED_OBJECT_TYPE, searchFields: ['is_default_monitoring'], search: 'true', @@ -164,10 +190,15 @@ class OutputService { output: NewOutput, options?: { id?: string; fromPreconfiguration?: boolean; overwrite?: boolean } ): Promise { - const data: OutputSOAttributes = { ...output }; + const data: OutputSOAttributes = { ...omit(output, 'ssl') }; if (output.type === outputType.Logstash) { await validateLogstashOutputNotUsedInAPMPolicy(soClient, undefined, data.is_default); + if (!appContextService.getEncryptedSavedObjectsSetup()?.canEncrypt) { + throw new FleetEncryptedSavedObjectEncryptionKeyRequired( + 'Logstash output needs encrypted saved object api key to be set' + ); + } } // ensure only default output exists @@ -202,15 +233,16 @@ class OutputService { data.output_id = options?.id; } - const newSo = await soClient.create(SAVED_OBJECT_TYPE, data, { + if (output.ssl) { + data.ssl = JSON.stringify(output.ssl); + } + + const newSo = await this.encryptedSoClient.create(SAVED_OBJECT_TYPE, data, { overwrite: options?.overwrite || options?.fromPreconfiguration, id: options?.id ? outputIdToUuid(options.id) : undefined, }); - return { - id: options?.id ?? newSo.id, - ...newSo.attributes, - }; + return outputSavedObjectToOutput(newSo); } public async bulkGet( @@ -218,7 +250,7 @@ class OutputService { ids: string[], { ignoreNotFound = false } = { ignoreNotFound: true } ) { - const res = await soClient.bulkGet( + const res = await this.encryptedSoClient.bulkGet( ids.map((id) => ({ id: outputIdToUuid(id), type: SAVED_OBJECT_TYPE })) ); @@ -237,7 +269,7 @@ class OutputService { } public async list(soClient: SavedObjectsClientContract) { - const outputs = await soClient.find({ + const outputs = await this.encryptedSoClient.find({ type: SAVED_OBJECT_TYPE, page: 1, perPage: SO_SEARCH_LIMIT, @@ -254,7 +286,10 @@ class OutputService { } public async get(soClient: SavedObjectsClientContract, id: string): Promise { - const outputSO = await soClient.get(SAVED_OBJECT_TYPE, outputIdToUuid(id)); + const outputSO = await this.encryptedSoClient.get( + SAVED_OBJECT_TYPE, + outputIdToUuid(id) + ); if (outputSO.error) { throw new Error(outputSO.error.message); @@ -292,7 +327,7 @@ class OutputService { id ); - return soClient.delete(SAVED_OBJECT_TYPE, outputIdToUuid(id)); + return this.encryptedSoClient.delete(SAVED_OBJECT_TYPE, outputIdToUuid(id)); } public async update( @@ -311,7 +346,7 @@ class OutputService { ); } - const updateData: Nullable> = { ...data }; + const updateData: Nullable> = { ...omit(data, 'ssl') }; const mergedType = data.type ?? originalOutput.type; const mergedIsDefault = data.is_default ?? originalOutput.is_default; @@ -331,6 +366,10 @@ class OutputService { } } + if (data.ssl) { + updateData.ssl = JSON.stringify(data.ssl); + } + // ensure only default output exists if (data.is_default) { const defaultDataOuputId = await this.getDefaultDataOutputId(soClient); @@ -359,7 +398,7 @@ class OutputService { if (mergedType === outputType.Elasticsearch && updateData.hosts) { updateData.hosts = updateData.hosts.map(normalizeHostsForAgents); } - const outputSO = await soClient.update>( + const outputSO = await this.encryptedSoClient.update>( SAVED_OBJECT_TYPE, outputIdToUuid(id), updateData From fc7e17862507c2b889587ab6ea12c1d913ea096b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Patryk=20Kopyci=C5=84ski?= Date: Tue, 5 Apr 2022 23:03:07 +0200 Subject: [PATCH 16/47] [Osquery] Fix missing privileges for loading prebuilt Packs (#129450) --- .../integration/all/add_integration.spec.ts | 82 ++++++++++--------- .../cypress/integration/all/alerts.spec.ts | 3 +- .../all/delete_all_ecs_mappings.spec.ts | 3 +- .../integration/all/live_query.spec.ts | 3 +- .../cypress/integration/all/metrics.spec.ts | 3 +- .../cypress/integration/all/packs.spec.ts | 18 +++- .../integration/all/saved_queries.spec.ts | 3 +- .../osquery/cypress/tasks/integrations.ts | 3 + .../public/common/hooks/use_error_toast.tsx | 6 +- .../osquery/scripts/roles_users/index.ts | 2 + .../platform_engineer/delete_user.sh | 11 +++ .../roles_users/platform_engineer/get_role.sh | 11 +++ .../roles_users/platform_engineer/index.ts | 11 +++ .../platform_engineer/post_role.sh | 14 ++++ .../platform_engineer/post_user.sh | 14 ++++ .../roles_users/platform_engineer/role.json | 20 +++++ .../roles_users/platform_engineer/user.json | 6 ++ .../roles_users/soc_manager/delete_user.sh | 11 +++ .../roles_users/soc_manager/get_role.sh | 11 +++ .../scripts/roles_users/soc_manager/index.ts | 11 +++ .../roles_users/soc_manager/post_role.sh | 14 ++++ .../roles_users/soc_manager/post_user.sh | 14 ++++ .../scripts/roles_users/soc_manager/role.json | 29 +++++++ .../scripts/roles_users/soc_manager/user.json | 6 ++ x-pack/plugins/osquery/server/plugin.ts | 8 +- .../routes/asset/update_assets_route.ts | 2 +- .../test/osquery_cypress/artifact_manager.ts | 2 +- 27 files changed, 270 insertions(+), 51 deletions(-) create mode 100755 x-pack/plugins/osquery/scripts/roles_users/platform_engineer/delete_user.sh create mode 100755 x-pack/plugins/osquery/scripts/roles_users/platform_engineer/get_role.sh create mode 100644 x-pack/plugins/osquery/scripts/roles_users/platform_engineer/index.ts create mode 100755 x-pack/plugins/osquery/scripts/roles_users/platform_engineer/post_role.sh create mode 100755 x-pack/plugins/osquery/scripts/roles_users/platform_engineer/post_user.sh create mode 100644 x-pack/plugins/osquery/scripts/roles_users/platform_engineer/role.json create mode 100644 x-pack/plugins/osquery/scripts/roles_users/platform_engineer/user.json create mode 100755 x-pack/plugins/osquery/scripts/roles_users/soc_manager/delete_user.sh create mode 100755 x-pack/plugins/osquery/scripts/roles_users/soc_manager/get_role.sh create mode 100644 x-pack/plugins/osquery/scripts/roles_users/soc_manager/index.ts create mode 100755 x-pack/plugins/osquery/scripts/roles_users/soc_manager/post_role.sh create mode 100755 x-pack/plugins/osquery/scripts/roles_users/soc_manager/post_user.sh create mode 100644 x-pack/plugins/osquery/scripts/roles_users/soc_manager/role.json create mode 100644 x-pack/plugins/osquery/scripts/roles_users/soc_manager/user.json diff --git a/x-pack/plugins/osquery/cypress/integration/all/add_integration.spec.ts b/x-pack/plugins/osquery/cypress/integration/all/add_integration.spec.ts index 11a904526d314..673ff082a606c 100644 --- a/x-pack/plugins/osquery/cypress/integration/all/add_integration.spec.ts +++ b/x-pack/plugins/osquery/cypress/integration/all/add_integration.spec.ts @@ -5,8 +5,8 @@ * 2.0. */ -import { FLEET_AGENT_POLICIES } from '../../tasks/navigation'; -import { addIntegration } from '../../tasks/integrations'; +import { FLEET_AGENT_POLICIES, OLD_OSQUERY_MANAGER } from '../../tasks/navigation'; +import { addIntegration, closeModalIfVisible } from '../../tasks/integrations'; import { login } from '../../tasks/login'; // import { findAndClickButton, findFormFieldByRowsLabelAndType } from '../../tasks/live_query'; @@ -15,9 +15,11 @@ import { DEFAULT_POLICY } from '../../screens/fleet'; describe('ALL - Add Integration', () => { const integration = 'Osquery Manager'; + before(() => { runKbnArchiverScript(ArchiverMethod.LOAD, 'saved_query'); }); + beforeEach(() => { login(); }); @@ -26,43 +28,45 @@ describe('ALL - Add Integration', () => { runKbnArchiverScript(ArchiverMethod.UNLOAD, 'saved_query'); }); - // it('should add the old integration and be able to upgrade it', () => { - // cy.visit(OLD_OSQUERY_MANAGER); - // cy.contains(integration).click(); - // addIntegration(); - // cy.contains('osquery_manager-1'); - // cy.visit('app/fleet/policies'); - // cy.contains(/^Default Fleet Server policy$/).click(); - // cy.contains('Actions').click(); - // cy.contains('View policy').click(); - // cy.contains('name: osquery_manager-1'); - // cy.contains(`version: 0.7.4`); - // cy.contains('Close').click(); - // cy.contains(/^Osquery Manager$/).click(); - // cy.contains(/^Settings$/).click(); - // cy.contains(/^Upgrade to latest version$/).click(); - // closeModalIfVisible(); - // cy.contains('Updated Osquery Manager and upgraded policies', { timeout: 60000 }); - // cy.visit('app/fleet/policies'); - // cy.contains(/^Default Fleet Server policy$/).click(); - // cy.contains('Actions').click(); - // cy.contains('View policy').click(); - // cy.contains('name: osquery_manager-1'); - // cy.contains(`version: 0.8.1`); - // cy.visit('app/integrations/detail/osquery_manager/policies'); - // cy.contains('Loading integration policies').should('exist'); - // cy.contains('Loading integration policies').should('not.exist'); - // cy.getBySel('integrationPolicyTable') - // .get('.euiTableRow', { timeout: 60000 }) - // .should('have.lengthOf.above', 0); - // cy.get('.euiTableCellContent').get('.euiPopover__anchor').get(`[aria-label="Open"]`).click(); - // cy.contains(/^Delete integration$/).click(); - // closeModalIfVisible(); - // cy.contains(/^Settings$/).click(); - // cy.contains(/^Uninstall Osquery Manager$/).click(); - // closeModalIfVisible(); - // cy.contains(/^Successfully uninstalled Osquery Manager$/); - // }); + it('should add the old integration and be able to upgrade it', () => { + const oldVersion = '0.7.4'; + + cy.visit(OLD_OSQUERY_MANAGER); + cy.contains(integration).click(); + addIntegration(); + cy.contains('osquery_manager-1'); + cy.visit('app/fleet/policies'); + cy.contains(/^Default Fleet Server policy$/).click(); + cy.contains('Actions').click(); + cy.contains('View policy').click(); + cy.contains('name: osquery_manager-1'); + cy.contains(`version: ${oldVersion}`); + cy.contains('Close').click(); + cy.contains(/^Osquery Manager$/).click(); + cy.contains(/^Settings$/).click(); + cy.contains(/^Upgrade to latest version$/).click(); + closeModalIfVisible(); + cy.contains('Updated Osquery Manager and upgraded policies', { timeout: 60000 }); + cy.visit('app/fleet/policies'); + cy.contains(/^Default Fleet Server policy$/).click(); + cy.contains('Actions').click(); + cy.contains('View policy').click(); + cy.contains('name: osquery_manager-1'); + cy.contains(`version: ${oldVersion}`).should('not.exist'); + cy.visit('app/integrations/detail/osquery_manager/policies'); + cy.contains('Loading integration policies').should('exist'); + cy.contains('Loading integration policies').should('not.exist'); + cy.getBySel('integrationPolicyTable') + .get('.euiTableRow', { timeout: 60000 }) + .should('have.lengthOf.above', 0); + cy.get('.euiTableCellContent').get('.euiPopover__anchor').get(`[aria-label="Open"]`).click(); + cy.contains(/^Delete integration$/).click(); + closeModalIfVisible(); + cy.contains(/^Settings$/).click(); + cy.contains(/^Uninstall Osquery Manager$/).click(); + closeModalIfVisible(); + cy.contains(/^Successfully uninstalled Osquery Manager$/); + }); it('add integration', () => { cy.visit(FLEET_AGENT_POLICIES); diff --git a/x-pack/plugins/osquery/cypress/integration/all/alerts.spec.ts b/x-pack/plugins/osquery/cypress/integration/all/alerts.spec.ts index 90492838bd2c3..7813a94e2bfe3 100644 --- a/x-pack/plugins/osquery/cypress/integration/all/alerts.spec.ts +++ b/x-pack/plugins/osquery/cypress/integration/all/alerts.spec.ts @@ -18,6 +18,7 @@ import { preparePack } from '../../tasks/packs'; import { closeModalIfVisible } from '../../tasks/integrations'; import { navigateTo } from '../../tasks/navigation'; import { RESULTS_TABLE, RESULTS_TABLE_BUTTON } from '../../screens/live_query'; +import { ROLES } from '../../test'; describe('Alert Event Details', () => { before(() => { @@ -25,7 +26,7 @@ describe('Alert Event Details', () => { runKbnArchiverScript(ArchiverMethod.LOAD, 'rule'); }); beforeEach(() => { - login(); + login(ROLES.soc_manager); }); after(() => { diff --git a/x-pack/plugins/osquery/cypress/integration/all/delete_all_ecs_mappings.spec.ts b/x-pack/plugins/osquery/cypress/integration/all/delete_all_ecs_mappings.spec.ts index 46d927329aa98..dab935d919a28 100644 --- a/x-pack/plugins/osquery/cypress/integration/all/delete_all_ecs_mappings.spec.ts +++ b/x-pack/plugins/osquery/cypress/integration/all/delete_all_ecs_mappings.spec.ts @@ -8,6 +8,7 @@ import { navigateTo } from '../../tasks/navigation'; import { login } from '../../tasks/login'; import { ArchiverMethod, runKbnArchiverScript } from '../../tasks/archiver'; +import { ROLES } from '../../test'; describe('ALL - Delete ECS Mappings', () => { const SAVED_QUERY_ID = 'Saved-Query-Id'; @@ -16,7 +17,7 @@ describe('ALL - Delete ECS Mappings', () => { runKbnArchiverScript(ArchiverMethod.LOAD, 'saved_query'); }); beforeEach(() => { - login(); + login(ROLES.soc_manager); navigateTo('/app/osquery/saved_queries'); }); diff --git a/x-pack/plugins/osquery/cypress/integration/all/live_query.spec.ts b/x-pack/plugins/osquery/cypress/integration/all/live_query.spec.ts index c33763bb2bff4..1ddec794f41be 100644 --- a/x-pack/plugins/osquery/cypress/integration/all/live_query.spec.ts +++ b/x-pack/plugins/osquery/cypress/integration/all/live_query.spec.ts @@ -21,10 +21,11 @@ import { RESULTS_TABLE_CELL_WRRAPER, } from '../../screens/live_query'; import { getAdvancedButton } from '../../screens/integrations'; +import { ROLES } from '../../test'; describe('ALL - Live Query', () => { beforeEach(() => { - login(); + login(ROLES.soc_manager); navigateTo('/app/osquery'); }); diff --git a/x-pack/plugins/osquery/cypress/integration/all/metrics.spec.ts b/x-pack/plugins/osquery/cypress/integration/all/metrics.spec.ts index ba71e75d9ea7b..13f2d3638fcdc 100644 --- a/x-pack/plugins/osquery/cypress/integration/all/metrics.spec.ts +++ b/x-pack/plugins/osquery/cypress/integration/all/metrics.spec.ts @@ -9,10 +9,11 @@ import { navigateTo } from '../../tasks/navigation'; import { login } from '../../tasks/login'; import { checkResults, inputQuery, submitQuery } from '../../tasks/live_query'; import { ArchiverMethod, runKbnArchiverScript } from '../../tasks/archiver'; +import { ROLES } from '../../test'; describe('ALL - Metrics', () => { beforeEach(() => { - login(); + login(ROLES.soc_manager); navigateTo('/app/osquery'); }); before(() => { diff --git a/x-pack/plugins/osquery/cypress/integration/all/packs.spec.ts b/x-pack/plugins/osquery/cypress/integration/all/packs.spec.ts index eafe36874244e..13403594d81e9 100644 --- a/x-pack/plugins/osquery/cypress/integration/all/packs.spec.ts +++ b/x-pack/plugins/osquery/cypress/integration/all/packs.spec.ts @@ -18,6 +18,7 @@ import { preparePack } from '../../tasks/packs'; import { addIntegration, closeModalIfVisible } from '../../tasks/integrations'; import { DEFAULT_POLICY } from '../../screens/fleet'; import { getSavedQueriesDropdown } from '../../screens/live_query'; +import { ROLES } from '../../test'; describe('ALL - Packs', () => { const integration = 'Osquery Manager'; @@ -32,8 +33,9 @@ describe('ALL - Packs', () => { runKbnArchiverScript(ArchiverMethod.LOAD, 'ecs_mapping_2'); runKbnArchiverScript(ArchiverMethod.LOAD, 'ecs_mapping_3'); }); + beforeEach(() => { - login(); + login(ROLES.soc_manager); navigateTo('/app/osquery'); }); @@ -202,6 +204,7 @@ describe('ALL - Packs', () => { deleteAndConfirm('pack'); }); }); + describe('Validate that agent is getting removed from pack if we remove agent', () => { beforeEach(() => { login(); @@ -249,4 +252,17 @@ describe('ALL - Packs', () => { cy.react('EuiComboBoxInput', { props: { value: '' } }).should('exist'); }); }); + + describe('Load prebuilt packs', () => { + beforeEach(() => { + login(ROLES.soc_manager); + navigateTo('/app/osquery/packs'); + }); + + it('should load prebuilt packs', () => { + cy.contains('Load Elastic prebuilt packs').click(); + cy.contains('Load Elastic prebuilt packs').should('not.exist'); + cy.react('EuiTableRow').should('have.length.above', 5); + }); + }); }); diff --git a/x-pack/plugins/osquery/cypress/integration/all/saved_queries.spec.ts b/x-pack/plugins/osquery/cypress/integration/all/saved_queries.spec.ts index 4e48e819ac0ab..18167506fc75c 100644 --- a/x-pack/plugins/osquery/cypress/integration/all/saved_queries.spec.ts +++ b/x-pack/plugins/osquery/cypress/integration/all/saved_queries.spec.ts @@ -9,13 +9,14 @@ import { navigateTo } from '../../tasks/navigation'; import { login } from '../../tasks/login'; import { getSavedQueriesComplexTest } from '../../tasks/saved_queries'; +import { ROLES } from '../../test'; const SAVED_QUERY_ID = 'Saved-Query-Id'; const SAVED_QUERY_DESCRIPTION = 'Test saved query description'; describe('ALL - Saved queries', () => { beforeEach(() => { - login(); + login(ROLES.soc_manager); navigateTo('/app/osquery'); }); diff --git a/x-pack/plugins/osquery/cypress/tasks/integrations.ts b/x-pack/plugins/osquery/cypress/tasks/integrations.ts index 9cd9cbd8d4db6..0c2d789f4728a 100644 --- a/x-pack/plugins/osquery/cypress/tasks/integrations.ts +++ b/x-pack/plugins/osquery/cypress/tasks/integrations.ts @@ -16,6 +16,9 @@ import { export const addIntegration = (agentPolicy = 'Default Fleet Server policy') => { cy.getBySel(ADD_POLICY_BTN).click(); cy.getBySel(DATA_COLLECTION_SETUP_STEP).find('.euiLoadingSpinner').should('not.exist'); + cy.contains('Existing hosts').click(); + cy.getBySel('agentPolicySelect').click(); + cy.contains(agentPolicy).click(); cy.getBySel('agentPolicySelect').should('have.text', agentPolicy); cy.getBySel(CREATE_PACKAGE_POLICY_SAVE_BTN).click(); // sometimes agent is assigned to default policy, sometimes not diff --git a/x-pack/plugins/osquery/public/common/hooks/use_error_toast.tsx b/x-pack/plugins/osquery/public/common/hooks/use_error_toast.tsx index fb17803a9d57b..0289c53e72017 100644 --- a/x-pack/plugins/osquery/public/common/hooks/use_error_toast.tsx +++ b/x-pack/plugins/osquery/public/common/hooks/use_error_toast.tsx @@ -19,8 +19,10 @@ export const useErrorToast = () => { toasts.remove(errorToast); } if (error) { - // @ts-expect-error update types - setErrorToast(toasts.addError(error, opts)); + setErrorToast( + // @ts-expect-error update types + toasts.addError(error, { title: error?.body?.error || error?.body?.message, ...opts }) + ); } }; }; diff --git a/x-pack/plugins/osquery/scripts/roles_users/index.ts b/x-pack/plugins/osquery/scripts/roles_users/index.ts index ce29ba92e2590..755b09387770d 100644 --- a/x-pack/plugins/osquery/scripts/roles_users/index.ts +++ b/x-pack/plugins/osquery/scripts/roles_users/index.ts @@ -5,6 +5,8 @@ * 2.0. */ +export * from './platform_engineer'; export * from './reader'; export * from './t1_analyst'; export * from './t2_analyst'; +export * from './soc_manager'; diff --git a/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/delete_user.sh b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/delete_user.sh new file mode 100755 index 0000000000000..cb2b0467f44ca --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/delete_user.sh @@ -0,0 +1,11 @@ + +# +# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +# or more contributor license agreements. Licensed under the Elastic License +# 2.0; you may not use this file except in compliance with the Elastic License +# 2.0. +# + +curl -v -H 'Content-Type: application/json' -H 'kbn-xsrf: 123'\ + -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ +-XDELETE ${ELASTICSEARCH_URL}/_security/user/platform_engineer diff --git a/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/get_role.sh b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/get_role.sh new file mode 100755 index 0000000000000..95fa058193b58 --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/get_role.sh @@ -0,0 +1,11 @@ + +# +# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +# or more contributor license agreements. Licensed under the Elastic License +# 2.0; you may not use this file except in compliance with the Elastic License +# 2.0. +# + +curl -H 'Content-Type: application/json' -H 'kbn-xsrf: 123'\ + -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ +-XGET ${KIBANA_URL}/api/security/role/platform_engineer | jq -S . diff --git a/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/index.ts b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/index.ts new file mode 100644 index 0000000000000..92e4bf9bddd3a --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/index.ts @@ -0,0 +1,11 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import * as platformEngineerUser from './user.json'; +import * as platformEngineerRole from './role.json'; + +export { platformEngineerUser, platformEngineerRole }; diff --git a/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/post_role.sh b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/post_role.sh new file mode 100755 index 0000000000000..14a5cd57d4da0 --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/post_role.sh @@ -0,0 +1,14 @@ + +# +# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +# or more contributor license agreements. Licensed under the Elastic License +# 2.0; you may not use this file except in compliance with the Elastic License +# 2.0. +# + +ROLE_CONFIG=(${@:-./detections_role.json}) + +curl -H 'Content-Type: application/json' -H 'kbn-xsrf: 123'\ + -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ +-XPUT ${KIBANA_URL}/api/security/role/platform_engineer \ +-d @${ROLE_CONFIG} diff --git a/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/post_user.sh b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/post_user.sh new file mode 100755 index 0000000000000..032d6882c2cb3 --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/post_user.sh @@ -0,0 +1,14 @@ + +# +# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +# or more contributor license agreements. Licensed under the Elastic License +# 2.0; you may not use this file except in compliance with the Elastic License +# 2.0. +# + +USER=(${@:-./detections_user.json}) + +curl -H 'Content-Type: application/json' -H 'kbn-xsrf: 123'\ + -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ + ${ELASTICSEARCH_URL}/_security/user/platform_engineer \ +-d @${USER} diff --git a/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/role.json b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/role.json new file mode 100644 index 0000000000000..5c6cbdb9fbbf9 --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/role.json @@ -0,0 +1,20 @@ +{ + "elasticsearch": { + "indices": [ + { + "names": ["logs-osquery_manager*"], + "privileges": ["read"] + } + ] + }, + "kibana": [ + { + "feature": { + "fleet": ["all"], + "osquery": ["all"] + }, + "spaces": ["*"] + } + ] +} + diff --git a/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/user.json b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/user.json new file mode 100644 index 0000000000000..b0bf7cca0798d --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/platform_engineer/user.json @@ -0,0 +1,6 @@ +{ + "password": "changeme", + "roles": ["platform_engineer"], + "full_name": "Platform Engineer", + "email": "osquery@example.com" +} diff --git a/x-pack/plugins/osquery/scripts/roles_users/soc_manager/delete_user.sh b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/delete_user.sh new file mode 100755 index 0000000000000..1bf103592b682 --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/delete_user.sh @@ -0,0 +1,11 @@ + +# +# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +# or more contributor license agreements. Licensed under the Elastic License +# 2.0; you may not use this file except in compliance with the Elastic License +# 2.0. +# + +curl -v -H 'Content-Type: application/json' -H 'kbn-xsrf: 123'\ + -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ +-XDELETE ${ELASTICSEARCH_URL}/_security/user/soc_manager diff --git a/x-pack/plugins/osquery/scripts/roles_users/soc_manager/get_role.sh b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/get_role.sh new file mode 100755 index 0000000000000..b6bf637bfc9d8 --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/get_role.sh @@ -0,0 +1,11 @@ + +# +# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +# or more contributor license agreements. Licensed under the Elastic License +# 2.0; you may not use this file except in compliance with the Elastic License +# 2.0. +# + +curl -H 'Content-Type: application/json' -H 'kbn-xsrf: 123'\ + -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ +-XGET ${KIBANA_URL}/api/security/role/soc_manager | jq -S . diff --git a/x-pack/plugins/osquery/scripts/roles_users/soc_manager/index.ts b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/index.ts new file mode 100644 index 0000000000000..0d9ec6842f146 --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/index.ts @@ -0,0 +1,11 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import * as socManagerUser from './user.json'; +import * as socManagerRole from './role.json'; + +export { socManagerUser, socManagerRole }; diff --git a/x-pack/plugins/osquery/scripts/roles_users/soc_manager/post_role.sh b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/post_role.sh new file mode 100755 index 0000000000000..c2d639c666273 --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/post_role.sh @@ -0,0 +1,14 @@ + +# +# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +# or more contributor license agreements. Licensed under the Elastic License +# 2.0; you may not use this file except in compliance with the Elastic License +# 2.0. +# + +ROLE_CONFIG=(${@:-./detections_role.json}) + +curl -H 'Content-Type: application/json' -H 'kbn-xsrf: 123'\ + -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ +-XPUT ${KIBANA_URL}/api/security/role/soc_manager \ +-d @${ROLE_CONFIG} diff --git a/x-pack/plugins/osquery/scripts/roles_users/soc_manager/post_user.sh b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/post_user.sh new file mode 100755 index 0000000000000..7a67068acb6a8 --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/post_user.sh @@ -0,0 +1,14 @@ + +# +# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +# or more contributor license agreements. Licensed under the Elastic License +# 2.0; you may not use this file except in compliance with the Elastic License +# 2.0. +# + +USER=(${@:-./detections_user.json}) + +curl -H 'Content-Type: application/json' -H 'kbn-xsrf: 123'\ + -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ + ${ELASTICSEARCH_URL}/_security/user/soc_manager \ +-d @${USER} diff --git a/x-pack/plugins/osquery/scripts/roles_users/soc_manager/role.json b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/role.json new file mode 100644 index 0000000000000..e3c97c0fe6560 --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/role.json @@ -0,0 +1,29 @@ +{ + "elasticsearch": { + "cluster": ["manage"], + "indices": [ + { + "names": [".items-*", ".lists-*", ".alerts-security.alerts-*", ".siem-signals-*"], + "privileges": ["manage", "read", "write", "view_index_metadata", "maintenance"] + }, + { + "names": ["*"], + "privileges": ["read"] + } + ] + }, + "kibana": [ + { + "feature": { + "discover": ["read"], + "infrastructure": ["read"], + "ml": ["all"], + "siem": ["all"], + "osquery": ["all"], + "visualize": ["read"] + }, + "spaces": ["*"] + } + ] +} + diff --git a/x-pack/plugins/osquery/scripts/roles_users/soc_manager/user.json b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/user.json new file mode 100644 index 0000000000000..0e34d20a0e97b --- /dev/null +++ b/x-pack/plugins/osquery/scripts/roles_users/soc_manager/user.json @@ -0,0 +1,6 @@ +{ + "password": "changeme", + "roles": ["soc_manager"], + "full_name": "SOC Manager", + "email": "osquery@example.com" +} diff --git a/x-pack/plugins/osquery/server/plugin.ts b/x-pack/plugins/osquery/server/plugin.ts index e0daae4c9687f..0533b770e8895 100644 --- a/x-pack/plugins/osquery/server/plugin.ts +++ b/x-pack/plugins/osquery/server/plugin.ts @@ -25,7 +25,11 @@ import { initSavedObjects } from './saved_objects'; import { initUsageCollectors } from './usage'; import { OsqueryAppContext, OsqueryAppContextService } from './lib/osquery_app_context_services'; import { ConfigType } from './config'; -import { packSavedObjectType, savedQuerySavedObjectType } from '../common/types'; +import { + packSavedObjectType, + packAssetSavedObjectType, + savedQuerySavedObjectType, +} from '../common/types'; import { PLUGIN_ID } from '../common'; import { getPackagePolicyDeleteCallback } from './lib/fleet_integration'; import { TelemetryEventsSender } from './lib/telemetry/sender'; @@ -165,7 +169,7 @@ const registerFeatures = (features: SetupPlugins['features']) => { includeIn: 'all', name: 'All', savedObject: { - all: [packSavedObjectType], + all: [packSavedObjectType, packAssetSavedObjectType], read: [], }, ui: ['writePacks', 'readPacks'], diff --git a/x-pack/plugins/osquery/server/routes/asset/update_assets_route.ts b/x-pack/plugins/osquery/server/routes/asset/update_assets_route.ts index 8cafdc11bd124..f3c2261389718 100644 --- a/x-pack/plugins/osquery/server/routes/asset/update_assets_route.ts +++ b/x-pack/plugins/osquery/server/routes/asset/update_assets_route.ts @@ -27,7 +27,7 @@ export const updateAssetsRoute = (router: IRouter, osqueryContext: OsqueryAppCon validate: { params: schema.object({}, { unknowns: 'allow' }), }, - options: { tags: [`access:${PLUGIN_ID}-all`] }, + options: { tags: [`access:${PLUGIN_ID}-writePacks`] }, }, async (context, request, response) => { const savedObjectsClient = context.core.savedObjects.client; diff --git a/x-pack/test/osquery_cypress/artifact_manager.ts b/x-pack/test/osquery_cypress/artifact_manager.ts index d96ef56ec87c8..777b19c0983d6 100644 --- a/x-pack/test/osquery_cypress/artifact_manager.ts +++ b/x-pack/test/osquery_cypress/artifact_manager.ts @@ -9,7 +9,7 @@ // import { last } from 'lodash'; export async function getLatestVersion(): Promise { - return '8.1.0-SNAPSHOT'; + return '8.2.0-SNAPSHOT'; // const response: any = await axios('https://artifacts-api.elastic.co/v1/versions'); // return last(response.data.versions as string[]) || '8.2.0-SNAPSHOT'; } From 772205f6708827f2823af876d73a8d610f15d70e Mon Sep 17 00:00:00 2001 From: Karl Godard Date: Tue, 5 Apr 2022 15:21:07 -0700 Subject: [PATCH 17/47] [Session View] jumpToEntityId / investigatedAlertId behavior fixed. (#129275) * Fix for process event pagination in session view * plumbing work to get a few more props to session view when loaded via timeline * session config plumbing work done * jump to event kinks worked out. * tests fixed * test fix * build error fixes * addressed PR comments. cleanup * addressed PR comments. cleanup * post merge fixes * pr comments addressed Co-authored-by: mitodrummer --- .../common/components/events_viewer/index.tsx | 6 +- .../public/common/mock/global_state.ts | 2 +- .../public/common/mock/timeline_results.ts | 4 +- .../components/alerts_table/actions.test.tsx | 2 +- .../components/graph_overlay/index.test.tsx | 4 +- .../components/graph_overlay/index.tsx | 6 +- .../timeline/body/actions/index.tsx | 37 ++++++---- .../timelines/components/timeline/index.tsx | 6 +- .../session_tab_content/use_session_view.tsx | 27 ++++--- .../timeline/tabs_content/index.tsx | 7 +- .../timelines/store/timeline/actions.ts | 7 +- .../timelines/store/timeline/defaults.ts | 2 +- .../timelines/store/timeline/epic.test.ts | 2 +- .../timelines/store/timeline/helpers.ts | 10 +-- .../public/timelines/store/timeline/model.ts | 5 +- .../timelines/store/timeline/reducer.test.ts | 2 +- .../timelines/store/timeline/reducer.ts | 12 ++-- .../plugins/session_view/common/constants.ts | 2 +- .../constants/session_view_process.mock.ts | 4 +- .../common/types/process_tree/index.ts | 2 +- .../common/utils/sort_processes.ts | 4 +- .../detail_panel_alert_actions/index.test.tsx | 22 +++--- .../detail_panel_alert_actions/index.tsx | 17 ++--- .../detail_panel_alert_group_item/index.tsx | 8 +-- .../detail_panel_alert_list_item/index.tsx | 16 +++-- .../detail_panel_alert_tab/index.test.tsx | 26 +++---- .../detail_panel_alert_tab/index.tsx | 71 ++++++++++--------- .../public/components/process_tree/helpers.ts | 4 +- .../public/components/process_tree/hooks.ts | 21 +++++- .../components/process_tree/index.test.tsx | 6 +- .../public/components/process_tree/index.tsx | 32 +++++---- .../components/process_tree_alerts/index.tsx | 17 ++--- .../process_tree_node/index.test.tsx | 13 +++- .../components/process_tree_node/index.tsx | 33 +++++---- .../public/components/session_view/hooks.ts | 32 +++++---- .../public/components/session_view/index.tsx | 47 ++++++++++-- .../session_view_detail_panel/index.test.tsx | 14 ++-- .../session_view_detail_panel/index.tsx | 16 ++--- .../session_view/public/hooks/use_visible.ts | 33 +++++---- x-pack/plugins/session_view/public/types.ts | 9 ++- .../server/routes/process_events_route.ts | 9 +-- 41 files changed, 360 insertions(+), 239 deletions(-) diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx index d46ab4b62be68..b3948681c491c 100644 --- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx +++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx @@ -105,7 +105,7 @@ const StatefulEventsViewerComponent: React.FC = ({ itemsPerPage, itemsPerPageOptions, kqlMode, - sessionViewId, + sessionViewConfig, showCheckboxes, sort, } = defaultModel, @@ -164,11 +164,11 @@ const StatefulEventsViewerComponent: React.FC = ({ const graphOverlay = useMemo(() => { const shouldShowOverlay = - (graphEventId != null && graphEventId.length > 0) || sessionViewId !== null; + (graphEventId != null && graphEventId.length > 0) || sessionViewConfig != null; return shouldShowOverlay ? ( ) : null; - }, [graphEventId, id, sessionViewId, SessionView, Navigation]); + }, [graphEventId, id, sessionViewConfig, SessionView, Navigation]); const setQuery = useCallback( (inspect, loading, refetch) => { dispatch(inputsActions.setQuery({ id, inputId: 'global', inspect, loading, refetch })); diff --git a/x-pack/plugins/security_solution/public/common/mock/global_state.ts b/x-pack/plugins/security_solution/public/common/mock/global_state.ts index 31948a13db0f1..3c3cd748fecee 100644 --- a/x-pack/plugins/security_solution/public/common/mock/global_state.ts +++ b/x-pack/plugins/security_solution/public/common/mock/global_state.ts @@ -321,7 +321,7 @@ export const mockGlobalState: State = { end: '2020-07-08T08:20:18.966Z', }, selectedEventIds: {}, - sessionViewId: null, + sessionViewConfig: null, show: false, showCheckboxes: false, pinnedEventIds: {}, diff --git a/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts b/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts index 4bbdca8564a8e..e450446e9e116 100644 --- a/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts +++ b/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts @@ -2011,7 +2011,7 @@ export const mockTimelineModel: TimelineModel = { savedObjectId: 'ef579e40-jibber-jabber', selectAll: false, selectedEventIds: {}, - sessionViewId: null, + sessionViewConfig: null, show: false, showCheckboxes: false, sort: [ @@ -2133,7 +2133,7 @@ export const defaultTimelineProps: CreateTimelineProps = { savedObjectId: null, selectAll: false, selectedEventIds: {}, - sessionViewId: null, + sessionViewConfig: null, show: false, showCheckboxes: false, sort: [{ columnId: '@timestamp', columnType: 'number', sortDirection: Direction.desc }], diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx index 2b54f9fe8504f..dd79a244d2b1b 100644 --- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx +++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx @@ -312,7 +312,7 @@ describe('alert actions', () => { savedObjectId: null, selectAll: false, selectedEventIds: {}, - sessionViewId: null, + sessionViewConfig: null, show: true, showCheckboxes: false, sort: [ diff --git a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx index 90a5798108d88..67f815f745a9d 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx +++ b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx @@ -226,7 +226,9 @@ describe('GraphOverlay', () => { timelineById: { [timelineId]: { ...mockGlobalState.timeline.timelineById[timelineId], - sessionViewId: 'testId', + sessionViewConfig: { + sessionEntityId: 'testId', + }, }, }, }, diff --git a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx index 694003311e6c8..e5aef07754f48 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx +++ b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx @@ -74,8 +74,8 @@ const GraphOverlayComponent: React.FC = ({ const graphEventId = useDeepEqualSelector( (state) => (getTimeline(state, timelineId) ?? timelineDefaults).graphEventId ); - const sessionViewId = useDeepEqualSelector( - (state) => (getTimeline(state, timelineId) ?? timelineDefaults).sessionViewId + const sessionViewConfig = useDeepEqualSelector( + (state) => (getTimeline(state, timelineId) ?? timelineDefaults).sessionViewConfig ); const getStartSelector = useMemo(() => startSelector(), []); @@ -134,7 +134,7 @@ const GraphOverlayComponent: React.FC = ({ [defaultDataView.patternList, isInTimeline, timelinePatterns] ); - if (!isInTimeline && sessionViewId !== null) { + if (!isInTimeline && sessionViewConfig !== null) { if (fullScreen) { return ( diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx index cd96cfaf42db1..b319ae12e7613 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx +++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx @@ -24,7 +24,7 @@ import { useShallowEqualSelector } from '../../../../../common/hooks/use_selecto import { setActiveTabTimeline, updateTimelineGraphEventId, - updateTimelineSessionViewSessionId, + updateTimelineSessionViewConfig, } from '../../../../store/timeline/actions'; import { useGlobalFullScreen, @@ -129,15 +129,26 @@ const ActionsComponent: React.FC = ({ } }, [dispatch, ecsData._id, timelineId, setGlobalFullScreen, setTimelineFullScreen]); - const entryLeader = useMemo(() => { - const { process } = ecsData; - const entryLeaderIds = process?.entry_leader?.entity_id; - if (entryLeaderIds !== undefined && entryLeaderIds.length > 0) { - return entryLeaderIds[0]; - } else { + const sessionViewConfig = useMemo(() => { + const { process, _id, timestamp } = ecsData; + const sessionEntityId = process?.entry_leader?.entity_id?.[0]; + + if (sessionEntityId === undefined) { return null; } - }, [ecsData]); + + const jumpToEntityId = process?.entity_id?.[0]; + const investigatedAlertId = eventType === 'signal' || eventType === 'eql' ? _id : undefined; + const jumpToCursor = + (investigatedAlertId && ecsData.kibana?.alert.original_time?.[0]) || timestamp; + + return { + sessionEntityId, + jumpToEntityId, + jumpToCursor, + investigatedAlertId, + }; + }, [ecsData, eventType]); const openSessionView = useCallback(() => { const dataGridIsFullScreen = document.querySelector('.euiDataGrid--fullScreen'); @@ -145,7 +156,7 @@ const ActionsComponent: React.FC = ({ if (dataGridIsFullScreen) { setTimelineFullScreen(true); } - if (entryLeader !== null) { + if (sessionViewConfig !== null) { dispatch(setActiveTabTimeline({ id: timelineId, activeTab: TimelineTabs.session })); } } else { @@ -153,10 +164,10 @@ const ActionsComponent: React.FC = ({ setGlobalFullScreen(true); } } - if (entryLeader !== null) { - dispatch(updateTimelineSessionViewSessionId({ id: timelineId, eventId: entryLeader })); + if (sessionViewConfig !== null) { + dispatch(updateTimelineSessionViewConfig({ id: timelineId, sessionViewConfig })); } - }, [dispatch, timelineId, entryLeader, setGlobalFullScreen, setTimelineFullScreen]); + }, [dispatch, timelineId, sessionViewConfig, setGlobalFullScreen, setTimelineFullScreen]); return ( @@ -250,7 +261,7 @@ const ActionsComponent: React.FC = ({ ) : null} - {entryLeader !== null ? ( + {sessionViewConfig !== null ? (
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx index 6ead70b79caac..b32246949e2cd 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx +++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx @@ -74,7 +74,7 @@ const StatefulTimelineComponent: React.FC = ({ savedObjectId, timelineType, description, - sessionViewId, + sessionViewConfig, } = useDeepEqualSelector((state) => pick( [ @@ -84,7 +84,7 @@ const StatefulTimelineComponent: React.FC = ({ 'savedObjectId', 'timelineType', 'description', - 'sessionViewId', + 'sessionViewConfig', ], getTimeline(state, timelineId) ?? timelineDefaults ) @@ -202,7 +202,7 @@ const StatefulTimelineComponent: React.FC = ({ timelineSelectors.getTimelineByIdSelector(), []); + const { globalFullScreen, setGlobalFullScreen } = useGlobalFullScreen(); const { timelineFullScreen, setTimelineFullScreen } = useTimelineFullScreen(); - const { graphEventId, sessionViewId, activeTab, prevActiveTab } = useDeepEqualSelector( + const { graphEventId, sessionViewConfig, activeTab, prevActiveTab } = useDeepEqualSelector( (state) => getTimeline(state, timelineId) ?? timelineDefaults ); + const onCloseOverlay = useCallback(() => { const isDataGridFullScreen = document.querySelector('.euiDataGrid--fullScreen') !== null; // Since EUI changes these values directly as a side effect, need to add them back on close. @@ -126,15 +135,15 @@ export const useSessionView = ({ } if (timelineId !== TimelineId.active) { dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: '' })); - dispatch(updateTimelineSessionViewSessionId({ id: timelineId, eventId: null })); + dispatch(updateTimelineSessionViewConfig({ id: timelineId, sessionViewConfig: null })); } else { if (activeTab === TimelineTabs.graph) { dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: '' })); - if (prevActiveTab === TimelineTabs.session && !sessionViewId) { + if (prevActiveTab === TimelineTabs.session && !sessionViewConfig) { dispatch(setActiveTabTimeline({ id: timelineId, activeTab: TimelineTabs.query })); } } else if (activeTab === TimelineTabs.session) { - dispatch(updateTimelineSessionViewSessionId({ id: timelineId, eventId: null })); + dispatch(updateTimelineSessionViewConfig({ id: timelineId, sessionViewConfig: null })); if (prevActiveTab === TimelineTabs.graph && !graphEventId) { dispatch(setActiveTabTimeline({ id: timelineId, activeTab: TimelineTabs.query })); } else { @@ -150,7 +159,7 @@ export const useSessionView = ({ activeTab, prevActiveTab, graphEventId, - sessionViewId, + sessionViewConfig, ]); const fullScreen = useMemo( () => isFullScreen({ globalFullScreen, timelineId, timelineFullScreen }), @@ -187,13 +196,13 @@ export const useSessionView = ({ }); const sessionViewComponent = useMemo(() => { - return sessionViewId !== null + return sessionViewConfig !== null ? sessionView.getSessionView({ - sessionEntityId: sessionViewId, + ...sessionViewConfig, loadAlertDetails: openDetailsPanel, }) : null; - }, [openDetailsPanel, sessionView, sessionViewId]); + }, [openDetailsPanel, sessionView, sessionViewConfig]); const navigation = useMemo(() => { return ( diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx index 2f5c986829b91..f25e86d4eebf6 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx +++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx @@ -27,6 +27,7 @@ import { } from '../../../../common/hooks/use_timeline_events_count'; import { timelineActions } from '../../../store/timeline'; import { CellValueElementProps } from '../cell_rendering'; +import { SessionViewConfig } from '../session_tab_content/use_session_view'; import { getActiveTabSelector, getNoteIdsSelector, @@ -60,7 +61,7 @@ interface BasicTimelineTab { timelineId: TimelineId; timelineType: TimelineType; graphEventId?: string; - sessionViewId?: string | null; + sessionViewConfig?: SessionViewConfig | null; timelineDescription: string; } @@ -235,7 +236,7 @@ const TabsContentComponent: React.FC = ({ timelineFullScreen, timelineType, graphEventId, - sessionViewId, + sessionViewConfig, timelineDescription, }) => { const dispatch = useDispatch(); @@ -351,7 +352,7 @@ const TabsContentComponent: React.FC = ({ data-test-subj={`timelineTabs-${TimelineTabs.session}`} onClick={setSessionAsActiveTab} isSelected={activeTab === TimelineTabs.session} - disabled={sessionViewId === null} + disabled={sessionViewConfig === null} key={TimelineTabs.session} > {i18n.SESSION_TAB} diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts index 1fe56de596ce0..10251f25fb02d 100644 --- a/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts +++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts @@ -46,6 +46,7 @@ export { upsertColumn, } from '../../../../../timelines/public'; import { ResolveTimelineConfig } from '../../components/open_timeline/types'; +import { SessionViewConfig } from '../../components/timeline/session_tab_content/use_session_view'; const actionCreator = actionCreatorFactory('x-pack/security_solution/local/timeline'); @@ -83,10 +84,10 @@ export const updateTimelineGraphEventId = actionCreator<{ id: string; graphEvent 'UPDATE_TIMELINE_GRAPH_EVENT_ID' ); -export const updateTimelineSessionViewSessionId = actionCreator<{ +export const updateTimelineSessionViewConfig = actionCreator<{ id: string; - eventId: string | null; -}>('UPDATE_TIMELINE_SESSION_VIEW_SESSION_ID'); + sessionViewConfig: SessionViewConfig | null; +}>('UPDATE_TIMELINE_SESSION_VIEW_CONFIG'); export const unPinEvent = actionCreator<{ id: string; eventId: string }>('UN_PIN_EVENT'); diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts index 7362ee9e76759..c1d37d21c2b1d 100644 --- a/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts +++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts @@ -65,7 +65,7 @@ export const timelineDefaults: SubsetTimelineModel & savedObjectId: null, selectAll: false, selectedEventIds: {}, - sessionViewId: null, + sessionViewConfig: null, show: false, showCheckboxes: false, sort: [ diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts index 31608ac4145b5..f79ecdb33f185 100644 --- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts +++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts @@ -159,7 +159,7 @@ describe('Epic Timeline', () => { dateRange: { start: '2019-10-30T21:06:27.644Z', end: '2019-10-31T21:06:27.644Z' }, savedObjectId: '11169110-fc22-11e9-8ca9-072f15ce2685', selectedEventIds: {}, - sessionViewId: null, + sessionViewConfig: null, show: true, showCheckboxes: false, sort: [{ columnId: '@timestamp', columnType: 'number', sortDirection: Direction.desc }], diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts index 36b790d451879..5748f0e9cf07a 100644 --- a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts +++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts @@ -49,7 +49,7 @@ import { } from '../../components/timeline/body/constants'; import { activeTimeline } from '../../containers/active_timeline_context'; import { ResolveTimelineConfig } from '../../components/open_timeline/types'; - +import { SessionViewConfig } from '../../components/timeline/session_tab_content/use_session_view'; export const isNotNull = (value: T | null): value is T => value !== null; interface AddTimelineHistoryParams { @@ -287,13 +287,13 @@ export const updateGraphEventId = ({ }; }; -export const updateSessionViewSessionId = ({ +export const updateSessionViewConfig = ({ id, - eventId, + sessionViewConfig, timelineById, }: { id: string; - eventId: string | null; + sessionViewConfig: SessionViewConfig | null; timelineById: TimelineById; }): TimelineById => { const timeline = timelineById[id]; @@ -302,7 +302,7 @@ export const updateSessionViewSessionId = ({ ...timelineById, [id]: { ...timeline, - sessionViewId: eventId, + sessionViewConfig, }, }; }; diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts index 73b51453f5e9f..d0bbd47a10176 100644 --- a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts +++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts @@ -16,6 +16,7 @@ import type { import { PinnedEvent } from '../../../../common/types/timeline/pinned_event'; import type { TGridModelForTimeline } from '../../../../../timelines/public'; import { ResolveTimelineConfig } from '../../components/open_timeline/types'; +import type { SessionViewConfig } from '../../components/timeline/session_tab_content/use_session_view'; export const DEFAULT_PAGE_COUNT = 2; // Eui Pager will not render unless this is a minimum of 2 pages export type KqlMode = 'filter' | 'search'; @@ -63,7 +64,7 @@ export type TimelineModel = TGridModelForTimeline & { resolveTimelineConfig?: ResolveTimelineConfig; showSaveModal?: boolean; savedQueryId?: string | null; - sessionViewId: string | null; + sessionViewConfig: SessionViewConfig | null; /** When true, show the timeline flyover */ show: boolean; /** status: active | draft */ @@ -119,7 +120,7 @@ export type SubsetTimelineModel = Readonly< | 'dateRange' | 'selectAll' | 'selectedEventIds' - | 'sessionViewId' + | 'sessionViewConfig' | 'show' | 'showCheckboxes' | 'sort' diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts index 41d9aa679e198..203b988be378f 100644 --- a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts +++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts @@ -123,7 +123,7 @@ const basicTimeline: TimelineModel = { savedObjectId: null, selectAll: false, selectedEventIds: {}, - sessionViewId: null, + sessionViewConfig: null, show: true, showCheckboxes: false, sort: [ diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts index 66fe71d058c87..18fce283962e0 100644 --- a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts +++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts @@ -44,7 +44,7 @@ import { updateTimeline, updateTimelineGraphEventId, updateTitleAndDescription, - updateTimelineSessionViewSessionId, + updateTimelineSessionViewConfig, toggleModalSaveTimeline, updateEqlOptions, setTimelineUpdatedAt, @@ -78,7 +78,7 @@ import { updateGraphEventId, updateFilters, updateTimelineEventType, - updateSessionViewSessionId, + updateSessionViewConfig, } from './helpers'; import { TimelineState, EMPTY_TIMELINE_BY_ID } from './types'; @@ -148,9 +148,13 @@ export const timelineReducer = reducerWithInitialState(initialTimelineState) ...state, timelineById: updateGraphEventId({ id, graphEventId, timelineById: state.timelineById }), })) - .case(updateTimelineSessionViewSessionId, (state, { id, eventId }) => ({ + .case(updateTimelineSessionViewConfig, (state, { id, sessionViewConfig }) => ({ ...state, - timelineById: updateSessionViewSessionId({ id, eventId, timelineById: state.timelineById }), + timelineById: updateSessionViewConfig({ + id, + sessionViewConfig, + timelineById: state.timelineById, + }), })) .case(pinEvent, (state, { id, eventId }) => ({ ...state, diff --git a/x-pack/plugins/session_view/common/constants.ts b/x-pack/plugins/session_view/common/constants.ts index 17a357820c1a4..3380cba4f7556 100644 --- a/x-pack/plugins/session_view/common/constants.ts +++ b/x-pack/plugins/session_view/common/constants.ts @@ -33,7 +33,7 @@ export const ALERT_STATUS = { // if not 100s of thousands of events, and to be required to page through these sessions to find more search matches is not a great experience. Future iterations of the // search functionality will instead use a separate ES backend search to avoid this. // 3. Fewer round trips to the backend! -export const PROCESS_EVENTS_PER_PAGE = 1000; +export const PROCESS_EVENTS_PER_PAGE = 2000; // As an initial approach, we won't be implementing pagination for alerts. // Instead we will load this fixed amount of alerts as a maximum for a session. diff --git a/x-pack/plugins/session_view/common/mocks/constants/session_view_process.mock.ts b/x-pack/plugins/session_view/common/mocks/constants/session_view_process.mock.ts index 45fa1b6e96409..df16f26730d98 100644 --- a/x-pack/plugins/session_view/common/mocks/constants/session_view_process.mock.ts +++ b/x-pack/plugins/session_view/common/mocks/constants/session_view_process.mock.ts @@ -659,7 +659,7 @@ export const mockAlerts: ProcessEvent[] = [ status: 'active', workflow_status: 'open', reason: 'process event created low alert cmd test alert.', - original_time: new Date('2021-11-23T15:25:04.218Z'), + original_time: '2021-11-23T15:25:04.218Z', original_event: { action: 'exec', }, @@ -844,7 +844,7 @@ export const mockAlerts: ProcessEvent[] = [ status: 'active', workflow_status: 'open', reason: 'process event created low alert cmd test alert.', - original_time: new Date('2021-11-23T15:25:05.202Z'), + original_time: '2021-11-23T15:25:05.202Z', original_event: { action: 'exit', }, diff --git a/x-pack/plugins/session_view/common/types/process_tree/index.ts b/x-pack/plugins/session_view/common/types/process_tree/index.ts index 085fb1e1198d8..9fae167c8bfb4 100644 --- a/x-pack/plugins/session_view/common/types/process_tree/index.ts +++ b/x-pack/plugins/session_view/common/types/process_tree/index.ts @@ -121,7 +121,7 @@ export interface ProcessEventAlert { reason?: string; workflow_status?: string; status?: string; - original_time?: Date; + original_time?: string; original_event?: { action?: string; }; diff --git a/x-pack/plugins/session_view/common/utils/sort_processes.ts b/x-pack/plugins/session_view/common/utils/sort_processes.ts index 0c43d9c197565..083847f5da814 100644 --- a/x-pack/plugins/session_view/common/utils/sort_processes.ts +++ b/x-pack/plugins/session_view/common/utils/sort_processes.ts @@ -8,8 +8,8 @@ import { Process } from '../types/process_tree'; export const sortProcesses = (a: Process, b: Process) => { - const eventAStartTime = new Date(a.getDetails().process?.start ?? ''); - const eventBStartTime = new Date(b.getDetails().process?.start ?? ''); + const eventAStartTime = a.getDetails()?.process?.start || 0; + const eventBStartTime = b.getDetails()?.process?.start || 0; if (eventAStartTime < eventBStartTime) { return -1; diff --git a/x-pack/plugins/session_view/public/components/detail_panel_alert_actions/index.test.tsx b/x-pack/plugins/session_view/public/components/detail_panel_alert_actions/index.test.tsx index aa12f49b1d816..09f107de0dd93 100644 --- a/x-pack/plugins/session_view/public/components/detail_panel_alert_actions/index.test.tsx +++ b/x-pack/plugins/session_view/public/components/detail_panel_alert_actions/index.test.tsx @@ -15,19 +15,19 @@ import { } from './index'; import { mockAlerts } from '../../../common/mocks/constants/session_view_process.mock'; import userEvent from '@testing-library/user-event'; -import { ProcessImpl } from '../process_tree/hooks'; +import { ProcessEvent } from '../../../common/types/process_tree'; describe('DetailPanelAlertActions component', () => { let render: () => ReturnType; let renderResult: ReturnType; let mockedContext: AppContextTestRender; let mockShowAlertDetails = jest.fn((uuid) => uuid); - let mockOnProcessSelected = jest.fn((process) => process); + let mockOnJumpToEvent = jest.fn((event: ProcessEvent) => event); beforeEach(() => { mockedContext = createAppRootMockRenderer(); mockShowAlertDetails = jest.fn((uuid) => uuid); - mockOnProcessSelected = jest.fn((process) => process); + mockOnJumpToEvent = jest.fn((process) => process); }); describe('When DetailPanelAlertActions is mounted', () => { @@ -37,7 +37,7 @@ describe('DetailPanelAlertActions component', () => { renderResult = mockedContext.render( ); @@ -46,7 +46,7 @@ describe('DetailPanelAlertActions component', () => { expect(renderResult.queryByTestId(SHOW_DETAILS_TEST_ID)).toBeTruthy(); expect(renderResult.queryByTestId(JUMP_TO_PROCESS_TEST_ID)).toBeTruthy(); expect(mockShowAlertDetails.mock.calls.length).toBe(0); - expect(mockOnProcessSelected.mock.calls.length).toBe(0); + expect(mockOnJumpToEvent.mock.calls.length).toBe(0); }); it('calls alert flyout callback when View details clicked', async () => { @@ -55,7 +55,7 @@ describe('DetailPanelAlertActions component', () => { renderResult = mockedContext.render( ); @@ -64,24 +64,24 @@ describe('DetailPanelAlertActions component', () => { userEvent.click(renderResult.getByTestId(SHOW_DETAILS_TEST_ID)); expect(mockShowAlertDetails.mock.calls.length).toBe(1); expect(mockShowAlertDetails.mock.results[0].value).toBe(mockEvent.kibana?.alert?.uuid); - expect(mockOnProcessSelected.mock.calls.length).toBe(0); + expect(mockOnJumpToEvent.mock.calls.length).toBe(0); }); - it('calls onProcessSelected when Jump to process clicked', async () => { + it('calls onJumpToEvent when Jump to process clicked', async () => { const mockEvent = mockAlerts[0]; renderResult = mockedContext.render( ); userEvent.click(renderResult.getByTestId(BUTTON_TEST_ID)); userEvent.click(renderResult.getByTestId(JUMP_TO_PROCESS_TEST_ID)); - expect(mockOnProcessSelected.mock.calls.length).toBe(1); - expect(mockOnProcessSelected.mock.results[0].value).toBeInstanceOf(ProcessImpl); + expect(mockOnJumpToEvent.mock.calls.length).toBe(1); + expect(mockOnJumpToEvent.mock.results[0].value).toEqual(mockEvent); expect(mockShowAlertDetails.mock.calls.length).toBe(0); }); }); diff --git a/x-pack/plugins/session_view/public/components/detail_panel_alert_actions/index.tsx b/x-pack/plugins/session_view/public/components/detail_panel_alert_actions/index.tsx index 6fb9a9fef24ff..e7a18191aa6b6 100644 --- a/x-pack/plugins/session_view/public/components/detail_panel_alert_actions/index.tsx +++ b/x-pack/plugins/session_view/public/components/detail_panel_alert_actions/index.tsx @@ -8,8 +8,7 @@ import React, { useState, useCallback } from 'react'; import { i18n } from '@kbn/i18n'; import { FormattedMessage } from '@kbn/i18n-react'; import { EuiPopover, EuiContextMenuPanel, EuiButtonIcon, EuiContextMenuItem } from '@elastic/eui'; -import { Process, ProcessEvent } from '../../../common/types/process_tree'; -import { ProcessImpl } from '../process_tree/hooks'; +import { ProcessEvent } from '../../../common/types/process_tree'; export const BUTTON_TEST_ID = 'sessionView:detailPanelAlertActionsBtn'; export const SHOW_DETAILS_TEST_ID = 'sessionView:detailPanelAlertActionShowDetails'; @@ -18,7 +17,7 @@ export const JUMP_TO_PROCESS_TEST_ID = 'sessionView:detailPanelAlertActionJumpTo interface DetailPanelAlertActionsDeps { event: ProcessEvent; onShowAlertDetails: (alertId: string) => void; - onProcessSelected: (process: Process) => void; + onJumpToEvent: (event: ProcessEvent) => void; } /** @@ -27,7 +26,7 @@ interface DetailPanelAlertActionsDeps { export const DetailPanelAlertActions = ({ event, onShowAlertDetails, - onProcessSelected, + onJumpToEvent, }: DetailPanelAlertActionsDeps) => { const [isPopoverOpen, setPopover] = useState(false); @@ -40,15 +39,9 @@ export const DetailPanelAlertActions = ({ }, [isPopoverOpen]); const onJumpToAlert = useCallback(() => { - if (!event.process?.entity_id) { - return; - } - const process = new ProcessImpl(event.process.entity_id); - process.addEvent(event); - - onProcessSelected(process); + onJumpToEvent(event); setPopover(false); - }, [event, onProcessSelected]); + }, [event, onJumpToEvent]); const onShowDetails = useCallback(() => { if (event.kibana?.alert?.uuid) { diff --git a/x-pack/plugins/session_view/public/components/detail_panel_alert_group_item/index.tsx b/x-pack/plugins/session_view/public/components/detail_panel_alert_group_item/index.tsx index 937d580eeb9c5..c2f1e8d5a0494 100644 --- a/x-pack/plugins/session_view/public/components/detail_panel_alert_group_item/index.tsx +++ b/x-pack/plugins/session_view/public/components/detail_panel_alert_group_item/index.tsx @@ -6,7 +6,7 @@ */ import React, { useMemo } from 'react'; import { EuiIcon, EuiText, EuiAccordion, EuiNotificationBadge } from '@elastic/eui'; -import { Process, ProcessEvent } from '../../../common/types/process_tree'; +import { ProcessEvent } from '../../../common/types/process_tree'; import { ALERT_COUNT_THRESHOLD } from '../../../common/constants'; import { dataOrDash } from '../../utils/data_or_dash'; import { useStyles } from '../detail_panel_alert_list_item/styles'; @@ -18,7 +18,7 @@ export const ALERT_GROUP_ITEM_TITLE_TEST_ID = 'sessionView:detailPanelAlertGroup interface DetailPanelAlertsGroupItemDeps { alerts: ProcessEvent[]; - onProcessSelected: (process: Process) => void; + onJumpToEvent: (event: ProcessEvent) => void; onShowAlertDetails: (alertId: string) => void; } @@ -27,7 +27,7 @@ interface DetailPanelAlertsGroupItemDeps { */ export const DetailPanelAlertGroupItem = ({ alerts, - onProcessSelected, + onJumpToEvent, onShowAlertDetails, }: DetailPanelAlertsGroupItemDeps) => { const styles = useStyles(); @@ -75,7 +75,7 @@ export const DetailPanelAlertGroupItem = ({ key={key} minimal event={event} - onProcessSelected={onProcessSelected} + onJumpToEvent={onJumpToEvent} onShowAlertDetails={onShowAlertDetails} /> ); diff --git a/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/index.tsx b/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/index.tsx index d8203b65d037a..b85b3e809e356 100644 --- a/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/index.tsx +++ b/x-pack/plugins/session_view/public/components/detail_panel_alert_list_item/index.tsx @@ -16,7 +16,7 @@ import { EuiPanel, EuiHorizontalRule, } from '@elastic/eui'; -import { Process, ProcessEvent } from '../../../common/types/process_tree'; +import { ProcessEvent } from '../../../common/types/process_tree'; import { useStyles } from './styles'; import { DetailPanelAlertActions } from '../detail_panel_alert_actions'; import { dataOrDash } from '../../utils/data_or_dash'; @@ -28,7 +28,7 @@ export const ALERT_LIST_ITEM_TIMESTAMP_TEST_ID = 'sessionView:detailPanelAlertLi interface DetailPanelAlertsListItemDeps { event: ProcessEvent; onShowAlertDetails: (alertId: string) => void; - onProcessSelected: (process: Process) => void; + onJumpToEvent: (event: ProcessEvent) => void; isInvestigated?: boolean; minimal?: boolean; } @@ -38,7 +38,7 @@ interface DetailPanelAlertsListItemDeps { */ export const DetailPanelAlertListItem = ({ event, - onProcessSelected, + onJumpToEvent, onShowAlertDetails, isInvestigated, minimal, @@ -50,8 +50,10 @@ export const DetailPanelAlertListItem = ({ } const timestamp = event['@timestamp']; - const rule = { ...event.kibana?.alert?.rule, uuid: '', name: '' }; - const { uuid, name } = rule; + const rule = event.kibana?.alert?.rule; + const uuid = rule?.uuid || ''; + const name = rule?.name || ''; + const { args } = event.process ?? {}; const forceState = !isInvestigated ? 'open' : undefined; @@ -69,7 +71,7 @@ export const DetailPanelAlertListItem = ({ @@ -104,7 +106,7 @@ export const DetailPanelAlertListItem = ({ extraAction={ } diff --git a/x-pack/plugins/session_view/public/components/detail_panel_alert_tab/index.test.tsx b/x-pack/plugins/session_view/public/components/detail_panel_alert_tab/index.test.tsx index 2beabfcb4cdb9..676757666af51 100644 --- a/x-pack/plugins/session_view/public/components/detail_panel_alert_tab/index.test.tsx +++ b/x-pack/plugins/session_view/public/components/detail_panel_alert_tab/index.test.tsx @@ -35,12 +35,12 @@ describe('DetailPanelAlertTab component', () => { let render: () => ReturnType; let renderResult: ReturnType; let mockedContext: AppContextTestRender; - let mockOnProcessSelected = jest.fn((process) => process); + let mockOnJumpToEvent = jest.fn((process) => process); let mockShowAlertDetails = jest.fn((alertId) => alertId); beforeEach(() => { mockedContext = createAppRootMockRenderer(); - mockOnProcessSelected = jest.fn((process) => process); + mockOnJumpToEvent = jest.fn((process) => process); mockShowAlertDetails = jest.fn((alertId) => alertId); }); @@ -49,7 +49,7 @@ describe('DetailPanelAlertTab component', () => { renderResult = mockedContext.render( ); @@ -68,7 +68,7 @@ describe('DetailPanelAlertTab component', () => { renderResult = mockedContext.render( ); @@ -89,9 +89,9 @@ describe('DetailPanelAlertTab component', () => { renderResult = mockedContext.render( ); @@ -106,9 +106,9 @@ describe('DetailPanelAlertTab component', () => { renderResult = mockedContext.render( ); @@ -139,7 +139,7 @@ describe('DetailPanelAlertTab component', () => { renderResult = mockedContext.render( ); @@ -171,7 +171,7 @@ describe('DetailPanelAlertTab component', () => { renderResult = mockedContext.render( ); @@ -205,7 +205,7 @@ describe('DetailPanelAlertTab component', () => { renderResult = mockedContext.render( ); @@ -223,7 +223,7 @@ describe('DetailPanelAlertTab component', () => { renderResult = mockedContext.render( ); @@ -240,7 +240,7 @@ describe('DetailPanelAlertTab component', () => { renderResult = mockedContext.render( ); diff --git a/x-pack/plugins/session_view/public/components/detail_panel_alert_tab/index.tsx b/x-pack/plugins/session_view/public/components/detail_panel_alert_tab/index.tsx index 83a4c1c5b5330..c8d32a833d369 100644 --- a/x-pack/plugins/session_view/public/components/detail_panel_alert_tab/index.tsx +++ b/x-pack/plugins/session_view/public/components/detail_panel_alert_tab/index.tsx @@ -9,7 +9,7 @@ import { EuiEmptyPrompt, EuiButtonGroup, EuiHorizontalRule } from '@elastic/eui' import { i18n } from '@kbn/i18n'; import { FormattedMessage } from '@kbn/i18n-react'; import { groupBy } from 'lodash'; -import { ProcessEvent, Process } from '../../../common/types/process_tree'; +import { ProcessEvent } from '../../../common/types/process_tree'; import { useStyles } from './styles'; import { DetailPanelAlertListItem } from '../detail_panel_alert_list_item'; import { DetailPanelAlertGroupItem } from '../detail_panel_alert_group_item'; @@ -20,9 +20,9 @@ export const VIEW_MODE_TOGGLE = 'sessionView:detailPanelAlertsViewMode'; interface DetailPanelAlertTabDeps { alerts: ProcessEvent[]; - onProcessSelected: (process: Process) => void; + onJumpToEvent: (event: ProcessEvent) => void; onShowAlertDetails: (alertId: string) => void; - investigatedAlert?: ProcessEvent; + investigatedAlertId?: string; } const VIEW_MODE_LIST = 'listView'; @@ -33,9 +33,9 @@ const VIEW_MODE_GROUP = 'groupView'; */ export const DetailPanelAlertTab = ({ alerts, - onProcessSelected, + onJumpToEvent, onShowAlertDetails, - investigatedAlert, + investigatedAlertId, }: DetailPanelAlertTabDeps) => { const styles = useStyles(); const [viewMode, setViewMode] = useState(VIEW_MODE_LIST); @@ -54,18 +54,18 @@ export const DetailPanelAlertTab = ({ }, ]; - const filteredAlerts = useMemo(() => { - return alerts.filter((event) => { - const isInvestigatedAlert = - event.kibana?.alert?.uuid && - event.kibana?.alert?.uuid === investigatedAlert?.kibana?.alert?.uuid; - return !isInvestigatedAlert; - }); - }, [investigatedAlert, alerts]); + const investigatedAlert = useMemo(() => { + return ( + investigatedAlertId && + alerts.find((event) => { + return event.kibana?.alert?.uuid === investigatedAlertId; + }) + ); + }, [investigatedAlertId, alerts]); const groupedAlerts = useMemo(() => { - return groupBy(filteredAlerts, (event) => event.kibana?.alert?.rule?.uuid); - }, [filteredAlerts]); + return groupBy(alerts, (event) => event.kibana?.alert?.rule?.uuid); + }, [alerts]); if (alerts.length === 0) { return ( @@ -109,7 +109,7 @@ export const DetailPanelAlertTab = ({
@@ -118,29 +118,34 @@ export const DetailPanelAlertTab = ({ )} {viewMode === VIEW_MODE_LIST - ? filteredAlerts.map((event) => { + ? alerts.map((event) => { const key = event.kibana?.alert?.uuid; - return ( - - ); + if (key && event !== investigatedAlert) { + return ( + + ); + } }) : Object.keys(groupedAlerts).map((ruleId: string) => { const alertsByRule = groupedAlerts[ruleId]; + const key = alertsByRule[0].kibana?.alert?.rule?.uuid; - return ( - - ); + if (key) { + return ( + + ); + } })}
); diff --git a/x-pack/plugins/session_view/public/components/process_tree/helpers.ts b/x-pack/plugins/session_view/public/components/process_tree/helpers.ts index 60d762e46ab78..064f11c10a736 100644 --- a/x-pack/plugins/session_view/public/components/process_tree/helpers.ts +++ b/x-pack/plugins/session_view/public/components/process_tree/helpers.ts @@ -5,8 +5,8 @@ * 2.0. */ import { - EventKind, AlertStatusEventEntityIdMap, + EventKind, Process, ProcessEvent, ProcessMap, @@ -55,7 +55,7 @@ export const updateProcessMap = (processMap: ProcessMap, events: ProcessEvent[]) processMap[id] = process; } - if (event.event?.kind === EventKind.signal) { + if (event.kibana?.alert) { process.addAlert(event); } else if (event.event?.kind === EventKind.event) { process.addEvent(event); diff --git a/x-pack/plugins/session_view/public/components/process_tree/hooks.ts b/x-pack/plugins/session_view/public/components/process_tree/hooks.ts index 4898ea0ec442c..009b839f6d55c 100644 --- a/x-pack/plugins/session_view/public/components/process_tree/hooks.ts +++ b/x-pack/plugins/session_view/public/components/process_tree/hooks.ts @@ -79,6 +79,10 @@ export class ProcessImpl implements Process { // This option is driven by the "verbose mode" toggle in SessionView/index.tsx if (!verboseMode) { return children.filter((child) => { + if (child.events.length === 0) { + return false; + } + const { group_leader: groupLeader, session_leader: sessionLeader } = child.getDetails().process ?? {}; @@ -109,6 +113,14 @@ export class ProcessImpl implements Process { return !!this.alerts.length; } + hasAlert(alertUuid: string | undefined) { + if (!alertUuid) { + return false; + } + + return !!this.alerts.find((event) => event.kibana?.alert?.uuid === alertUuid); + } + getAlerts() { return this.alerts; } @@ -152,6 +164,10 @@ export class ProcessImpl implements Process { isUserEntered() { const event = this.getDetails(); + if (!event) { + return false; + } + const { pid, tty, @@ -224,6 +240,8 @@ export const useProcessTree = ({ const sessionLeaderProcess = new ProcessImpl(sessionEntityId); if (fakeLeaderEvent) { + fakeLeaderEvent.user = fakeLeaderEvent?.process?.entry_leader?.user; + fakeLeaderEvent.group = fakeLeaderEvent?.process?.entry_leader?.group; fakeLeaderEvent.process = { ...fakeLeaderEvent.process, ...fakeLeaderEvent.process?.entry_leader, @@ -279,7 +297,8 @@ export const useProcessTree = ({ // currently we are loading a single page of alerts, with no pagination // so we only need to add these alert events to processMap once. if (!alertsProcessed) { - updateProcessMap(processMap, alerts); + const updatedProcessMap = updateProcessMap(processMap, alerts); + setProcessMap({ ...updatedProcessMap }); setAlertsProcessed(true); } }, [processMap, alerts, alertsProcessed]); diff --git a/x-pack/plugins/session_view/public/components/process_tree/index.test.tsx b/x-pack/plugins/session_view/public/components/process_tree/index.test.tsx index e6cfb120939a5..4dfb00025f35a 100644 --- a/x-pack/plugins/session_view/public/components/process_tree/index.test.tsx +++ b/x-pack/plugins/session_view/public/components/process_tree/index.test.tsx @@ -78,7 +78,11 @@ describe('ProcessTree component', () => { expect(process?.id).toBe(jumpToEvent.process!.entity_id!); }); renderResult = mockedContext.render( - + ); expect(renderResult.queryByTestId('sessionView:sessionViewProcessTree')).toBeTruthy(); expect(renderResult.queryAllByTestId('sessionView:processTreeNode')).toBeTruthy(); diff --git a/x-pack/plugins/session_view/public/components/process_tree/index.tsx b/x-pack/plugins/session_view/public/components/process_tree/index.tsx index d094d3a22c4f0..2478119801074 100644 --- a/x-pack/plugins/session_view/public/components/process_tree/index.tsx +++ b/x-pack/plugins/session_view/public/components/process_tree/index.tsx @@ -28,7 +28,8 @@ export interface ProcessTreeDeps { data: ProcessEventsPage[]; alerts: ProcessEvent[]; - jumpToEvent?: ProcessEvent; + jumpToEntityId?: string; + investigatedAlertId?: string; isFetching: boolean; hasNextPage: boolean | undefined; hasPreviousPage: boolean | undefined; @@ -54,7 +55,8 @@ export const ProcessTree = ({ sessionEntityId, data, alerts, - jumpToEvent, + jumpToEntityId, + investigatedAlertId, isFetching, hasNextPage, hasPreviousPage, @@ -169,22 +171,24 @@ export const ProcessTree = ({ }, [selectedProcess, selectProcess]); useEffect(() => { - // after 2 pages are loaded (due to bi-directional jump to), auto select the process - // for the jumpToEvent - if (!selectedProcess && jumpToEvent) { - const process = processMap[jumpToEvent.process?.entity_id ?? '']; + if (jumpToEntityId) { + const process = processMap[jumpToEntityId]; + const hasDetails = !!process?.getDetails(); - if (process && jumpToEvent.process?.entity_id) { + if (!selectedProcess && hasDetails) { onProcessSelected(process); - } else { - // auto selects the session leader process if jumpToEvent is not found in processMap - onProcessSelected(sessionLeader); } } else if (!selectedProcess) { - // auto selects the session leader process if no selection is made yet onProcessSelected(sessionLeader); } - }, [jumpToEvent, processMap, onProcessSelected, selectProcess, selectedProcess, sessionLeader]); + }, [ + jumpToEntityId, + processMap, + onProcessSelected, + selectProcess, + selectedProcess, + sessionLeader, + ]); return ( <> @@ -203,8 +207,8 @@ export const ProcessTree = ({ isSessionLeader process={sessionLeader} onProcessSelected={onProcessSelected} - jumpToEventID={jumpToEvent?.process?.entity_id} - jumpToAlertID={jumpToEvent?.kibana?.alert?.uuid} + jumpToEntityId={jumpToEntityId} + investigatedAlertId={investigatedAlertId} selectedProcessId={selectedProcess?.id} scrollerRef={scrollerRef} onChangeJumpToEventVisibility={onChangeJumpToEventVisibility} diff --git a/x-pack/plugins/session_view/public/components/process_tree_alerts/index.tsx b/x-pack/plugins/session_view/public/components/process_tree_alerts/index.tsx index c5a422df9abe7..92581c8654bc6 100644 --- a/x-pack/plugins/session_view/public/components/process_tree_alerts/index.tsx +++ b/x-pack/plugins/session_view/public/components/process_tree_alerts/index.tsx @@ -13,7 +13,7 @@ import { MOUSE_EVENT_PLACEHOLDER } from '../../../common/constants'; export interface ProcessTreeAlertsDeps { alerts: ProcessEvent[]; - jumpToAlertID?: string; + investigatedAlertId?: string; isProcessSelected?: boolean; onAlertSelected: (e: MouseEvent) => void; onShowAlertDetails: (alertUuid: string) => void; @@ -21,7 +21,7 @@ export interface ProcessTreeAlertsDeps { export function ProcessTreeAlerts({ alerts, - jumpToAlertID, + investigatedAlertId, isProcessSelected = false, onAlertSelected, onShowAlertDetails, @@ -30,13 +30,14 @@ export function ProcessTreeAlerts({ const styles = useStyles(); useEffect(() => { - const jumpToAlert = alerts.find( - (alert) => alert.kibana?.alert?.uuid && alert.kibana?.alert?.uuid === jumpToAlertID - ); - if (jumpToAlertID && jumpToAlert) { + const jumpToAlert = + investigatedAlertId && + alerts.find((alert) => alert.kibana?.alert?.uuid === investigatedAlertId); + + if (jumpToAlert) { setSelectedAlert(jumpToAlert.kibana?.alert!); } - }, [jumpToAlertID, alerts]); + }, [investigatedAlertId, alerts]); const scrollerRef = useRef(null); @@ -86,7 +87,7 @@ export function ProcessTreeAlerts({ { let render: () => ReturnType; let renderResult: ReturnType; let mockedContext: AppContextTestRender; + const props: ProcessDeps = { process: processMock, scrollerRef: { @@ -96,6 +98,13 @@ describe('ProcessTreeNode component', () => { }); it('calls onChangeJumpToEventVisibility with isVisible false if jumpToEvent is not visible', async () => { + const processWithAlerts: typeof processMock = { + ...processMock, + getAlerts: () => { + return mockAlerts; + }, + }; + const onChangeJumpToEventVisibility = jest.fn(); const scrollerRef = { current: { @@ -111,13 +120,15 @@ describe('ProcessTreeNode component', () => { renderResult = mockedContext.render( ); jest.advanceTimersByTime(DEBOUNCE_TIMEOUT); + expect(onChangeJumpToEventVisibility).toHaveBeenCalled(); }); diff --git a/x-pack/plugins/session_view/public/components/process_tree_node/index.tsx b/x-pack/plugins/session_view/public/components/process_tree_node/index.tsx index fabceb300c04f..94fb8eec31fc5 100644 --- a/x-pack/plugins/session_view/public/components/process_tree_node/index.tsx +++ b/x-pack/plugins/session_view/public/components/process_tree_node/index.tsx @@ -38,8 +38,8 @@ export interface ProcessDeps { isSessionLeader?: boolean; depth?: number; onProcessSelected?: (process: Process) => void; - jumpToEventID?: string; - jumpToAlertID?: string; + jumpToEntityId?: string; + investigatedAlertId?: string; selectedProcessId?: string; timeStampOn?: boolean; verboseModeOn?: boolean; @@ -57,8 +57,8 @@ export function ProcessTreeNode({ isSessionLeader = false, depth = 0, onProcessSelected, - jumpToEventID, - jumpToAlertID, + jumpToEntityId, + investigatedAlertId, selectedProcessId, timeStampOn = true, verboseModeOn = true, @@ -83,9 +83,11 @@ export function ProcessTreeNode({ () => !!( hasAlerts && - alerts.find((alert) => jumpToAlertID && jumpToAlertID === alert.kibana?.alert?.uuid) + alerts.find( + (alert) => investigatedAlertId && investigatedAlertId === alert.kibana?.alert?.uuid + ) ), - [hasAlerts, alerts, jumpToAlertID] + [hasAlerts, alerts, investigatedAlertId] ); const isSelected = selectedProcessId === process.id; const styles = useStyles({ depth, hasAlerts, hasInvestigatedAlert, isSelected }); @@ -93,10 +95,13 @@ export function ProcessTreeNode({ const nodeRef = useVisible({ viewPortEl: scrollerRef.current, - visibleCallback: (isVisible, isAbove) => { - onChangeJumpToEventVisibility(isVisible, isAbove); - }, - shouldAddListener: jumpToEventID === process.id, + visibleCallback: useCallback( + (isVisible, isAbove) => { + onChangeJumpToEventVisibility(isVisible, isAbove); + }, + [onChangeJumpToEventVisibility] + ), + shouldAddListener: hasInvestigatedAlert, }); // Automatically expand alerts list when investigating an alert @@ -206,7 +211,7 @@ export function ProcessTreeNode({ const shouldRenderChildren = childrenExpanded && children?.length > 0; const childrenTreeDepth = depth + 1; - const showUserEscalation = !!user?.id && user.id !== parent?.user?.id; + const showUserEscalation = !isSessionLeader && !!user?.id && user.id !== parent?.user?.id; const interactiveSession = !!tty; const sessionIcon = interactiveSession ? 'desktop' : 'gear'; const iconTestSubj = hasExec @@ -289,7 +294,7 @@ export function ProcessTreeNode({ {alertsExpanded && ( { const { http } = useKibana().services; - const [isJumpToFirstPage, setIsJumpToFirstPage] = useState(false); - const jumpToCursor = jumpToEvent && jumpToEvent.process?.start; - const cachingKeys = [QUERY_KEY_PROCESS_EVENTS, sessionEntityId]; + const [currentJumpToCursor, setCurrentJumpToCursor] = useState(''); + const cachingKeys = useMemo( + () => [QUERY_KEY_PROCESS_EVENTS, sessionEntityId, jumpToCursor], + [sessionEntityId, jumpToCursor] + ); const query = useInfiniteQuery( cachingKeys, @@ -58,15 +60,21 @@ export const useFetchSessionViewProcessEvents = ( getNextPageParam: (lastPage) => { if (lastPage.events.length === PROCESS_EVENTS_PER_PAGE) { return { - cursor: lastPage.events[lastPage.events.length - 1].process?.start, + cursor: lastPage.events[lastPage.events.length - 1]['@timestamp'], forward: true, }; } }, - getPreviousPageParam: (firstPage) => { - if (jumpToEvent && firstPage.events.length === PROCESS_EVENTS_PER_PAGE) { + getPreviousPageParam: (firstPage, pages) => { + const atBeginning = pages.length > 1 && firstPage.events.length < PROCESS_EVENTS_PER_PAGE; + + if (jumpToCursor && !atBeginning) { + // it's possible the first page returned no events + // fallback to using jumpToCursor if there are no "forward" events. + const cursor = firstPage.events?.[0]?.['@timestamp'] || jumpToCursor; + return { - cursor: firstPage.events[0].process?.start, + cursor, forward: false, }; } @@ -78,11 +86,11 @@ export const useFetchSessionViewProcessEvents = ( ); useEffect(() => { - if (jumpToEvent && query.data?.pages.length === 1 && !isJumpToFirstPage) { + if (jumpToCursor && query.data?.pages.length === 1 && jumpToCursor !== currentJumpToCursor) { query.fetchPreviousPage({ cancelRefetch: true }); - setIsJumpToFirstPage(true); + setCurrentJumpToCursor(jumpToCursor); } - }, [jumpToEvent, query, isJumpToFirstPage]); + }, [jumpToCursor, query, currentJumpToCursor]); return query; }; diff --git a/x-pack/plugins/session_view/public/components/session_view/index.tsx b/x-pack/plugins/session_view/public/components/session_view/index.tsx index 58494061d36f0..1cd7ae60cc3dd 100644 --- a/x-pack/plugins/session_view/public/components/session_view/index.tsx +++ b/x-pack/plugins/session_view/public/components/session_view/index.tsx @@ -17,7 +17,11 @@ import { import { FormattedMessage } from '@kbn/i18n-react'; import { SectionLoading } from '../../shared_imports'; import { ProcessTree } from '../process_tree'; -import { AlertStatusEventEntityIdMap, Process } from '../../../common/types/process_tree'; +import { + AlertStatusEventEntityIdMap, + Process, + ProcessEvent, +} from '../../../common/types/process_tree'; import { DisplayOptionsState } from '../../../common/types/session_view'; import { SessionViewDeps } from '../../types'; import { SessionViewDetailPanel } from '../session_view_detail_panel'; @@ -36,9 +40,17 @@ import { export const SessionView = ({ sessionEntityId, height, - jumpToEvent, + jumpToEntityId, + jumpToCursor, + investigatedAlertId, loadAlertDetails, }: SessionViewDeps) => { + // don't engage jumpTo if jumping to session leader. + if (jumpToEntityId === sessionEntityId) { + jumpToEntityId = undefined; + jumpToCursor = undefined; + } + const [isDetailOpen, setIsDetailOpen] = useState(false); const [selectedProcess, setSelectedProcess] = useState(null); const [searchQuery, setSearchQuery] = useState(''); @@ -49,6 +61,8 @@ export const SessionView = ({ }); const [fetchAlertStatus, setFetchAlertStatus] = useState([]); const [updatedAlertsStatus, setUpdatedAlertsStatus] = useState({}); + const [currentJumpToCursor, setCurrentJumpToCursor] = useState(jumpToCursor); + const [currentJumpToEntityId, setCurrentJumpToEntityId] = useState(jumpToEntityId); const styles = useStyles({ height }); @@ -56,6 +70,25 @@ export const SessionView = ({ setSelectedProcess(process); }, []); + const onJumpToEvent = useCallback( + (event: ProcessEvent) => { + if (event.process) { + const { entity_id: entityId } = event.process; + if (entityId !== sessionEntityId) { + const alert = event.kibana?.alert; + const cursor = alert ? alert?.original_time : event['@timestamp']; + + if (cursor) { + setCurrentJumpToEntityId(entityId); + setCurrentJumpToCursor(cursor); + } + } + setSelectedProcess(null); + } + }, + [sessionEntityId] + ); + const { data, error, @@ -64,7 +97,7 @@ export const SessionView = ({ isFetching, fetchPreviousPage, hasPreviousPage, - } = useFetchSessionViewProcessEvents(sessionEntityId, jumpToEvent); + } = useFetchSessionViewProcessEvents(sessionEntityId, currentJumpToCursor); const alertsQuery = useFetchSessionViewAlerts(sessionEntityId); const { data: alerts, error: alertsError, isFetching: alertsFetching } = alertsQuery; @@ -214,13 +247,15 @@ export const SessionView = ({ {hasData && (
diff --git a/x-pack/plugins/session_view/public/components/session_view_detail_panel/index.test.tsx b/x-pack/plugins/session_view/public/components/session_view_detail_panel/index.test.tsx index 44f4e08203890..75d04cbf6833b 100644 --- a/x-pack/plugins/session_view/public/components/session_view_detail_panel/index.test.tsx +++ b/x-pack/plugins/session_view/public/components/session_view_detail_panel/index.test.tsx @@ -17,12 +17,12 @@ describe('SessionView component', () => { let render: () => ReturnType; let renderResult: ReturnType; let mockedContext: AppContextTestRender; - let mockOnProcessSelected = jest.fn((process) => process); + let mockOnJumpToEvent = jest.fn((process) => process); let mockShowAlertDetails = jest.fn((alertId) => alertId); beforeEach(() => { mockedContext = createAppRootMockRenderer(); - mockOnProcessSelected = jest.fn((process) => process); + mockOnJumpToEvent = jest.fn((process) => process); mockShowAlertDetails = jest.fn((alertId) => alertId); }); @@ -31,7 +31,7 @@ describe('SessionView component', () => { renderResult = mockedContext.render( ); @@ -42,7 +42,7 @@ describe('SessionView component', () => { renderResult = mockedContext.render( ); @@ -53,7 +53,7 @@ describe('SessionView component', () => { renderResult = mockedContext.render( ); @@ -68,7 +68,7 @@ describe('SessionView component', () => { ); @@ -81,7 +81,7 @@ describe('SessionView component', () => { ); diff --git a/x-pack/plugins/session_view/public/components/session_view_detail_panel/index.tsx b/x-pack/plugins/session_view/public/components/session_view_detail_panel/index.tsx index 2fedd5aa607c6..c2e8eec173422 100644 --- a/x-pack/plugins/session_view/public/components/session_view_detail_panel/index.tsx +++ b/x-pack/plugins/session_view/public/components/session_view_detail_panel/index.tsx @@ -19,8 +19,8 @@ import { ALERT_COUNT_THRESHOLD } from '../../../common/constants'; interface SessionViewDetailPanelDeps { selectedProcess: Process | undefined; alerts?: ProcessEvent[]; - investigatedAlert?: ProcessEvent; - onProcessSelected: (process: Process) => void; + investigatedAlertId?: string; + onJumpToEvent: (event: ProcessEvent) => void; onShowAlertDetails: (alertId: string) => void; } @@ -30,8 +30,8 @@ interface SessionViewDetailPanelDeps { export const SessionViewDetailPanel = ({ alerts, selectedProcess, - investigatedAlert, - onProcessSelected, + investigatedAlertId, + onJumpToEvent, onShowAlertDetails, }: SessionViewDetailPanelDeps) => { const [selectedTabId, setSelectedTabId] = useState('process'); @@ -76,9 +76,9 @@ export const SessionViewDetailPanel = ({ content: alerts && ( ), }, @@ -88,9 +88,9 @@ export const SessionViewDetailPanel = ({ alertsCount, processDetail, selectedProcess?.events, - onProcessSelected, onShowAlertDetails, - investigatedAlert, + investigatedAlertId, + onJumpToEvent, ]); const onSelectedTabChanged = useCallback((id: string) => { diff --git a/x-pack/plugins/session_view/public/hooks/use_visible.ts b/x-pack/plugins/session_view/public/hooks/use_visible.ts index 19f628819fb56..70e671337f7f8 100644 --- a/x-pack/plugins/session_view/public/hooks/use_visible.ts +++ b/x-pack/plugins/session_view/public/hooks/use_visible.ts @@ -4,7 +4,7 @@ * 2.0; you may not use this file except in compliance with the Elastic License * 2.0. */ -import { useRef, MutableRefObject, useEffect } from 'react'; +import { useRef, MutableRefObject, useEffect, useMemo } from 'react'; import { debounce } from 'lodash'; import { DEBOUNCE_TIMEOUT } from '../../common/constants'; @@ -34,32 +34,37 @@ export function useVisible({ }: IUseVisibleDeps): MutableRefObject { const currentElement = useRef(null); - const onScroll = debounce(() => { - if (!currentElement.current || !viewPortEl) { - return; - } + const onScroll = useMemo( + () => + debounce(() => { + if (!currentElement.current || !viewPortEl) { + return; + } - const { height: elHeight, y: elTop } = currentElement.current.getBoundingClientRect(); - const { y: viewPortElTop } = viewPortEl.getBoundingClientRect(); + const { height: elHeight, y: elTop } = currentElement.current.getBoundingClientRect(); + const { y: viewPortElTop } = viewPortEl.getBoundingClientRect(); - const viewPortElBottom = viewPortElTop + viewPortEl.clientHeight; - const elBottom = elTop + elHeight; - const isVisible = elBottom + offset >= viewPortElTop && elTop - offset <= viewPortElBottom; + const viewPortElBottom = viewPortElTop + viewPortEl.clientHeight; + const elBottom = elTop + elHeight; + const isVisible = elBottom + offset >= viewPortElTop && elTop - offset <= viewPortElBottom; - // if elBottom + offset < viewPortElTop, the currentElement is above the current scroll window - visibleCallback(isVisible, elBottom + offset < viewPortElTop); - }, debounceTimeout); + // if elBottom + offset < viewPortElTop, the currentElement is above the current scroll window + visibleCallback(isVisible, elBottom + offset < viewPortElTop); + }, debounceTimeout), + [debounceTimeout, offset, viewPortEl, visibleCallback] + ); useEffect(() => { if (shouldAddListener) { viewPortEl?.addEventListener('scroll', onScroll); } + return () => { if (shouldAddListener) { viewPortEl?.removeEventListener('scroll', onScroll); } }; - }); + }, [onScroll, viewPortEl, shouldAddListener]); return currentElement; } diff --git a/x-pack/plugins/session_view/public/types.ts b/x-pack/plugins/session_view/public/types.ts index 043d3788ca258..5d4299571995a 100644 --- a/x-pack/plugins/session_view/public/types.ts +++ b/x-pack/plugins/session_view/public/types.ts @@ -6,7 +6,7 @@ */ import { ReactNode } from 'react'; import { CoreStart } from '../../../../src/core/public'; -import { ProcessEvent, Teletype } from '../common/types/process_tree'; +import { Teletype } from '../common/types/process_tree'; export type SessionViewServices = CoreStart; @@ -14,9 +14,14 @@ export interface SessionViewDeps { // the root node of the process tree to render. e.g process.entry.entity_id or process.session_leader.entity_id sessionEntityId: string; height?: string; + // if provided, the session view will jump to and select the provided event if it belongs to the session leader // session view will fetch a page worth of events starting from jumpToEvent as well as a page backwards. - jumpToEvent?: ProcessEvent; + jumpToEntityId?: string; + jumpToCursor?: string; + + // when loading session viewer from an alert, this prop can be set to add extra UX to keep the focus on the alert + investigatedAlertId?: string; // Callback to open the alerts flyout loadAlertDetails?: ( alertUuid: string, diff --git a/x-pack/plugins/session_view/server/routes/process_events_route.ts b/x-pack/plugins/session_view/server/routes/process_events_route.ts index 0dc864c51a07d..ced65c3c62f19 100644 --- a/x-pack/plugins/session_view/server/routes/process_events_route.ts +++ b/x-pack/plugins/session_view/server/routes/process_events_route.ts @@ -51,13 +51,8 @@ export const doSearch = async ( }, }, size: PROCESS_EVENTS_PER_PAGE, - // we first sort by process.start, this allows lifecycle events to load all at once for a given process, and - // avoid issues like where the session leaders 'end' event is loaded at the very end of what could be multiple pages of events - sort: [ - { 'process.start': forward ? 'asc' : 'desc' }, - { '@timestamp': forward ? 'asc' : 'desc' }, - ], - search_after: cursor ? [cursor, cursor] : undefined, + sort: [{ '@timestamp': forward ? 'asc' : 'desc' }], + search_after: cursor ? [cursor] : undefined, }, }); From f2266afdda447f824495b65ca212d6b068c2a2cc Mon Sep 17 00:00:00 2001 From: Stacey Gammon Date: Tue, 5 Apr 2022 18:34:01 -0400 Subject: [PATCH 18/47] remove bad link (#129538) --- nav-kibana-dev.docnav.json | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/nav-kibana-dev.docnav.json b/nav-kibana-dev.docnav.json index 96d7dec7e430a..8542855dbcfe6 100644 --- a/nav-kibana-dev.docnav.json +++ b/nav-kibana-dev.docnav.json @@ -61,8 +61,8 @@ }, { "id": "kibDevTutorialCI" }, { "id": "kibDevTutorialServerEndpoint" }, - { "id": "kibDevTutorialAdvancedSettings"}, - { "id": "kibDevSharePluginReadme"} + { "id": "kibDevTutorialAdvancedSettings" }, + { "id": "kibDevSharePluginReadme" } ] }, { @@ -103,7 +103,6 @@ { "id": "kibDataViewsPluginApi" }, { "id": "kibDataQueryPluginApi" }, { "id": "kibDataSearchPluginApi" }, - { "id": "kibDataUiPluginApi" }, { "id": "kibBfetchPluginApi" }, { "id": "kibAlertingPluginApi" }, { "id": "kibTaskManagerPluginApi" }, From 60e06c39970f4ce518d6afb167878c9b6ea9407c Mon Sep 17 00:00:00 2001 From: Justin Ibarra Date: Tue, 5 Apr 2022 14:50:43 -0800 Subject: [PATCH 19/47] [Detection Rules] Add 8.2 rules (#129526) --- ...tion_added_to_google_workspace_domain.json | 2 +- ...ion_email_powershell_exchange_mailbox.json | 13 +- ...llection_microsoft_365_new_inbox_rule.json | 4 +- .../collection_posh_audio_capture.json | 6 +- .../collection_posh_keylogger.json | 6 +- .../collection_posh_screen_grabber.json | 5 +- .../collection_winrar_encryption.json | 3 +- ...d_control_certutil_network_connection.json | 6 +- ...ommand_and_control_common_webservices.json | 5 +- ...nd_and_control_dns_tunneling_nslookup.json | 3 +- ...control_encrypted_channel_freesslcert.json | 3 +- ...ontrol_port_forwarding_added_registry.json | 3 +- ...te_desktop_protocol_from_the_internet.json | 4 +- .../command_and_control_rdp_tunnel_plink.json | 3 +- ...ol_remote_file_copy_desktopimgdownldr.json | 3 +- ...and_control_remote_file_copy_mpcmdrun.json | 4 +- ...d_control_teamviewer_remote_file_copy.json | 3 +- ...mand_and_control_telnet_port_activity.json | 4 +- ...d_and_control_tunneling_via_earthworm.json | 3 +- ...ccess_to_browser_credentials_procargs.json | 3 +- .../credential_access_cmdline_dump_tool.json | 3 +- ...s_cookies_chromium_browsers_debugging.json | 3 +- ...ess_copy_ntds_sam_volshadowcp_cmdline.json | 3 +- ...ial_access_credential_dumping_msbuild.json | 3 +- ...edential_access_credentials_keychains.json | 3 +- ...tial_access_dcsync_replication_rights.json | 4 +- ...ntial_access_disable_kerberos_preauth.json | 8 +- ...cess_domain_backup_dpapi_private_keys.json | 4 +- ...credential_access_dump_registry_hives.json | 3 +- ...tial_access_dumping_keychain_security.json | 3 +- ...ntial_access_iis_apppoolsa_pwd_appcmd.json | 3 +- ..._access_iis_connectionstrings_dumping.json | 3 +- ..._access_kerberoasting_unusual_process.json | 3 +- ...s_keychain_pwd_retrieval_security_cmd.json | 3 +- ...ial_access_lsass_memdump_file_created.json | 5 +- ...al_access_lsass_memdump_handle_access.json | 60 ++++ ...redential_access_mfa_push_brute_force.json | 5 +- ...l_access_mimikatz_memssp_default_logs.json | 3 +- ..._access_mod_wdigest_security_provider.json | 6 +- ...l_access_moving_registry_hive_via_smb.json | 74 ++++ ...e_network_logon_provider_modification.json | 4 +- .../credential_access_posh_minidump.json | 4 +- ...credential_access_posh_request_ticket.json | 5 +- ..._potential_lsa_memdump_via_mirrordump.json | 3 +- ...al_access_promt_for_pwd_via_osascript.json | 3 +- ...dential_access_remote_sam_secretsdump.json | 72 ++++ ...redential_access_saved_creds_vaultcmd.json | 3 +- ...edelegationprivilege_assigned_to_user.json | 11 +- ...dential_access_spn_attribute_modified.json | 62 ++++ .../credential_access_ssh_backdoor_log.json | 3 +- ...l_access_suspicious_comsvcs_imageload.json | 3 +- ...ccess_suspicious_lsass_access_memdump.json | 3 +- ..._suspicious_lsass_access_via_snapshot.json | 4 +- ...cious_winreg_access_via_sebackup_priv.json | 72 ++++ ..._symbolic_link_to_shadow_copy_created.json | 57 +++ ..._symbolic_link_to_shadow_copy_created.json | 53 --- .../credential_access_systemkey_dumping.json | 4 +- ...tial_access_user_impersonation_access.json | 46 +++ ...ess_via_snapshot_lsass_clone_creation.json | 4 +- ...den_file_attribute_with_via_attribexe.json | 5 +- ..._evasion_agent_spoofing_mismatched_id.json | 4 +- .../defense_evasion_amsienable_key_mod.json | 5 +- ...evasion_attempt_del_quarantine_attrib.json | 3 +- ...sion_clearing_windows_console_history.json | 3 +- ...e_evasion_clearing_windows_event_logs.json | 3 +- ...efense_evasion_code_injection_conhost.json | 3 +- ...e_evasion_create_mod_root_certificate.json | 3 +- ...vasion_defender_disabled_via_registry.json | 14 +- ...ion_defender_exclusion_via_powershell.json | 14 +- ...delete_volume_usn_journal_with_fsutil.json | 3 +- ...e_evasion_deleting_websvr_access_logs.json | 3 +- ...deletion_of_bash_command_line_history.json | 3 +- ...asion_disable_posh_scriptblocklogging.json | 3 +- ...ble_windows_firewall_rules_with_netsh.json | 3 +- ...disabling_windows_defender_powershell.json | 3 +- ...efense_evasion_disabling_windows_logs.json | 3 +- ...efense_evasion_dns_over_https_enabled.json | 3 +- ...vasion_dotnet_compiler_parent_process.json | 3 +- ...evasion_enable_inbound_rdp_with_netsh.json | 3 +- ...n_enable_network_discovery_with_netsh.json | 3 +- ...ecution_control_panel_suspicious_args.json | 3 +- ...ense_evasion_execution_lolbas_wuauclt.json | 5 +- ...ecution_msbuild_started_by_office_app.json | 3 +- ...n_execution_msbuild_started_by_script.json | 3 +- ...ion_msbuild_started_by_system_process.json | 3 +- ...ion_execution_msbuild_started_renamed.json | 3 +- ...cution_msbuild_started_unusal_process.json | 3 +- ...execution_suspicious_explorer_winword.json | 3 +- ...sion_execution_windefend_unusual_path.json | 3 +- ..._evasion_file_creation_mult_extension.json | 3 +- ...e_evasion_gcp_logging_bucket_deletion.json | 4 +- .../defense_evasion_hidden_file_dir_tmp.json | 3 +- ...ense_evasion_iis_httplogging_disabled.json | 3 +- ...nse_evasion_kubernetes_events_deleted.json | 4 +- .../defense_evasion_log_files_deleted.json | 3 +- ...querading_as_elastic_endpoint_process.json | 3 +- ...e_evasion_masquerading_renamed_autoit.json | 3 +- ...erading_suspicious_werfault_childproc.json | 3 +- ...vasion_masquerading_trusted_directory.json | 3 +- ..._evasion_microsoft_defender_tampering.json | 7 +- ...e_evasion_ms_office_suspicious_regmod.json | 5 +- .../defense_evasion_posh_compressed.json | 4 +- ...efense_evasion_posh_process_injection.json | 6 +- ..._powershell_windows_firewall_disabled.json | 5 +- ...cy_controls_tcc_database_modification.json | 3 +- ...tion_privacy_pref_sshd_fulldiskaccess.json | 3 +- ...ion_scheduledjobs_at_protocol_enabled.json | 3 +- ..._evasion_sdelete_like_filename_rename.json | 4 +- ...ackdoor_service_disabled_via_registry.json | 3 +- ..._evasion_suspicious_certutil_commands.json | 5 +- ...picious_execution_from_mounted_device.json | 13 +- ...n_suspicious_managedcode_host_process.json | 3 +- ...picious_process_access_direct_syscall.json | 3 +- ...suspicious_process_creation_calltrace.json | 3 +- ...evasion_suspicious_zoom_child_process.json | 3 +- ..._critical_proc_abnormal_file_activity.json | 3 +- .../defense_evasion_timestomp_touch.json | 3 +- ...nse_evasion_unusual_ads_file_creation.json | 3 +- .../defense_evasion_unusual_dir_ads.json | 3 +- ...nusual_network_connection_via_dllhost.json | 3 +- ...asion_unusual_system_vp_child_program.json | 3 +- .../defense_evasion_via_filter_manager.json | 3 +- ...asion_waf_rule_or_rule_group_deletion.json | 4 +- ...on_whitespace_padding_in_command_line.json | 4 +- ...evasion_workfolders_control_execution.json | 52 +++ .../discovery_adfind_command_activity.json | 14 +- .../discovery_admin_recon.json | 3 +- .../discovery_file_dir_discovery.json | 3 +- .../discovery_net_command_system_account.json | 7 +- .../prepackaged_rules/discovery_net_view.json | 3 +- .../discovery_peripheral_device.json | 3 +- ...scovery_posh_suspicious_api_functions.json | 4 +- ...very_privileged_localgroup_membership.json | 4 +- ...ote_system_discovery_commands_windows.json | 3 +- .../discovery_security_software_grep.json | 3 +- .../discovery_security_software_wmic.json | 3 +- ...covery_users_domain_built_in_commands.json | 5 +- ...y_virtual_machine_fingerprinting_grep.json | 3 +- .../discovery_whoami_command_activity.json | 3 +- ...d_to_google_workspace_trusted_domains.json | 2 +- .../execution_apt_binary.json | 56 +++ ...arwinds_backdoor_child_cmd_powershell.json | 3 +- ...inds_backdoor_unusual_child_processes.json | 3 +- .../execution_awk_binary_shell.json | 56 +++ .../execution_busybox_binary.json | 55 +++ .../execution_c89_c99_binary.json | 56 +++ .../execution_com_object_xwizard.json | 3 +- ...tion_command_shell_started_by_svchost.json | 7 +- ...mand_shell_started_by_unusual_process.json | 3 +- .../execution_command_shell_via_rundll32.json | 3 +- .../execution_cpulimit_binary.json | 55 +++ .../execution_crash_binary.json | 55 +++ .../execution_enumeration_via_wmiprvse.json | 15 +- .../execution_env_binary.json | 55 +++ .../execution_expect_binary.json | 55 +++ .../execution_find_binary.json | 55 +++ .../execution_flock_binary.json | 55 +++ .../execution_from_unusual_directory.json | 3 +- .../execution_from_unusual_path_cmdline.json | 4 +- .../execution_gcc_binary.json | 55 +++ ...ution_installer_spawned_network_event.json | 3 +- .../execution_mysql_binary.json | 55 +++ .../execution_posh_portable_executable.json | 6 +- .../execution_posh_psreflect.json | 6 +- .../execution_python_tty_shell.json | 6 +- ...er_program_connecting_to_the_internet.json | 4 +- .../execution_revershell_via_shell_cmd.json | 3 +- ...xecution_shared_modules_local_sxs_dll.json | 4 +- .../execution_ssh_binary.json | 55 +++ .../execution_suspicious_cmd_wmi.json | 3 +- ...n_suspicious_image_load_wmi_ms_office.json | 3 +- ...xecution_suspicious_jar_child_process.json | 3 +- ...tion_suspicious_java_netcon_childproc.json | 3 +- .../execution_suspicious_pdf_reader.json | 3 +- ...ecution_suspicious_powershell_imgload.json | 3 +- .../execution_suspicious_psexesvc.json | 3 +- ...ecution_suspicious_short_program_name.json | 3 +- .../execution_vi_binary.json | 55 +++ .../execution_via_compiled_html_file.json | 3 +- .../execution_via_hidden_shell_conhost.json | 3 +- ...ia_xp_cmdshell_mssql_stored_procedure.json | 3 +- ..._365_exchange_transport_rule_creation.json | 4 +- .../google_workspace_admin_role_deletion.json | 2 +- ...le_workspace_mfa_enforcement_disabled.json | 2 +- .../google_workspace_policy_modified.json | 2 +- ...e_service_principal_credentials_added.json | 4 +- .../impact_backup_file_deletion.json | 3 +- ...deleting_backup_catalogs_with_wbadmin.json | 3 +- ...mpact_efs_filesystem_or_mount_deleted.json | 4 +- .../impact_hosts_file_modified.json | 6 +- .../impact_modification_of_boot_config.json | 3 +- ...copy_deletion_or_resized_via_vssadmin.json | 3 +- ...e_shadow_copy_deletion_via_powershell.json | 3 +- ..._volume_shadow_copy_deletion_via_wmic.json | 3 +- .../rules/prepackaged_rules/index.ts | 326 ++++++++++-------- ...al_access_script_executing_powershell.json | 3 +- ...l_access_suspicious_ms_exchange_files.json | 4 +- ...access_suspicious_ms_exchange_process.json | 3 +- ...ious_ms_exchange_worker_child_process.json | 3 +- ...ss_suspicious_ms_office_child_process.json | 3 +- ...s_suspicious_ms_outlook_child_process.json | 3 +- ...l_access_unusual_dns_service_children.json | 4 +- ...ccess_unusual_dns_service_file_writes.json | 4 +- ...explorer_suspicious_child_parent_args.json | 3 +- .../lateral_movement_dcom_hta.json | 4 +- .../lateral_movement_dns_server_overflow.json | 6 +- ...ateral_movement_evasion_rdp_shadowing.json | 3 +- ..._movement_execution_from_tsclient_mup.json | 3 +- ..._movement_malware_uploaded_sharepoint.json | 4 +- ...ment_mount_hidden_or_webdav_share_net.json | 3 +- .../lateral_movement_mounting_smb_share.json | 3 +- ...l_movement_powershell_remoting_target.json | 4 +- ...lateral_movement_rdp_enabled_registry.json | 3 +- ...ovement_remote_file_copy_hidden_share.json | 3 +- ...nt_service_control_spawned_script_int.json | 3 +- ...ement_suspicious_rdp_client_imageload.json | 3 +- ...l_movement_via_startup_folder_rdp_smb.json | 3 +- ...teral_movement_vpn_connection_attempt.json | 3 +- ...led_for_google_workspace_organization.json | 2 +- ...exchange_dkim_signing_config_disabled.json | 4 +- .../ml_cloudtrail_error_message_spike.json | 4 +- .../ml_cloudtrail_rare_method_by_country.json | 4 +- .../ml_rare_process_by_host_windows.json | 4 +- .../persistence_adobe_hijack_persistence.json | 3 +- .../persistence_appcertdlls_registry.json | 3 +- .../persistence_appinitdlls_registry.json | 3 +- ...re_conditional_access_policy_modified.json | 4 +- ...re_global_administrator_role_assigned.json | 4 +- ..._creation_hidden_login_item_osascript.json | 3 +- ...creation_modif_launch_deamon_sequence.json | 4 +- .../persistence_dontexpirepasswd_account.json | 53 +++ ...persistence_emond_rules_file_creation.json | 3 +- ...n_hidden_launch_agent_deamon_creation.json | 3 +- ...evasion_hidden_local_account_creation.json | 3 +- ...egistry_startup_shell_folder_modified.json | 4 +- ...istence_folder_action_scripts_runtime.json | 4 +- ...workspace_admin_role_assigned_to_user.json | 2 +- ...a_domain_wide_delegation_of_authority.json | 2 +- ...e_workspace_custom_admin_role_created.json | 2 +- ...stence_google_workspace_role_modified.json | 2 +- ...sistence_gpo_schtask_service_creation.json | 3 +- ...ersistence_kde_autostart_modification.json | 3 +- ...sistence_local_scheduled_job_creation.json | 3 +- ...istence_local_scheduled_task_creation.json | 7 +- ...rsistence_login_logout_hooks_defaults.json | 3 +- ..._365_global_administrator_role_assign.json | 4 +- ...fication_sublime_app_plugin_or_script.json | 3 +- .../persistence_ms_office_addins_file.json | 3 +- .../persistence_ms_outlook_vba_template.json | 3 +- ...ll_exch_mailbox_activesync_add_device.json | 3 +- ...escalation_via_accessibility_features.json | 3 +- .../persistence_registry_uncommon.json | 6 +- .../persistence_remote_password_reset.json | 3 +- ...persistence_run_key_and_startup_broad.json | 4 +- ...saver_engine_unexpected_child_process.json | 4 +- ...e_screensaver_plist_file_modification.json | 4 +- ...istence_sdprop_exclusion_dsheuristics.json | 45 +++ ...er_file_written_by_suspicious_process.json | 3 +- .../persistence_startup_folder_scripts.json | 3 +- ...s_image_load_scheduled_task_ms_office.json | 3 +- ...nce_suspicious_scheduled_task_runtime.json | 3 +- ...ersistence_system_shells_via_services.json | 3 +- .../persistence_time_provider_mod.json | 4 +- ..._account_added_to_privileged_group_ad.json | 6 +- .../persistence_user_account_creation.json | 3 +- .../persistence_via_application_shimming.json | 3 +- ...rsistence_via_bits_job_notify_command.json | 3 +- ...sistence_via_hidden_run_key_valuename.json | 3 +- ...sa_security_support_provider_registry.json | 3 +- ...emetrycontroller_scheduledtask_hijack.json | 3 +- ...ia_update_orchestrator_service_hijack.json | 3 +- ...nt_instrumentation_event_subscription.json | 3 +- .../persistence_webshell_detection.json | 4 +- ...calation_applescript_with_admin_privs.json | 3 +- ...ilege_escalation_disable_uac_registry.json | 3 +- ...ege_escalation_group_policy_iniscript.json | 4 +- ...lation_group_policy_privileged_groups.json | 4 +- ...scalation_group_policy_scheduled_task.json | 4 +- ...rivilege_escalation_installertakeover.json | 6 +- ...e_escalation_named_pipe_impersonation.json | 3 +- ...ge_escalation_persistence_phantom_dll.json | 3 +- ...vilege_escalation_pkexec_envar_hijack.json | 4 +- ...spooler_malicious_driver_file_changes.json | 50 --- ...ooler_malicious_registry_modification.json | 48 --- ..._printspooler_service_suspicious_file.json | 3 +- ...printspooler_suspicious_file_deletion.json | 3 +- ...tion_printspooler_suspicious_spl_file.json | 4 +- ...lation_samaccountname_spoofing_attack.json | 3 +- ...lege_escalation_uac_bypass_com_clipup.json | 3 +- ...ge_escalation_uac_bypass_com_ieinstal.json | 3 +- ...n_uac_bypass_com_interface_icmluautil.json | 3 +- ...alation_uac_bypass_diskcleanup_hijack.json | 3 +- ...escalation_uac_bypass_dll_sideloading.json | 3 +- ...ge_escalation_uac_bypass_event_viewer.json | 3 +- ...ege_escalation_uac_bypass_mock_windir.json | 3 +- ...scalation_uac_bypass_winfw_mmc_hijack.json | 3 +- ...tion_unusual_parentchild_relationship.json | 3 +- ...ion_unusual_printspooler_childprocess.json | 5 +- ...n_unusual_svchost_childproc_childless.json | 3 +- ...ilege_escalation_via_rogue_named_pipe.json | 4 +- 300 files changed, 2159 insertions(+), 702 deletions(-) create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_handle_access.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_moving_registry_hive_via_smb.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_remote_sam_secretsdump.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_spn_attribute_modified.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_winreg_access_via_sebackup_priv.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_symbolic_link_to_shadow_copy_created.json delete mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_symbolic_link_to_shadow_copy_createdcredential_access_symbolic_link_to_shadow_copy_created.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_user_impersonation_access.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_workfolders_control_execution.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_awk_binary_shell.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_busybox_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_c89_c99_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_cpulimit_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_crash_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_env_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_expect_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_find_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_flock_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_gcc_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_mysql_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_ssh_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_vi_binary.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_dontexpirepasswd_account.json create mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_sdprop_exclusion_dsheuristics.json delete mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_malicious_driver_file_changes.json delete mode 100644 x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_malicious_registry_modification.json diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/application_added_to_google_workspace_domain.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/application_added_to_google_workspace_domain.json index 1d4724153e2da..6dbae907d892d 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/application_added_to_google_workspace_domain.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/application_added_to_google_workspace_domain.json @@ -33,5 +33,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 6 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_email_powershell_exchange_mailbox.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_email_powershell_exchange_mailbox.json index 627cbfa777416..225ee22682e7c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_email_powershell_exchange_mailbox.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_email_powershell_exchange_mailbox.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Exporting Exchange Mailbox via PowerShell", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name: (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and process.args : \"New-MailboxExportRequest*\"\n", "references": [ "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", @@ -39,6 +40,11 @@ "reference": "https://attack.mitre.org/tactics/TA0009/" }, "technique": [ + { + "id": "T1005", + "name": "Data from Local System", + "reference": "https://attack.mitre.org/techniques/T1005/" + }, { "id": "T1114", "name": "Email Collection", @@ -50,16 +56,11 @@ "reference": "https://attack.mitre.org/techniques/T1114/002/" } ] - }, - { - "id": "T1005", - "name": "Data from Local System", - "reference": "https://attack.mitre.org/techniques/T1005/" } ] } ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_microsoft_365_new_inbox_rule.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_microsoft_365_new_inbox_rule.json index 30c63674ef284..d989c53a79cf0 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_microsoft_365_new_inbox_rule.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_microsoft_365_new_inbox_rule.json @@ -4,7 +4,7 @@ "Gary Blackwell", "Austin Songer" ], - "description": "Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data while not requiring organization-wide configuration changes nor privileges to set those.", + "description": "Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges.", "false_positives": [ "Users and Administrators can create inbox rules for legitimate purposes. Verify if it complies with the company policy and done with the user's consent. Exceptions can be added to this rule to filter expected behavior." ], @@ -61,5 +61,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_audio_capture.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_audio_capture.json index 491ba75865885..7534dbca7b9db 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_audio_capture.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_audio_capture.json @@ -11,8 +11,8 @@ "language": "kuery", "license": "Elastic License v2", "name": "PowerShell Suspicious Script with Audio Capture Capabilities", - "note": "## Triage and analysis.\n\n### Investigating PowerShell Suspicious Script with Audio Capture Capabilities\n\nPowerShell is one of the main tools used by system administrators for automation, report routines, and other tasks.\n\nAttackers can use PowerShell to interact with the Windows API and capture audio from input devices connected to the\ncomputer.\n\n#### Possible investigation steps:\n\n- Examine script content that triggered the detection. \n- Investigate script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- If the action is suspicious for the user, check for any other activities done by the user in the last 48 hours.\n\n### False Positive Analysis\n\n- Verify whether the script content is malicious/harmful.\n\n### Related Rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d\n\n### Response and Remediation\n\n- Immediate response should be taken to validate, investigate, and potentially contain the activity to prevent further\npost-compromise behavior.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", - "query": "event.category:process and \n powershell.file.script_block_text : (\n Get-MicrophoneAudio or (waveInGetNumDevs and mciSendStringA)\n )\n", + "note": "## Triage and analysis.\n\n### Investigating PowerShell Suspicious Script with Audio Capture Capabilities\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This\nmakes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can use PowerShell to interact with the Windows API with the intent of capturing audio from input devices\nconnected to the victim's computer.\n\n#### Possible investigation steps\n\n- Examine script content that triggered the detection. \n- Investigate the script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Consider whether the user needs PowerShell to complete its tasks.\n- Investigate if the script stores the recorded data locally and determine if anything was recorded.\n- Investigate if the script contains exfiltration capabilities and the destination of this exfiltration.\n- Assess network data to determine if the host communicated with the exfiltration server.\n- Determine if the user credentials were compromised and if the attacker used them to perform unauthorized access to the\nlinked email account.\n\n### False positive analysis\n\n- Regular users should not need scripts to capture audio, which makes false positives unlikely. In the case of\nauthorized benign true positives (B-TPs), exceptions can be added.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- The response must be prioritized if this alert involves key executives or potentially valuable targets for espionage.\n- Quarantine the involved host for forensic investigation, as well as eradication and recovery activities.\n- Configure AppLocker or equivalent software to restrict access to PowerShell for regular users.\n- Review GPOs to add additional restrictions for PowerShell usage by users.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", + "query": "event.category:process and \n powershell.file.script_block_text : (\n \"Get-MicrophoneAudio\" or (waveInGetNumDevs and mciSendStringA)\n )\n", "references": [ "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-MicrophoneAudio.ps1" ], @@ -67,5 +67,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_keylogger.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_keylogger.json index 8cac619d6c7dd..b3b9299fe0977 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_keylogger.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_keylogger.json @@ -11,8 +11,8 @@ "language": "kuery", "license": "Elastic License v2", "name": "PowerShell Keylogging Script", - "note": "## Triage and analysis.\n\n### Investigating PowerShell Keylogging Script\n\nPowerShell is one of the main tools used by system administrators for automation, report routines, and other tasks.\n\nAttackers can abuse PowerShell capabilities to capture user keystrokes with the goal of stealing credentials and other\nvaluable information as credit card data and confidential conversations.\n\n#### Possible investigation steps:\n\n- Examine script content that triggered the detection. \n- Investigate script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- If the action is suspicious for the user, check for any other activities done by the user in the last 48 hours.\n\n### False Positive Analysis\n\n- Verify whether the script content is malicious/harmful.\n\n### Related Rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and Remediation\n\n- Immediate response should be taken to validate, investigate, and potentially contain the activity to prevent further\npost-compromise behavior.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", - "query": "event.category:process and \n ( \n powershell.file.script_block_text : (GetAsyncKeyState or NtUserGetAsyncKeyState or GetKeyboardState or Get-Keystrokes) or \n powershell.file.script_block_text : ((SetWindowsHookA or SetWindowsHookW or SetWindowsHookEx or SetWindowsHookExA or NtUserSetWindowsHookEx) and (GetForegroundWindow or GetWindowTextA or GetWindowTextW or WM_KEYBOARD_LL))\n )\n", + "note": "## Triage and analysis.\n\n### Investigating PowerShell Keylogging Script\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This\nmakes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can abuse PowerShell capabilities to capture user keystrokes with the goal of stealing credentials and other\nvaluable information as credit card data and confidential conversations.\n\n#### Possible investigation steps:\n\n- Examine script content that triggered the detection. \n- Investigate the script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Consider whether the user needs PowerShell to complete its tasks.\n- Investigate if the script stores the captured data locally.\n- Investigate if the script contains exfiltration capabilities and the destination of this exfiltration.\n- Assess network data to determine if the host communicated with the exfiltration server.\n\n### False positive analysis\n\n- Regular users do not have a business justification for using scripting utilities to capture keystrokes, making\nfalse positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- The response must be prioritized if this alert involves key executives or potentially valuable targets for espionage.\n- Quarantine the involved host for forensic investigation, as well as eradication and recovery activities.\n- Configure AppLocker or equivalent software to restrict access to PowerShell for regular users.\n- Reset the password for the user account and other potentially compromised accounts (email, services, CRMs, etc.).\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", + "query": "event.category:process and \n ( \n powershell.file.script_block_text : (GetAsyncKeyState or NtUserGetAsyncKeyState or GetKeyboardState or \"Get-Keystrokes\") or \n powershell.file.script_block_text : (\n (SetWindowsHookA or SetWindowsHookW or SetWindowsHookEx or SetWindowsHookExA or NtUserSetWindowsHookEx) and\n (GetForegroundWindow or GetWindowTextA or GetWindowTextW or \"WM_KEYBOARD_LL\")\n )\n )\n", "references": [ "https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-Keystrokes.ps1", "https://github.com/MojtabaTajik/FunnyKeylogger/blob/master/FunnyLogger.ps1" @@ -75,5 +75,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_screen_grabber.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_screen_grabber.json index afab1df677e3d..66e6dc5ec75f9 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_screen_grabber.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_posh_screen_grabber.json @@ -11,7 +11,8 @@ "language": "kuery", "license": "Elastic License v2", "name": "PowerShell Suspicious Script with Screenshot Capabilities", - "query": "event.category:process and \n powershell.file.script_block_text : (\n CopyFromScreen and\n (System.Drawing.Bitmap or Drawing.Bitmap)\n )\n", + "note": "## Triage and analysis\n\n### Investigating PowerShell Suspicious Script with Screenshot Capabilities\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, which makes\nit available for use in various environments and creates an attractive way for attackers to execute code.\n\nAttackers can abuse PowerShell capabilities and take screen captures of desktops to gather information over the course\nof an operation.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection. \n- Investigate the script execution chain (parent process tree).\n- Inspect file or network events from the suspicious PowerShell host process instance.\n- Investigate other alerts associated with the user or host in the past 48 hours.\n- Consider whether the user needs PowerShell to complete its tasks.\n- Investigate if the script stores the captured data locally.\n- Investigate if the script contains exfiltration capabilities and the destination of this exfiltration.\n- Examine network data to determine if the host communicated with the exfiltration server.\n\n### False positive analysis\n\n- Regular users do not have a business justification for using scripting utilities to take screenshots, which makes false\npositives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.\n\n### Related rules\n\n- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Quarantine the involved host for forensic investigation, as well as eradication and recovery activities.\n- Configure AppLocker or equivalent software to restrict access to PowerShell for regular users.\n- Reset the password for the user account.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", + "query": "event.category:process and \n powershell.file.script_block_text : (\n CopyFromScreen and\n (\"System.Drawing.Bitmap\" or \"Drawing.Bitmap\")\n )\n", "references": [ "https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen" ], @@ -66,5 +67,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_winrar_encryption.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_winrar_encryption.json index fa0ee2b18bb15..3098d574d99c8 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_winrar_encryption.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/collection_winrar_encryption.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Encrypting Files with WinRar or 7z", + "note": "## Triage and analysis\n\n### Investigating Encrypting Files with WinRar or 7z\n\nAttackers may compress and/or encrypt data collected before exfiltration. Compressing the data can help obfuscate the\ncollected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is\nbeing exfiltrated from detection or make exfiltration less apparent upon inspection by a defender.\n\nThese steps are usually done in preparation for exfiltration, meaning the attack may be in its final stages.\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree).\n- Retrieve the encrypted file.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Check if the password used in the encryption was included in the command line.\n- Decrypt the `.rar`/`.zip` and check if the information is sensitive.\n- If the password is not available, and the format is `.zip` or the option used in WinRAR is not the `-hp`, list the\nfile names included in the encrypted file.\n- Investigate if the file was transferred to an attacker-controlled server.\n\n### False positive analysis\n\n- Backup software can use these utilities. Check the `process.parent.executable` and\n`process.parent.command_line` fields to determine what triggered the encryption.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- If personally identifiable information (PII) or other classified data is involved, investigations into this should be prioritized.\n- Quarantine the involved host for forensic investigation, as well as eradication and recovery activities.\n- Reset the passwords of the involved accounts.\n- Safeguard critical assets to prevent further harm or theft of data.\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n ((process.name:\"rar.exe\" or process.code_signature.subject_name == \"win.rar GmbH\" or\n process.pe.original_file_name == \"Command line RAR\") and\n process.args == \"a\" and process.args : (\"-hp*\", \"-p*\", \"-dw\", \"-tb\", \"-ta\", \"/hp*\", \"/p*\", \"/dw\", \"/tb\", \"/ta\"))\n\n or\n (process.pe.original_file_name in (\"7z.exe\", \"7za.exe\") and\n process.args == \"a\" and process.args : (\"-p*\", \"-sdel\"))\n\n /* uncomment if noisy for backup software related FPs */\n /* not process.parent.executable : (\"C:\\\\Program Files\\\\*.exe\", \"C:\\\\Program Files (x86)\\\\*.exe\") */\n", "references": [ "https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_certutil_network_connection.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_certutil_network_connection.json index 2f265710feb0a..3fa17ac4585cb 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_certutil_network_connection.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_certutil_network_connection.json @@ -12,9 +12,11 @@ "language": "eql", "license": "Elastic License v2", "name": "Network Connection via Certutil", + "note": "## Triage and analysis\n\n### Investigating Network Connection via Certutil\n\nAttackers can abuse `certutil.exe` to download malware, offensive security tools, and certificates from external sources\nin order to take the next steps in a compromised environment.\n\nThis rule looks for network events where `certutil.exe` contacts IP ranges other than the ones specified in\n[IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml)\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree).\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Investigate if the downloaded file was executed.\n- Determine the context in which `certutil.exe` and the file were run.\n- Retrieve the file downloaded and:\n - Use a sandboxed malware analysis system to perform analysis.\n - Observe attempts of contacting external domains and addresses.\n - Use the PowerShell Get-FileHash cmdlet to get the SHA-256 hash value of the file.\n - Search for the existence of this file in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. If trusted software uses this command and the triage has not identified\nanything suspicious, this alert can be closed as a false positive.\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination\nof user and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n- Implement any temporary network rules, procedures, and segmentation required to contain the malware.\n", "query": "sequence by process.entity_id\n [process where process.name : \"certutil.exe\" and event.type == \"start\"]\n [network where process.name : \"certutil.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\",\n \"192.0.0.171/32\", \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\",\n \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\", \"192.175.48.0/24\",\n \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\")]\n", "references": [ - "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml", + "https://frsecure.com/malware-incident-response-playbook/" ], "risk_score": 21, "rule_id": "3838e0e3-1850-4850-a411-2e8c5ba40ba8", @@ -44,5 +46,5 @@ } ], "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_common_webservices.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_common_webservices.json index 665049d1d9b13..540babaeea673 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_common_webservices.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_common_webservices.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Adversaries may implement command and control communications that use common web services in order to hide their activity. This attack technique is typically targeted to an organization and uses web services common to the victim network which allows the adversary to blend into legitimate traffic. activity. These popular services are typically targeted since they have most likely been used before a compromise and allow adversaries to blend in the network.", + "description": "Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in.", "from": "now-9m", "index": [ "logs-endpoint.events.*" @@ -10,6 +10,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Connection to Commonly Abused Web Services", + "note": "## Triage and analysis\n\n### Investigating Connection to Commonly Abused Web Services\n\nAdversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised\nsystem. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the\nlikelihood that hosts within a network are already communicating with them prior to a compromise.\n\nThis rule looks for processes outside known legitimate program locations communicating with a list of services that can\nbe abused for exfiltration or command and control.\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree).\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Verify whether the digital signature exists in the executable.\n- Identify the kind of the operation (upload, download, tunneling, etc.).\n- Use a sandboxed malware analysis system to perform analysis on the executable.\n- Use the PowerShell Get-FileHash cmdlet to get the SHA-256 hash value of the file.\n - Search for the existence of this file in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This rule has a high chance to produce false positives because it detects communication with legitimate services. Noisy\nfalse positives can be added as exceptions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n- Implement any temporary network rules, procedures, and segmentation required to contain the malware.\n", "query": "network where network.protocol == \"dns\" and\n process.name != null and user.id not in (\"S-1-5-18\", \"S-1-5-19\", \"S-1-5-20\") and\n /* Add new WebSvc domains here */\n dns.question.name :\n (\n \"raw.githubusercontent.*\",\n \"*.pastebin.*\",\n \"*drive.google.*\",\n \"*docs.live.*\",\n \"*api.dropboxapi.*\",\n \"*dropboxusercontent.*\",\n \"*onedrive.*\",\n \"*4shared.*\",\n \"*.file.io\",\n \"*filebin.net\",\n \"*slack-files.com\",\n \"*ghostbin.*\",\n \"*ngrok.*\",\n \"*portmap.*\",\n \"*serveo.net\",\n \"*localtunnel.me\",\n \"*pagekite.me\",\n \"*localxpose.io\",\n \"*notabug.org\",\n \"rawcdn.githack.*\",\n \"paste.nrecom.net\",\n \"zerobin.net\",\n \"controlc.com\",\n \"requestbin.net\",\n \"cdn.discordapp.com\",\n \"discordapp.com\",\n \"discord.com\"\n ) and\n /* Insert noisy false positives here */\n not process.executable :\n (\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Windows\\\\System32\\\\WWAHost.exe\",\n \"?:\\\\Windows\\\\System32\\\\smartscreen.exe\",\n \"?:\\\\Windows\\\\System32\\\\MicrosoftEdgeCP.exe\",\n \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\*\\\\MsMpEng.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Programs\\\\Fiddler\\\\Fiddler.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft VS Code\\\\Code.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\OneDrive.exe\",\n \"?:\\\\Windows\\\\system32\\\\mobsync.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\mobsync.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Discord\\\\-*\\\\Discord.exe\"\n )\n", "risk_score": 21, "rule_id": "66883649-f908-4a5b-a1e0-54090a1d3a32", @@ -67,5 +68,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 7 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_tunneling_nslookup.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_tunneling_nslookup.json index 29c30f6bc0b49..f9109b2d3ff0e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_tunneling_nslookup.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_dns_tunneling_nslookup.json @@ -12,6 +12,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "Potential DNS Tunneling via NsLookup", + "note": "## Triage and analysis\n\n### Investigating Potential DNS Tunneling via NsLookup\n\nAttackers can abuse existing network rules that allow DNS communication with external resources to use the protocol as\ntheir command and control and/or exfiltration channel.\n\nDNS queries can be used to infiltrate data such as commands to be run, malicious files, etc., and also for exfiltration,\nsince queries can be used to send data to the attacker-controlled DNS server. This process is commonly known as DNS tunneling.\n\nMore information on how tunneling works and how it can be abused can be found on\n[Palo Alto Unit42 Research](https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors).\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree).\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Inspect the DNS query and identify the information sent.\n- Extract this communication's indicators of compromise (IoCs) and use traffic logs to search for other potentially compromised hosts.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. If the parent process is trusted and the data sent is not sensitive nor\ncommand and control related, this alert can be closed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Immediately block the IoCs identified on the triage.\n- Implement any temporary network rules, procedures, and segmentation required to contain the attack.\n- Capture forensic images to preserve evidence.\n- Reset the password for the user account and other potentially compromised accounts (email, services, CRMs, etc.).\n- Update firewall rules to be more restrictive.\n- Reimage affected systems.\n", "query": "event.category:process and event.type:start and process.name:nslookup.exe and process.args:(-querytype=* or -qt=* or -q=* or -type=*)\n", "references": [ "https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/" @@ -57,5 +58,5 @@ "value": 15 }, "type": "threshold", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_encrypted_channel_freesslcert.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_encrypted_channel_freesslcert.json index 2cc8c9ee8ac2b..d7dd6dcf48762 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_encrypted_channel_freesslcert.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_encrypted_channel_freesslcert.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Connection to Commonly Abused Free SSL Certificate Providers", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "network where network.protocol == \"dns\" and\n /* Add new free SSL certificate provider domains here */\n dns.question.name : (\"*letsencrypt.org\", \"*.sslforfree.com\", \"*.zerossl.com\", \"*.freessl.org\") and\n \n /* Native Windows process paths that are unlikely to have network connections to domains secured using free SSL certificates */\n process.executable : (\"C:\\\\Windows\\\\System32\\\\*.exe\",\n \"C:\\\\Windows\\\\System\\\\*.exe\",\n\t \"C:\\\\Windows\\\\SysWOW64\\\\*.exe\",\n\t\t \"C:\\\\Windows\\\\Microsoft.NET\\\\Framework*\\\\*.exe\",\n\t\t \"C:\\\\Windows\\\\explorer.exe\",\n\t\t \"C:\\\\Windows\\\\notepad.exe\") and\n \n /* Insert noisy false positives here */\n not process.name : (\"svchost.exe\", \"MicrosoftEdge*.exe\", \"msedge.exe\")\n", "risk_score": 21, "rule_id": "e3cf38fa-d5b8-46cc-87f9-4a7513e4281d", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_port_forwarding_added_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_port_forwarding_added_registry.json index 91ca5d8d74166..5ac169440ce79 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_port_forwarding_added_registry.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_port_forwarding_added_registry.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Port Forwarding Rule Addition", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where registry.path : \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\PortProxy\\\\v4tov4\\\\*\"\n", "references": [ "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html" @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_remote_desktop_protocol_from_the_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_remote_desktop_protocol_from_the_internet.json index d322ce0505724..7277998b00c51 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_remote_desktop_protocol_from_the_internet.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_remote_desktop_protocol_from_the_internet.json @@ -72,7 +72,9 @@ ] } ], + "timeline_id": "300afc76-072d-4261-864d-4149714bf3f1", + "timeline_title": "Comprehensive Network Timeline", "timestamp_override": "event.ingested", "type": "query", - "version": 11 + "version": 12 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_tunnel_plink.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_tunnel_plink.json index 3c89ff7c9ff9a..81e353ba7aaf7 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_tunnel_plink.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_rdp_tunnel_plink.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Remote Desktop Tunneling Detected", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n /* RDP port and usual SSH tunneling related switches in command line */\n process.args : \"*:3389\" and\n process.args : (\"-L\", \"-P\", \"-R\", \"-pw\", \"-ssh\")\n", "references": [ "https://blog.netspi.com/how-to-access-rdp-over-a-reverse-ssh-tunnel/" @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_desktopimgdownldr.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_desktopimgdownldr.json index 3adeb4f71808a..f4c64f6f8f968 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_desktopimgdownldr.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_desktopimgdownldr.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Remote File Download via Desktopimgdownldr Utility", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"desktopimgdownldr.exe\" or process.pe.original_file_name == \"desktopimgdownldr.exe\") and\n process.args : \"/lockscreenurl:http*\"\n", "references": [ "https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/" @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_mpcmdrun.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_mpcmdrun.json index f026df5fd19b9..703155453e7fc 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_mpcmdrun.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_remote_file_copy_mpcmdrun.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Remote File Download via MpCmdRun", - "note": "## Triage and analysis\n\n### Investigating Remote File Download via MpCmdRun\nVerify details such as the parent process, URL reputation, and downloaded file details. Additionally, `MpCmdRun` logs this information in the Appdata Temp folder in `MpCmdRun.log`.", + "note": "## Triage and analysis\n\n### Investigating Remote File Download via MpCmdRun\nVerify details such as the parent process, URL reputation, and downloaded file details. Additionally, `MpCmdRun` logs this information in the Appdata Temp folder in `MpCmdRun.log`.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n (process.name : \"MpCmdRun.exe\" or process.pe.original_file_name == \"MpCmdRun.exe\") and\n process.args : \"-DownloadFile\" and process.args : \"-url\" and process.args : \"-path\"\n", "references": [ "https://twitter.com/mohammadaskar2/status/1301263551638761477", @@ -47,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_teamviewer_remote_file_copy.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_teamviewer_remote_file_copy.json index a1f0f061a69bc..022ae049f58f2 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_teamviewer_remote_file_copy.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_teamviewer_remote_file_copy.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Remote File Copy via TeamViewer", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type == \"creation\" and process.name : \"TeamViewer.exe\" and\n file.extension : (\"exe\", \"dll\", \"scr\", \"com\", \"bat\", \"ps1\", \"vbs\", \"vbe\", \"js\", \"wsh\", \"hta\")\n", "references": [ "https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html" @@ -50,5 +51,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_telnet_port_activity.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_telnet_port_activity.json index 2abf35bdd7575..3487f46c1d855 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_telnet_port_activity.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_telnet_port_activity.json @@ -69,7 +69,9 @@ ] } ], + "timeline_id": "300afc76-072d-4261-864d-4149714bf3f1", + "timeline_title": "Comprehensive Network Timeline", "timestamp_override": "event.ingested", "type": "query", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_tunneling_via_earthworm.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_tunneling_via_earthworm.json index eafe28709a0d2..f908579e6b55b 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_tunneling_via_earthworm.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/command_and_control_tunneling_via_earthworm.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Protocol Tunneling via EarthWorm", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.args : \"-s\" and process.args : \"-d\" and process.args : \"rssocks\"\n", "references": [ "http://rootkiter.com/EarthWorm/", @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_access_to_browser_credentials_procargs.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_access_to_browser_credentials_procargs.json index 49699af5b0eeb..021fc87afc5da 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_access_to_browser_credentials_procargs.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_access_to_browser_credentials_procargs.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Access of Stored Browser Credentials", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.args :\n (\n \"/Users/*/Library/Application Support/Google/Chrome/Default/Login Data\", \n \"/Users/*/Library/Application Support/Google/Chrome/Default/Cookies\", \n \"/Users/*/Library/Cookies*\", \n \"/Users/*/Library/Application Support/Firefox/Profiles/*.default/cookies.sqlite\", \n \"/Users/*/Library/Application Support/Firefox/Profiles/*.default/key*.db\", \n \"/Users/*/Library/Application Support/Firefox/Profiles/*.default/logins.json\", \n \"Login Data\",\n \"Cookies.binarycookies\", \n \"key4.db\", \n \"key3.db\", \n \"logins.json\", \n \"cookies.sqlite\"\n )\n", "references": [ "https://securelist.com/calisto-trojan-for-macos/86543/" @@ -51,5 +52,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cmdline_dump_tool.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cmdline_dump_tool.json index 9671f3c4edf2a..eaf284c3a6c1c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cmdline_dump_tool.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cmdline_dump_tool.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Credential Access via Windows Utilities", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n/* update here with any new lolbas with dump capability */\n(process.pe.original_file_name == \"procdump\" and process.args : \"-ma\") or\n(process.name : \"ProcessDump.exe\" and not process.parent.executable regex~ \"\"\"C:\\\\Program Files( \\(x86\\))?\\\\Cisco Systems\\\\.*\"\"\") or\n(process.pe.original_file_name == \"WriteMiniDump.exe\" and not process.parent.executable regex~ \"\"\"C:\\\\Program Files( \\(x86\\))?\\\\Steam\\\\.*\"\"\") or\n(process.pe.original_file_name == \"RUNDLL32.EXE\" and (process.args : \"MiniDump*\" or process.command_line : \"*comsvcs.dll*#24*\")) or\n(process.pe.original_file_name == \"RdrLeakDiag.exe\" and process.args : \"/fullmemdmp\") or\n(process.pe.original_file_name == \"SqlDumper.exe\" and process.args : \"0x01100*\") or\n(process.pe.original_file_name == \"TTTracer.exe\" and process.args : \"-dumpFull\" and process.args : \"-attach\") or\n(process.pe.original_file_name == \"ntdsutil.exe\" and process.args : \"create*full*\") or\n(process.pe.original_file_name == \"diskshadow.exe\" and process.args : \"/s\")\n", "references": [ "https://lolbas-project.github.io/" @@ -57,5 +58,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cookies_chromium_browsers_debugging.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cookies_chromium_browsers_debugging.json index a177d7ad457fa..b50a678b18fc4 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cookies_chromium_browsers_debugging.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_cookies_chromium_browsers_debugging.json @@ -17,6 +17,7 @@ "license": "Elastic License v2", "max_signals": 33, "name": "Potential Cookies Theft via Browser Debugging", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\", \"info\") and\n process.name in (\n \"Microsoft Edge\",\n \"chrome.exe\",\n \"Google Chrome\",\n \"google-chrome-stable\",\n \"google-chrome-beta\",\n \"google-chrome\",\n \"msedge.exe\") and\n process.args : (\"--remote-debugging-port=*\", \n \"--remote-debugging-targets=*\", \n \"--remote-debugging-pipe=*\") and\n process.args : \"--user-data-dir=*\" and not process.args:\"--remote-debugging-port=0\"\n", "references": [ "https://github.com/defaultnamehere/cookie_crimes", @@ -55,5 +56,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_copy_ntds_sam_volshadowcp_cmdline.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_copy_ntds_sam_volshadowcp_cmdline.json index 0aeba88224138..f7a566d3cbe04 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_copy_ntds_sam_volshadowcp_cmdline.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_copy_ntds_sam_volshadowcp_cmdline.json @@ -14,6 +14,7 @@ "license": "Elastic License v2", "max_signals": 33, "name": "NTDS or SAM Database File Copied", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (\n (process.pe.original_file_name in (\"Cmd.Exe\", \"PowerShell.EXE\", \"XCOPY.EXE\") and\n process.args : (\"copy\", \"xcopy\", \"Copy-Item\", \"move\", \"cp\", \"mv\")\n ) or\n (process.pe.original_file_name : \"esentutl.exe\" and process.args : (\"*/y*\", \"*/vss*\", \"*/d*\"))\n ) and\n process.args : (\"*\\\\ntds.dit\", \"*\\\\config\\\\SAM\", \"\\\\*\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy*\\\\*\", \"*/system32/config/SAM*\")\n", "references": [ "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/", @@ -55,5 +56,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_credential_dumping_msbuild.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_credential_dumping_msbuild.json index da4689ed12d70..8995c6ba7bb4c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_credential_dumping_msbuild.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_credential_dumping_msbuild.json @@ -43,7 +43,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 8 + "version": 9 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_credentials_keychains.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_credentials_keychains.json index 9c8f2943c44d8..764d5b5969644 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_credentials_keychains.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_credentials_keychains.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Access to Keychain Credentials Directories", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.args :\n (\n \"/Users/*/Library/Keychains/*\",\n \"/Library/Keychains/*\",\n \"/Network/Library/Keychains/*\",\n \"System.keychain\",\n \"login.keychain-db\",\n \"login.keychain\"\n ) and\n not process.args : (\"find-certificate\",\n \"add-trusted-cert\",\n \"set-keychain-settings\",\n \"delete-certificate\",\n \"/Users/*/Library/Keychains/openvpn.keychain-db\",\n \"show-keychain-info\",\n \"lock-keychain\",\n \"set-key-partition-list\",\n \"import\",\n \"find-identity\") and\n not process.parent.executable : \"/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect\"\n", "references": [ "https://objective-see.com/blog/blog_0x25.html", @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dcsync_replication_rights.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dcsync_replication_rights.json index ee85eacf12b75..a8a73e2176f03 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dcsync_replication_rights.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dcsync_replication_rights.json @@ -11,7 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Credential Access via DCSync", - "note": "## Triage and analysis.\n\n### Investigating Active Directory Replication From User Account\n\nActive Directory replication is the process by which the changes that originate on one domain controller are\nautomatically transferred to other domain controllers that store the same data. \n\nActive Directory data takes the form of objects that have properties, or attributes. Each object is an instance\nof an object class, and object classes and their respective attributes are defined in the Active Directory schema.\nThe values of the attributes define the object, and a change to a value of an attribute must be transferred from\nthe domain controller on which it occurs to every other domain controller that stores a replica of that object.\n\nAdversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process\nfrom a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys used\nlegitimately for tickets creation, but also tickets forging by attackers. This attack requires some extended privileges\nto succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of\nthe Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused\nto grant controlled objects the right to DCsync/Replicate.\n\nMore details can be found on [Threat Hunter Playbook](https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing).\nand [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync)\n\nThis rule will monitor for Event ID 4662 (Operation was performed on an Active Directory object) and identify events that use the access\nmask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID\n(DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set). It also filters out events that\nuse computer accounts and also Azure AD Connect MSOL accounts (more details [here](https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028)).\n\n#### Possible investigation steps:\n\n- Identify the account that performed the action\n- Confirm whether the account owner is aware of the operation\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received\nthe replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.\n- Investigate which credentials were compromised (e.g. All accounts were replicated or a specific account).\n\n### False Positive Analysis\n\n- This activity should not happen legitimately. Any potential B-TP (Benign True Positive) should be mapped and monitored by the security\nteam as replication should be done by Domain Controllers only. Any account that performs this activity can put the domain at risk for not\nhaving the same security standards (Long, complex, random passwords that change frequently) as computer accounts, exposing it to credential\ncracking attacks (Kerberoasting, brute force, etc.).\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage\n- In case of specific credentials were compromised:\n - Reset the password for the accounts\n- In case of the entire domain or the `krbtgt` user were compromised:\n - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password\n reset (twice) of the `krbtgt` user.\n\n## Config\n\nThe 'Audit Directory Service Access' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nDS Access > \nAudit Directory Service Access (Success,Failure)\n```\n", + "note": "## Triage and analysis.\n\n### Investigating Active Directory Replication From User Account\n\nActive Directory replication is the process by which the changes that originate on one domain controller are\nautomatically transferred to other domain controllers that store the same data. \n\nActive Directory data takes the form of objects that have properties, or attributes. Each object is an instance\nof an object class, and object classes and their respective attributes are defined in the Active Directory schema.\nThe values of the attributes define the object, and a change to a value of an attribute must be transferred from\nthe domain controller on which it occurs to every other domain controller that stores a replica of that object.\n\nAdversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process\nfrom a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys used\nlegitimately for tickets creation, but also tickets forging by attackers. This attack requires some extended privileges\nto succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of\nthe Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused\nto grant controlled objects the right to DCsync/Replicate.\n\nMore details can be found on [Threat Hunter Playbook](https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing).\nand [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync)\n\nThis rule will monitor for Event ID 4662 (Operation was performed on an Active Directory object) and identify events that use the access\nmask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID\n(DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set). It also filters out events that\nuse computer accounts and also Azure AD Connect MSOL accounts (more details [here](https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028)).\n\n#### Possible investigation steps:\n\n- Identify the account that performed the action.\n- Confirm whether the account owner is aware of the operation.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received\nthe replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.\n- Investigate which credentials were compromised (e.g. All accounts were replicated or a specific account).\n\n### False Positive Analysis\n\n- This activity should not happen legitimately. Any potential B-TP (Benign True Positive) should be mapped and monitored by the security\nteam as replication should be done by Domain Controllers only. Any account that performs this activity can put the domain at risk for not\nhaving the same security standards (Long, complex, random passwords that change frequently) as computer accounts, exposing it to credential\ncracking attacks (Kerberoasting, brute force, etc.).\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- If specific credentials were compromised:\n - Reset the password for the accounts.\n- If the entire domain or the `krbtgt` user were compromised:\n - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password\n reset (twice) of the `krbtgt` user.\n\n## Config\n\nThe 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nDS Access > \nAudit Directory Service Changes (Success,Failure)\n```\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n\n", "query": "any where event.action == \"Directory Service Access\" and\n event.code == \"4662\" and winlog.event_data.Properties : (\n\n /* Control Access Rights/Permissions Symbol */\n\n \"*DS-Replication-Get-Changes*\",\n \"*DS-Replication-Get-Changes-All*\",\n \"*DS-Replication-Get-Changes-In-Filtered-Set*\",\n\n /* Identifying GUID used in ACE */\n\n \"*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*\",\n \"*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*\",\n \"*89e95b76-444d-4c62-991a-0facbeda640c*\") \n \n /* The right to perform an operation controlled by an extended access right. */\n\n and winlog.event_data.AccessMask : \"0x100\" and\n not winlog.event_data.SubjectUserName : (\"*$\", \"MSOL_*\")\n", "references": [ "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html", @@ -58,5 +58,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_disable_kerberos_preauth.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_disable_kerberos_preauth.json index 781a90638b187..ed0657315d243 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_disable_kerberos_preauth.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_disable_kerberos_preauth.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Identifies the modification of account Kerberos preauthentication options. An adversary with GenericWrite/GenericAll rights over the account can maliciously modify these settings to perform offline password cracking attacks such as AS-REP roasting.", + "description": "Identifies the modification of an account's Kerberos pre-authentication options. An adversary with GenericWrite/GenericAll rights over the account can maliciously modify these settings to perform offline password cracking attacks such as AS-REP roasting.", "from": "now-9m", "index": [ "winlogbeat-*", @@ -11,8 +11,8 @@ ], "language": "kuery", "license": "Elastic License v2", - "name": "Kerberos Preauthentication Disabled for User", - "note": "## Config\n\nThe 'Audit User Account Management' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nAccount Management > \nAudit User Account Management (Success,Failure)\n```\n", + "name": "Kerberos Pre-authentication Disabled for User", + "note": "## Triage and analysis\n\n### Investigating Kerberos Pre-authentication Disabled for User\n\nKerberos pre-authentication is an account protection against offline password cracking. When enabled, a user requesting\naccess to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request\n(AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to\nsuccessfully decrypt the timestamp with the hash of the user\u2019s password, it will then send an Authentication Server\nResponse (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is\nsigned with the user\u2019s password. Microsoft's security monitoring [recommendations](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738) state that `'Don't Require Preauth' \u2013 Enabled` should not be enabled for user accounts because it weakens security for the account\u2019s Kerberos authentication.\n\nAS-REP roasting is an attack against Kerberos for user accounts that do not require pre-authentication, which means that\nif the target user has pre-authentication disabled, an attacker can request authentication data for it and get a TGT that\ncan be brute-forced offline, similarly to Kerberoasting.\n\n#### Possible investigation steps\n\n- Identify the account that performed the action.\n- Check whether this user should be doing this kind of activity.\n- Investigate if the target account is privileged.\n- Contact the account owner and confirm whether they are aware of this activity.\n\n### False positive analysis\n\n- Disabling pre-authentication is a bad security practice and should not be allowed in the domain. The security team\nshould map and monitor any potential benign true positives (B-TPs), especially if the target account is privileged.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Reset the target account's password if there is any risk of TGTs having been retrieved.\n- Reset the password of the origin user if the activity was not recognized by the account owner.\n- Re-enable the preauthentication option for the account.\n\n## Config\n\nThe 'Audit User Account Management' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nAccount Management > \nAudit User Account Management (Success,Failure)\n```\n", "query": "event.code:4738 and message:\"'Don't Require Preauth' - Enabled\"\n", "references": [ "https://www.harmj0y.net/blog/activedirectory/roasting-as-reps", @@ -55,5 +55,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_domain_backup_dpapi_private_keys.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_domain_backup_dpapi_private_keys.json index 43ea1078d1583..5077e1ea51f2e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_domain_backup_dpapi_private_keys.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_domain_backup_dpapi_private_keys.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Creation or Modification of Domain Backup DPAPI private key", - "note": "## Triage and analysis\n\nDomain DPAPI Backup keys are stored on domain controllers and can be dumped remotely with tools such as Mimikatz. The resulting .pvk private key can be used to decrypt ANY domain user masterkeys, which then can be used to decrypt any secrets protected by those keys.", + "note": "## Triage and analysis\n\nDomain DPAPI Backup keys are stored on domain controllers and can be dumped remotely with tools such as Mimikatz. The resulting .pvk private key can be used to decrypt ANY domain user masterkeys, which then can be used to decrypt any secrets protected by those keys.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and file.name : (\"ntds_capi_*.pfx\", \"ntds_capi_*.pvk\")\n", "references": [ "https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/", @@ -59,5 +59,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dump_registry_hives.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dump_registry_hives.json index 10c6996fa56aa..4688a7b3c9be9 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dump_registry_hives.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dump_registry_hives.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Credential Acquisition via Registry Hive Dumping", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.pe.original_file_name == \"reg.exe\" and\n process.args : (\"save\", \"export\") and\n process.args : (\"hklm\\\\sam\", \"hklm\\\\security\")\n", "references": [ "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-the-registry-7512674487f8" @@ -57,5 +58,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dumping_keychain_security.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dumping_keychain_security.json index 6d3a45f905a9f..7b8e3af679113 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dumping_keychain_security.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_dumping_keychain_security.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Dumping of Keychain Content via Security Command", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and process.args : \"dump-keychain\" and process.args : \"-d\"\n", "references": [ "https://ss64.com/osx/security.html" @@ -51,5 +52,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_iis_apppoolsa_pwd_appcmd.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_iis_apppoolsa_pwd_appcmd.json index 200f4e79795a4..1b10f96fc54ee 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_iis_apppoolsa_pwd_appcmd.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_iis_apppoolsa_pwd_appcmd.json @@ -13,6 +13,7 @@ "license": "Elastic License v2", "max_signals": 33, "name": "Microsoft IIS Service Account Password Dumped", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"appcmd.exe\" or process.pe.original_file_name == \"appcmd.exe\") and \n process.args : \"/list\" and process.args : \"/text*password\"\n", "references": [ "https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/" @@ -46,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_iis_connectionstrings_dumping.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_iis_connectionstrings_dumping.json index 56b5cba40aeff..cb091a5eb2ccd 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_iis_connectionstrings_dumping.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_iis_connectionstrings_dumping.json @@ -13,6 +13,7 @@ "license": "Elastic License v2", "max_signals": 33, "name": "Microsoft IIS Connection Strings Decryption", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"aspnet_regiis.exe\" or process.pe.original_file_name == \"aspnet_regiis.exe\") and\n process.args : \"connectionStrings\" and process.args : \"-pdf\"\n", "references": [ "https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/", @@ -47,5 +48,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberoasting_unusual_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberoasting_unusual_process.json index f1d18a80a4652..813fa167f6ab1 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberoasting_unusual_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_kerberoasting_unusual_process.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Kerberos Traffic from Unusual Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "network where event.type == \"start\" and network.direction : (\"outgoing\", \"egress\") and\n destination.port == 88 and source.port >= 49152 and\n process.executable != \"C:\\\\Windows\\\\System32\\\\lsass.exe\" and destination.address !=\"127.0.0.1\" and destination.address !=\"::1\" and\n /* insert false positives here */\n not process.name in (\"swi_fc.exe\", \"fsIPcam.exe\", \"IPCamera.exe\", \"MicrosoftEdgeCP.exe\", \"MicrosoftEdge.exe\", \"iexplore.exe\", \"chrome.exe\", \"msedge.exe\", \"opera.exe\", \"firefox.exe\")\n", "risk_score": 47, "rule_id": "897dc6b5-b39f-432a-8d75-d3730d50c782", @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_keychain_pwd_retrieval_security_cmd.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_keychain_pwd_retrieval_security_cmd.json index cacf0e1f3676c..b2c42f6b50d92 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_keychain_pwd_retrieval_security_cmd.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_keychain_pwd_retrieval_security_cmd.json @@ -14,6 +14,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Keychain Password Retrieval via Command Line", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.name : \"security\" and process.args : \"-wa\" and process.args : (\"find-generic-password\", \"find-internet-password\") and\n process.args : (\"Chrome*\", \"Chromium\", \"Opera\", \"Safari*\", \"Brave\", \"Microsoft Edge\", \"Edge\", \"Firefox*\") and\n not process.parent.executable : \"/Applications/Keeper Password Manager.app/Contents/Frameworks/Keeper Password Manager Helper*/Contents/MacOS/Keeper Password Manager Helper*\"\n", "references": [ "https://www.netmeister.org/blog/keychain-passwords.html", @@ -69,5 +70,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_file_created.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_file_created.json index d083fb322e895..2f04843ec7a95 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_file_created.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_file_created.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "LSASS Memory Dump Creation", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where file.name : (\"lsass*.dmp\", \"dumpert.dmp\", \"Andrew.dmp\", \"SQLDmpr*.mdmp\", \"Coredump.dmp\")\n", "references": [ "https://github.com/outflanknl/Dumpert", @@ -51,7 +52,9 @@ ] } ], + "timeline_id": "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "timeline_title": "Comprehensive File Timeline", "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_handle_access.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_handle_access.json new file mode 100644 index 0000000000000..03ae8e244d578 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_lsass_memdump_handle_access.json @@ -0,0 +1,60 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz, Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "LSASS Memory Dump Handle Access", + "note": "## Triage and analysis.\n\n### Investigating\n\nLocal Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible\nfor enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles\npassword changes, and creates access tokens.\n\nAdversaries may attempt to access credential material stored in the process memory of the LSASS. After a user logs on,\nthe system generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate\nsingle sign-on (SSO) ensuring a user isn\u2019t prompted each time resource access is requested. These credential materials\ncan be harvested by an adversary using administrative user or SYSTEM privileges to conduct Lateral Movement using\n[Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550/).\n\n#### Possible investigation steps:\n\n- Validate the correct install path for the process that triggered this detection\n- Confirm that any AV or EDR solutions that trigger this detection have the correct install path\n\n### False Positive Analysis\n\n- There should be very few if any false positives for this rule. However, it may be tripped by AV or EDR solutions.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage\n- In case of specific credentials were compromised:\n - Reset the password for the accounts\n\n## Config\n\nEnsure advanced audit policies for Windows are enabled, specifically\nObject Access policies [Event ID 4656](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656) (Handle to an Object was Requested)\n\n```\nComputer Configuration >\nPolicies >\nWindows Settings >\nSecurity Settings >\nAdvanced Audit Policies Configuration >\nSystem Audit Policies >\nObject Access >\nAudit File System (Success,Failure)\nAudit Handle Manipulation (Success,Failure)\n```\n\nAlso, this event generates only if the object\u2019s [SACL](https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists) has the required ACE to handle the use of specific access rights.\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n\n", + "query": "any where event.action == \"File System\" and event.code == \"4656\" and\n\n winlog.event_data.ObjectName : (\n \"?:\\\\Windows\\\\System32\\\\lsass.exe\",\n \"\\\\Device\\\\HarddiskVolume?\\\\Windows\\\\System32\\\\lsass.exe\",\n \"\\\\Device\\\\HarddiskVolume??\\\\Windows\\\\System32\\\\lsass.exe\") and\n\n /* The right to perform an operation controlled by an extended access right. */\n\n (winlog.event_data.AccessMask : (\"0x1fffff\" , \"0x1010\", \"0x120089\", \"0x1F3FFF\") or\n winlog.event_data.AccessMaskDescription : (\"READ_CONTROL\", \"Read from process memory\"))\n\n /* Common Noisy False Positives */\n\n and not winlog.event_data.ProcessName : (\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Windows\\\\system32\\\\wbem\\\\WmiPrvSE.exe\",\n \"?:\\\\Windows\\\\System32\\\\dllhost.exe\",\n \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Windows\\\\System32\\\\msiexec.exe\",\n \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*.exe\",\n \"?:\\\\Windows\\\\explorer.exe\")\n", + "references": [ + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656", + "https://twitter.com/jsecurity101/status/1227987828534956033?s=20", + "https://attack.mitre.org/techniques/T1003/001/", + "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-170105221010.html", + "http://findingbad.blogspot.com/2017/" + ], + "risk_score": 73, + "rule_id": "208dbe77-01ed-4954-8d44-1e5751cb20de", + "severity": "high", + "tags": [ + "Elastic", + "Host", + "Windows", + "Threat Detection", + "Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mfa_push_brute_force.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mfa_push_brute_force.json index 9fa6f3a10b31c..d7e78dacd0f5a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mfa_push_brute_force.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mfa_push_brute_force.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Detect when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.", + "description": "Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.", "index": [ "filebeat-*", "logs-okta*" @@ -43,7 +43,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mimikatz_memssp_default_logs.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mimikatz_memssp_default_logs.json index 9f9bd297e17c1..0cdf87c777ce1 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mimikatz_memssp_default_logs.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mimikatz_memssp_default_logs.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Mimikatz Memssp Log File Detected", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where file.name : \"mimilsa.log\" and process.name : \"lsass.exe\"\n", "risk_score": 73, "rule_id": "ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mod_wdigest_security_provider.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mod_wdigest_security_provider.json index d2360c9889dea..0c434f8b78116 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mod_wdigest_security_provider.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_mod_wdigest_security_provider.json @@ -12,10 +12,12 @@ "language": "eql", "license": "Elastic License v2", "name": "Modification of WDigest Security Provider", + "note": "## Triage and analysis.\n\n### Investigating Modification of WDigest Security Provider\n\nIn Windows XP, Microsoft added support for a protocol known as WDigest. The WDigest protocol allows clients to send\ncleartext credentials to Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) applications\nbased on RFC 2617 and 2831. Windows versions up to 8 and 2012 store logon credentials in memory in plaintext by default,\nwhich is no longer the case with newer Windows versions.\n\nStill, attackers can force WDigest to store the passwords insecurely on the memory by modifying the\n`HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential` registry key. This activity is\ncommonly related to the execution of credential dumping tools.\n\n#### Possible investigation steps\n\n- It is unlikely that the monitored registry key was modified legitimately in newer versions of Windows. Analysts should\ntreat any activity triggered from this rule with high priority as it typically represents an active adversary.\n- Investigate the script execution chain (parent process tree).\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Determine if credential dumping tools were run on the host and if any suspicious tool is found:\n - Retrieve the file.\n - Use a sandboxed malware analysis system to perform analysis.\n - Observe attempts to contact external domains and addresses.\n - Use the PowerShell Get-FileHash cmdlet to get the SHA-256 hash value of the file.\n - Search for the existence of this file in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Use process name, command line, and file hash to search for other compromised hosts.\n- Scope potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target\nhost after the registry modification.\n\n### False positive analysis\n\n- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and\nmonitored by the security team, as these modifications expose the entire domain to credential compromises and\nconsequently unauthorized access.\n\n### Related rules\n\n- Mimikatz Powershell Module Activity - ac96ceb8-4399-4191-af1d-4feeac1f1f46\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Disable user account\u2019s ability to log in remotely.\n- Reset the password for the user account and other potentially compromised accounts (email, services, CRMs, etc.).\n- Reimage the host operating system and restore compromised files to clean versions.\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where event.type : (\"creation\", \"change\") and\n registry.path : \n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\SecurityProviders\\\\WDigest\\\\UseLogonCredential\"\n and registry.data.strings : (\"1\", \"0x00000001\")\n", "references": [ "https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html", - "https://www.praetorian.com/blog/mitigating-mimikatz-wdigest-cleartext-credential-theft?edition=2019" + "https://www.praetorian.com/blog/mitigating-mimikatz-wdigest-cleartext-credential-theft?edition=2019", + "https://frsecure.com/compromised-credentials-response-playbook" ], "risk_score": 73, "rule_id": "d703a5af-d5b0-43bd-8ddb-7a5d500b7da5", @@ -53,5 +55,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_moving_registry_hive_via_smb.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_moving_registry_hive_via_smb.json new file mode 100644 index 0000000000000..4e0abecf3e443 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_moving_registry_hive_via_smb.json @@ -0,0 +1,74 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies the creation or modification of a medium size registry hive file via the SMB protocol. This may indicate an exfiltration attempt via dumping SAM registry hive in preparation for credential access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Registry Hive File Creation via SMB", + "query": "file where event.type == \"creation\" and\n /* regf file header */\n file.Ext.header_bytes : \"72656766*\" and file.size >= 30000 and\n process.pid == 4 and user.id : \"s-1-5-21*\"\n", + "risk_score": 47, + "rule_id": "a4c7473a-5cb4-4bc1-9d06-e4a75adbc494", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Windows", + "Threat Detection", + "Lateral Movement", + "Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.002", + "name": "Security Account Manager", + "reference": "https://attack.mitre.org/techniques/T1003/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.002", + "name": "SMB/Windows Admin Shares", + "reference": "https://attack.mitre.org/techniques/T1021/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_persistence_network_logon_provider_modification.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_persistence_network_logon_provider_modification.json index d83bf00d9860c..110b790de887d 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_persistence_network_logon_provider_modification.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_persistence_network_logon_provider_modification.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon.", + "description": "Identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon.", "false_positives": [ "Authorized third party network logon providers." ], @@ -63,5 +63,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_posh_minidump.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_posh_minidump.json index b9cbc6f0c60cc..276ee92e3b086 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_posh_minidump.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_posh_minidump.json @@ -14,7 +14,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "PowerShell MiniDump Script", - "note": "## Triage and analysis.\n\n### Investigating PowerShell MiniDump Script\n\nPowerShell is one of the main tools used by system administrators for automation, report routines, and other tasks.\n\nProcess Memory Dump capabilities can be abused by attackers to extract credentials from LSASS or to obtain other privileged\ninformation stored in the process memory.\n\n#### Possible investigation steps:\n\n- Examine script content that triggered the detection. \n- Investigate script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- If the action is suspicious for the user, check for any other activities done by the user in the last 48 hours.\n\n### False Positive Analysis\n\n- Verify whether the script content is malicious/harmful.\n\n### Related Rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d\n\n### Response and Remediation\n\n- Immediate response should be taken to validate, investigate, and potentially contain the activity to prevent further\npost-compromise behavior.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", + "note": "## Triage and analysis.\n\n### Investigating PowerShell MiniDump Script\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This\nmakes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can abuse Process Memory Dump capabilities to extract credentials from LSASS or to obtain other\nprivileged information stored in the process memory.\n\n#### Possible investigation steps\n\n- Examine script content that triggered the detection. \n- Investigate the script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Consider whether the user needs PowerShell to complete its tasks.\n- Check if the imported function was executed and which process it targeted.\n\n### False positive analysis\n\n- Regular users do not have a business justification for using scripting utilities to dump process memory, making false\npositives unlikely.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Quarantine the involved host for forensic investigation, as well as eradication and recovery activities.\n- Configure AppLocker or equivalent software to restrict access to PowerShell for regular users.\n- Reset the password for the user account.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", "query": "event.category:process and powershell.file.script_block_text:(MiniDumpWriteDump or MiniDumpWithFullMemory or pmuDetirWpmuDiniM)\n", "references": [ "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Out-Minidump.ps1", @@ -79,5 +79,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_posh_request_ticket.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_posh_request_ticket.json index ca1ea37561b20..2719736e43ddc 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_posh_request_ticket.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_posh_request_ticket.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is common step in Kerberoasting toolkits to crack service accounts.", + "description": "Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts.", "from": "now-9m", "index": [ "winlogbeat-*", @@ -11,6 +11,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "PowerShell Kerberos Ticket Request", + "note": "## Triage and analysis\n\n### Investigating Explicit PowerShell Kerberos Ticket Request\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making\nit available for use in various environments, creating an attractive way for attackers to execute code.\n\nAccounts associated with a service principal name (SPN) are viable targets for Kerberoasting attacks, which use brute\nforce to crack the user password, which is used to encrypt a Kerberos TGS ticket.\n\nAttackers can use PowerShell to request these Kerberos tickets, with the intent of extracting them from memory to\nperform Kerberoasting.\n\n#### Possible investigation steps\n\n- Retrieve the script contents.\n- Investigate the script execution chain (parent process tree).\n- Investigate if the script was executed, and if so, which account was targeted.\n- Check whether this user should be doing this kind of activity.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Check if the script has any other functionality that can be potentially malicious.\n- Investigate other alerts related to the host and user in the last 48 hours.\n- Review event ID [4769](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769)\nrelated to this account and service name for additional information.\n\n### False positive analysis\n\n- A possible false positive can be identified if the script content is not malicious/harmful or does not request\nKerberos tickets for user accounts, as computer accounts are not vulnerable to Kerberoasting due to complex password\nrequirements and policy.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Reset the password of the involved accounts. Priority should be given to privileged accounts.\n- Quarantine the involved host for forensic investigation, as well as eradication and recovery activities.\n", "query": "event.category:process and \n powershell.file.script_block_text : (\n KerberosRequestorSecurityToken\n )\n", "references": [ "https://cobalt.io/blog/kerberoast-attack-techniques", @@ -79,5 +80,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_potential_lsa_memdump_via_mirrordump.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_potential_lsa_memdump_via_mirrordump.json index f248df2a6f7e9..d6fd9ba869b29 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_potential_lsa_memdump_via_mirrordump.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_potential_lsa_memdump_via_mirrordump.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Credential Access via DuplicateHandle in LSASS", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.code == \"10\" and \n\n /* LSASS requesting DuplicateHandle access right to another process */\n process.name : \"lsass.exe\" and winlog.event_data.GrantedAccess == \"0x40\" and\n\n /* call is coming from an unknown executable region */\n winlog.event_data.CallTrace : \"*UNKNOWN*\"\n", "references": [ "https://github.com/CCob/MirrorDump" @@ -51,5 +52,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_promt_for_pwd_via_osascript.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_promt_for_pwd_via_osascript.json index bb79304b9de10..31b08204b6e8e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_promt_for_pwd_via_osascript.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_promt_for_pwd_via_osascript.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Prompt for Credentials with OSASCRIPT", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and process.name : \"osascript\" and\n process.command_line : \"osascript*display dialog*password*\"\n", "references": [ "https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/prompt.py", @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_remote_sam_secretsdump.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_remote_sam_secretsdump.json new file mode 100644 index 0000000000000..102056540e0e2 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_remote_sam_secretsdump.json @@ -0,0 +1,72 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies remote access to the registry to potentially dump credential data from the SAM registry hive in preparation for credential access and privileges elevation.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Remote Credential Access via Registry", + "note": "## Config\n\nThis rule uses Elastic Endpoint file creation and System Integration events for correlation. Both data should be\ncollected from the host for this detection to work.\n", + "query": "sequence by host.id, user.id with maxspan=1m\n [authentication where\n event.outcome == \"success\" and\n winlog.logon.type == \"Network\" and not user.name == \"ANONYMOUS LOGON\" and\n not user.domain == \"NT AUTHORITY\" and source.ip != \"127.0.0.1\" and source.ip !=\"::1\"]\n [file where event.action == \"creation\" and process.name : \"svchost.exe\" and\n file.Ext.header_bytes : \"72656766*\" and user.id : \"S-1-5-21-*\" and file.size >= 30000]\n", + "references": [ + "https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py" + ], + "risk_score": 73, + "rule_id": "850d901a-2a3c-46c6-8b22-55398a01aad8", + "severity": "high", + "tags": [ + "Elastic", + "Host", + "Windows", + "Threat Detection", + "Lateral Movement", + "Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.002", + "name": "Security Account Manager", + "reference": "https://attack.mitre.org/techniques/T1003/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_saved_creds_vaultcmd.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_saved_creds_vaultcmd.json index c6db4426ac8c1..a91f9316d8e87 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_saved_creds_vaultcmd.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_saved_creds_vaultcmd.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Searching for Saved Credentials via VaultCmd", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.pe.original_file_name:\"vaultcmd.exe\" or process.name:\"vaultcmd.exe\") and\n process.args:\"/list*\"\n", "references": [ "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16", @@ -58,5 +59,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_seenabledelegationprivilege_assigned_to_user.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_seenabledelegationprivilege_assigned_to_user.json index 20738784c1c5e..853b1446cb41f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_seenabledelegationprivilege_assigned_to_user.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_seenabledelegationprivilege_assigned_to_user.json @@ -12,11 +12,13 @@ "language": "kuery", "license": "Elastic License v2", "name": "Sensitive Privilege SeEnableDelegationPrivilege assigned to a User", - "note": "## Config\n\nThe 'Audit Authorization Policy Change' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration >\nWindows Settings >\nSecurity Settings >\nAdvanced Audit Policy Configuration >\nAudit Policies >\nPolicy Change >\nAudit Authorization Policy Change (Success,Failure)\n```\n", + "note": "## Triage and analysis\n\n### Investigating Sensitive Privilege SeEnableDelegationPrivilege assigned to a User\n\nKerberos delegation is an Active Directory feature that allows user and computer accounts to impersonate other accounts,\nact on their behalf, and use their privileges. Delegation (constrained and unconstrained) can be configured\nfor user and computer objects.\n\nEnabling unconstrained delegation for a computer causes the computer to store the ticket-granting ticket\n(TGT) in memory at any time an account connects to the computer, so it can be used by the computer for impersonation\nwhen needed. Risk is heightened if an attacker compromises computers with unconstrained delegation enabled, as they\ncould extract TGTs from memory and then replay them to move laterally on the domain. If the attacker coerces a privileged\nuser to connect to the server, or if the user does so routinely, the account will be compromised and the attacker will\nbe able to pass-the-ticket to privileged assets.\n\nSeEnableDelegationPrivilege is a user right that is controlled within the Local Security Policy of a domain controller\nand is managed through Group Policy. This setting is named **Enable computer and user accounts to be trusted for\ndelegation**.\n\nIt is critical to control the assignment of this privilege. A user with this privilege and write access to a computer\ncan control delegation settings, perform the attacks described above, and harvest TGTs from any user that connects to\nthe system. \n\n#### Possible investigation steps\n\n- Investigate how the privilege was assigned to the user and who assigned it.\n- Investigate other potentially malicious activity that was performed by the user that assigned the privileges using the\n`user.id` and `winlog.activity_id` fields as a filter during the past 48 hours.\n- Investigate other alerts associated with the involved accounts during the past 48 hours.\n\n### False positive analysis\n\n- The SeEnableDelegationPrivilege privilege should not be assigned to users. If this rule is triggered in your\nenvironment legitimately, the security team should notify the administrators about the risks of using it.\n\n### Related rules\n\n- KRBTGT Delegation Backdoor - e052c845-48d0-4f46-8a13-7d0aba05df82\n\n### Response and remediation\n\n- Immediate response should be taken to validate, investigate, and potentially contain the activity to prevent further\npost-compromise behavior.\n\n## Config\n\nThe 'Audit Authorization Policy Change' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration >\nWindows Settings >\nSecurity Settings >\nAdvanced Audit Policy Configuration >\nAudit Policies >\nPolicy Change >\nAudit Authorization Policy Change (Success,Failure)\n```\n", "query": "event.action: \"Authorization Policy Change\" and event.code:4704 and winlog.event_data.PrivilegeList:\"SeEnableDelegationPrivilege\"\n", "references": [ - "https://www.harmj0y.net/blog/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of", + "https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/", "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_alert_active_directory_user_control.yml", + "https://twitter.com/_nwodtuhs/status/1454049485080907776", + "https://www.thehacker.recipes/ad/movement/kerberos/delegations", "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0105_windows_audit_authorization_policy_change.md" ], "risk_score": 73, @@ -27,7 +29,8 @@ "Host", "Windows", "Threat Detection", - "Credential Access" + "Credential Access", + "Active Directory" ], "threat": [ { @@ -51,5 +54,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_spn_attribute_modified.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_spn_attribute_modified.json new file mode 100644 index 0000000000000..70f897b2ee83a --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_spn_attribute_modified.json @@ -0,0 +1,62 @@ +{ + "author": [ + "Elastic" + ], + "description": "Detects when a user account has the servicePrincipalName attribute modified. Attackers can abuse write privileges over a user to configure SPNs so that they can perform Kerberoasting. Administrators can also configure this for legitimate purposes, exposing the account to Kerberoasting.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "User account exposed to Kerberoasting", + "note": "## Triage and analysis.\n\n### Investigating User account exposed to Kerberoasting\n\nService principal names (SPNs) is the name by which a Kerberos client uniquely identifies an instance of a service for a\ngiven Kerberos target computer. \n\nBy default, only computer accounts have SPNs, and there is no significant risk about this, as machine accounts have a\ndefault domain policy that configures these accounts to rotate their passwords every 30 days, and the password is\ncompound of 120 random characters, making them not to be vulnerable to Kerberoasting.\n\nSo, a user account with an SPN assigned is considered a Service Account, making it available to be accessed by the\nentire domain. If any user in the directory requests a TGS, the domain controller will encrypt it with the secret key of\nthe account executing the service. An attacker can potentially perform a Kerberoasting attack with this information, as\nthe human-defined password is more likely to be less complex.\n\nFor scenarios where SPNs cannot be avoided on user accounts, Microsoft provides the Group Managed Service Accounts (gMSA)\nfeature, which ensures that the account password is robust and changed regularly and automatically. More information can\nbe found [here](https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview).\n\nAttackers can also perform \"Targeted Kerberoasting\", which consists of adding fake SPNs to user accounts that they have\nwrite privileges to, making them potentially vulnerable to Kerberoasting.\n\n#### Possible investigation steps:\n\n- Identify the account that performed the action.\n- Check whether this user should be doing this kind of activity.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate if the target account is a member of Privileged groups (Domain Admins, Enterprise Admins, etc).\n- Investigate if tickets have been requested for the target account.\n- Investigate other alerts related to the user in the last 48 hours.\n\n### False Positive Analysis\n\n- The use of user accounts as service accounts is a bad security practice and should not be allowed in the domain. The\nsecurity team should map and monitor any potential B-TP (Benign True Positive), especially if the account is privileged.\nDomain Administrators that define this kind of setting can put the domain at risk as user accounts don't have the same\nsecurity standards (Long, complex, random passwords that change frequently) as computer accounts, exposing them to\ncredential cracking attacks (Kerberoasting, brute force, etc.).\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage\n- Reset the password of the involved accounts. Priority should be given to privileged accounts.\n- Quarantine the involved host for forensic investigation, as well as eradication and recovery activities.\n\n## Config\n\nThe 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nDS Access > \nAudit Directory Service Changes (Success,Failure)\n```\n\nThe above policy does not cover User objects, so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule.\nAs this specifies the servicePrincipalName Attribute GUID, it is expected to be low noise.\n\n```\nSet-AuditRule -AdObjectPath 'AD:\\CN=Users,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights WriteProperty -InheritanceFlags Children -AttributeGUID f3a64788-5306-11d1-a9c5-0000f80367c1 -AuditFlags Success\n```\n", + "query": "event.action:\"Directory Service Changes\" and event.code:5136 and winlog.event_data.ObjectClass:\"user\" \nand winlog.event_data.AttributeLDAPDisplayName:\"servicePrincipalName\"\n", + "references": [ + "https://www.thehacker.recipes/ad/movement/access-controls/targeted-kerberoasting", + "https://www.qomplx.com/qomplx-knowledge-kerberoasting-attacks-explained/", + "https://www.thehacker.recipes/ad/movement/kerberos/kerberoast", + "https://attack.stealthbits.com/cracking-kerberos-tgs-tickets-using-kerberoasting", + "https://adsecurity.org/?p=280", + "https://github.com/OTRF/Set-AuditRule" + ], + "risk_score": 73, + "rule_id": "0b2f3da5-b5ec-47d1-908b-6ebb74814289", + "severity": "high", + "tags": [ + "Elastic", + "Host", + "Windows", + "Threat Detection", + "Credential Access", + "Active Directory" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1558", + "name": "Steal or Forge Kerberos Tickets", + "reference": "https://attack.mitre.org/techniques/T1558/", + "subtechnique": [ + { + "id": "T1558.003", + "name": "Kerberoasting", + "reference": "https://attack.mitre.org/techniques/T1558/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_ssh_backdoor_log.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_ssh_backdoor_log.json index a2a18e84647ee..9e45afac8f290 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_ssh_backdoor_log.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_ssh_backdoor_log.json @@ -14,6 +14,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential OpenSSH Backdoor Logging Activity", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type == \"change\" and process.executable : (\"/usr/sbin/sshd\", \"/usr/bin/ssh\") and\n (\n file.name : (\".*\", \"~*\") or\n file.extension : (\"in\", \"out\", \"ini\", \"h\", \"gz\", \"so\", \"sock\", \"sync\", \"0\", \"1\", \"2\", \"3\", \"4\", \"5\", \"6\", \"7\", \"8\", \"9\") or\n file.path : \n (\n \"/private/etc/*--\", \n \"/usr/share/*\", \n \"/usr/include/*\", \n \"/usr/local/include/*\", \n \"/private/tmp/*\", \n \"/private/var/tmp/*\",\n \"/usr/tmp/*\", \n \"/usr/share/man/*\", \n \"/usr/local/share/*\", \n \"/usr/lib/*.so.*\", \n \"/private/etc/ssh/.sshd_auth\",\n \"/usr/bin/ssd\", \n \"/private/var/opt/power\", \n \"/private/etc/ssh/ssh_known_hosts\", \n \"/private/var/html/lol\", \n \"/private/var/log/utmp\", \n \"/private/var/lib\",\n \"/var/run/sshd/sshd.pid\",\n \"/var/run/nscd/ns.pid\",\n \"/var/run/udev/ud.pid\",\n \"/var/run/udevd.pid\"\n )\n )\n", "references": [ "https://github.com/eset/malware-ioc/tree/master/sshdoor", @@ -64,5 +65,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_comsvcs_imageload.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_comsvcs_imageload.json index ce37891caaea4..5b27c1ea0694c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_comsvcs_imageload.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_comsvcs_imageload.json @@ -50,7 +50,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_lsass_access_memdump.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_lsass_access_memdump.json index f51f049f03641..b36ef7b3f68b0 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_lsass_access_memdump.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_lsass_access_memdump.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Credential Access via LSASS Memory Dump", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.code == \"10\" and\n winlog.event_data.TargetImage : \"?:\\\\WINDOWS\\\\system32\\\\lsass.exe\" and\n \n /* DLLs exporting MiniDumpWriteDump API to create an lsass mdmp*/\n winlog.event_data.CallTrace : (\"*dbghelp*\", \"*dbgcore*\") and\n \n /* case of lsass crashing */\n not process.executable : (\"?:\\\\Windows\\\\System32\\\\WerFault.exe\", \"?:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\")\n", "references": [ "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz" @@ -51,5 +52,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_lsass_access_via_snapshot.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_lsass_access_via_snapshot.json index 95b1ff9fac197..3b0976b78c9f0 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_lsass_access_via_snapshot.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_lsass_access_via_snapshot.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Identifies suspicious access to an LSASS handle via PssCaptureSnapShot where two successive process accesses are performed by the same process and targeting two different instances of LSASS. This may indicate an attempt to evade detection and dump LSASS memory for credential access.", + "description": "Identifies suspicious access to an LSASS handle via PssCaptureSnapShot where two successive process accesses are performed by the same process and target two different instances of LSASS. This may indicate an attempt to evade detection and dump LSASS memory for credential access.", "from": "now-9m", "index": [ "winlogbeat-*", @@ -65,5 +65,5 @@ }, "timestamp_override": "event.ingested", "type": "threshold", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_winreg_access_via_sebackup_priv.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_winreg_access_via_sebackup_priv.json new file mode 100644 index 0000000000000..8a6219c80839f --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_suspicious_winreg_access_via_sebackup_priv.json @@ -0,0 +1,72 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies remote access to the registry via an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials via dumping the SAM registry hive in preparation for credential access and privileges elevation.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Remote Registry Access via SeBackupPrivilege", + "note": "## Config\n\nThe 'Audit Detailed File Share' audit policy is required be configured (Success) on Domain Controllers and Sensitive Windows Servers.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n```\nComputer Configuration >\nPolicies >\nWindows Settings >\nSecurity Settings >\nAdvanced Audit Policies Configuration >\nAudit Policies >\nObject Access >\nAudit Detailed File Share (Success)\n```\n\nThe 'Special Logon' audit policy must be configured (Success).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n```\nComputer Configuration >\nPolicies >\nWindows Settings >\nSecurity Settings >\nAdvanced Audit Policies Configuration >\nAudit Policies >\nLogon/Logoff >\nSpecial Logon (Success)\n```\n", + "query": "sequence by host.id, winlog.event_data.SubjectLogonId with maxspan=1m\n [iam where event.action == \"logged-in-special\" and\n winlog.event_data.PrivilegeList : \"SeBackupPrivilege\"]\n [any where event.action == \"Detailed File Share\" and winlog.event_data.RelativeTargetName : \"winreg\"]\n", + "references": [ + "https://github.com/mpgn/BackupOperatorToDA", + "https://raw.githubusercontent.com/Wh04m1001/Random/main/BackupOperators.cpp" + ], + "risk_score": 47, + "rule_id": "47e22836-4a16-4b35-beee-98f6c4ee9bf2", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Windows", + "Threat Detection", + "Lateral Movement", + "Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.002", + "name": "Security Account Manager", + "reference": "https://attack.mitre.org/techniques/T1003/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_symbolic_link_to_shadow_copy_created.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_symbolic_link_to_shadow_copy_created.json new file mode 100644 index 0000000000000..1daea178fca7e --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_symbolic_link_to_shadow_copy_created.json @@ -0,0 +1,57 @@ +{ + "author": [ + "Elastic", + "Austin Songer" + ], + "description": "Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials.", + "false_positives": [ + "Legitimate administrative activity related to shadow copies." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Symbolic Link to Shadow Copy Created", + "note": "## Triage and analysis.\n\n### Investigating\n\nShadow copies are backups or snapshots of an endpoints files or volumes at the time of being in use. Adversaries may attempt to discover and create symbolic links to these shadow copies in order to copy sensitive information offline. If Active Directory (AD) is in use, often the ntds.dit file is a target as it contains password hashes but an offline copy is needed to extract these hashes and potentially conduct lateral movement.\n\n#### Possible investigation steps:\n\n- Determine if a volume shadow copy was recently created on this endpoint.\n- Review priviledges of the end user as this requires administrative access.\n- Verify ntds.dit file was successfully copied and the location.\n- Investigate for registry SYSTEM file copies made recently or saved via Reg.exe.\n- Investigate recent deletions of volume shadow copies.\n- Identify other files potentially copied from volume shadow copy paths directly.\n\n### False Positive Analysis\n\n- There should be very little false positive triggers with this rule.\n\n### Related Rules\n- NTDS or SAM Database File Copied - 3bc6deaa-fbd4-433a-ae21-3e892f95624f\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- In case specific credentials were compromised:\n - Reset the password for the accounts\n- Locate and remove static files copied from volume shadow copies.\n- Command-Line tool mklink should require administrative access by default unless in developer mode.\n\n## Config\n\nEnsure advanced audit policies for Windows are enabled, specifically\nObject Access policies [Event ID 4656](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656) (Handle to an Object was Requested)\n\n```\nComputer Configuration >\nPolicies >\nWindows Settings >\nSecurity Settings >\nAdvanced Audit Policies Configuration >\nSystem Audit Policies >\nObject Access >\nAudit File System (Success,Failure)\nAudit Handle Manipulation (Success,Failure)\n```\n\nThis event will only trigger if symbolic links are created from a new process spawning for cmd.exe or powershell.exe with the correct arguments.\nDirect access to a shell and calling symbolic link creation tools will not generate an event.\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n\n", + "query": "process where event.type in (\"start\",\"process_created\") and \n process.pe.original_file_name in (\"Cmd.Exe\",\"PowerShell.EXE\") and \n \n /* Create Symbolic Link to Shadow Copies */\n process.args : (\"*mklink*\", \"*SymbolicLink*\") and process.command_line : (\"*HarddiskVolumeShadowCopy*\")\n", + "references": [ + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mklink", + "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf", + "https://blog.netwrix.com/2021/11/30/extracting-password-hashes-from-the-ntds-dit-file/", + "https://www.hackingarticles.in/credential-dumping-ntds-dit/" + ], + "risk_score": 47, + "rule_id": "d117cbb4-7d56-41b4-b999-bdf8c25648a0", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Windows", + "Threat Detection", + "Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_symbolic_link_to_shadow_copy_createdcredential_access_symbolic_link_to_shadow_copy_created.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_symbolic_link_to_shadow_copy_createdcredential_access_symbolic_link_to_shadow_copy_created.json deleted file mode 100644 index bbf07b959285f..0000000000000 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_symbolic_link_to_shadow_copy_createdcredential_access_symbolic_link_to_shadow_copy_created.json +++ /dev/null @@ -1,53 +0,0 @@ -{ - "author": [ - "Austin Songer" - ], - "description": "Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files that may contain credential information.", - "false_positives": [ - "Legitimate administrative activity related to shadow copies." - ], - "from": "now-9m", - "index": [ - "winlogbeat-*", - "logs-endpoint.events.*", - "logs-windows.*" - ], - "language": "eql", - "license": "Elastic License v2", - "name": "Symbolic Link to Shadow Copy Created", - "query": "process where event.type in (\"start\", \"process_started\") and\nprocess.pe.original_file_name == \"Cmd.Exe\" and\nprocess.args : \"*mklink*\" and\nprocess.args : \"*\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy*\"\n", - "references": [ - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mklink", - "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf" - ], - "risk_score": 47, - "rule_id": "d117cbb4-7d56-41b4-b999-bdf8c25648a0", - "severity": "medium", - "tags": [ - "Elastic", - "Host", - "Windows", - "Threat Detection", - "Credential Access" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0006", - "name": "Credential Access", - "reference": "https://attack.mitre.org/tactics/TA0006/" - }, - "technique": [ - { - "id": "T1003", - "name": "OS Credential Dumping", - "reference": "https://attack.mitre.org/techniques/T1003/" - } - ] - } - ], - "timestamp_override": "event.ingested", - "type": "eql", - "version": 2 -} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_systemkey_dumping.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_systemkey_dumping.json index 9eaa51279bf4b..c7659fab81750 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_systemkey_dumping.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_systemkey_dumping.json @@ -11,7 +11,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "SystemKey Access via Command Line", - "query": "event.category:process and event.type:(start or process_started) and\n process.args:\"/private/var/db/SystemKey\"\n", + "query": "event.category:process and event.type:(start or process_started) and\n process.args:(\"/private/var/db/SystemKey\" or \"/var/db/SystemKey\")\n", "references": [ "https://github.com/AlessandroZ/LaZagne/blob/master/Mac/lazagne/softwares/system/chainbreaker.py" ], @@ -51,5 +51,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_user_impersonation_access.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_user_impersonation_access.json new file mode 100644 index 0000000000000..7cd8ebcd77d31 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_user_impersonation_access.json @@ -0,0 +1,46 @@ +{ + "author": [ + "Elastic" + ], + "description": "A user has initiated a session impersonation granting them access to the environment with the permissions of the user they are impersonating. This would likely indicate Okta administrative access and should only ever occur if requested and expected.", + "from": "now-30m", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "interval": "15m", + "language": "kuery", + "license": "Elastic License v2", + "name": "Okta User Session Impersonation", + "note": "## Config\n\nThe Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "query": "event.dataset:okta.system and event.action:user.session.impersonation.initiate\n", + "references": [ + "https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/" + ], + "risk_score": 73, + "rule_id": "cdbebdc1-dc97-43c6-a538-f26a20c0a911", + "severity": "high", + "tags": [ + "Elastic", + "Identity", + "Okta", + "Continuous Monitoring", + "SecOps", + "Identity and Access", + "Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_via_snapshot_lsass_clone_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_via_snapshot_lsass_clone_creation.json index 386fb66bb4cbf..3680bcfd8c956 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_via_snapshot_lsass_clone_creation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/credential_access_via_snapshot_lsass_clone_creation.json @@ -11,7 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential LSASS Clone Creation via PssCaptureSnapShot", - "note": "## Config\n\nThis is meant to run only on datasources using Windows security event 4688 that captures the process clone creation.", + "note": "## Config\n\nThis is meant to run only on datasources using Windows security event 4688 that captures the process clone creation.\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.code:\"4688\" and\n process.executable : \"?:\\\\Windows\\\\System32\\\\lsass.exe\" and\n process.parent.executable : \"?:\\\\Windows\\\\System32\\\\lsass.exe\"\n", "references": [ "https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/", @@ -53,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.json index 66d900975ff39..03189a0c45a28 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Adding Hidden File Attribute via Attrib", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : \"attrib.exe\" and process.args : \"+h\"\n", "risk_score": 21, "rule_id": "4630d948-40d4-4cef-ac69-4002e29bc3db", @@ -56,7 +57,9 @@ "technique": [] } ], + "timeline_id": "e70679c2-6cde-4510-9764-4823df18f7db", + "timeline_title": "Comprehensive Process Timeline", "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_agent_spoofing_mismatched_id.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_agent_spoofing_mismatched_id.json index b5dfb8c37a47e..88dfa27a313b3 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_agent_spoofing_mismatched_id.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_agent_spoofing_mismatched_id.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Detects events which have a mismatch on the expected event agent ID. The status \"agent_id_mismatch\" occurs when the expected agent ID associated with the API key does not match the actual agent ID in an event. This could indicate attempts to spoof events in order to masquerade actual activity to evade detection.", + "description": "Detects events that have a mismatch on the expected event agent ID. The status \"agent_id_mismatch\" occurs when the expected agent ID associated with the API key does not match the actual agent ID in an event. This could indicate attempts to spoof events in order to masquerade actual activity to evade detection.", "false_positives": [ "This is meant to run only on datasources using Elastic Agent 7.14+ since versions prior to that will be missing the necessary field, resulting in false positives." ], @@ -43,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_amsienable_key_mod.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_amsienable_key_mod.json index a1905ffa6c9aa..f2e4f9e740a4a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_amsienable_key_mod.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_amsienable_key_mod.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "JScript tries to query the AmsiEnable registry key from the HKEY_USERS registry hive before initializing Antimalware Scan Interface (AMSI). If this key is set to 0, AMSI is not enabled for the JScript process. An adversary can modify this key to disable AMSI protections.", + "description": "Identifies modifications of the AmsiEnable registry key to 0, which disables the Antimalware Scan Interface (AMSI). An adversary can modify this key to disable AMSI protections.", "from": "now-9m", "index": [ "winlogbeat-*", @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Modification of AmsiEnable Registry Key", + "note": "## Triage and analysis\n\n### Investigating Modification of AmsiEnable Registry Key\n\nThe Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and\nservices to integrate with any antimalware product that's present on a machine. AMSI provides integration with multiple\nWindows components, ranging from User Account Control (UAC) to VBA Macros.\n\nSince AMSI is widely used across security products for increased visibility, attackers can disable it to evade\ndetections that rely on it.\n\nThis rule monitors the modifications to the Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable registry key.\n\n#### Possible investigation steps\n\n- Identify the user that performed the action.\n- Check whether this user should be doing this kind of activity.\n- Investigate program execution chain (parent process tree).\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Investigate the execution of scripts and macros after the registry modification.\n- Retrieve script/office files:\n - Use a sandboxed malware analysis system to perform analysis.\n - Observe attempts to contact external domains and addresses.\n - Use the PowerShell Get-FileHash cmdlet to get the SHA-256 hash value of the file.\n - Search for the existence of this file in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Use process name, command line, and file hash to search for occurrences on other hosts.\n\n### False positive analysis\n\n- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and\nmonitored by the security team, as these modifications expose the host to malware infections.\n\n### Related rules\n\n- Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If malware was found, implement temporary network rules, procedures, and segmentation required to contain it.\n- Delete or set the key to its default value.\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where event.type in (\"creation\", \"change\") and\n registry.path : (\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows Script\\\\Settings\\\\AmsiEnable\",\n \"HKU\\\\*\\\\Software\\\\Microsoft\\\\Windows Script\\\\Settings\\\\AmsiEnable\"\n ) and\n registry.data.strings: (\"0\", \"0x00000000\")\n", "references": [ "https://hackinparis.com/data/slides/2019/talks/HIP2019-Dominic_Chell-Cracking_The_Perimeter_With_Sharpshooter.pdf", @@ -53,5 +54,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_attempt_del_quarantine_attrib.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_attempt_del_quarantine_attrib.json index ee724eb4e33eb..b6e853b63dece 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_attempt_del_quarantine_attrib.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_attempt_del_quarantine_attrib.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Attempt to Remove File Quarantine Attribute", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.args : \"xattr\" and\n (\n (process.args : \"com.apple.quarantine\" and process.args : (\"-d\", \"-w\")) or\n (process.args : \"-c\" and process.command_line :\n (\n \"/bin/bash -c xattr -c *\",\n \"/bin/zsh -c xattr -c *\",\n \"/bin/sh -c xattr -c *\"\n )\n )\n )\n", "references": [ "https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html", @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_console_history.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_console_history.json index 6b6df117865de..9744a5f6ee472 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_console_history.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_console_history.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Clearing Windows Console History", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.action == \"start\" and\n (process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") or process.pe.original_file_name == \"PowerShell.EXE\") and\n (process.args : \"*Clear-History*\" or\n (process.args : (\"*Remove-Item*\", \"rm\") and process.args : (\"*ConsoleHost_history.txt*\", \"*(Get-PSReadlineOption).HistorySavePath*\")) or\n (process.args : \"*Set-PSReadlineOption*\" and process.args : \"*SaveNothing*\"))\n", "references": [ "https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/", @@ -54,5 +55,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_event_logs.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_event_logs.json index 43e4ae9182112..2a807abdb6856 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_event_logs.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_clearing_windows_event_logs.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Clearing Windows Event Logs", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"process_started\", \"start\") and\n (process.name : \"wevtutil.exe\" or process.pe.original_file_name == \"wevtutil.exe\") and\n process.args : (\"/e:false\", \"cl\", \"clear-log\") or\n process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and process.args : \"Clear-EventLog\"\n", "risk_score": 21, "rule_id": "d331bbe2-6db4-4941-80a5-8270db72eb61", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 11 + "version": 12 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_code_injection_conhost.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_code_injection_conhost.json index ba4fe13622733..85b5c5d897e0f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_code_injection_conhost.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_code_injection_conhost.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Process from Conhost", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"conhost.exe\" and\n not process.executable : (\"?:\\\\Windows\\\\splwow64.exe\", \"?:\\\\Windows\\\\System32\\\\WerFault.exe\", \"?:\\\\Windows\\\\System32\\\\conhost.exe\")\n", "references": [ "https://modexp.wordpress.com/2018/09/12/process-injection-user-data/", @@ -46,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_create_mod_root_certificate.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_create_mod_root_certificate.json index 2252a075b50be..89cadc166debf 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_create_mod_root_certificate.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_create_mod_root_certificate.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Creation or Modification of Root Certificate", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where event.type in (\"creation\", \"change\") and\n registry.path :\n (\n \"HKLM\\\\Software\\\\Microsoft\\\\SystemCertificates\\\\Root\\\\Certificates\\\\*\\\\Blob\",\n \"HKLM\\\\Software\\\\Microsoft\\\\SystemCertificates\\\\AuthRoot\\\\Certificates\\\\*\\\\Blob\",\n \"HKLM\\\\Software\\\\Policies\\\\Microsoft\\\\SystemCertificates\\\\Root\\\\Certificates\\\\*\\\\Blob\",\n \"HKLM\\\\Software\\\\Policies\\\\Microsoft\\\\SystemCertificates\\\\AuthRoot\\\\Certificates\\\\*\\\\Blob\"\n )\n", "references": [ "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec", @@ -56,5 +57,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_disabled_via_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_disabled_via_registry.json index 5571bb2b9e317..fadc8651b726c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_disabled_via_registry.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_disabled_via_registry.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Windows Defender Disabled via Registry Modification", - "note": "## Triage and analysis\n\nDetections should be investigated to identify if the hosts and users are authorized to use this tool. As this rule detects post-exploitation process activity, investigations into this should be prioritized.", + "note": "## Triage and analysis\n\nDetections should be investigated to identify if the hosts and users are authorized to use this tool. As this rule detects post-exploitation process activity, investigations into this should be prioritized.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where event.type in (\"creation\", \"change\") and\n (\n (\n registry.path:\"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\DisableAntiSpyware\" and\n registry.data.strings: (\"1\", \"0x00000001\")\n ) or\n (\n registry.path:\"HKLM\\\\System\\\\*ControlSet*\\\\Services\\\\WinDefend\\\\Start\" and\n registry.data.strings in (\"3\", \"4\", \"0x00000003\", \"0x00000004\")\n )\n )\n", "references": [ "https://thedfirreport.com/2020/12/13/defender-control/" @@ -41,15 +41,15 @@ "name": "Impair Defenses", "reference": "https://attack.mitre.org/techniques/T1562/", "subtechnique": [ - { - "id": "T1562.006", - "name": "Indicator Blocking", - "reference": "https://attack.mitre.org/techniques/T1562/006/" - }, { "id": "T1562.001", "name": "Disable or Modify Tools", "reference": "https://attack.mitre.org/techniques/T1562/001/" + }, + { + "id": "T1562.006", + "name": "Indicator Blocking", + "reference": "https://attack.mitre.org/techniques/T1562/006/" } ] } @@ -58,5 +58,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_exclusion_via_powershell.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_exclusion_via_powershell.json index ecd200c116b04..b5c007363bdb8 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_exclusion_via_powershell.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_defender_exclusion_via_powershell.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Windows Defender Exclusions Added via PowerShell", - "note": "## Triage and analysis\n\n### Investigating Windows Defender Exclusions\n\nMicrosoft Windows Defender is an anti-virus product built-in within Microsoft Windows. Since this software product is\nused to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration\nsettings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of the more\nnotable [examples](https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/) was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defense to avoid detection.\n\n#### Possible investigation steps:\n- With this specific rule, it's completely possible to trigger detections on network administrative activity or benign users\nusing scripting and PowerShell to configure the different exclusions for Windows Defender. Therefore, it's important to\nidentify the source of the activity first and determine if there is any mal-intent behind the events.\n- The actual exclusion such as the process, the file or directory should be reviewed in order to determine the original\nintent behind the exclusion. Is the excluded file or process malicious in nature or is it related to software that needs\nto be legitimately allowlisted from Windows Defender?\n\n### False Positive Analysis\n- This rule has a higher chance to produce false positives based on the nature around configuring exclusions by possibly\na network administrator. In order to validate the activity further, review the specific exclusion and based on its\nintent. There are many legitimate reasons for exclusions, so it's important to gain context.\n\n### Related Rules\n- Windows Defender Disabled via Registry Modification\n- Disabling Windows Defender Security Settings via PowerShell\n\n### Response and Remediation\n- Since this is related to post-exploitation activity, take immediate action to review, investigate and\npotentially isolate further activity\n- If further analysis showed malicious intent was behind the Defender exclusions, administrators should remove\nthe exclusion and ensure antimalware capability has not been disabled or deleted\n- Exclusion lists for antimalware capabilities should always be routinely monitored for review\n", + "note": "## Triage and analysis\n\n### Investigating Windows Defender Exclusions\n\nMicrosoft Windows Defender is an anti-virus product built-in within Microsoft Windows. Since this software product is\nused to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration\nsettings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of the more\nnotable [examples](https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/) was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defense to avoid detection.\n\n#### Possible investigation steps:\n- With this specific rule, it's completely possible to trigger detections on network administrative activity or benign users\nusing scripting and PowerShell to configure the different exclusions for Windows Defender. Therefore, it's important to\nidentify the source of the activity first and determine if there is any mal-intent behind the events.\n- The actual exclusion such as the process, the file or directory should be reviewed in order to determine the original\nintent behind the exclusion. Is the excluded file or process malicious in nature or is it related to software that needs\nto be legitimately allowlisted from Windows Defender?\n\n### False Positive Analysis\n- This rule has a higher chance to produce false positives based on the nature around configuring exclusions by possibly\na network administrator. In order to validate the activity further, review the specific exclusion and its intent. There\nare many legitimate reasons for exclusions, so it's important to gain context.\n\n### Related Rules\n- Windows Defender Disabled via Registry Modification\n- Disabling Windows Defender Security Settings via PowerShell\n\n### Response and Remediation\n- Since this is related to post-exploitation activity, take immediate action to review, investigate and\npotentially isolate further activity.\n- If further analysis showed malicious intent was behind the Defender exclusions, administrators should remove\nthe exclusion and ensure antimalware capability has not been disabled or deleted.\n- Exclusion lists for antimalware capabilities should always be routinely monitored for review.\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n (process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") or process.pe.original_file_name in (\"powershell.exe\", \"pwsh.dll\", \"powershell_ise.exe\")) and\n process.args : (\"*Add-MpPreference*\", \"*Set-MpPreference*\") and\n process.args : (\"*-Exclusion*\")\n", "references": [ "https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf" @@ -41,15 +41,15 @@ "name": "Impair Defenses", "reference": "https://attack.mitre.org/techniques/T1562/", "subtechnique": [ - { - "id": "T1562.006", - "name": "Indicator Blocking", - "reference": "https://attack.mitre.org/techniques/T1562/006/" - }, { "id": "T1562.001", "name": "Disable or Modify Tools", "reference": "https://attack.mitre.org/techniques/T1562/001/" + }, + { + "id": "T1562.006", + "name": "Indicator Blocking", + "reference": "https://attack.mitre.org/techniques/T1562/006/" } ] } @@ -80,5 +80,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_delete_volume_usn_journal_with_fsutil.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_delete_volume_usn_journal_with_fsutil.json index caa6209fca745..5cc8aa2dcf109 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_delete_volume_usn_journal_with_fsutil.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_delete_volume_usn_journal_with_fsutil.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Delete Volume USN Journal with Fsutil", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"fsutil.exe\" or process.pe.original_file_name == \"fsutil.exe\") and \n process.args : \"deletejournal\" and process.args : \"usn\"\n", "risk_score": 21, "rule_id": "f675872f-6d85-40a3-b502-c0d2ef101e92", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deleting_websvr_access_logs.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deleting_websvr_access_logs.json index 6386c3b75c105..9ae0b9f5ec2a2 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deleting_websvr_access_logs.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deleting_websvr_access_logs.json @@ -13,6 +13,7 @@ "language": "eql", "license": "Elastic License v2", "name": "WebServer Access Logs Deleted", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type == \"deletion\" and\n file.path : (\"C:\\\\inetpub\\\\logs\\\\LogFiles\\\\*.log\", \n \"/var/log/apache*/access.log\",\n \"/etc/httpd/logs/access_log\", \n \"/var/log/httpd/access_log\", \n \"/var/www/*/logs/access.log\")\n", "risk_score": 47, "rule_id": "665e7a4f-c58e-4fc6-bc83-87a7572670ac", @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deletion_of_bash_command_line_history.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deletion_of_bash_command_line_history.json index e97c64455f627..5cebabb176592 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deletion_of_bash_command_line_history.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_deletion_of_bash_command_line_history.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Tampering of Bash Command-Line History", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (\n (process.args : (\"rm\", \"echo\") and process.args : (\".bash_history\", \"/root/.bash_history\", \"/home/*/.bash_history\")) or\n (process.name : \"history\" and process.args : \"-c\") or\n (process.args : \"export\" and process.args : (\"HISTFILE=/dev/null\", \"HISTFILESIZE=0\")) or\n (process.args : \"unset\" and process.args : \"HISTFILE\") or\n (process.args : \"set\" and process.args : \"history\" and process.args : \"+o\")\n )\n", "risk_score": 47, "rule_id": "7bcbb3ac-e533-41ad-a612-d6c3bf666aba", @@ -48,5 +49,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_posh_scriptblocklogging.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_posh_scriptblocklogging.json index f3f321fe6918a..fc5dd888d5d45 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_posh_scriptblocklogging.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_posh_scriptblocklogging.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "PowerShell Script Block Logging Disabled", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where event.type == \"change\" and\n registry.path : \n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ScriptBlockLogging\\\\EnableScriptBlockLogging\"\n and registry.data.strings : (\"0\", \"0x00000000\")\n", "references": [ "https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScriptBlockLogging" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_windows_firewall_rules_with_netsh.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_windows_firewall_rules_with_netsh.json index 2e18f3ba62786..7e5451355c17a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_windows_firewall_rules_with_netsh.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disable_windows_firewall_rules_with_netsh.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Disable Windows Firewall Rules via Netsh", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : \"netsh.exe\" and\n (process.args : \"disable\" and process.args : \"firewall\" and process.args : \"set\") or\n (process.args : \"advfirewall\" and process.args : \"off\" and process.args : \"state\")\n", "risk_score": 47, "rule_id": "4b438734-3793-4fda-bd42-ceeada0be8f9", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_defender_powershell.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_defender_powershell.json index b59d6f18370cb..22dcb355cd2fe 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_defender_powershell.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_defender_powershell.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Disabling Windows Defender Security Settings via PowerShell", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n (process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") or process.pe.original_file_name in (\"powershell.exe\", \"pwsh.dll\", \"powershell_ise.exe\")) and\n process.args : \"Set-MpPreference\" and process.args : (\"-Disable*\", \"Disabled\", \"NeverSend\", \"-Exclusion*\")\n", "references": [ "https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps" @@ -55,5 +56,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_logs.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_logs.json index 256d1c7d9c135..b92d59f930fb4 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_logs.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_disabling_windows_logs.json @@ -14,6 +14,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Disable Windows Event and Security Logs Using Built-in Tools", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n\n ((process.name:\"logman.exe\" or process.pe.original_file_name == \"Logman.exe\") and\n process.args : \"EventLog-*\" and process.args : (\"stop\", \"delete\")) or\n\n ((process.name : (\"pwsh.exe\", \"powershell.exe\", \"powershell_ise.exe\") or process.pe.original_file_name in\n (\"pwsh.exe\", \"powershell.exe\", \"powershell_ise.exe\")) and\n\tprocess.args : \"Set-Service\" and process.args: \"EventLog\" and process.args : \"Disabled\") or\n\t\n ((process.name:\"auditpol.exe\" or process.pe.original_file_name == \"AUDITPOL.EXE\") and process.args : \"/success:disable\")\n", "references": [ "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman" @@ -54,5 +55,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dns_over_https_enabled.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dns_over_https_enabled.json index 7475c929e279f..0c4fb8d0cd9dd 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dns_over_https_enabled.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dns_over_https_enabled.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "DNS-over-HTTPS Enabled via Registry", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where event.type in (\"creation\", \"change\") and\n (registry.path : \"*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Edge\\\\BuiltInDnsClientEnabled\" and\n registry.data.strings : \"1\") or\n (registry.path : \"*\\\\SOFTWARE\\\\Google\\\\Chrome\\\\DnsOverHttpsMode\" and\n registry.data.strings : \"secure\") or\n (registry.path : \"*\\\\SOFTWARE\\\\Policies\\\\Mozilla\\\\Firefox\\\\DNSOverHTTPS\" and\n registry.data.strings : \"1\")\n", "references": [ "https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html", @@ -46,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dotnet_compiler_parent_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dotnet_compiler_parent_process.json index e8edb8fba6472..96d7c2a2ebbdc 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dotnet_compiler_parent_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_dotnet_compiler_parent_process.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious .NET Code Compilation", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : (\"csc.exe\", \"vbc.exe\") and\n process.parent.name : (\"wscript.exe\", \"mshta.exe\", \"cscript.exe\", \"wmic.exe\", \"svchost.exe\", \"rundll32.exe\", \"cmstp.exe\", \"regsvr32.exe\")\n", "risk_score": 47, "rule_id": "201200f1-a99b-43fb-88ed-f65a45c4972c", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_inbound_rdp_with_netsh.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_inbound_rdp_with_netsh.json index e6b53af71433a..10ed16998c4cc 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_inbound_rdp_with_netsh.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_inbound_rdp_with_netsh.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Remote Desktop Enabled in Windows Firewall", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"netsh.exe\" or process.pe.original_file_name == \"netsh.exe\") and\n process.args : (\"localport=3389\", \"RemoteDesktop\", \"group=\\\"remote desktop\\\"\") and\n process.args : (\"action=allow\", \"enable=Yes\", \"enable\")\n", "risk_score": 47, "rule_id": "074464f9-f30d-4029-8c03-0ed237fffec7", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_network_discovery_with_netsh.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_network_discovery_with_netsh.json index bf688fd74ce14..eff4d1dac1415 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_network_discovery_with_netsh.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_enable_network_discovery_with_netsh.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Enable Host Network Discovery via Netsh", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\nprocess.name : \"netsh.exe\" and\nprocess.args : (\"firewall\", \"advfirewall\") and process.args : \"group=Network Discovery\" and process.args : \"enable=Yes\"\n", "risk_score": 47, "rule_id": "8b4f0816-6a65-4630-86a6-c21c179c0d09", @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_control_panel_suspicious_args.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_control_panel_suspicious_args.json index 60112d55db74e..68e4718f79e17 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_control_panel_suspicious_args.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_control_panel_suspicious_args.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Control Panel Process with Unusual Arguments", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.executable : (\"?:\\\\Windows\\\\SysWOW64\\\\control.exe\", \"?:\\\\Windows\\\\System32\\\\control.exe\") and\n process.command_line :\n (\"*.jpg*\",\n \"*.png*\",\n \"*.gif*\",\n \"*.bmp*\",\n \"*.jpeg*\",\n \"*.TIFF*\",\n \"*.inf*\",\n \"*.dat*\",\n \"*.cpl:*/*\",\n \"*../../..*\",\n \"*/AppData/Local/*\",\n \"*:\\\\Users\\\\Public\\\\*\",\n \"*\\\\AppData\\\\Local\\\\*\")\n", "references": [ "https://www.joesandbox.com/analysis/476188/1/html" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_lolbas_wuauclt.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_lolbas_wuauclt.json index bf92ff1f08eff..eeb45198e7e21 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_lolbas_wuauclt.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_lolbas_wuauclt.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "ImageLoad via Windows Update Auto Update Client", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.pe.original_file_name == \"wuauclt.exe\" or process.name : \"wuauclt.exe\") and\n /* necessary windows update client args to load a dll */\n process.args : \"/RunHandlerComServer\" and process.args : \"/UpdateDeploymentProvider\" and\n /* common paths writeable by a standard user where the target DLL can be placed */\n process.args : (\"C:\\\\Users\\\\*.dll\", \"C:\\\\ProgramData\\\\*.dll\", \"C:\\\\Windows\\\\Temp\\\\*.dll\", \"C:\\\\Windows\\\\Tasks\\\\*.dll\")\n", "references": [ "https://dtm.uk/wuauclt/" @@ -43,7 +44,9 @@ ] } ], + "timeline_id": "e70679c2-6cde-4510-9764-4823df18f7db", + "timeline_title": "Comprehensive Process Timeline", "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_office_app.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_office_app.json index 0ad45f03a0499..8da432218fd3c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_office_app.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_office_app.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Microsoft Build Engine Started by an Office Application", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : \"MSBuild.exe\" and\n process.parent.name : (\"eqnedt32.exe\",\n \"excel.exe\",\n \"fltldr.exe\",\n \"msaccess.exe\",\n \"mspub.exe\",\n \"outlook.exe\",\n \"powerpnt.exe\",\n \"winword.exe\" )\n", "references": [ "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" @@ -64,5 +65,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_script.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_script.json index ab74d4a99f6c5..996ed0c3b9531 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_script.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_script.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Microsoft Build Engine Started by a Script Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n (process.name : \"MSBuild.exe\" or process.pe.original_file_name == \"MSBuild.exe\") and\n process.parent.name : (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\", \"cscript.exe\", \"wscript.exe\", \"mshta.exe\")\n", "risk_score": 21, "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2", @@ -61,5 +62,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_system_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_system_process.json index fdee8ee548218..3cbcc0c2baf86 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_system_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_by_system_process.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Microsoft Build Engine Started by a System Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : \"MSBuild.exe\" and\n process.parent.name : (\"explorer.exe\", \"wmiprvse.exe\")\n", "risk_score": 47, "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3", @@ -61,5 +62,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_renamed.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_renamed.json index a22594083bedb..a92e7949b45d5 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_renamed.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_renamed.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Microsoft Build Engine Using an Alternate Name", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.pe.original_file_name == \"MSBuild.exe\" and\n not process.name : \"MSBuild.exe\"\n", "risk_score": 21, "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4", @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_unusal_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_unusal_process.json index 38a5a99370662..368035727ff10 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_unusal_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_msbuild_started_unusal_process.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Microsoft Build Engine Started an Unusual Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"MSBuild.exe\" and\n process.name : (\"csc.exe\", \"iexplore.exe\", \"powershell.exe\")\n", "references": [ "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" @@ -55,5 +56,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 8 + "version": 9 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_suspicious_explorer_winword.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_suspicious_explorer_winword.json index 74aaa9a9c3615..4f7d4b166fecb 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_suspicious_explorer_winword.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_suspicious_explorer_winword.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential DLL SideLoading via Trusted Microsoft Programs", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.pe.original_file_name in (\"WinWord.exe\", \"EXPLORER.EXE\", \"w3wp.exe\", \"DISM.EXE\") and\n not (process.name : (\"winword.exe\", \"explorer.exe\", \"w3wp.exe\", \"Dism.exe\") or\n process.executable : (\"?:\\\\Windows\\\\explorer.exe\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office*\\\\WINWORD.EXE\",\n \"?:\\\\Program Files?(x86)\\\\Microsoft Office\\\\root\\\\Office*\\\\WINWORD.EXE\",\n \"?:\\\\Windows\\\\System32\\\\Dism.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\Dism.exe\",\n \"?:\\\\Windows\\\\System32\\\\inetsrv\\\\w3wp.exe\")\n )\n", "risk_score": 73, "rule_id": "1160dcdb-0a0a-4a79-91d8-9b84616edebd", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_windefend_unusual_path.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_windefend_unusual_path.json index 826d55f3b1882..1291ede56e2aa 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_windefend_unusual_path.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_execution_windefend_unusual_path.json @@ -16,6 +16,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential DLL Side-Loading via Microsoft Antimalware Service Executable", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n (process.pe.original_file_name == \"MsMpEng.exe\" and not process.name : \"MsMpEng.exe\") or\n (process.name : \"MsMpEng.exe\" and not\n process.executable : (\"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*.exe\",\n \"?:\\\\Program Files\\\\Windows Defender\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\Windows Defender\\\\*.exe\",\n \"?:\\\\Program Files\\\\Microsoft Security Client\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Security Client\\\\*.exe\"))\n", "references": [ "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/" @@ -56,5 +57,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_file_creation_mult_extension.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_file_creation_mult_extension.json index 4cbfb8bbbce6c..a97d811683d38 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_file_creation_mult_extension.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_file_creation_mult_extension.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Executable File Creation with Multiple Extensions", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type == \"creation\" and file.extension : \"exe\" and\n file.name regex~ \"\"\".*\\.(vbs|vbe|bat|js|cmd|wsh|ps1|pdf|docx?|xlsx?|pptx?|txt|rtf|gif|jpg|png|bmp|hta|txt|img|iso)\\.exe\"\"\"\n", "risk_score": 47, "rule_id": "8b2b3a62-a598-4293-bc14-3d5fa22bb98f", @@ -71,5 +72,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_gcp_logging_bucket_deletion.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_gcp_logging_bucket_deletion.json index 69dfd4c1fad1a..73033ad852590 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_gcp_logging_bucket_deletion.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_gcp_logging_bucket_deletion.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets are containers that store and organize log data. A deleted bucket stays in a pending state for 7 days, and Logging continues to route logs to the bucket during that time. To stop routing logs to a deleted bucket, the log sinks can be deleted that have the bucket as a destination, or the filter for the sinks can be modified to stop routing logs to the deleted bucket. An adversary may delete a log bucket to evade detection.", + "description": "Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets are containers that store and organize log data. A deleted bucket stays in a pending state for 7 days, and Logging continues to route logs to the bucket during that time. To stop routing logs to a deleted bucket, you can delete the log sinks that have the bucket as their destination, or modify the filter for the sinks to stop it from routing logs to the deleted bucket. An adversary may delete a log bucket to evade detection.", "false_positives": [ "Logging bucket deletions may be done by a system or network administrator. Verify whether the user email, resource name, and/or hostname should be making changes in your environment. Logging bucket deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule." ], @@ -49,5 +49,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_hidden_file_dir_tmp.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_hidden_file_dir_tmp.json index 5d8b9684ec039..c4dfa95c5bc05 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_hidden_file_dir_tmp.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_hidden_file_dir_tmp.json @@ -15,6 +15,7 @@ "license": "Elastic License v2", "max_signals": 33, "name": "Creation of Hidden Files and Directories", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.working_directory in (\"/tmp\", \"/var/tmp\", \"/dev/shm\") and\n process.args regex~ \"\"\"\\.[a-z0-9_\\-][a-z0-9_\\-\\.]{1,254}\"\"\" and\n not process.name in (\"ls\", \"find\")\n", "risk_score": 47, "rule_id": "b9666521-4742-49ce-9ddc-b8e84c35acae", @@ -61,5 +62,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 7 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_iis_httplogging_disabled.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_iis_httplogging_disabled.json index da12646d40226..642d307c42ef2 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_iis_httplogging_disabled.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_iis_httplogging_disabled.json @@ -13,6 +13,7 @@ "license": "Elastic License v2", "max_signals": 33, "name": "IIS HTTP Logging Disabled", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"appcmd.exe\" or process.pe.original_file_name == \"appcmd.exe\") and\n process.args : \"/dontLog*:*True\" and\n not process.parent.name : \"iissetup.exe\"\n", "risk_score": 73, "rule_id": "ebf1adea-ccf2-4943-8b96-7ab11ca173a5", @@ -50,5 +51,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_kubernetes_events_deleted.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_kubernetes_events_deleted.json index 33dac6fd4f37a..54ca81401c213 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_kubernetes_events_deleted.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_kubernetes_events_deleted.json @@ -2,7 +2,7 @@ "author": [ "Austin Songer" ], - "description": "Identifies when events are deleted in Azure Kubernetes. Kubernetes events are objects that log any state changes. Example events are a container creation, an image pull, or a pod scheduling on a node. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.", + "description": "Identifies when events are deleted in Azure Kubernetes. Kubernetes events are objects that log any state changes. Example events are a container creation, an image pull, or a pod scheduling on a node. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.", "false_positives": [ "Events deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule." ], @@ -56,5 +56,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_log_files_deleted.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_log_files_deleted.json index 4d1d26c6bbd20..afaa771c5e752 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_log_files_deleted.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_log_files_deleted.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "System Log File Deletion", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type == \"deletion\" and \n file.path : \n (\n \"/var/run/utmp\", \n \"/var/log/wtmp\", \n \"/var/log/btmp\", \n \"/var/log/lastlog\", \n \"/var/log/faillog\",\n \"/var/log/syslog\", \n \"/var/log/messages\", \n \"/var/log/secure\", \n \"/var/log/auth.log\"\n )\n", "references": [ "https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html" @@ -44,5 +45,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_as_elastic_endpoint_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_as_elastic_endpoint_process.json index 993e7317d0b30..c19475e4c05f2 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_as_elastic_endpoint_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_as_elastic_endpoint_process.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Endpoint Security Parent Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\", \"info\") and\n process.name : (\"esensor.exe\", \"elastic-endpoint.exe\") and\n process.parent.executable != null and\n /* add FPs here */\n not process.parent.executable : (\"C:\\\\Program Files\\\\Elastic\\\\*\", \n \"C:\\\\Windows\\\\System32\\\\services.exe\", \n \"C:\\\\Windows\\\\System32\\\\WerFault*.exe\", \n \"C:\\\\Windows\\\\System32\\\\wermgr.exe\")\n", "risk_score": 47, "rule_id": "b41a13c6-ba45-4bab-a534-df53d0cfed6a", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_renamed_autoit.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_renamed_autoit.json index 5c855207dda7d..0e56479211592 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_renamed_autoit.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_renamed_autoit.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Renamed AutoIt Scripts Interpreter", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\", \"info\") and\n process.pe.original_file_name : \"AutoIt*.exe\" and not process.name : \"AutoIt*.exe\"\n", "risk_score": 47, "rule_id": "2e1e835d-01e5-48ca-b9fc-7a61f7f11902", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_suspicious_werfault_childproc.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_suspicious_werfault_childproc.json index e0f544ceb832c..72a0c6824033c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_suspicious_werfault_childproc.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_suspicious_werfault_childproc.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious WerFault Child Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"WerFault.exe\" and\n not process.name : (\"cofire.exe\",\n \"psr.exe\",\n \"VsJITDebugger.exe\",\n \"TTTracer.exe\",\n \"rundll32.exe\",\n \"LogiOptionsMgr.exe\") and\n not process.args : (\"/LOADSAVEDWINDOWS\",\n \"/restore\",\n \"RestartByRestartManager*\",\n \"--restarted\",\n \"createdump\",\n \"dontsend\",\n \"/watson\")\n", "references": [ "https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/", @@ -50,5 +51,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_trusted_directory.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_trusted_directory.json index 54d251f3417a5..6605efbaffa02 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_trusted_directory.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_masquerading_trusted_directory.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Program Files Directory Masquerading", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.executable : \"C:\\\\*Program*Files*\\\\*.exe\" and\n not process.executable : (\"C:\\\\Program Files\\\\*.exe\", \"C:\\\\Program Files (x86)\\\\*.exe\", \"C:\\\\Users\\\\*.exe\", \"C:\\\\ProgramData\\\\*.exe\")\n", "risk_score": 47, "rule_id": "32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_microsoft_defender_tampering.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_microsoft_defender_tampering.json index 9d37136d8db91..2a7603e57117c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_microsoft_defender_tampering.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_microsoft_defender_tampering.json @@ -2,7 +2,7 @@ "author": [ "Austin Songer" ], - "description": "Identifies when one or more features on Microsoft Defender are disabled. Adversaries may disable or tamper Microsoft Defender features to evade detection and conceal malicious behavior.", + "description": "Identifies when one or more features on Microsoft Defender are disabled. Adversaries may disable or tamper with Microsoft Defender features to evade detection and conceal malicious behavior.", "false_positives": [ "Legitimate Windows Defender configuration changes" ], @@ -15,7 +15,8 @@ "language": "eql", "license": "Elastic License v2", "name": "Microsoft Windows Defender Tampering", - "query": "registry where event.type in (\"creation\", \"change\") and\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\PUAProtection\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender Security Center\\\\App and Browser protection\\\\DisallowExploitProtectionOverride\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\DisableAntiSpyware\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Features\\\\TamperProtection\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableRealtimeMonitoring\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableIntrusionPreventionSystem\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableScriptScanning\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Windows Defender Exploit Guard\\\\Controlled Folder Access\\\\EnableControlledFolderAccess\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableIOAVProtection\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Reporting\\\\DisableEnhancedNotifications\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\SpyNet\\\\DisableBlockAtFirstSeen\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\SpyNet\\\\SpynetReporting\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\SpyNet\\\\SubmitSamplesConsent\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableBehaviorMonitoring\" and\n registry.data.strings : (\"1\", \"0x00000001\"))\n", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", + "query": "registry where event.type in (\"creation\", \"change\") and\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\PUAProtection\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender Security Center\\\\App and Browser protection\\\\DisallowExploitProtectionOverride\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\DisableAntiSpyware\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Features\\\\TamperProtection\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableRealtimeMonitoring\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableIntrusionPreventionSystem\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableScriptScanning\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Windows Defender Exploit Guard\\\\Controlled Folder Access\\\\EnableControlledFolderAccess\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableIOAVProtection\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Reporting\\\\DisableEnhancedNotifications\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\SpyNet\\\\DisableBlockAtFirstSeen\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\SpyNet\\\\SpynetReporting\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\SpyNet\\\\SubmitSamplesConsent\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableBehaviorMonitoring\" and\n registry.data.strings : (\"1\", \"0x00000001\"))\n", "references": [ "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", "https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html", @@ -55,5 +56,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_ms_office_suspicious_regmod.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_ms_office_suspicious_regmod.json index bbd6d1840fc0e..4fc39214636fa 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_ms_office_suspicious_regmod.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_ms_office_suspicious_regmod.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Microsoft Office Products offers options for users and developers to control the security settings for running and using Macros. Adversaries may abuse these security settings to modify the default behavior of the Office Application to trust future macros and/or disable security warnings, which could increase their chances of establishing persistence.", + "description": "Microsoft Office Products offer options for users and developers to control the security settings for running and using Macros. Adversaries may abuse these security settings to modify the default behavior of the Office Application to trust future macros and/or disable security warnings, which could increase their chances of establishing persistence.", "from": "now-9m", "index": [ "winlogbeat-*", @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "MS Office Macro Security Registry Modifications", + "note": "## Triage and analysis\n\n### Investigating MS Office Macro Security Registry Modifications\n\nMacros are small programs that are used to automate repetitive tasks in Microsoft Office applications.\nHistorically, macros have been used for a variety of reasons -- from automating part of a job, to\nbuilding entire processes and data flows. Macros are written in Visual Basic for Applications (VBA) and are saved as\npart of Microsoft Office files.\n\nMacros are often created for legitimate reasons, but they can also be written by attackers to gain access, harm a\nsystem, or bypass other security controls such as application allow listing. In fact, exploitation from malicious macros\nis one of the top ways that organizations are compromised today. These attacks are often conducted through phishing or\nspear phishing campaigns.\n\nAttackers can convince victims to modify Microsoft Office security settings, so their macros are trusted by default and\nno warnings are displayed when they are executed. These settings include:\n\n* *Trust access to the VBA project object model* - When enabled, Microsoft Office will trust all macros and run any code\nwithout showing a security warning or requiring user permission.\n* *VbaWarnings* - When set to 1, Microsoft Office will trust all macros and run any code without showing a security\nwarning or requiring user permission.\n\nThis rule looks for registry changes affecting the conditions above.\n\n#### Possible investigation steps\n\n- Identify the user that performed the operation.\n- Verify whether malicious macros were executed after the registry change.\n- Contact the user and check if the change was done manually.\n- Investigate other alerts associated with the user during the past 48 hours.\n\n### False positive analysis\n\n- This activity should not happen legitimately. The security team should address any potential benign true\npositives (B-TPs), as this configuration can put the user and the domain at risk.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Reset the registry key value.\n- Isolate the host if malicious code was executed and reset the involved account's passwords.\n- Explore using GPOs to manage security settings for Microsoft Office macros.\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where event.type == \"change\" and\n registry.path : (\n \"HKU\\\\S-1-5-21-*\\\\SOFTWARE\\\\Microsoft\\\\Office\\\\*\\\\Security\\\\AccessVBOM\",\n \"HKU\\\\S-1-5-21-*\\\\SOFTWARE\\\\Microsoft\\\\Office\\\\*\\\\Security\\\\VbaWarnings\"\n ) and \n registry.data.strings == \"0x00000001\" and\n process.name : (\"cscript.exe\", \"wscript.exe\", \"mshta.exe\", \"mshta.exe\", \"winword.exe\", \"excel.exe\")\n", "risk_score": 47, "rule_id": "feeed87c-5e95-4339-aef1-47fd79bcfbe3", @@ -63,5 +64,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_posh_compressed.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_posh_compressed.json index 81b17f8aa1039..1bb2fb2bcc8f2 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_posh_compressed.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_posh_compressed.json @@ -14,7 +14,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "PowerShell Suspicious Payload Encoded and Compressed", - "query": "event.category:process and \n powershell.file.script_block_text : (\n (System.IO.Compression.DeflateStream or System.IO.Compression.GzipStream or IO.Compression.DeflateStream or IO.Compression.GzipStream) and\n FromBase64String\n )\n", + "query": "event.category:process and \n powershell.file.script_block_text : (\n (\n \"System.IO.Compression.DeflateStream\" or\n \"System.IO.Compression.GzipStream\" or\n \"IO.Compression.DeflateStream\" or\n \"IO.Compression.GzipStream\"\n ) and\n FromBase64String\n )\n", "risk_score": 47, "rule_id": "81fe9dc6-a2d7-4192-a2d8-eed98afc766a", "severity": "medium", @@ -71,5 +71,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_posh_process_injection.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_posh_process_injection.json index 86f1d853330bb..361aa370a22a2 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_posh_process_injection.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_posh_process_injection.json @@ -14,8 +14,8 @@ "language": "kuery", "license": "Elastic License v2", "name": "Potential Process Injection via PowerShell", - "note": "## Triage and analysis.\n\n### Investigating Potential Process Injection via PowerShell\n\nPowerShell is one of the main tools used by system administrators for automation, report routines, and other tasks.\n\nPowerShell also has solid capabilities to make the interaction with the Win32 API in an uncomplicated and reliable way,\nlike the execution of inline C# code, PSReflect, Get-ProcAddress, etc.\n\nRed Team tooling and malware developers take advantage of these capabilities to develop stagers and loaders that inject\npayloads directly into the memory, without touching the disk.\n\n#### Possible investigation steps:\n\n- Examine script content that triggered the detection. \n- Investigate script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- If the action is suspicious for the user, check for any other activities done by the user in the last 48 hours.\n\n### False Positive Analysis\n\n- Verify whether the script content is malicious/harmful.\n\n### Related Rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and Remediation\n\n- Immediate response should be taken to validate, investigate, and potentially contain the activity to prevent further\npost-compromise behavior.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", - "query": "event.category:process and \n powershell.file.script_block_text : (\n (VirtualAlloc or VirtualAllocEx or VirtualProtect or LdrLoadDll or LoadLibrary or LoadLibraryA or\n LoadLibraryEx or GetProcAddress or OpenProcess or OpenProcessToken or AdjustTokenPrivileges) and\n (WriteProcessMemory or CreateRemoteThread or NtCreateThreadEx or CreateThread or QueueUserAPC or\n SuspendThread or ResumeThread)\n )\n", + "note": "## Triage and analysis.\n\n### Investigating Potential Process Injection via PowerShell\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This\nmakes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nPowerShell also has solid capabilities to make the interaction with the Win32 API in an uncomplicated and reliable way,\nlike the execution of inline C# code, PSReflect, Get-ProcAddress, etc.\n\nRed Team tooling and malware developers take advantage of these capabilities to develop stagers and loaders that inject\npayloads directly into the memory without touching the disk to circumvent file-based security protections.\n\n#### Possible investigation steps\n\n- Examine script content that triggered the detection. \n- Investigate the script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Consider whether the user needs PowerShell to complete its tasks.\n- Check if the imported function was executed and which process it targeted.\n- Check if the injected code can be retrieved (hardcoded in the script or on command line logs).\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Quarantine the involved host for forensic investigation, as well as eradication and recovery activities.\n- Configure AppLocker or equivalent software to restrict access to PowerShell for regular users.\n- Reset the password for the user account.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", + "query": "event.category:process and \n powershell.file.script_block_text : (\n (VirtualAlloc or VirtualAllocEx or VirtualProtect or LdrLoadDll or LoadLibrary or LoadLibraryA or\n LoadLibraryEx or GetProcAddress or OpenProcess or OpenProcessToken or AdjustTokenPrivileges) and\n (WriteProcessMemory or CreateRemoteThread or NtCreateThreadEx or CreateThread or QueueUserAPC or\n SuspendThread or ResumeThread or GetDelegateForFunctionPointer)\n )\n", "references": [ "https://github.com/EmpireProject/Empire/blob/master/data/module_source/management/Invoke-PSInject.ps1", "https://github.com/EmpireProject/Empire/blob/master/data/module_source/management/Invoke-ReflectivePEInjection.ps1", @@ -62,5 +62,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_powershell_windows_firewall_disabled.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_powershell_windows_firewall_disabled.json index d4e49ec00b648..43d5d7adcbccf 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_powershell_windows_firewall_disabled.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_powershell_windows_firewall_disabled.json @@ -2,7 +2,7 @@ "author": [ "Austin Songer" ], - "description": "Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which attackers do to evade network constraints, like internet and network lateral communication restrictions.", + "description": "Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions.", "false_positives": [ "Windows Firewall can be disabled by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Windows Profile being disabled by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." ], @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Windows Firewall Disabled via PowerShell", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.action == \"start\" and\n (process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") or process.pe.original_file_name == \"PowerShell.EXE\") and\n process.args : \"*Set-NetFirewallProfile*\" and\n (process.args : \"*-Enabled*\" and process.args : \"*False*\") and\n (process.args : \"*-All*\" or process.args : (\"*Public*\", \"*Domain*\", \"*Private*\"))\n", "references": [ "https://docs.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2019-ps", @@ -58,5 +59,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_privacy_controls_tcc_database_modification.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_privacy_controls_tcc_database_modification.json index e92620eaca93e..7109a68b805ae 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_privacy_controls_tcc_database_modification.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_privacy_controls_tcc_database_modification.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Privacy Control Bypass via TCCDB Modification", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and process.name : \"sqlite*\" and \n process.args : \"/*/Application Support/com.apple.TCC/TCC.db\"\n", "references": [ "https://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/", @@ -53,5 +54,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.json index 02d6115760bab..94b082ecd60fc 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Privacy Control Bypass via Localhost Secure Copy", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and \n process.name:\"scp\" and\n process.args:\"StrictHostKeyChecking=no\" and \n process.command_line:(\"scp *localhost:/*\", \"scp *127.0.0.1:/*\") and\n not process.args:\"vagrant@*127.0.0.1*\"\n", "references": [ "https://blog.trendmicro.com/trendlabs-security-intelligence/xcsset-mac-malware-infects-xcode-projects-performs-uxss-attack-on-safari-other-browsers-leverages-zero-day-exploits/" @@ -60,5 +61,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_scheduledjobs_at_protocol_enabled.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_scheduledjobs_at_protocol_enabled.json index e5d4e23d55bec..0d24d9b347d93 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_scheduledjobs_at_protocol_enabled.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_scheduledjobs_at_protocol_enabled.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Scheduled Tasks AT Command Enabled", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where \n registry.path : \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Schedule\\\\Configuration\\\\EnableAt\" and \n registry.data.strings : (\"1\", \"0x00000001\")\n", "references": [ "https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_sdelete_like_filename_rename.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_sdelete_like_filename_rename.json index 116525ab3dfcd..510b588f33ef8 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_sdelete_like_filename_rename.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_sdelete_like_filename_rename.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Secure File Deletion via SDelete Utility", - "note": "## Triage and analysis\n\nVerify process details such as command line and hash to confirm this activity legitimacy.", + "note": "## Triage and analysis\n\nVerify process details such as command line and hash to confirm this activity legitimacy.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type == \"change\" and file.name : \"*AAA.AAA\"\n", "risk_score": 21, "rule_id": "5aee924b-6ceb-4633-980e-1bde8cdb40c5", @@ -50,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.json index 743ebc561dd1c..68e279eca8bcb 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "SolarWinds Process Disabling Services via Registry", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where registry.path : \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\Start\" and\n registry.data.strings : (\"4\", \"0x00000004\") and\n process.name : (\n \"SolarWinds.BusinessLayerHost*.exe\", \n \"ConfigurationWizard*.exe\", \n \"NetflowDatabaseMaintenance*.exe\", \n \"NetFlowService*.exe\", \n \"SolarWinds.Administration*.exe\", \n \"SolarWinds.Collector.Service*.exe\" , \n \"SolarwindsDiagnostics*.exe\")\n", "references": [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" @@ -74,5 +75,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_certutil_commands.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_certutil_commands.json index 3a6c8411e8f97..1ae658f2f14f3 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_certutil_commands.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_certutil_commands.json @@ -13,6 +13,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious CertUtil Commands", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n (process.name : \"certutil.exe\" or process.pe.original_file_name == \"CertUtil.exe\") and \n process.args : (\"?decode\", \"?encode\", \"?urlcache\", \"?verifyctl\", \"?encodehex\", \"?decodehex\", \"?exportPFX\")\n", "references": [ "https://twitter.com/Moriarty_Meng/status/984380793383370752", @@ -47,7 +48,9 @@ ] } ], + "timeline_id": "e70679c2-6cde-4510-9764-4823df18f7db", + "timeline_title": "Comprehensive Process Timeline", "timestamp_override": "event.ingested", "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_execution_from_mounted_device.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_execution_from_mounted_device.json index b05402f419f5a..9228fc3856550 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_execution_from_mounted_device.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_execution_from_mounted_device.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Execution from a Mounted Device", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and process.executable : \"C:\\\\*\" and\n (process.working_directory : \"?:\\\\\" and not process.working_directory: \"C:\\\\\") and\n process.parent.name : \"explorer.exe\" and\n process.name : (\"rundll32.exe\", \"mshta.exe\", \"powershell.exe\", \"pwsh.exe\", \"cmd.exe\", \"regsvr32.exe\",\n \"cscript.exe\", \"wscript.exe\")\n", "references": [ "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/", @@ -41,11 +42,6 @@ "name": "Signed Binary Proxy Execution", "reference": "https://attack.mitre.org/techniques/T1218/", "subtechnique": [ - { - "id": "T1218.011", - "name": "Rundll32", - "reference": "https://attack.mitre.org/techniques/T1218/011/" - }, { "id": "T1218.005", "name": "Mshta", @@ -55,6 +51,11 @@ "id": "T1218.010", "name": "Regsvr32", "reference": "https://attack.mitre.org/techniques/T1218/010/" + }, + { + "id": "T1218.011", + "name": "Rundll32", + "reference": "https://attack.mitre.org/techniques/T1218/011/" } ] } @@ -85,5 +86,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_managedcode_host_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_managedcode_host_process.json index 3f5d69ff7f4ec..75b897a107446 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_managedcode_host_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_managedcode_host_process.json @@ -43,7 +43,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_process_access_direct_syscall.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_process_access_direct_syscall.json index 1580376dbfb73..6073f402771af 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_process_access_direct_syscall.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_process_access_direct_syscall.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Process Access via Direct System Call", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.code == \"10\" and\n length(winlog.event_data.CallTrace) > 0 and\n \n /* Sysmon CallTrace starting with unknown memory module instead of ntdll which host Windows NT Syscalls */\n not winlog.event_data.CallTrace : (\"?:\\\\WINDOWS\\\\SYSTEM32\\\\ntdll.dll*\", \"?:\\\\WINDOWS\\\\SysWOW64\\\\ntdll.dll*\")\n", "references": [ "https://twitter.com/SBousseaden/status/1278013896440324096", @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_process_creation_calltrace.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_process_creation_calltrace.json index b6c839b71c8f1..82541efacbd06 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_process_creation_calltrace.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_process_creation_calltrace.json @@ -39,7 +39,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_zoom_child_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_zoom_child_process.json index b1caf3a677657..ea6a7027592be 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_zoom_child_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_suspicious_zoom_child_process.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Zoom Child Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\", \"info\") and\n process.parent.name : \"Zoom.exe\" and process.name : (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\")\n", "risk_score": 47, "rule_id": "97aba1ef-6034-4bd3-8c1a-1e0996b27afa", @@ -47,5 +48,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_system_critical_proc_abnormal_file_activity.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_system_critical_proc_abnormal_file_activity.json index 6fa6f0ab569a8..eac0233b1e76a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_system_critical_proc_abnormal_file_activity.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_system_critical_proc_abnormal_file_activity.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Unusual Executable File Creation by a System Critical Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n file.extension : (\"exe\", \"dll\") and\n process.name : (\"smss.exe\",\n \"autochk.exe\",\n \"csrss.exe\",\n \"wininit.exe\",\n \"services.exe\",\n \"lsass.exe\",\n \"winlogon.exe\",\n \"userinit.exe\",\n \"LogonUI.exe\")\n", "risk_score": 73, "rule_id": "e94262f2-c1e9-4d3f-a907-aeab16712e1a", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_timestomp_touch.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_timestomp_touch.json index ee45ffce416d2..7e507dc83e38c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_timestomp_touch.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_timestomp_touch.json @@ -12,6 +12,7 @@ "license": "Elastic License v2", "max_signals": 33, "name": "Timestomping using Touch Command", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.name : \"touch\" and user.id != \"0\" and\n process.args : (\"-r\", \"-t\", \"-a*\",\"-m*\") and\n not process.args : (\"/usr/lib/go-*/bin/go\", \"/usr/lib/dracut/dracut-functions.sh\", \"/tmp/KSInstallAction.*/m/.patch/*\")\n", "risk_score": 47, "rule_id": "b0046934-486e-462f-9487-0d4cf9e429c6", @@ -50,5 +51,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_ads_file_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_ads_file_creation.json index a9d4e7d10295c..67c2d2fdca43a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_ads_file_creation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_ads_file_creation.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Unusual File Creation - Alternate Data Stream", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type == \"creation\" and\n file.path : \"C:\\\\*:*\" and\n not file.path : \"C:\\\\*:zone.identifier*\" and\n file.extension :\n (\n \"pdf\",\n \"dll\",\n \"png\",\n \"exe\",\n \"dat\",\n \"com\",\n \"bat\",\n \"cmd\",\n \"sys\",\n \"vbs\",\n \"ps1\",\n \"hta\",\n \"txt\",\n \"vbe\",\n \"js\",\n \"wsh\",\n \"docx\",\n \"doc\",\n \"xlsx\",\n \"xls\",\n \"pptx\",\n \"ppt\",\n \"rtf\",\n \"gif\",\n \"jpg\",\n \"png\",\n \"bmp\",\n \"img\",\n \"iso\"\n )\n", "risk_score": 47, "rule_id": "71bccb61-e19b-452f-b104-79a60e546a95", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_dir_ads.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_dir_ads.json index f926a1ba24faf..2c570f9e66eb4 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_dir_ads.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_dir_ads.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Unusual Process Execution Path - Alternate Data Stream", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.args : \"?:\\\\*:*\" and process.args_count == 1\n", "risk_score": 47, "rule_id": "4bd1c1af-79d4-4d37-9efa-6e0240640242", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_network_connection_via_dllhost.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_network_connection_via_dllhost.json index a030c88941a41..1b6b500d42413 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_network_connection_via_dllhost.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_network_connection_via_dllhost.json @@ -45,7 +45,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_system_vp_child_program.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_system_vp_child_program.json index 2153b4c8e8c04..eaff79d12b68d 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_system_vp_child_program.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_unusual_system_vp_child_program.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Unusual Child Process from a System Virtual Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.pid == 4 and\n not process.executable : (\"Registry\", \"MemCompression\", \"?:\\\\Windows\\\\System32\\\\smss.exe\")\n", "risk_score": 73, "rule_id": "de9bd7e0-49e9-4e92-a64d-53ade2e66af1", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_via_filter_manager.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_via_filter_manager.json index c0d171739b76d..8457e79426754 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_via_filter_manager.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_via_filter_manager.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Evasion via Filter Manager", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and \n process.name : \"fltMC.exe\" and process.args : \"unload\"\n", "risk_score": 47, "rule_id": "06dceabf-adca-48af-ac79-ffdf4c3b1e9a", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 8 + "version": 9 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_waf_rule_or_rule_group_deletion.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_waf_rule_or_rule_group_deletion.json index fb35a65bde354..e23fb0c2d9829 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_waf_rule_or_rule_group_deletion.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_waf_rule_or_rule_group_deletion.json @@ -16,7 +16,7 @@ "license": "Elastic License v2", "name": "AWS WAF Rule or Rule Group Deletion", "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", - "query": "event.dataset:aws.cloudtrail and event.action:(DeleteRule or DeleteRuleGroup) and event.outcome:success\n", + "query": "event.dataset:aws.cloudtrail and event.provider:(waf.amazonaws.com or waf-regional.amazonaws.com or wafv2.amazonaws.com) and event.action:(DeleteRule or DeleteRuleGroup) and event.outcome:success\n", "references": [ "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/waf/delete-rule-group.html", "https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRuleGroup.html" @@ -58,5 +58,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 7 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_whitespace_padding_in_command_line.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_whitespace_padding_in_command_line.json index e99065b9cb1e3..7ed0cc2f60dcd 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_whitespace_padding_in_command_line.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_whitespace_padding_in_command_line.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Whitespace Padding in Process Command Line", - "note": "## Triage and analysis\n\n- Analyze the command line of the process in question for evidence of malicious code execution.\n- Review the ancestor and child processes spawned by the process in question for indicators of further malicious code execution.", + "note": "## Triage and analysis\n\n- Analyze the command line of the process in question for evidence of malicious code execution.\n- Review the ancestor and child processes spawned by the process in question for indicators of further malicious code execution.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.command_line regex \".*[ ]{20,}.*\" or \n \n /* this will match on 3 or more separate occurrences of 5+ contiguous whitespace characters */\n process.command_line regex \".*(.*[ ]{5,}[^ ]*){3,}.*\"\n", "references": [ "https://twitter.com/JohnLaTwC/status/1419251082736201737" @@ -40,5 +40,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_workfolders_control_execution.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_workfolders_control_execution.json new file mode 100644 index 0000000000000..06d9dc6fec4e7 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/defense_evasion_workfolders_control_execution.json @@ -0,0 +1,52 @@ +{ + "author": [ + "Elastic", + "Austin Songer" + ], + "description": "Identifies the use of Windows Work Folders to execute a potentially masqueraded control.exe file in the current working directory. Misuse of Windows Work Folders could indicate malicious activity.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Signed Proxy Execution via MS WorkFolders", + "note": "## Triage and analysis\n\n### Investigating control.exe Execution via Work Folders in Current Working Directory\n\nWork Folders is a role service for file servers running Windows Server that provides a consistent way for users to access their work files from their PCs and devices. This allows for users to store work files and access them from anywhere. When called, Work Folders will automatically execute any Portable Executable (PE) named `control.exe` as an argument before accessing the synced share.\n\nUsing Work Folders to execute a masqueraded control.exe could allow an adversary to bypass application controls and increase privileges.\n\n#### Possible investigation steps:\n- Investigate the process tree starting with parent process WorkFolders.exe and child process control.exe to determine if other child processes spawned during execution.\n- Trace the activity related to the `control.exe` binary to determine continued intrusion activity on the host.\n- Examine the location of the WorkFolders.exe binary to determine if it was copied to the location of the control.exe binary as it resides in the System32 directory by default.\n- Review the control.exe binary executed with Work Folders to determine maliciousness such as additional host activity or network traffic generated\n- Determine if control.exe was synced to sync share, indicating potential lateral movement.\n- Review where control.exe originated from on the host in terms of delivery such as email, web download or written to disk from a seperate binary.\n\n### False Positive Analysis\n- Windows Work Folders are used legitimately by end users and administrators for file sharing and syncing but not in the instance where a suspicious `control.exe` is passed as an argument.\n\n### Response and Remediation\n- If identified as a compromise, engage incident response processes and policies.\n- Take immediate action to review, investigate and potentially isolate activity to prevent further post-compromise\nbehavior.\n- Review the Work Folders synced share to determine if the 'control.exe' was shared and if so remove it.\n- If no lateral movement was identified during investigation, take the effected host offline if possible and remove the control.exe binary as well as any additional artifacts identified during investigation.\n- Review integrating Windows Information Protection (WIP) to enforce data protection by encrypting the data on PCs using Work Folders.\n- Confirm with user whether this was expected or not and reset their password.\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", + "query": "process where event.type in (\"start\",\"process_started\")\n and process.name : \"control.exe\" and process.parent.name : \"WorkFolders.exe\"\n and not process.executable : (\"?:\\\\Windows\\\\System32\\\\control.exe\", \"?:\\\\Windows\\\\SysWOW64\\\\control.exe\")\n", + "references": [ + "https://docs.microsoft.com/en-us/windows-server/storage/work-folders/work-folders-overview", + "https://twitter.com/ElliotKillick/status/1449812843772227588", + "https://lolbas-project.github.io/lolbas/Binaries/WorkFolders/" + ], + "risk_score": 47, + "rule_id": "ad0d2742-9a49-11ec-8d6b-acde48001122", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Windows", + "Threat Detection", + "Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "Signed Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_adfind_command_activity.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_adfind_command_activity.json index 9cf0541d1162e..c6fdb26a1eade 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_adfind_command_activity.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_adfind_command_activity.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "AdFind Command Activity", - "note": "## Triage and analysis\n\n### Investigating AdFind Command Activity\n\n[AdFind](http://www.joeware.net/freetools/tools/adfind/) is a freely available command-line tool used to retrieve information from\nActive Directory (AD). Network discovery and enumeration tools like `AdFind` are useful to adversaries in the same ways\nthey are effective for network administrators. This tool provides quick ability to scope AD person/computer objects and\nunderstand subnets and domain information. There are many [examples](https://thedfirreport.com/category/adfind/)\nobserved where this tool has been adopted by ransomware and criminal groups and used in compromises.\n\n#### Possible investigation steps:\n- `AdFind` is a legitimate Active Directory enumeration tool used by network administrators, it's important to understand\nthe source of the activity. This could involve identifying the account using `AdFind` and determining based on the command-lines\nwhat information was retrieved, then further determining if these actions are in scope of that user's traditional responsibilities.\n- In multiple public references, `AdFind` is leveraged after initial access is achieved, review previous activity on impacted\nmachine looking for suspicious indicators such as previous anti-virus/EDR alerts, phishing emails received, or network traffic\nto suspicious infrastructure.\n\n### False Positive Analysis\n- This rule has the high chance to produce false positives as it is a legitimate tool used by network administrators. One\noption could be allowlisting specific users or groups who use the tool as part of their daily responsibilities. This can\nbe done by leveraging the exception workflow in the Kibana Security App or Elasticsearch API to tune this rule to your environment\n- Malicious behavior with `AdFind` should be investigated as part of a step within an attack chain. It doesn't happen in\nisolation, so reviewing previous logs/activity from impacted machines could be very telling.\n\n### Related Rules\n- Windows Network Enumeration\n- Enumeration of Administrator Accounts\n- Enumeration Command Spawned via WMIPrvSE\n\n### Response and Remediation\n- take immediate action to validate activity, investigate and potentially isolate activity to prevent further\npost-compromise behavior\n- It's important to understand that `AdFind` is an Active Directory enumeration tool and can be used for malicious or legitimate\npurposes, so understanding the intent behind the activity will help determine the appropropriate response.\n", + "note": "## Triage and analysis\n\n### Investigating AdFind Command Activity\n\n[AdFind](http://www.joeware.net/freetools/tools/adfind/) is a freely available command-line tool used to retrieve information from\nActive Directory (AD). Network discovery and enumeration tools like `AdFind` are useful to adversaries in the same ways\nthey are effective for network administrators. This tool provides quick ability to scope AD person/computer objects and\nunderstand subnets and domain information. There are many [examples](https://thedfirreport.com/category/adfind/)\nobserved where this tool has been adopted by ransomware and criminal groups and used in compromises.\n\n#### Possible investigation steps:\n- `AdFind` is a legitimate Active Directory enumeration tool used by network administrators, it's important to understand\nthe source of the activity. This could involve identifying the account using `AdFind` and determining based on the command-lines\nwhat information was retrieved, then further determining if these actions are in scope of that user's traditional responsibilities.\n- In multiple public references, `AdFind` is leveraged after initial access is achieved. Review previous activity on impacted\nmachines for suspicious indicators such as previous anti-virus/EDR alerts, phishing emails received, or network traffic\nto suspicious infrastructure.\n\n### False Positive Analysis\n- This rule has a high chance to produce false positives as it is a legitimate tool used by network administrators. One\noption could be allowlisting specific users or groups who use the tool as part of their daily responsibilities. This can\nbe done by leveraging the exception workflow in the Kibana Security App or Elasticsearch API to tune this rule to your environment.\n- Malicious behavior with `AdFind` should be investigated as part of a step within an attack chain. It doesn't happen in\nisolation, so reviewing previous logs/activity from impacted machines can be very telling.\n\n### Related Rules\n- Windows Network Enumeration\n- Enumeration of Administrator Accounts\n- Enumeration Command Spawned via WMIPrvSE\n\n### Response and Remediation\n- Take immediate action to validate activity, investigate and potentially isolate activity to prevent further\npost-compromise behavior.\n- It's important to understand that `AdFind` is an Active Directory enumeration tool and can be used for malicious or legitimate\npurposes, so understanding the intent behind the activity will help determine the appropropriate response.\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and \n (process.name : \"AdFind.exe\" or process.pe.original_file_name == \"AdFind.exe\") and \n process.args : (\"objectcategory=computer\", \"(objectcategory=computer)\", \n \"objectcategory=person\", \"(objectcategory=person)\",\n \"objectcategory=subnet\", \"(objectcategory=subnet)\",\n \"objectcategory=group\", \"(objectcategory=group)\", \n \"objectcategory=organizationalunit\", \"(objectcategory=organizationalunit)\",\n \"objectcategory=attributeschema\", \"(objectcategory=attributeschema)\",\n \"domainlist\", \"dcmodes\", \"adinfo\", \"dclist\", \"computers_pwnotreqd\", \"trustdmp\")\n", "references": [ "http://www.joeware.net/freetools/tools/adfind/", @@ -41,6 +41,11 @@ "reference": "https://attack.mitre.org/tactics/TA0007/" }, "technique": [ + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + }, { "id": "T1069", "name": "Permission Groups Discovery", @@ -69,16 +74,11 @@ "id": "T1482", "name": "Domain Trust Discovery", "reference": "https://attack.mitre.org/techniques/T1482/" - }, - { - "id": "T1018", - "name": "Remote System Discovery", - "reference": "https://attack.mitre.org/techniques/T1018/" } ] } ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_admin_recon.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_admin_recon.json index d5026780fdf56..abb1d504ad479 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_admin_recon.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_admin_recon.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Enumeration of Administrator Accounts", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (((process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or\n ((process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and\n not process.parent.name : \"net.exe\")) and\n process.args : (\"group\", \"user\", \"localgroup\") and\n process.args : (\"admin\", \"Domain Admins\", \"Remote Desktop Users\", \"Enterprise Admins\", \"Organization Management\") and\n not process.args : \"/add\")\n\n or\n\n ((process.name : \"wmic.exe\" or process.pe.original_file_name == \"wmic.exe\") and\n process.args : (\"group\", \"useraccount\"))\n", "risk_score": 21, "rule_id": "871ea072-1b71-4def-b016-6278b505138d", @@ -54,5 +55,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_file_dir_discovery.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_file_dir_discovery.json index 6e1406471a390..0134bdb26cc37 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_file_dir_discovery.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_file_dir_discovery.json @@ -43,7 +43,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_command_system_account.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_command_system_account.json index 0ea71e5314ed4..7ac70f0094d17 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_command_system_account.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_command_system_account.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Identifies the SYSTEM account using an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation.", + "description": "Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation.", "from": "now-9m", "index": [ "winlogbeat-*", @@ -12,7 +12,8 @@ "language": "eql", "license": "Elastic License v2", "name": "Net command via SYSTEM account", - "query": "process where event.type in (\"start\", \"process_started\") and \n (process.Ext.token.integrity_level_name : \"System\" or\n winlog.event_data.IntegrityLevel : \"System\") and\n process.name : \"whoami.exe\" or\n (process.name : \"net1.exe\" and not process.parent.name : \"net.exe\")\n", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", + "query": "process where event.type in (\"start\", \"process_started\") and \n (?process.Ext.token.integrity_level_name : \"System\" or\n ?winlog.event_data.IntegrityLevel : \"System\") and\n process.name : \"whoami.exe\" or\n (process.name : \"net1.exe\" and not process.parent.name : \"net.exe\")\n", "risk_score": 21, "rule_id": "2856446a-34e6-435b-9fb5-f8f040bfa7ed", "severity": "low", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_view.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_view.json index 9e7725d29079d..654bfc284106c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_view.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_net_view.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Windows Network Enumeration", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n ((process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or\n ((process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and\n not process.parent.name : \"net.exe\")) and\n (process.args : \"view\" or (process.args : \"time\" and process.args : \"\\\\\\\\*\"))\n\n\n /* expand when ancestry is available\n and not descendant of [process where event.type == (\"start\", \"process_started\") and process.name : \"cmd.exe\" and\n ((process.parent.name : \"userinit.exe\") or\n (process.parent.name : \"gpscript.exe\") or\n (process.parent.name : \"explorer.exe\" and\n process.args : \"C:\\\\*\\\\Start Menu\\\\Programs\\\\Startup\\\\*.bat*\"))]\n */\n", "risk_score": 47, "rule_id": "7b8bfc26-81d2-435e-965c-d722ee397ef1", @@ -47,5 +48,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_peripheral_device.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_peripheral_device.json index a9b52d3f245f9..146602a9a8d9b 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_peripheral_device.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_peripheral_device.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Peripheral Device Discovery", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"fsutil.exe\" or process.pe.original_file_name == \"fsutil.exe\") and \n process.args : \"fsinfo\" and process.args : \"drives\"\n", "risk_score": 21, "rule_id": "0c7ca5c2-728d-4ad9-b1c5-bbba83ecb1f4", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_posh_suspicious_api_functions.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_posh_suspicious_api_functions.json index 5f5d99e7f17f5..6fc58f9dc4e9f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_posh_suspicious_api_functions.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_posh_suspicious_api_functions.json @@ -14,7 +14,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "PowerShell Suspicious Discovery Related Windows API Functions", - "note": "## Triage and analysis.\n\n### Investigating PowerShell Suspicious Discovery Related Windows API Functions\n\nPowerShell is one of the main tools used by system administrators for automation, report routines, and other tasks.\n\nAttackers can use PowerShell to interact with the Win32 API to bypass file based antivirus detections, using libraries\nlike PSReflect or Get-ProcAddress Cmdlet.\n\n#### Possible investigation steps:\n\n- Examine script content that triggered the detection. \n- Investigate script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- If the action is suspicious for the user, check for any other activities done by the user in the last 48 hours.\n\n### False Positive Analysis\n\n- Verify whether the script content is malicious/harmful.\n\n### Related Rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and Remediation\n\n- Immediate response should be taken to validate, investigate, and potentially contain the activity to prevent further\npost-compromise behavior.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", + "note": "## Triage and analysis.\n\n### Investigating PowerShell Suspicious Discovery Related Windows API Functions\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This\nmakes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can use PowerShell to interact with the Win32 API to bypass command line based detections, using libraries\nlike PSReflect or Get-ProcAddress Cmdlet.\n\n#### Possible investigation steps\n\n- Examine script content that triggered the detection. \n- Investigate the script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Consider whether the user needs PowerShell to complete its tasks.\n- Check if the imported function was executed.\n\n### False positive analysis\n\n- Discovery activities themselves are not inherently malicious if occurring in isolation, as long as the script does not\ncontain other capabilities, and there are no other alerts related to the user or host; such alerts can be dismissed.\nHowever, analysts should keep in mind that this is not a common way of getting information, making it suspicious.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Quarantine the involved host to prevent further post-compromise behavior.\n- Configure AppLocker or equivalent software to restrict access to PowerShell for regular users.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", "query": "event.category:process and \n powershell.file.script_block_text : (\n NetShareEnum or\n NetWkstaUserEnum or\n NetSessionEnum or\n NetLocalGroupEnum or\n NetLocalGroupGetMembers or\n DsGetSiteName or\n DsEnumerateDomainTrusts or\n WTSEnumerateSessionsEx or\n WTSQuerySessionInformation or\n LsaGetLogonSessionData or\n QueryServiceObjectSecurity\n )\n", "references": [ "https://github.com/BC-SECURITY/Empire/blob/9259e5106986847d2bb770c4289c0c0f1adf2344/data/module_source/situational_awareness/network/powerview.ps1#L21413", @@ -88,5 +88,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_privileged_localgroup_membership.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_privileged_localgroup_membership.json index 467d5ecc88977..2fdcdbcc948c7 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_privileged_localgroup_membership.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_privileged_localgroup_membership.json @@ -11,7 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Enumeration of Privileged Local Groups Membership", - "note": "## Config\n\nThis will require Windows security event 4799 by enabling audit success for the Windows Account Management category and\nthe Security Group Management subcategory.\n", + "note": "## Config\n\nThis will require Windows security event 4799 by enabling audit success for the Windows Account Management category and\nthe Security Group Management subcategory.\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n\n", "query": "iam where event.action == \"user-member-enumerated\" and\n\n /* noisy and usual legit processes excluded */\n not winlog.event_data.CallerProcessName:\n (\"?:\\\\Windows\\\\System32\\\\VSSVC.exe\",\n \"?:\\\\Windows\\\\System32\\\\SearchIndexer.exe\",\n \"?:\\\\Windows\\\\System32\\\\CompatTelRunner.exe\",\n \"?:\\\\Windows\\\\System32\\\\oobe\\\\msoobe.exe\",\n \"?:\\\\Windows\\\\System32\\\\net1.exe\",\n \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Windows\\\\System32\\\\Netplwiz.exe\",\n \"?:\\\\Windows\\\\System32\\\\msiexec.exe\",\n \"?:\\\\Windows\\\\System32\\\\CloudExperienceHostBroker.exe\",\n \"?:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\",\n \"?:\\\\Windows\\\\System32\\\\SrTasks.exe\",\n \"?:\\\\Windows\\\\System32\\\\lsass.exe\",\n \"?:\\\\Windows\\\\System32\\\\diskshadow.exe\",\n \"?:\\\\Windows\\\\System32\\\\dfsrs.exe\",\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\") and\n /* privileged local groups */\n (group.name:(\"admin*\",\"RemoteDesktopUsers\") or\n winlog.event_data.TargetSid:(\"S-1-5-32-544\",\"S-1-5-32-555\"))\n", "risk_score": 43, "rule_id": "291a0de9-937a-4189-94c0-3e847c8b13e4", @@ -49,5 +49,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_remote_system_discovery_commands_windows.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_remote_system_discovery_commands_windows.json index 6df1f7a5e7499..27f4852fcccc3 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_remote_system_discovery_commands_windows.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_remote_system_discovery_commands_windows.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Remote System Discovery Commands", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"nbtstat.exe\" and process.args : (\"-n\", \"-s\")) or\n (process.name : \"arp.exe\" and process.args : \"-a\")\n", "risk_score": 21, "rule_id": "0635c542-1b96-4335-9b47-126582d2c19a", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_grep.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_grep.json index 4862cf42e92c3..903fb701e1dee 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_grep.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_grep.json @@ -14,6 +14,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Security Software Discovery via Grep", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\nprocess.name : \"grep\" and user.id != \"0\" and\n not process.parent.executable : \"/Library/Application Support/*\" and\n process.args :\n (\"Little Snitch*\",\n \"Avast*\",\n \"Avira*\",\n \"ESET*\",\n \"BlockBlock*\",\n \"360Sec*\",\n \"LuLu*\",\n \"KnockKnock*\",\n \"kav\",\n \"KIS\",\n \"RTProtectionDaemon*\",\n \"Malware*\",\n \"VShieldScanner*\",\n \"WebProtection*\",\n \"webinspectord*\",\n \"McAfee*\",\n \"isecespd*\",\n \"macmnsvc*\",\n \"masvc*\",\n \"kesl*\",\n \"avscan*\",\n \"guard*\",\n \"rtvscand*\",\n \"symcfgd*\",\n \"scmdaemon*\",\n \"symantec*\",\n \"sophos*\",\n \"osquery*\",\n \"elastic-endpoint*\"\n ) and\n not (process.args : \"Avast\" and process.args : \"Passwords\")\n", "risk_score": 47, "rule_id": "870aecc0-cea4-4110-af3f-e02e9b373655", @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_wmic.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_wmic.json index 92731ab40e78a..5049236e3f248 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_wmic.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_security_software_wmic.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Security Software Discovery using WMIC", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name:\"wmic.exe\" or process.pe.original_file_name:\"wmic.exe\") and\n process.args:\"/namespace:\\\\\\\\root\\\\SecurityCenter2\" and process.args:\"Get\"\n", "risk_score": 47, "rule_id": "6ea55c81-e2ba-42f2-a134-bccf857ba922", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_users_domain_built_in_commands.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_users_domain_built_in_commands.json index a9276ca950fa5..7152bb4c93d3d 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_users_domain_built_in_commands.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_users_domain_built_in_commands.json @@ -11,7 +11,8 @@ "language": "eql", "license": "Elastic License v2", "name": "Enumeration of Users or Groups via Built-in Commands", - "query": "process where event.type in (\"start\", \"process_started\") and\n not process.parent.executable : (\"/Applications/NoMAD.app/Contents/MacOS/NoMAD\", \n \"/Applications/ZoomPresence.app/Contents/MacOS/ZoomPresence\",\n \"/Applications/Sourcetree.app/Contents/MacOS/Sourcetree\",\n \"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon\",\n \"/usr/local/jamf/bin/jamf\"\n ) and \n process.name : (\"ldapsearch\", \"dsmemberutil\") or\n (process.name : \"dscl\" and \n process.args : (\"read\", \"-read\", \"list\", \"-list\", \"ls\", \"search\", \"-search\") and \n process.args : (\"/Active Directory/*\", \"/Users*\", \"/Groups*\"))\n", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", + "query": "process where event.type in (\"start\", \"process_started\") and\n not process.parent.executable : (\"/Applications/NoMAD.app/Contents/MacOS/NoMAD\", \n \"/Applications/ZoomPresence.app/Contents/MacOS/ZoomPresence\",\n \"/Applications/Sourcetree.app/Contents/MacOS/Sourcetree\",\n \"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon\",\n \"/Applications/Jamf Connect.app/Contents/MacOS/Jamf Connect\",\n \"/usr/local/jamf/bin/jamf\"\n ) and \n process.name : (\"ldapsearch\", \"dsmemberutil\") or\n (process.name : \"dscl\" and \n process.args : (\"read\", \"-read\", \"list\", \"-list\", \"ls\", \"search\", \"-search\") and \n process.args : (\"/Active Directory/*\", \"/Users*\", \"/Groups*\"))\n", "risk_score": 21, "rule_id": "6e9b351e-a531-4bdc-b73e-7034d6eed7ff", "severity": "low", @@ -46,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_virtual_machine_fingerprinting_grep.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_virtual_machine_fingerprinting_grep.json index e557e37db23d6..009cdf49ab28b 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_virtual_machine_fingerprinting_grep.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_virtual_machine_fingerprinting_grep.json @@ -14,6 +14,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Virtual Machine Fingerprinting via Grep", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.name in (\"grep\", \"egrep\") and user.id != \"0\" and\n process.args : (\"parallels*\", \"vmware*\", \"virtualbox*\") and process.args : \"Manufacturer*\" and \n not process.parent.executable in (\"/Applications/Docker.app/Contents/MacOS/Docker\", \"/usr/libexec/kcare/virt-what\")\n", "references": [ "https://objective-see.com/blog/blog_0x4F.html" @@ -48,5 +49,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_whoami_command_activity.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_whoami_command_activity.json index 9999ab2ffb973..9f9cc2b7a65d8 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_whoami_command_activity.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/discovery_whoami_command_activity.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Whoami Process Activity", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and process.name : \"whoami.exe\"\n", "risk_score": 21, "rule_id": "ef862985-3f13-4262-a686-5f357bbb9bc2", @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 7 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/domain_added_to_google_workspace_trusted_domains.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/domain_added_to_google_workspace_trusted_domains.json index 3f9e9ca343bd4..e9f029c6b25bb 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/domain_added_to_google_workspace_trusted_domains.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/domain_added_to_google_workspace_trusted_domains.json @@ -33,5 +33,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 6 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_binary.json new file mode 100644 index 0000000000000..c9b900ce92a56 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_binary.json @@ -0,0 +1,56 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary apt/apt-get abuse to breakout out of restricted shells or environments by spawning an interactive system shell. The apt utility allows us to manage installation and removal of softwares on Debian based Linux distributions and the activity of spawning shell is not a standard use of this binary for a user or system administrator. It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via apt/apt-get Changelog Escape", + "query": "process where event.type == \"start\" and process.name == \"sensible-pager\" and\n process.args in (\"/bin/sh\", \"/bin/bash\", \"/bin/dash\", \"sh\", \"bash\", \"dash\") and\n process.parent.name in (\"apt\", \"apt-get\") and process.parent.args == \"changelog\"\n", + "references": [ + "https://gtfobins.github.io/gtfobins/apt/", + "https://gtfobins.github.io/gtfobins/apt-get/" + ], + "risk_score": 47, + "rule_id": "8fed8450-847e-43bd-874c-3bbf0cd425f3", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_solarwinds_backdoor_child_cmd_powershell.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_solarwinds_backdoor_child_cmd_powershell.json index b1b15698f884f..8b25f73c239bb 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_solarwinds_backdoor_child_cmd_powershell.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_solarwinds_backdoor_child_cmd_powershell.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Command Execution via SolarWinds Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and process.name: (\"cmd.exe\", \"powershell.exe\") and\nprocess.parent.name: (\n \"ConfigurationWizard*.exe\",\n \"NetflowDatabaseMaintenance*.exe\",\n \"NetFlowService*.exe\",\n \"SolarWinds.Administration*.exe\",\n \"SolarWinds.Collector.Service*.exe\",\n \"SolarwindsDiagnostics*.exe\"\n )\n", "references": [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", @@ -71,5 +72,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_solarwinds_backdoor_unusual_child_processes.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_solarwinds_backdoor_unusual_child_processes.json index 33580e0d3838b..12ee31cecda30 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_solarwinds_backdoor_unusual_child_processes.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_apt_solarwinds_backdoor_unusual_child_processes.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious SolarWinds Child Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name: (\"SolarWinds.BusinessLayerHost.exe\", \"SolarWinds.BusinessLayerHostx64.exe\") and\n not process.name : (\n \"APMServiceControl*.exe\",\n \"ExportToPDFCmd*.Exe\",\n \"SolarWinds.Credentials.Orion.WebApi*.exe\",\n \"SolarWinds.Orion.Topology.Calculator*.exe\",\n \"Database-Maint.exe\",\n \"SolarWinds.Orion.ApiPoller.Service.exe\",\n \"WerFault.exe\",\n \"WerMgr.exe\")\n", "references": [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", @@ -71,5 +72,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_awk_binary_shell.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_awk_binary_shell.json new file mode 100644 index 0000000000000..2bf7b9e9271be --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_awk_binary_shell.json @@ -0,0 +1,56 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary awk abuse to breakout out of restricted shells or environments by spawning an interactive system shell. The awk utility is a text processing language used for data extraction and reporting tools and the activity of spawning shell is not a standard use of this binary for a user or system administrator. It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via awk Commands", + "query": "process where event.type == \"start\" and process.name in (\"sh\", \"bash\", \"dash\") and\n process.parent.name in (\"nawk\", \"mawk\", \"awk\", \"gawk\") and process.parent.args : \"BEGIN {system(*)}\"\n", + "references": [ + "https://gtfobins.github.io/gtfobins/nawk/", + "https://gtfobins.github.io/gtfobins/mawk/" + ], + "risk_score": 47, + "rule_id": "10754992-28c7-4472-be5b-f3770fd04f2d", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_busybox_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_busybox_binary.json new file mode 100644 index 0000000000000..daf980004d5e6 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_busybox_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary busybox abuse to break out from restricted environments by spawning an interactive system shell.The busybox is software utility suite that provides several Unix utilities in a single executable file and the activity of spawing a shell is not a standard use of this binary by a user or system administrator. It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via busybox Shell Evasion", + "query": "process where event.type == \"start\" and process.name == \"busybox\" and process.args_count == 2 and process.args in (\"/bin/sh\", \"/bin/ash\", \"sh\", \"ash\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/busybox/" + ], + "risk_score": 47, + "rule_id": "e9b4a3c7-24fc-49fd-a00f-9c938031eef1", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_c89_c99_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_c89_c99_binary.json new file mode 100644 index 0000000000000..1cf6c650b0fe7 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_c89_c99_binary.json @@ -0,0 +1,56 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary c89/c99 abuse to break out from restricted environments by spawning an interactive system shell.The c89/c99 utility is an interface to the standard C compilation system and the activity of spawing a shell is not a standard use of this binary by a user or system administrator. It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via c89/c99 Shell evasion", + "query": "process where event.type == \"start\" and process.name in (\"sh\", \"dash\", \"bash\") and\n process.parent.name in (\"c89\",\"c99\") and process.parent.args == \"-wrapper\" and\n process.parent.args in (\"sh,-s\", \"bash,-s\", \"dash,-s\", \"/bin/sh,-s\", \"/bin/bash,-s\", \"/bin/dash,-s\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/c89/", + "https://gtfobins.github.io/gtfobins/c99/" + ], + "risk_score": 47, + "rule_id": "1859ce38-6a50-422b-a5e8-636e231ea0cd", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_com_object_xwizard.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_com_object_xwizard.json index bd697055ec14e..15a2ef5d93a6e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_com_object_xwizard.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_com_object_xwizard.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Execution of COM object via Xwizard", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.pe.original_file_name : \"xwizard.exe\" and\n (\n (process.args : \"RunWizard\" and process.args : \"{*}\") or\n (process.executable != null and\n not process.executable : (\"C:\\\\Windows\\\\SysWOW64\\\\xwizard.exe\", \"C:\\\\Windows\\\\System32\\\\xwizard.exe\")\n )\n )\n", "references": [ "https://lolbas-project.github.io/lolbas/Binaries/Xwizard/", @@ -53,5 +54,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_started_by_svchost.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_started_by_svchost.json index f0270a576c88b..23a8b0820a65c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_started_by_svchost.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_started_by_svchost.json @@ -12,7 +12,8 @@ "language": "eql", "license": "Elastic License v2", "name": "Svchost spawning Cmd", - "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"svchost.exe\" and process.name : \"cmd.exe\" and \n not (process.pe.original_file_name == \"Cmd.Exe\" and process.args : \"?:\\\\Program Files\\\\Npcap\\\\CheckStatus.bat??\")\n", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", + "query": "process where event.type == \"start\" and\n process.parent.name : \"svchost.exe\" and process.name : \"cmd.exe\" and \n not (process.pe.original_file_name : \"cmd.exe\" and process.args : (\n \"??:\\\\Program Files\\\\Npcap\\\\CheckStatus.bat?\",\n \"?:\\\\Program Files\\\\Npcap\\\\CheckStatus.bat\",\n \"\\\\system32\\\\cleanmgr.exe\",\n \"?:\\\\Windows\\\\system32\\\\silcollector.cmd\",\n \"\\\\system32\\\\AppHostRegistrationVerifier.exe\",\n \"\\\\system32\\\\ServerManagerLauncher.exe\"))\n", "risk_score": 21, "rule_id": "fd7a6052-58fa-4397-93c3-4795249ccfa2", "severity": "low", @@ -40,7 +41,9 @@ ] } ], + "timeline_id": "e70679c2-6cde-4510-9764-4823df18f7db", + "timeline_title": "Comprehensive Process Timeline", "timestamp_override": "event.ingested", "type": "eql", - "version": 8 + "version": 9 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_started_by_unusual_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_started_by_unusual_process.json index ac21f5be5eaef..27ec0d952beaf 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_started_by_unusual_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_started_by_unusual_process.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Unusual Parent Process for cmd.exe", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : \"cmd.exe\" and\n process.parent.name : (\"lsass.exe\",\n \"csrss.exe\",\n \"epad.exe\",\n \"regsvr32.exe\",\n \"dllhost.exe\",\n \"LogonUI.exe\",\n \"wermgr.exe\",\n \"spoolsv.exe\",\n \"jucheck.exe\",\n \"jusched.exe\",\n \"ctfmon.exe\",\n \"taskhostw.exe\",\n \"GoogleUpdate.exe\",\n \"sppsvc.exe\",\n \"sihost.exe\",\n \"slui.exe\",\n \"SIHClient.exe\",\n \"SearchIndexer.exe\",\n \"SearchProtocolHost.exe\",\n \"FlashPlayerUpdateService.exe\",\n \"WerFault.exe\",\n \"WUDFHost.exe\",\n \"unsecapp.exe\",\n \"wlanext.exe\" )\n", "risk_score": 47, "rule_id": "3b47900d-e793-49e8-968f-c90dc3526aa1", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_via_rundll32.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_via_rundll32.json index 1b25b865a4f29..5e5cdd317828a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_via_rundll32.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_command_shell_via_rundll32.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Command Shell Activity Started via RunDLL32", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.name : (\"cmd.exe\", \"powershell.exe\") and\n process.parent.name : \"rundll32.exe\" and process.parent.command_line != null and\n /* common FPs can be added here */\n not process.parent.args : (\"C:\\\\Windows\\\\System32\\\\SHELL32.dll,RunAsNewUser_RunDLL\",\n \"C:\\\\WINDOWS\\\\*.tmp,zzzzInvokeManagedCustomActionOutOfProc\")\n", "risk_score": 21, "rule_id": "9ccf3ce0-0057-440a-91f5-870c6ad39093", @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_cpulimit_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_cpulimit_binary.json new file mode 100644 index 0000000000000..67d3fda3b3889 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_cpulimit_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary cpulimit abuse to break out from restricted environments by spawning an interactive system shell. The cpulimit utility is used to restrict the CPU usage of a process in cases of CPU or system load exceeding the defined threshold and the activity of spawning a shell is not a standard use of this binary by a user or system administrator. This can potentially indicate a malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via cpulimit Shell Evasion", + "query": "process where event.type == \"start\" and process.name in (\"bash\", \"sh\", \"dash\") and\n process.parent.name == \"cpulimit\" and process.parent.args == \"-f\" and\n process.parent.args in (\"/bin/sh\", \"/bin/bash\", \"/bin/dash\", \"sh\", \"bash\", \"dash\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/cpulimit/" + ], + "risk_score": 47, + "rule_id": "0968cfbd-40f0-4b1c-b7b1-a60736c7b241", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_crash_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_crash_binary.json new file mode 100644 index 0000000000000..a82db8b462fdd --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_crash_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary crash abuse to break out from restricted environments by spawning an interactive system shell.The crash utility helps to analyze Linux crash dump data or a live system and the activity of spawing a shell is not a standard use of this binary by a user or system administrator. It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via crash Shell evasion", + "query": "process where event.type == \"start\" and process.parent.name == \"crash\" and process.parent.args == \"-h\" and process.name == \"sh\"\n", + "references": [ + "https://gtfobins.github.io/gtfobins/crash/" + ], + "risk_score": 47, + "rule_id": "ee619805-54d7-4c56-ba6f-7717282ddd73", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_enumeration_via_wmiprvse.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_enumeration_via_wmiprvse.json index 441e01b4a1b12..29a0f88b271ea 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_enumeration_via_wmiprvse.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_enumeration_via_wmiprvse.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Enumeration Command Spawned via WMIPrvSE", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name:\n (\n \"arp.exe\",\n \"dsquery.exe\",\n \"dsget.exe\",\n \"gpresult.exe\",\n \"hostname.exe\",\n \"ipconfig.exe\",\n \"nbtstat.exe\",\n \"net.exe\",\n \"net1.exe\",\n \"netsh.exe\",\n \"netstat.exe\",\n \"nltest.exe\",\n \"ping.exe\",\n \"qprocess.exe\",\n \"quser.exe\",\n \"qwinsta.exe\",\n \"reg.exe\",\n \"sc.exe\",\n \"systeminfo.exe\",\n \"tasklist.exe\",\n \"tracert.exe\",\n \"whoami.exe\"\n ) and\n process.parent.name:\"wmiprvse.exe\"\n", "risk_score": 21, "rule_id": "770e0c4d-b998-41e5-a62e-c7901fd7f470", @@ -48,9 +49,9 @@ }, "technique": [ { - "id": "T1518", - "name": "Software Discovery", - "reference": "https://attack.mitre.org/techniques/T1518/" + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" }, { "id": "T1087", @@ -58,14 +59,14 @@ "reference": "https://attack.mitre.org/techniques/T1087/" }, { - "id": "T1018", - "name": "Remote System Discovery", - "reference": "https://attack.mitre.org/techniques/T1018/" + "id": "T1518", + "name": "Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/" } ] } ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_env_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_env_binary.json new file mode 100644 index 0000000000000..c002869ba4c12 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_env_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary env abuse to break out from restricted environments by spawning an interactive system shell.The env utility is a shell command for Unix like OS which is used to print a list of environment variables and the activity of spawning shell is not a standard use of this binary for a user or system administrator. It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via env Shell Evasion", + "query": "process where event.type == \"start\" and process.name : \"env\" and process.args_count == 2 and process.args : (\"/bin/sh\", \"/bin/bash\", \"sh\", \"bash\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/env/" + ], + "risk_score": 47, + "rule_id": "72d33577-f155-457d-aad3-379f9b750c97", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_expect_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_expect_binary.json new file mode 100644 index 0000000000000..2879a9407c920 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_expect_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary expect abuse to break out from restricted environments by spawning an interactive system shell. The expect utility allows us to automate control of interactive applications such as telnet,ftp,ssh and others and the activity of spawning shell is not a standard use of this binary for a user or system administrator and could potentially indicate malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via the expect command", + "query": "process where event.type == \"start\" and process.name in (\"bash\", \"sh\", \"dash\") and\n process.parent.name == \"expect\" and process.parent.args == \"-c\" and\n process.parent.args in (\"spawn /bin/sh;interact\", \"spawn /bin/bash;interact\", \"spawn /bin/dash;interact\", \"spawn sh;interact\", \"spawn bash;interact\", \"spawn dash;interact\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/expect/" + ], + "risk_score": 47, + "rule_id": "fd3fc25e-7c7c-4613-8209-97942ac609f6", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_find_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_find_binary.json new file mode 100644 index 0000000000000..a6700e8449911 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_find_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary find abuse to break out from restricted environments by spawning an interactive system shell. The find command in Unix is a command line utility for walking a file hirerarchy and the activity of spawning shell is not a standard use of this binary for a user or system administrator.It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via the find command", + "query": "process where event.type == \"start\" and process.name in (\"bash\", \"sh\") and\n process.parent.name == \"find\" and process.parent.args == \"-exec\" and\n process.parent.args == \";\" and process.parent.args in (\"/bin/bash\", \"/bin/sh\", \"bash\", \"sh\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/find/" + ], + "risk_score": 47, + "rule_id": "6f683345-bb10-47a7-86a7-71e9c24fb358", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_flock_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_flock_binary.json new file mode 100644 index 0000000000000..13d16968697f0 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_flock_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary flock abuse to break out from restricted environments by spawning an interactive system shell.The flock utility allows us to manage advisory file locks in shell scripts or on the command line and the activity of spawing a shell is not a standard use of this binary by a user or system administrator. It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via flock Shell evasion", + "query": "process where event.type == \"start\" and process.parent.name == \"flock\" and process.parent.args == \"-u\" and process.parent.args == \"/\" and process.parent.args in (\"/bin/sh\", \"/bin/bash\", \"/bin/dash\", \"sh\", \"bash\", \"dash\") and process.name in (\"bash\", \"dash\", \"sh\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/flock/" + ], + "risk_score": 47, + "rule_id": "f52362cd-baf1-4b6d-84be-064efc826461", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_from_unusual_directory.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_from_unusual_directory.json index 3043dba116b8a..d71469d125d27 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_from_unusual_directory.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_from_unusual_directory.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Process Execution from an Unusual Directory", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\", \"info\") and\n /* add suspicious execution paths here */\nprocess.executable : (\"C:\\\\PerfLogs\\\\*.exe\",\"C:\\\\Users\\\\Public\\\\*.exe\",\"C:\\\\Users\\\\Default\\\\*.exe\",\"C:\\\\Windows\\\\Tasks\\\\*.exe\",\"C:\\\\Intel\\\\*.exe\",\"C:\\\\AMD\\\\Temp\\\\*.exe\",\"C:\\\\Windows\\\\AppReadiness\\\\*.exe\",\n\"C:\\\\Windows\\\\ServiceState\\\\*.exe\",\"C:\\\\Windows\\\\security\\\\*.exe\",\"C:\\\\Windows\\\\IdentityCRL\\\\*.exe\",\"C:\\\\Windows\\\\Branding\\\\*.exe\",\"C:\\\\Windows\\\\csc\\\\*.exe\",\n \"C:\\\\Windows\\\\DigitalLocker\\\\*.exe\",\"C:\\\\Windows\\\\en-US\\\\*.exe\",\"C:\\\\Windows\\\\wlansvc\\\\*.exe\",\"C:\\\\Windows\\\\Prefetch\\\\*.exe\",\"C:\\\\Windows\\\\Fonts\\\\*.exe\",\n \"C:\\\\Windows\\\\diagnostics\\\\*.exe\",\"C:\\\\Windows\\\\TAPI\\\\*.exe\",\"C:\\\\Windows\\\\INF\\\\*.exe\",\"C:\\\\Windows\\\\System32\\\\Speech\\\\*.exe\",\"C:\\\\windows\\\\tracing\\\\*.exe\",\n \"c:\\\\windows\\\\IME\\\\*.exe\",\"c:\\\\Windows\\\\Performance\\\\*.exe\",\"c:\\\\windows\\\\intel\\\\*.exe\",\"c:\\\\windows\\\\ms\\\\*.exe\",\"C:\\\\Windows\\\\dot3svc\\\\*.exe\",\"C:\\\\Windows\\\\ServiceProfiles\\\\*.exe\",\n \"C:\\\\Windows\\\\panther\\\\*.exe\",\"C:\\\\Windows\\\\RemotePackages\\\\*.exe\",\"C:\\\\Windows\\\\OCR\\\\*.exe\",\"C:\\\\Windows\\\\appcompat\\\\*.exe\",\"C:\\\\Windows\\\\apppatch\\\\*.exe\",\"C:\\\\Windows\\\\addins\\\\*.exe\",\n \"C:\\\\Windows\\\\Setup\\\\*.exe\",\"C:\\\\Windows\\\\Help\\\\*.exe\",\"C:\\\\Windows\\\\SKB\\\\*.exe\",\"C:\\\\Windows\\\\Vss\\\\*.exe\",\"C:\\\\Windows\\\\Web\\\\*.exe\",\"C:\\\\Windows\\\\servicing\\\\*.exe\",\"C:\\\\Windows\\\\CbsTemp\\\\*.exe\",\n \"C:\\\\Windows\\\\Logs\\\\*.exe\",\"C:\\\\Windows\\\\WaaS\\\\*.exe\",\"C:\\\\Windows\\\\twain_32\\\\*.exe\",\"C:\\\\Windows\\\\ShellExperiences\\\\*.exe\",\"C:\\\\Windows\\\\ShellComponents\\\\*.exe\",\"C:\\\\Windows\\\\PLA\\\\*.exe\",\n \"C:\\\\Windows\\\\Migration\\\\*.exe\",\"C:\\\\Windows\\\\debug\\\\*.exe\",\"C:\\\\Windows\\\\Cursors\\\\*.exe\",\"C:\\\\Windows\\\\Containers\\\\*.exe\",\"C:\\\\Windows\\\\Boot\\\\*.exe\",\"C:\\\\Windows\\\\bcastdvr\\\\*.exe\",\n \"C:\\\\Windows\\\\assembly\\\\*.exe\",\"C:\\\\Windows\\\\TextInput\\\\*.exe\",\"C:\\\\Windows\\\\security\\\\*.exe\",\"C:\\\\Windows\\\\schemas\\\\*.exe\",\"C:\\\\Windows\\\\SchCache\\\\*.exe\",\"C:\\\\Windows\\\\Resources\\\\*.exe\",\n \"C:\\\\Windows\\\\rescache\\\\*.exe\",\"C:\\\\Windows\\\\Provisioning\\\\*.exe\",\"C:\\\\Windows\\\\PrintDialog\\\\*.exe\",\"C:\\\\Windows\\\\PolicyDefinitions\\\\*.exe\",\"C:\\\\Windows\\\\media\\\\*.exe\",\n \"C:\\\\Windows\\\\Globalization\\\\*.exe\",\"C:\\\\Windows\\\\L2Schemas\\\\*.exe\",\"C:\\\\Windows\\\\LiveKernelReports\\\\*.exe\",\"C:\\\\Windows\\\\ModemLogs\\\\*.exe\",\"C:\\\\Windows\\\\ImmersiveControlPanel\\\\*.exe\") and\n not process.name : (\"SpeechUXWiz.exe\",\"SystemSettings.exe\",\"TrustedInstaller.exe\",\"PrintDialog.exe\",\"MpSigStub.exe\",\"LMS.exe\",\"mpam-*.exe\")\n /* uncomment once in winlogbeat */\n /* and not (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true) */\n", "risk_score": 47, "rule_id": "ebfe1448-7fac-4d59-acea-181bd89b1f7f", @@ -25,5 +26,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_from_unusual_path_cmdline.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_from_unusual_path_cmdline.json index d82313c758972..d7aff0ae809c5 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_from_unusual_path_cmdline.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_from_unusual_path_cmdline.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Execution from Unusual Directory - Command Line", - "note": "## Triage and analysis\n\nThis is related to the `Process Execution from an Unusual Directory rule`.", + "note": "## Triage and analysis\n\nThis is related to the `Process Execution from an Unusual Directory rule`.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\", \"info\") and\n process.name : (\"wscript.exe\", \n \"cscript.exe\", \n \"rundll32.exe\", \n \"regsvr32.exe\", \n \"cmstp.exe\",\n \"RegAsm.exe\",\n \"installutil.exe\",\n \"mshta.exe\",\n \"RegSvcs.exe\", \n \"powershell.exe\", \n \"pwsh.exe\", \n \"cmd.exe\") and\n \n /* add suspicious execution paths here */\n process.args : (\"C:\\\\PerfLogs\\\\*\",\n \"C:\\\\Users\\\\Public\\\\*\",\n \"C:\\\\Users\\\\Default\\\\*\",\n \"C:\\\\Windows\\\\Tasks\\\\*\",\n \"C:\\\\Intel\\\\*\", \n \"C:\\\\AMD\\\\Temp\\\\*\", \n \"C:\\\\Windows\\\\AppReadiness\\\\*\", \n \"C:\\\\Windows\\\\ServiceState\\\\*\",\n \"C:\\\\Windows\\\\security\\\\*\",\n \"C:\\\\Windows\\\\IdentityCRL\\\\*\",\n \"C:\\\\Windows\\\\Branding\\\\*\",\n \"C:\\\\Windows\\\\csc\\\\*\",\n \"C:\\\\Windows\\\\DigitalLocker\\\\*\",\n \"C:\\\\Windows\\\\en-US\\\\*\",\n \"C:\\\\Windows\\\\wlansvc\\\\*\",\n \"C:\\\\Windows\\\\Prefetch\\\\*\",\n \"C:\\\\Windows\\\\Fonts\\\\*\",\n \"C:\\\\Windows\\\\diagnostics\\\\*\",\n \"C:\\\\Windows\\\\TAPI\\\\*\",\n \"C:\\\\Windows\\\\INF\\\\*\",\n \"C:\\\\Windows\\\\System32\\\\Speech\\\\*\",\n \"C:\\\\windows\\\\tracing\\\\*\",\n \"c:\\\\windows\\\\IME\\\\*\",\n \"c:\\\\Windows\\\\Performance\\\\*\",\n \"c:\\\\windows\\\\intel\\\\*\",\n \"c:\\\\windows\\\\ms\\\\*\",\n \"C:\\\\Windows\\\\dot3svc\\\\*\",\n \"C:\\\\Windows\\\\ServiceProfiles\\\\*\",\n \"C:\\\\Windows\\\\panther\\\\*\",\n \"C:\\\\Windows\\\\RemotePackages\\\\*\",\n \"C:\\\\Windows\\\\OCR\\\\*\",\n \"C:\\\\Windows\\\\appcompat\\\\*\",\n \"C:\\\\Windows\\\\apppatch\\\\*\",\n \"C:\\\\Windows\\\\addins\\\\*\",\n \"C:\\\\Windows\\\\Setup\\\\*\",\n \"C:\\\\Windows\\\\Help\\\\*\",\n \"C:\\\\Windows\\\\SKB\\\\*\",\n \"C:\\\\Windows\\\\Vss\\\\*\",\n \"C:\\\\Windows\\\\Web\\\\*\",\n \"C:\\\\Windows\\\\servicing\\\\*\",\n \"C:\\\\Windows\\\\CbsTemp\\\\*\",\n \"C:\\\\Windows\\\\Logs\\\\*\",\n \"C:\\\\Windows\\\\WaaS\\\\*\",\n \"C:\\\\Windows\\\\twain_32\\\\*\",\n \"C:\\\\Windows\\\\ShellExperiences\\\\*\",\n \"C:\\\\Windows\\\\ShellComponents\\\\*\",\n \"C:\\\\Windows\\\\PLA\\\\*\",\n \"C:\\\\Windows\\\\Migration\\\\*\",\n \"C:\\\\Windows\\\\debug\\\\*\",\n \"C:\\\\Windows\\\\Cursors\\\\*\",\n \"C:\\\\Windows\\\\Containers\\\\*\",\n \"C:\\\\Windows\\\\Boot\\\\*\",\n \"C:\\\\Windows\\\\bcastdvr\\\\*\",\n \"C:\\\\Windows\\\\assembly\\\\*\",\n \"C:\\\\Windows\\\\TextInput\\\\*\",\n \"C:\\\\Windows\\\\security\\\\*\",\n \"C:\\\\Windows\\\\schemas\\\\*\",\n \"C:\\\\Windows\\\\SchCache\\\\*\",\n \"C:\\\\Windows\\\\Resources\\\\*\",\n \"C:\\\\Windows\\\\rescache\\\\*\",\n \"C:\\\\Windows\\\\Provisioning\\\\*\",\n \"C:\\\\Windows\\\\PrintDialog\\\\*\",\n \"C:\\\\Windows\\\\PolicyDefinitions\\\\*\",\n \"C:\\\\Windows\\\\media\\\\*\",\n \"C:\\\\Windows\\\\Globalization\\\\*\",\n \"C:\\\\Windows\\\\L2Schemas\\\\*\",\n \"C:\\\\Windows\\\\LiveKernelReports\\\\*\",\n \"C:\\\\Windows\\\\ModemLogs\\\\*\",\n \"C:\\\\Windows\\\\ImmersiveControlPanel\\\\*\",\n \"C:\\\\$Recycle.Bin\\\\*\") and\n not process.parent.executable : (\"C:\\\\WINDOWS\\\\System32\\\\DriverStore\\\\FileRepository\\\\*\\\\igfxCUIService*.exe\",\n \"C:\\\\Windows\\\\System32\\\\spacedeskService.exe\",\n \"C:\\\\Program Files\\\\Dell\\\\SupportAssistAgent\\\\SRE\\\\SRE.exe\") and\n not (process.name : \"rundll32.exe\" and process.args : (\"uxtheme.dll,#64\", \"PRINTUI.DLL,PrintUIEntry\"))\n", "risk_score": 47, "rule_id": "cff92c41-2225-4763-b4ce-6f71e5bda5e6", @@ -26,5 +26,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_gcc_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_gcc_binary.json new file mode 100644 index 0000000000000..e5b93a08b0ef9 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_gcc_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary gcc abuse to break out from restricted environments by spawning an interactive system shell.The gcc utility is a complier system for various languages and mainly used to complie C and C++ programs and the activity of spawning shell is not a standard use of this binary for a user or system administrator.It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via the gcc command", + "query": "process where event.type == \"start\" and process.name in (\"sh\", \"dash\", \"bash\") and\n process.parent.name == \"gcc\" and process.parent.args == \"-wrapper\" and\n process.parent.args in (\"sh,-s\", \"bash,-s\", \"dash,-s\", \"/bin/sh,-s\", \"/bin/bash,-s\", \"/bin/dash,-s\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/gcc/" + ], + "risk_score": 47, + "rule_id": "da986d2c-ffbf-4fd6-af96-a88dbf68f386", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_installer_spawned_network_event.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_installer_spawned_network_event.json index 6b8941ca81f61..1746a813563d8 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_installer_spawned_network_event.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_installer_spawned_network_event.json @@ -74,7 +74,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_mysql_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_mysql_binary.json new file mode 100644 index 0000000000000..75bed04b4b54f --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_mysql_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies MySQL server abuse to break out from restricted environments by spawning an interactive system shell.The MySQL is an open source relational database management system and the activity of spawning shell is not a standard use of this binary for a user or system administrator.It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via the mysql command", + "query": "process where event.type == \"start\" and process.name in (\"bash\", \"sh\", \"dash\") and\n process.parent.name == \"mysql\" and process.parent.args == \"-e\" and\n process.parent.args : (\"\\\\!*sh\", \"\\\\!*bash\", \"\\\\!*dash\", \"\\\\!*/bin/sh\", \"\\\\!*/bin/bash\", \"\\\\!*/bin/dash\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/mysql/" + ], + "risk_score": 47, + "rule_id": "83b2c6e5-e0b2-42d7-8542-8f3af86a1acb", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_posh_portable_executable.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_posh_portable_executable.json index 38dfa02f40560..8f26482c048ed 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_posh_portable_executable.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_posh_portable_executable.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Detects the presence of portable executables (PE) in a PowerShell script by looking for its encoded header. Attackers embed PEs into PowerShell scripts for injecting them into the memory, avoiding defenses by not writing to disk.", + "description": "Detects the presence of a portable executable (PE) in a PowerShell script by looking for its encoded header. Attackers embed PEs into PowerShell scripts to inject them into memory, avoiding defences by not writing to disk.", "from": "now-9m", "index": [ "winlogbeat-*", @@ -11,7 +11,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "Suspicious Portable Executable Encoded in Powershell Script", - "note": "## Triage and analysis.\n\n### Investigating Suspicious Portable Executable Encoded in Powershell Script\n\nPowerShell is one of the main tools used by system administrators for automation, report routines, and other tasks.\n\nAttackers can abuse PowerShell in-memory capabilities to inject executables into memory without touching the disk,\nbypassing antivirus software. These executables are generally base64 encoded.\n\n#### Possible investigation steps:\n\n- Examine script content that triggered the detection. \n- Investigate script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- If the action is suspicious for the user, check for any other activities done by the user in the last 48 hours.\n\n### False Positive Analysis\n\n- Verify whether the script content is malicious/harmful.\n\n### Related Rules\n\n- PowerShell Reflection Assembly Load - e26f042e-c590-4e82-8e05-41e81bd822ad\n- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and Remediation\n\n- Immediate response should be taken to validate, investigate, and potentially contain the activity to prevent further\npost-compromise behavior.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", + "note": "## Triage and analysis.\n\n### Investigating Suspicious Portable Executable Encoded in Powershell Script\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This\nmakes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can abuse PowerShell in-memory capabilities to inject executables into memory without touching the disk,\nbypassing file-based security protections. These executables are generally base64 encoded.\n\n#### Possible investigation steps\n\n- Examine script content that triggered the detection. \n- Investigate the script execution chain (parent process tree).\n- Inspect any file or network events from the suspicious PowerShell host process instance.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Consider whether the user needs PowerShell to complete its tasks.\n- Retrieve the script and execute it in a sandbox or controlled environment.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Related rules\n\n- PowerShell Reflection Assembly Load - e26f042e-c590-4e82-8e05-41e81bd822ad\n- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Quarantine the involved host to prevent further post-compromise behavior.\n- Configure AppLocker or equivalent software to restrict access to PowerShell for regular users.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", "query": "event.category:process and \n powershell.file.script_block_text : (\n TVqQAAMAAAAEAAAA\n )\n", "references": [ "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md" @@ -52,5 +52,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_posh_psreflect.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_posh_psreflect.json index 6ff1d2b8fff9d..d6fc7d1ff1553 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_posh_psreflect.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_posh_psreflect.json @@ -14,8 +14,8 @@ "language": "kuery", "license": "Elastic License v2", "name": "PowerShell PSReflect Script", - "note": "## Triage and analysis\n### Investigating PowerShell PSReflect Script\n\nPowerShell is one of the main tools in the belt of system administrators for automation, report routines, and other tasks.\n\nPSReflect is a library that enables PowerShell to access win32 API functions in an uncomplicated way. It also helps to\ncreate enums and structs easily\u2014all without touching the disk.\n\nAlthough this is an interesting project for every developer and admin out there, it is mainly used in the red team and\nmalware tooling for its capabilities.\n\nDetecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through\nPowerShell, enabling the defender to discover tools being dropped in the environment.\n\n#### Possible investigation steps:\n- Check for additional PowerShell logs that indicate that the script/command was run.\n- Gather the script content that may be split into multiple script blocks, and identify its capabilities.\n- If the action is suspicious for the user, check for any other activities done by the user in the last 48 hours.\n- Look for additional alerts involving the host and the user.\n\n### False Positive Analysis\n- Verify whether the script content is malicious/harmful.\n\n### Related Rules\n- PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e\n- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889\n- PowerShell Suspicious Script with Audio Capture Capabilities - 2f2f4939-0b34-40c2-a0a3-844eb7889f43\n- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d\n- PowerShell Reflection Assembly Load - e26f042e-c590-4e82-8e05-41e81bd822ad\n- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a\n- PowerShell Suspicious Script with Screenshot Capabilities - 959a7353-1129-4aa7-9084-30746b256a70\n\n### Response and Remediation\n- Immediate response should be taken to validate activity, investigate, and potentially isolate activity to prevent further\npost-compromise behavior.\n\n## Config\nThe 'PowerShell Script Block Logging' logging policy is required be configured (Enable).\n\nSteps to implement the logging policy with with Advanced Audit Configuration:\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\nSteps to implement the logging policy via registry:\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", - "query": "event.category:process and \n powershell.file.script_block_text:(\n New-InMemoryModule or\n Add-Win32Type or\n psenum or\n DefineDynamicAssembly or\n DefineDynamicModule or\n Reflection.TypeAttributes or\n Reflection.Emit.OpCodes or\n Reflection.Emit.CustomAttributeBuilder or\n Runtime.InteropServices.DllImportAttribute\n )\n", + "note": "## Triage and analysis\n\n### Investigating PowerShell PSReflect Script\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This\nmakes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nPSReflect is a library that enables PowerShell to access win32 API functions in an uncomplicated way. It also helps to\ncreate enums and structs easily\u2014all without touching the disk.\n\nAlthough this is an interesting project for every developer and admin out there, it is mainly used in the red team and\nmalware tooling for its capabilities.\n\nDetecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through\nPowerShell, enabling defenders to discover tools being dropped in the environment.\n\n#### Possible investigation steps\n\n- Check for additional PowerShell and command-line logs that indicate that imported functions were run.\n- Gather the script content that may be split into multiple script blocks (the field `powershell.file.script_block_id`\ncan be used for filtering), and identify its capabilities.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Consider whether the user needs PowerShell to complete its tasks.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Related rules\n\n- PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e\n- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889\n- PowerShell Suspicious Script with Audio Capture Capabilities - 2f2f4939-0b34-40c2-a0a3-844eb7889f43\n- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d\n- PowerShell Reflection Assembly Load - e26f042e-c590-4e82-8e05-41e81bd822ad\n- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a\n- PowerShell Suspicious Script with Screenshot Capabilities - 959a7353-1129-4aa7-9084-30746b256a70\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Quarantine the involved host to prevent further post-compromise behavior.\n- Configure AppLocker or equivalent software to restrict access to PowerShell for regular users.\n\n## Config\n\nThe 'PowerShell Script Block Logging' logging policy must be configured (Enable).\n\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nAdministrative Templates > \nWindows PowerShell > \nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```\n", + "query": "event.category:process and \n powershell.file.script_block_text:(\n \"New-InMemoryModule\" or\n \"Add-Win32Type\" or\n psenum or\n DefineDynamicAssembly or\n DefineDynamicModule or\n \"Reflection.TypeAttributes\" or\n \"Reflection.Emit.OpCodes\" or\n \"Reflection.Emit.CustomAttributeBuilder\" or\n \"Runtime.InteropServices.DllImportAttribute\"\n )\n", "references": [ "https://github.com/mattifestation/PSReflect/blob/master/PSReflect.psm1", "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md" @@ -61,5 +61,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_python_tty_shell.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_python_tty_shell.json index 2c40ff28bfa11..523dda198e2d8 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_python_tty_shell.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_python_tty_shell.json @@ -11,7 +11,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "Interactive Terminal Spawned via Python", - "query": "event.category:process and event.type:(start or process_started) and process.name:python and\n process.args:(\"import pty; pty.spawn(\\\"/bin/sh\\\")\" or\n \"import pty; pty.spawn(\\\"/bin/dash\\\")\" or\n \"import pty; pty.spawn(\\\"/bin/bash\\\")\")\n", + "query": "event.category:process and event.type:(start or process_started) and \n process.name:python* and\n process.args:(\"import pty; pty.spawn(\\\"/bin/sh\\\")\" or\n \"import pty; pty.spawn(\\\"/bin/dash\\\")\" or\n \"import pty; pty.spawn(\\\"/bin/bash\\\")\")\n", "risk_score": 73, "rule_id": "d76b02ef-fc95-4001-9297-01cb7412232f", "severity": "high", @@ -39,7 +39,9 @@ ] } ], + "timeline_id": "e70679c2-6cde-4510-9764-4823df18f7db", + "timeline_title": "Comprehensive Process Timeline", "timestamp_override": "event.ingested", "type": "query", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_register_server_program_connecting_to_the_internet.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_register_server_program_connecting_to_the_internet.json index 34ec31d697fa4..3097bad9256ad 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_register_server_program_connecting_to_the_internet.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_register_server_program_connecting_to_the_internet.json @@ -15,7 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Network Connection via Registration Utility", - "query": "sequence by process.entity_id\n [process where event.type == \"start\" and\n process.name : (\"regsvr32.exe\", \"RegAsm.exe\", \"RegSvcs.exe\") and\n not (\n (process.Ext.token.integrity_level_name : \"System\" or winlog.event_data.IntegrityLevel : \"System\") and\n (process.parent.name : \"msiexec.exe\" or process.parent.executable : (\"C:\\\\Program Files (x86)\\\\*.exe\", \"C:\\\\Program Files\\\\*.exe\"))\n )\n ]\n [network where process.name : (\"regsvr32.exe\", \"RegAsm.exe\", \"RegSvcs.exe\") and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\",\n \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\",\n \"100.64.0.0/10\", \"192.175.48.0/24\",\"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\") and network.protocol != \"dns\"]\n", + "query": "sequence by process.entity_id\n [process where event.type == \"start\" and\n process.name : (\"regsvr32.exe\", \"RegAsm.exe\", \"RegSvcs.exe\") and\n not (\n (?process.Ext.token.integrity_level_name : \"System\" or ?winlog.event_data.IntegrityLevel : \"System\") and\n (process.parent.name : \"msiexec.exe\" or process.parent.executable : (\"C:\\\\Program Files (x86)\\\\*.exe\", \"C:\\\\Program Files\\\\*.exe\"))\n )\n ]\n [network where process.name : (\"regsvr32.exe\", \"RegAsm.exe\", \"RegSvcs.exe\") and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\",\n \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\",\n \"100.64.0.0/10\", \"192.175.48.0/24\",\"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\") and network.protocol != \"dns\"]\n", "references": [ "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" ], @@ -63,5 +63,5 @@ } ], "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_revershell_via_shell_cmd.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_revershell_via_shell_cmd.json index 537252b0e5bd1..7f9805799c879 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_revershell_via_shell_cmd.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_revershell_via_shell_cmd.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Reverse Shell Activity via Terminal", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name in (\"sh\", \"bash\", \"zsh\", \"dash\", \"zmodload\") and\n process.args:(\"*/dev/tcp/*\", \"*/dev/udp/*\", \"zsh/net/tcp\", \"zsh/net/udp\")\n", "references": [ "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md", @@ -47,5 +48,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_shared_modules_local_sxs_dll.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_shared_modules_local_sxs_dll.json index 4fd4c708eda99..27fed16285827 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_shared_modules_local_sxs_dll.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_shared_modules_local_sxs_dll.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Execution via local SxS Shared Module", - "note": "## Triage and analysis\n\nThe SxS DotLocal folder is a legitimate feature that can be abused to hijack standard modules loading order by forcing an executable on the same application.exe.local folder to load a malicious DLL module from the same directory.", + "note": "## Triage and analysis\n\nThe SxS DotLocal folder is a legitimate feature that can be abused to hijack standard modules loading order by forcing an executable on the same application.exe.local folder to load a malicious DLL module from the same directory.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where file.extension : \"dll\" and file.path : \"C:\\\\*\\\\*.exe.local\\\\*.dll\"\n", "references": [ "https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection" @@ -46,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_ssh_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_ssh_binary.json new file mode 100644 index 0000000000000..197ea320339f9 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_ssh_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary ssh abuse to break out from restricted environments by spawning an interactive system shell.The ssh is a network protocol that gives users,particularly system administrators a secure way to access a computer over a network and the activity of spawning shell is not a standard use of this binary for a user or system administrator.It indicates a potentially malicious actor attempting to improve the capabilities or stability of their access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via the ssh command", + "query": "process where event.type == \"start\" and process.name : (\"bash\", \"sh\", \"dash\") and\n process.parent.name == \"ssh\" and process.parent.args == \"-o\" and\n process.parent.args in (\"ProxyCommand=;sh 0<&2 1>&2\", \"ProxyCommand=;bash 0<&2 1>&2\", \"ProxyCommand=;dash 0<&2 1>&2\", \"ProxyCommand=;/bin/sh 0<&2 1>&2\", \"ProxyCommand=;/bin/bash 0<&2 1>&2\", \"ProxyCommand=;/bin/dash 0<&2 1>&2\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/ssh/" + ], + "risk_score": 47, + "rule_id": "97da359b-2b61-4a40-b2e4-8fc48cf7a294", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_cmd_wmi.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_cmd_wmi.json index 4899adb4e68ff..a72c764b3463e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_cmd_wmi.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_cmd_wmi.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Cmd Execution via WMI", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"WmiPrvSE.exe\" and process.name : \"cmd.exe\" and\n process.args : \"\\\\\\\\127.0.0.1\\\\*\" and process.args : (\"2>&1\", \"1>\")\n", "risk_score": 47, "rule_id": "12f07955-1674-44f7-86b5-c35da0a6f41a", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_image_load_wmi_ms_office.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_image_load_wmi_ms_office.json index dbb5c088f2b82..fa82cda9e1620 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_image_load_wmi_ms_office.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_image_load_wmi_ms_office.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious WMI Image Load from MS Office", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "library where process.name : (\"WINWORD.EXE\", \"EXCEL.EXE\", \"POWERPNT.EXE\", \"MSPUB.EXE\", \"MSACCESS.EXE\") and\n event.action : \"load\" and\n event.category : \"library\" and\n dll.name : \"wmiutils.dll\"\n", "references": [ "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16" @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_jar_child_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_jar_child_process.json index 3816e0db1e7ed..6a124ad3b5f94 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_jar_child_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_jar_child_process.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious JAVA Child Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"java\" and\n process.name : (\"sh\", \"bash\", \"dash\", \"ksh\", \"tcsh\", \"zsh\", \"curl\", \"wget\")\n", "references": [ "https://www.lunasec.io/docs/blog/log4j-zero-day/", @@ -54,5 +55,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_java_netcon_childproc.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_java_netcon_childproc.json index fe04cfe35b363..38a9a6ebf47e7 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_java_netcon_childproc.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_java_netcon_childproc.json @@ -57,7 +57,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_pdf_reader.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_pdf_reader.json index e4e58e89c7d38..3897f78345580 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_pdf_reader.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_pdf_reader.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious PDF Reader Child Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : (\"AcroRd32.exe\",\n \"Acrobat.exe\",\n \"FoxitPhantomPDF.exe\",\n \"FoxitReader.exe\") and\n process.name : (\"arp.exe\", \"dsquery.exe\", \"dsget.exe\", \"gpresult.exe\", \"hostname.exe\", \"ipconfig.exe\", \"nbtstat.exe\",\n \"net.exe\", \"net1.exe\", \"netsh.exe\", \"netstat.exe\", \"nltest.exe\", \"ping.exe\", \"qprocess.exe\",\n \"quser.exe\", \"qwinsta.exe\", \"reg.exe\", \"sc.exe\", \"systeminfo.exe\", \"tasklist.exe\", \"tracert.exe\",\n \"whoami.exe\", \"bginfo.exe\", \"cdb.exe\", \"cmstp.exe\", \"csi.exe\", \"dnx.exe\", \"fsi.exe\", \"ieexec.exe\",\n \"iexpress.exe\", \"installutil.exe\", \"Microsoft.Workflow.Compiler.exe\", \"msbuild.exe\", \"mshta.exe\",\n \"msxsl.exe\", \"odbcconf.exe\", \"rcsi.exe\", \"regsvr32.exe\", \"xwizard.exe\", \"atbroker.exe\",\n \"forfiles.exe\", \"schtasks.exe\", \"regasm.exe\", \"regsvcs.exe\", \"cmd.exe\", \"cscript.exe\",\n \"powershell.exe\", \"pwsh.exe\", \"wmic.exe\", \"wscript.exe\", \"bitsadmin.exe\", \"certutil.exe\", \"ftp.exe\")\n", "risk_score": 21, "rule_id": "53a26770-9cbd-40c5-8b57-61d01a325e14", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 7 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_powershell_imgload.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_powershell_imgload.json index f42f1f04a2587..d9c90946c91fa 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_powershell_imgload.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_powershell_imgload.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious PowerShell Engine ImageLoad", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "library where dll.name : (\"System.Management.Automation.ni.dll\", \"System.Management.Automation.dll\") and\n/* add false positives relevant to your environment here */\nnot process.executable : (\"C:\\\\Windows\\\\System32\\\\RemoteFXvGPUDisablement.exe\", \"C:\\\\Windows\\\\System32\\\\sdiagnhost.exe\") and\nnot process.executable regex~ \"\"\"C:\\\\Program Files( \\(x86\\))?\\\\*\\.exe\"\"\" and\n not process.name :\n (\n \"Altaro.SubAgent.exe\",\n \"AppV_Manage.exe\",\n \"azureadconnect.exe\",\n \"CcmExec.exe\",\n \"configsyncrun.exe\",\n \"choco.exe\",\n \"ctxappvservice.exe\",\n \"DVLS.Console.exe\",\n \"edgetransport.exe\",\n \"exsetup.exe\",\n \"forefrontactivedirectoryconnector.exe\",\n \"InstallUtil.exe\",\n \"JenkinsOnDesktop.exe\",\n \"Microsoft.EnterpriseManagement.ServiceManager.UI.Console.exe\",\n \"mmc.exe\",\n \"mscorsvw.exe\",\n \"msexchangedelivery.exe\",\n \"msexchangefrontendtransport.exe\",\n \"msexchangehmworker.exe\",\n \"msexchangesubmission.exe\",\n \"msiexec.exe\",\n \"MsiExec.exe\",\n \"noderunner.exe\",\n \"NServiceBus.Host.exe\",\n \"NServiceBus.Host32.exe\",\n \"NServiceBus.Hosting.Azure.HostProcess.exe\",\n \"OuiGui.WPF.exe\",\n \"powershell.exe\",\n \"powershell_ise.exe\",\n \"pwsh.exe\",\n \"SCCMCliCtrWPF.exe\",\n \"ScriptEditor.exe\",\n \"ScriptRunner.exe\",\n \"sdiagnhost.exe\",\n \"servermanager.exe\",\n \"setup100.exe\",\n \"ServiceHub.VSDetouredHost.exe\",\n \"SPCAF.Client.exe\",\n \"SPCAF.SettingsEditor.exe\",\n \"SQLPS.exe\",\n \"telemetryservice.exe\",\n \"UMWorkerProcess.exe\",\n \"w3wp.exe\",\n \"wsmprovhost.exe\"\n )\n", "risk_score": 47, "rule_id": "852c1f19-68e8-43a6-9dce-340771fe1be3", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_psexesvc.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_psexesvc.json index bd762c9cdb486..e9c10e387e6ea 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_psexesvc.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_psexesvc.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Process Execution via Renamed PsExec Executable", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\", \"info\") and\n process.pe.original_file_name : \"psexesvc.exe\" and not process.name : \"PSEXESVC.exe\"\n", "risk_score": 47, "rule_id": "e2f9fdf5-8076-45ad-9427-41e0e03dc9c2", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_short_program_name.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_short_program_name.json index 232e158380965..e1e3ecefd2bc8 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_short_program_name.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_suspicious_short_program_name.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Execution - Short Program Name", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and length(process.name) > 0 and\n length(process.name) == 5 and host.os.name == \"Windows\" and length(process.pe.original_file_name) > 5\n", "risk_score": 47, "rule_id": "17c7f6a5-5bc9-4e1f-92bf-13632d24384d", @@ -25,5 +26,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_vi_binary.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_vi_binary.json new file mode 100644 index 0000000000000..ef407b26aa5d7 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_vi_binary.json @@ -0,0 +1,55 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies Linux binary find abuse to break out from restricted environments by spawning an interactive system shell. The vi/vim is the standard text editor in Linux distribution and the activity of spawning a shell is not a standard use of this binary by a user or system administrator and could potentially indicate malicious actor attempting to improve the capabilities or stability of their access.\"", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via the vi command", + "query": "process where event.type == \"start\" and process.parent.name in (\"vi\", \"vim\") and process.parent.args == \"-c\" and process.parent.args in (\":!/bin/bash\", \":!/bin/sh\", \":!bash\", \":!sh\") and process.name in (\"bash\", \"sh\")\n", + "references": [ + "https://gtfobins.github.io/gtfobins/vi/" + ], + "risk_score": 47, + "rule_id": "89583d1b-3c2e-4606-8b74-0a9fd2248e88", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Linux", + "Threat Detection", + "Execution", + "GTFOBins" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_compiled_html_file.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_compiled_html_file.json index a8d42d4a93b7a..4aa2adb6b2dd0 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_compiled_html_file.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_compiled_html_file.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Process Activity via Compiled HTML File", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and \n process.parent.name : \"hh.exe\" and \n process.name : (\"mshta.exe\", \"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\", \"cscript.exe\", \"wscript.exe\")\n", "risk_score": 47, "rule_id": "e3343ab9-4245-4715-b344-e11c56b0a47f", @@ -74,5 +75,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_hidden_shell_conhost.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_hidden_shell_conhost.json index 4b5e38d65e43b..e66959acd741e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_hidden_shell_conhost.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_hidden_shell_conhost.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Conhost Spawned By Suspicious Parent Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : \"conhost.exe\" and\n process.parent.name : (\"svchost.exe\", \"lsass.exe\", \"services.exe\", \"smss.exe\", \"winlogon.exe\", \"explorer.exe\",\n \"dllhost.exe\", \"rundll32.exe\", \"regsvr32.exe\", \"userinit.exe\", \"wininit.exe\", \"spoolsv.exe\",\n \"wermgr.exe\", \"csrss.exe\", \"ctfmon.exe\")\n", "references": [ "https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-one.html" @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_xp_cmdshell_mssql_stored_procedure.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_xp_cmdshell_mssql_stored_procedure.json index e5be955247bd0..1b2b37bf23469 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_xp_cmdshell_mssql_stored_procedure.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/execution_via_xp_cmdshell_mssql_stored_procedure.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Execution via MSSQL xp_cmdshell Stored Procedure", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : \"cmd.exe\" and process.parent.name : \"sqlservr.exe\"\n", "risk_score": 73, "rule_id": "4ed493fc-d637-4a36-80ff-ac84937e5461", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/exfiltration_microsoft_365_exchange_transport_rule_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/exfiltration_microsoft_365_exchange_transport_rule_creation.json index 25ae6170a7ca5..146a742b419d0 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/exfiltration_microsoft_365_exchange_transport_rule_creation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/exfiltration_microsoft_365_exchange_transport_rule_creation.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Identifies a transport rule creation in Microsoft 365. Exchange Online mail transport rules should be set to not forward email to domains outside of your organization as a best practice. An adversary may create transport rules to exfiltrate data.", + "description": "Identifies a transport rule creation in Microsoft 365. As a best practice, Exchange Online mail transport rules should not be set to forward email to domains outside of your organization. An adversary may create transport rules to exfiltrate data.", "false_positives": [ "A new transport rule may be created by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior." ], @@ -50,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_admin_role_deletion.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_admin_role_deletion.json index 657128132d559..e694e21393324 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_admin_role_deletion.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_admin_role_deletion.json @@ -33,5 +33,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 6 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_mfa_enforcement_disabled.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_mfa_enforcement_disabled.json index a90fd8c18266e..825ab59886d6f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_mfa_enforcement_disabled.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_mfa_enforcement_disabled.json @@ -33,5 +33,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 7 + "version": 9 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_policy_modified.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_policy_modified.json index d29b41bdf56c3..aae167f36443d 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_policy_modified.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/google_workspace_policy_modified.json @@ -30,5 +30,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 7 + "version": 9 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_azure_service_principal_credentials_added.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_azure_service_principal_credentials_added.json index 0036a719250c1..486f7bb7ed06c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_azure_service_principal_credentials_added.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_azure_service_principal_credentials_added.json @@ -17,7 +17,7 @@ "license": "Elastic License v2", "name": "Azure Service Principal Credentials Added", "note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", - "query": "event.dataset:azure.auditlogs and azure.auditlogs.operation_name:\"Add service principal credentials.\" and event.outcome:(success or Success)\n", + "query": "event.dataset:azure.auditlogs and azure.auditlogs.operation_name:\"Add service principal credentials\" and event.outcome:(success or Success)\n", "references": [ "https://www.fireeye.com/content/dam/collateral/en/wp-m-unc2452.pdf" ], @@ -51,5 +51,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_backup_file_deletion.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_backup_file_deletion.json index 39a1e77418297..13864eaf8b4ec 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_backup_file_deletion.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_backup_file_deletion.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Third-party Backup Files Deleted via Unexpected Process", + "note": "## Triage and analysis\n\n### Investigating Third-party Backup Files Deleted via Unexpected Process\n\nBackups are a significant obstacle for any ransomware operation. They allow the victim to resume business by performing\ndata recovery, making them a valuable target.\n\nAttackers can delete backups from the host and gain access to backup servers to remove centralized backups for the\nenvironment, ensuring that victims have no alternatives to paying the ransom.\n\nThis rule identifies file deletions performed by a process that does not belong to the backup suite and aims to delete\nVeritas or Veeam backups.\n\n#### Possible investigation steps\n\n- Identify the process (location, name, etc.) and the user that performed this operation.\n- Check whether the account is authorized to perform this operation.\n- Confirm whether the account owner is aware of the operation.\n- Investigate other alerts associated with the user during the past 48 hours.\n\n### False positive analysis\n\n- This rule can be triggered by the manual removal of backup files and by removal using other third-party tools that are\nnot from the backup suite. Exceptions can be added for specific accounts and executables, preferably tied together.\n\n### Related rules\n\n- Deleting Backup Catalogs with Wbadmin - 581add16-df76-42bb-af8e-c979bfb39a59\n- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921\n- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4\n- Volume Shadow Copy Deletion via WMIC - dc9c1f74-dac3-48e3-b47f-eb79db358f57\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Reset the password of the involved accounts.\n- Perform data recovery locally or restore the backups from replicated copies (Cloud, other servers, etc.).\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type == \"deletion\" and\n (\n /* Veeam Related Backup Files */\n (file.extension : (\"VBK\", \"VIB\", \"VBM\") and\n not process.executable : (\"?:\\\\Windows\\\\Veeam\\\\Backup\\\\*\",\n \"?:\\\\Program Files\\\\Veeam\\\\Backup and Replication\\\\*\",\n \"?:\\\\Program Files (x86)\\\\Veeam\\\\Backup and Replication\\\\*\")) or\n\n /* Veritas Backup Exec Related Backup File */\n (file.extension : \"BKF\" and\n not process.executable : (\"?:\\\\Program Files\\\\Veritas\\\\Backup Exec\\\\*\",\n \"?:\\\\Program Files (x86)\\\\Veritas\\\\Backup Exec\\\\*\"))\n )\n", "references": [ "https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love" @@ -48,5 +49,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_deleting_backup_catalogs_with_wbadmin.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_deleting_backup_catalogs_with_wbadmin.json index 0c0c2a71b8263..f919c2459aa3f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_deleting_backup_catalogs_with_wbadmin.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_deleting_backup_catalogs_with_wbadmin.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Deleting Backup Catalogs with Wbadmin", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"wbadmin.exe\" or process.pe.original_file_name == \"WBADMIN.EXE\") and\n process.args : \"catalog\" and process.args : \"delete\"\n", "risk_score": 21, "rule_id": "581add16-df76-42bb-af8e-c979bfb39a59", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_efs_filesystem_or_mount_deleted.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_efs_filesystem_or_mount_deleted.json index 9465922d7c34f..9a20a97b632fa 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_efs_filesystem_or_mount_deleted.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_efs_filesystem_or_mount_deleted.json @@ -2,7 +2,7 @@ "author": [ "Austin Songer" ], - "description": "Detects when a EFS File System or Mount is deleted. An adversary could break any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts. The mount must be deleted prior to deleting the File System, or the adversary will be unable to delete the File System.", + "description": "Detects when an EFS File System or Mount is deleted. An adversary could break any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts. The mount must be deleted prior to deleting the File System, or the adversary will be unable to delete the File System.", "false_positives": [ "File System or Mount being deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. File System Mount deletion by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." ], @@ -51,5 +51,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_hosts_file_modified.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_hosts_file_modified.json index 18f4f1c2e50e2..c8609bf8b8513 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_hosts_file_modified.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_hosts_file_modified.json @@ -13,7 +13,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Hosts File Modified", - "note": "## Config\n\nFor Windows systems using Auditbeat, this rule requires adding `C:/Windows/System32/drivers/etc` as an additional path in the 'file_integrity' module of auditbeat.yml.", + "note": "## Config\n\nFor Windows systems using Auditbeat, this rule requires adding `C:/Windows/System32/drivers/etc` as an additional path in the 'file_integrity' module of auditbeat.yml.\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "any where\n\n /* file events for creation; file change events are not captured by some of the included sources for linux and so may\n miss this, which is the purpose of the process + command line args logic below */\n (\n event.category == \"file\" and event.type in (\"change\", \"creation\") and\n file.path : (\"/private/etc/hosts\", \"/etc/hosts\", \"?:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\hosts\")\n )\n or\n\n /* process events for change targeting linux only */\n (\n event.category == \"process\" and event.type in (\"start\") and\n process.name in (\"nano\", \"vim\", \"vi\", \"emacs\", \"echo\", \"sed\") and\n process.args : (\"/etc/hosts\")\n )\n", "references": [ "https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-reference-yml.html" @@ -54,7 +54,9 @@ ] } ], + "timeline_id": "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "timeline_title": "Comprehensive File Timeline", "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_modification_of_boot_config.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_modification_of_boot_config.json index 91f5959bee119..2f9efd05d9cba 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_modification_of_boot_config.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_modification_of_boot_config.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Modification of Boot Configuration", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"bcdedit.exe\" or process.pe.original_file_name == \"bcdedit.exe\") and\n (process.args : \"/set\" and process.args : \"bootstatuspolicy\" and process.args : \"ignoreallfailures\") or\n (process.args : \"no\" and process.args : \"recoveryenabled\")\n", "risk_score": 21, "rule_id": "69c251fb-a5d6-4035-b5ec-40438bd829ff", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.json index fb7121abee4c7..a81ca2b2756b5 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Volume Shadow Copy Deleted or Resized via VssAdmin", + "note": "## Triage and analysis.\n\n### Investigating Volume Shadow Copy Deleted or Resized via VssAdmin\n\nThe Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes\nthat can later be restored or mounted to recover specific files or folders.\n\nA typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow\nCopies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow\ncopies worth monitoring.\n\nThis rule monitors the execution of Vssadmin.exe to either delete or resize shadow copies.\n\n#### Possible investigation steps\n\n- Investigate the program execution chain (parent process tree).\n- Check whether the account is authorized to perform this operation.\n- Confirm whether the account owner is aware of the operation.\n- In the case of a resize operation, check if the resize value is equal to suspicious values, like 401MB.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- If unsigned files are found on the process tree:\n - Capture copies of the files.\n - Use a sandboxed malware analysis system to perform analysis.\n - Observe attempts to contact external domains and addresses.\n - Use the PowerShell Get-FileHash cmdlet to get the SHA-256 hash value of the file.\n - Search for the existence of this file in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Use process name, command line, and file hash to search for occurrences in other hosts.\n- Check if any files on the host machine have been encrypted.\n\n\n### False positive analysis\n\n- This rule may produce benign true positives (B-TPs). If this activity is expected and noisy in your\nenvironment, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Related rules\n\n- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921\n- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Priority should be given due to the advanced stage of this activity on the attack.\n- If malware was found, isolate the involved hosts to prevent the infection of other hosts.\n- Disable the involved accounts, or restrict their ability to log on remotely.\n- If data was encrypted, deleted, or modified, activate your data recovery plan.\n- Reset the password of the involved accounts.\n- Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\")\n and (process.name : \"vssadmin.exe\" or process.pe.original_file_name == \"VSSADMIN.EXE\") and\n process.args in (\"delete\", \"resize\") and process.args : \"shadows*\"\n", "risk_score": 73, "rule_id": "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 11 + "version": 12 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_powershell.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_powershell.json index 59aceaad39ec2..c67b8947dfcf5 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_powershell.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_powershell.json @@ -13,6 +13,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Volume Shadow Copy Deletion via PowerShell", + "note": "## Triage and analysis\n\n### Investigating Volume Shadow Copy Deletion via PowerShell\n\nThe Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes\nthat can later be restored or mounted to recover specific files or folders.\n\nA typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow\nCopies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow\ncopies worth monitoring.\n\nThis rule monitors the execution of PowerShell cmdlets to interact with the Win32_ShadowCopy WMI class, retrieve shadow\ncopy objects, and delete them.\n\n#### Possible investigation steps\n\n- Investigate the program execution chain (parent process tree).\n- Check whether the account is authorized to perform this operation.\n- Confirm whether the account owner is aware of the operation.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- If unsigned files are found on the process tree:\n - Capture copies of the files.\n - Use a sandboxed malware analysis system to perform analysis.\n - Observe attempts of contacting external domains and addresses.\n - Use the PowerShell Get-FileHash cmdlet to get the SHA-256 hash value of the file.\n - Search for the existence of this file in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Use process name, command line, and file hash to search for occurrences in other hosts.\n- Check if any files on the host machine have been encrypted.\n\n\n### False positive analysis\n\n- This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your\nenvironment, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Related rules\n\n- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921\n- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Priority should be given due to the advanced stage of this activity on the attack.\n- If malware was found, isolate the involved hosts to prevent the infection of other hosts.\n- Disable the involved accounts, or restrict their ability to log on remotely.\n- If data was encrypted, deleted, or modified, activate your data recovery plan.\n- Reset the password of the involved accounts.\n- Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and \n process.args : (\"*Get-WmiObject*\", \"*gwmi*\", \"*Get-CimInstance*\", \"*gcim*\") and\n process.args : (\"*Win32_ShadowCopy*\") and\n process.args : (\"*.Delete()*\", \"*Remove-WmiObject*\", \"*rwmi*\", \"*Remove-CimInstance*\", \"*rcim*\")\n", "references": [ "https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi/win32-shadowcopy", @@ -48,5 +49,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_wmic.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_wmic.json index f4f530362a5b8..85660d00e557e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_wmic.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/impact_volume_shadow_copy_deletion_via_wmic.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Volume Shadow Copy Deletion via WMIC", + "note": "## Triage and analysis\n\n### Investigating Volume Shadow Copy Deletion via WMIC\n\nThe Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes\nthat can later be restored or mounted to recover specific files or folders.\n\nA typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow\nCopies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow\ncopies worth monitoring.\n\nThis rule monitors the execution of `wmic.exe` to interact with VSS via the `shadowcopy` alias and delete parameter.\n\n#### Possible investigation steps\n\n- Investigate the program execution chain (parent process tree).\n- Check whether the account is authorized to perform this operation.\n- Confirm whether the account owner is aware of the operation.\n- In the case of a resize operation, check if the resize value is equal to suspicious values, like 401MB.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- If unsigned files are found on the process tree:\n - Capture copies of the files.\n - Use a sandboxed malware analysis system to perform analysis.\n - Observe attempts of contacting external domains and addresses.\n - Use the PowerShell Get-FileHash cmdlet to get the SHA-256 hash value of the file.\n - Search for the existence of this file in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Use process name, command line, and file hash to search for occurrences in other hosts.\n- Check if any files on the host machine have been encrypted.\n\n\n### False positive analysis\n\n- This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your\nenvironment, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Related rules\n\n- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921\n- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Priority should be given due to the advanced stage of this activity on the attack.\n- If malware was found, isolate the involved hosts to prevent the infection of other hosts.\n- Disable the involved accounts, or restrict their ability to log on remotely.\n- If data was encrypted, deleted, or modified, activate your data recovery plan.\n- Reset the password of the involved accounts.\n- Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"WMIC.exe\" or process.pe.original_file_name == \"wmic.exe\") and\n process.args : \"delete\" and process.args : \"shadowcopy\"\n", "risk_score": 73, "rule_id": "dc9c1f74-dac3-48e3-b47f-eb79db358f57", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/index.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/index.ts index db98e7af01c3e..26629d7155ebc 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/index.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/index.ts @@ -522,148 +522,169 @@ import rule509 from './persistence_periodic_tasks_file_mdofiy.json'; import rule510 from './persistence_via_atom_init_file_modification.json'; import rule511 from './privilege_escalation_lsa_auth_package.json'; import rule512 from './privilege_escalation_port_monitor_print_pocessor_abuse.json'; -import rule513 from './credential_access_posh_request_ticket.json'; -import rule514 from './credential_access_dumping_hashes_bi_cmds.json'; -import rule515 from './lateral_movement_mounting_smb_share.json'; -import rule516 from './privilege_escalation_echo_nopasswd_sudoers.json'; -import rule517 from './privilege_escalation_ld_preload_shared_object_modif.json'; -import rule518 from './privilege_escalation_root_crontab_filemod.json'; -import rule519 from './defense_evasion_create_mod_root_certificate.json'; -import rule520 from './privilege_escalation_sudo_buffer_overflow.json'; -import rule521 from './execution_installer_spawned_network_event.json'; -import rule522 from './initial_access_suspicious_ms_exchange_files.json'; -import rule523 from './initial_access_suspicious_ms_exchange_process.json'; -import rule524 from './initial_access_suspicious_ms_exchange_worker_child_process.json'; -import rule525 from './persistence_evasion_registry_startup_shell_folder_modified.json'; -import rule526 from './persistence_local_scheduled_job_creation.json'; -import rule527 from './persistence_via_wmi_stdregprov_run_services.json'; -import rule528 from './credential_access_persistence_network_logon_provider_modification.json'; -import rule529 from './lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.json'; -import rule530 from './collection_microsoft_365_new_inbox_rule.json'; -import rule531 from './ml_high_count_network_denies.json'; -import rule532 from './ml_high_count_network_events.json'; -import rule533 from './ml_rare_destination_country.json'; -import rule534 from './ml_spike_in_traffic_to_a_country.json'; -import rule535 from './command_and_control_tunneling_via_earthworm.json'; -import rule536 from './lateral_movement_evasion_rdp_shadowing.json'; -import rule537 from './threat_intel_fleet_integrations.json'; -import rule538 from './exfiltration_ec2_vm_export_failure.json'; -import rule539 from './exfiltration_ec2_full_network_packet_capture_detected.json'; -import rule540 from './impact_azure_service_principal_credentials_added.json'; -import rule541 from './persistence_ec2_security_group_configuration_change_detection.json'; -import rule542 from './defense_evasion_disabling_windows_logs.json'; -import rule543 from './persistence_route_53_domain_transfer_lock_disabled.json'; -import rule544 from './persistence_route_53_domain_transferred_to_another_account.json'; -import rule545 from './initial_access_okta_user_attempted_unauthorized_access.json'; -import rule546 from './credential_access_user_excessive_sso_logon_errors.json'; -import rule547 from './persistence_exchange_suspicious_mailbox_right_delegation.json'; -import rule548 from './privilege_escalation_new_or_modified_federation_domain.json'; -import rule549 from './privilege_escalation_sts_assumerole_usage.json'; -import rule550 from './privilege_escalation_sts_getsessiontoken_abuse.json'; -import rule551 from './defense_evasion_suspicious_execution_from_mounted_device.json'; -import rule552 from './defense_evasion_unusual_network_connection_via_dllhost.json'; -import rule553 from './defense_evasion_amsienable_key_mod.json'; -import rule554 from './impact_rds_group_deletion.json'; -import rule555 from './persistence_rds_group_creation.json'; -import rule556 from './persistence_route_table_created.json'; -import rule557 from './persistence_route_table_modified_or_deleted.json'; -import rule558 from './exfiltration_rds_snapshot_export.json'; -import rule559 from './persistence_rds_instance_creation.json'; -import rule560 from './privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.json'; -import rule561 from './ml_auth_rare_hour_for_a_user_to_logon.json'; -import rule562 from './ml_auth_rare_source_ip_for_a_user.json'; -import rule563 from './ml_auth_rare_user_logon.json'; -import rule564 from './ml_auth_spike_in_failed_logon_events.json'; -import rule565 from './ml_auth_spike_in_logon_events.json'; -import rule566 from './ml_auth_spike_in_logon_events_from_a_source_ip.json'; -import rule567 from './privilege_escalation_cyberarkpas_error_audit_event_promotion.json'; -import rule568 from './privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion.json'; -import rule569 from './defense_evasion_kubernetes_events_deleted.json'; -import rule570 from './impact_kubernetes_pod_deleted.json'; -import rule571 from './exfiltration_rds_snapshot_restored.json'; -import rule572 from './privilege_escalation_printspooler_malicious_driver_file_changes.json'; -import rule573 from './privilege_escalation_printspooler_malicious_registry_modification.json'; -import rule574 from './privilege_escalation_printspooler_suspicious_file_deletion.json'; -import rule575 from './privilege_escalation_unusual_printspooler_childprocess.json'; -import rule576 from './defense_evasion_disabling_windows_defender_powershell.json'; -import rule577 from './defense_evasion_enable_network_discovery_with_netsh.json'; -import rule578 from './defense_evasion_execution_windefend_unusual_path.json'; -import rule579 from './defense_evasion_agent_spoofing_mismatched_id.json'; -import rule580 from './defense_evasion_agent_spoofing_multiple_hosts.json'; -import rule581 from './defense_evasion_parent_process_pid_spoofing.json'; -import rule582 from './impact_microsoft_365_potential_ransomware_activity.json'; -import rule583 from './impact_microsoft_365_unusual_volume_of_file_deletion.json'; -import rule584 from './initial_access_microsoft_365_user_restricted_from_sending_email.json'; -import rule585 from './defense_evasion_elasticache_security_group_creation.json'; -import rule586 from './defense_evasion_elasticache_security_group_modified_or_deleted.json'; -import rule587 from './impact_volume_shadow_copy_deletion_via_powershell.json'; -import rule588 from './persistence_route_53_hosted_zone_associated_with_a_vpc.json'; -import rule589 from './defense_evasion_defender_exclusion_via_powershell.json'; -import rule590 from './defense_evasion_dns_over_https_enabled.json'; -import rule591 from './defense_evasion_whitespace_padding_in_command_line.json'; -import rule592 from './defense_evasion_frontdoor_firewall_policy_deletion.json'; -import rule593 from './credential_access_azure_full_network_packet_capture_detected.json'; -import rule594 from './persistence_webshell_detection.json'; -import rule595 from './defense_evasion_suppression_rule_created.json'; -import rule596 from './impact_efs_filesystem_or_mount_deleted.json'; -import rule597 from './defense_evasion_execution_control_panel_suspicious_args.json'; -import rule598 from './defense_evasion_azure_blob_permissions_modified.json'; -import rule599 from './privilege_escalation_aws_suspicious_saml_activity.json'; -import rule600 from './credential_access_potential_lsa_memdump_via_mirrordump.json'; -import rule601 from './discovery_virtual_machine_fingerprinting_grep.json'; -import rule602 from './impact_backup_file_deletion.json'; -import rule603 from './credential_access_posh_minidump.json'; -import rule604 from './persistence_screensaver_engine_unexpected_child_process.json'; -import rule605 from './persistence_screensaver_plist_file_modification.json'; -import rule606 from './credential_access_suspicious_lsass_access_memdump.json'; -import rule607 from './defense_evasion_suspicious_process_access_direct_syscall.json'; -import rule608 from './discovery_posh_suspicious_api_functions.json'; -import rule609 from './privilege_escalation_via_rogue_named_pipe.json'; -import rule610 from './credential_access_suspicious_lsass_access_via_snapshot.json'; -import rule611 from './defense_evasion_posh_process_injection.json'; -import rule612 from './collection_posh_keylogger.json'; -import rule613 from './defense_evasion_posh_assembly_load.json'; -import rule614 from './defense_evasion_powershell_windows_firewall_disabled.json'; -import rule615 from './execution_posh_portable_executable.json'; -import rule616 from './execution_posh_psreflect.json'; -import rule617 from './credential_access_suspicious_comsvcs_imageload.json'; -import rule618 from './impact_aws_eventbridge_rule_disabled_or_deleted.json'; -import rule619 from './defense_evasion_microsoft_defender_tampering.json'; -import rule620 from './initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.json'; -import rule621 from './persistence_remote_password_reset.json'; -import rule622 from './privilege_escalation_azure_kubernetes_rolebinding_created.json'; -import rule623 from './collection_posh_audio_capture.json'; -import rule624 from './collection_posh_screen_grabber.json'; -import rule625 from './defense_evasion_posh_compressed.json'; -import rule626 from './defense_evasion_suspicious_process_creation_calltrace.json'; -import rule627 from './privilege_escalation_group_policy_iniscript.json'; -import rule628 from './privilege_escalation_group_policy_privileged_groups.json'; -import rule629 from './privilege_escalation_group_policy_scheduled_task.json'; -import rule630 from './defense_evasion_clearing_windows_console_history.json'; -import rule631 from './threat_intel_filebeat8x.json'; -import rule632 from './privilege_escalation_installertakeover.json'; -import rule633 from './credential_access_via_snapshot_lsass_clone_creation.json'; -import rule634 from './persistence_via_bits_job_notify_command.json'; -import rule635 from './execution_suspicious_java_netcon_childproc.json'; -import rule636 from './privilege_escalation_samaccountname_spoofing_attack.json'; -import rule637 from './credential_access_symbolic_link_to_shadow_copy_createdcredential_access_symbolic_link_to_shadow_copy_created.json'; -import rule638 from './credential_access_mfa_push_brute_force.json'; -import rule639 from './persistence_azure_global_administrator_role_assigned.json'; -import rule640 from './persistence_microsoft_365_global_administrator_role_assign.json'; -import rule641 from './lateral_movement_malware_uploaded_onedrive.json'; -import rule642 from './lateral_movement_malware_uploaded_sharepoint.json'; -import rule643 from './defense_evasion_ms_office_suspicious_regmod.json'; -import rule644 from './initial_access_o365_user_reported_phish_malware.json'; -import rule645 from './defense_evasion_microsoft_365_mailboxauditbypassassociation.json'; -import rule646 from './credential_access_disable_kerberos_preauth.json'; -import rule647 from './credential_access_shadow_credentials.json'; -import rule648 from './privilege_escalation_pkexec_envar_hijack.json'; -import rule649 from './credential_access_seenabledelegationprivilege_assigned_to_user.json'; -import rule650 from './persistence_msds_alloweddelegateto_krbtgt.json'; -import rule651 from './defense_evasion_disable_posh_scriptblocklogging.json'; -import rule652 from './persistence_ad_adminsdholder.json'; -import rule653 from './privilege_escalation_windows_service_via_unusual_client.json'; -import rule654 from './credential_access_dcsync_replication_rights.json'; +import rule513 from './credential_access_dumping_hashes_bi_cmds.json'; +import rule514 from './lateral_movement_mounting_smb_share.json'; +import rule515 from './privilege_escalation_echo_nopasswd_sudoers.json'; +import rule516 from './privilege_escalation_ld_preload_shared_object_modif.json'; +import rule517 from './privilege_escalation_root_crontab_filemod.json'; +import rule518 from './defense_evasion_create_mod_root_certificate.json'; +import rule519 from './privilege_escalation_sudo_buffer_overflow.json'; +import rule520 from './execution_installer_spawned_network_event.json'; +import rule521 from './initial_access_suspicious_ms_exchange_files.json'; +import rule522 from './initial_access_suspicious_ms_exchange_process.json'; +import rule523 from './initial_access_suspicious_ms_exchange_worker_child_process.json'; +import rule524 from './persistence_evasion_registry_startup_shell_folder_modified.json'; +import rule525 from './persistence_local_scheduled_job_creation.json'; +import rule526 from './persistence_via_wmi_stdregprov_run_services.json'; +import rule527 from './credential_access_persistence_network_logon_provider_modification.json'; +import rule528 from './lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.json'; +import rule529 from './collection_microsoft_365_new_inbox_rule.json'; +import rule530 from './ml_high_count_network_denies.json'; +import rule531 from './ml_high_count_network_events.json'; +import rule532 from './ml_rare_destination_country.json'; +import rule533 from './ml_spike_in_traffic_to_a_country.json'; +import rule534 from './command_and_control_tunneling_via_earthworm.json'; +import rule535 from './lateral_movement_evasion_rdp_shadowing.json'; +import rule536 from './threat_intel_fleet_integrations.json'; +import rule537 from './exfiltration_ec2_vm_export_failure.json'; +import rule538 from './exfiltration_ec2_full_network_packet_capture_detected.json'; +import rule539 from './impact_azure_service_principal_credentials_added.json'; +import rule540 from './persistence_ec2_security_group_configuration_change_detection.json'; +import rule541 from './defense_evasion_disabling_windows_logs.json'; +import rule542 from './persistence_route_53_domain_transfer_lock_disabled.json'; +import rule543 from './persistence_route_53_domain_transferred_to_another_account.json'; +import rule544 from './initial_access_okta_user_attempted_unauthorized_access.json'; +import rule545 from './credential_access_user_excessive_sso_logon_errors.json'; +import rule546 from './persistence_exchange_suspicious_mailbox_right_delegation.json'; +import rule547 from './privilege_escalation_new_or_modified_federation_domain.json'; +import rule548 from './privilege_escalation_sts_assumerole_usage.json'; +import rule549 from './privilege_escalation_sts_getsessiontoken_abuse.json'; +import rule550 from './defense_evasion_suspicious_execution_from_mounted_device.json'; +import rule551 from './defense_evasion_unusual_network_connection_via_dllhost.json'; +import rule552 from './defense_evasion_amsienable_key_mod.json'; +import rule553 from './impact_rds_group_deletion.json'; +import rule554 from './persistence_rds_group_creation.json'; +import rule555 from './persistence_route_table_created.json'; +import rule556 from './persistence_route_table_modified_or_deleted.json'; +import rule557 from './exfiltration_rds_snapshot_export.json'; +import rule558 from './persistence_rds_instance_creation.json'; +import rule559 from './privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.json'; +import rule560 from './ml_auth_rare_hour_for_a_user_to_logon.json'; +import rule561 from './ml_auth_rare_source_ip_for_a_user.json'; +import rule562 from './ml_auth_rare_user_logon.json'; +import rule563 from './ml_auth_spike_in_failed_logon_events.json'; +import rule564 from './ml_auth_spike_in_logon_events.json'; +import rule565 from './ml_auth_spike_in_logon_events_from_a_source_ip.json'; +import rule566 from './privilege_escalation_cyberarkpas_error_audit_event_promotion.json'; +import rule567 from './privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion.json'; +import rule568 from './defense_evasion_kubernetes_events_deleted.json'; +import rule569 from './impact_kubernetes_pod_deleted.json'; +import rule570 from './exfiltration_rds_snapshot_restored.json'; +import rule571 from './privilege_escalation_printspooler_suspicious_file_deletion.json'; +import rule572 from './privilege_escalation_unusual_printspooler_childprocess.json'; +import rule573 from './defense_evasion_disabling_windows_defender_powershell.json'; +import rule574 from './defense_evasion_enable_network_discovery_with_netsh.json'; +import rule575 from './defense_evasion_execution_windefend_unusual_path.json'; +import rule576 from './defense_evasion_agent_spoofing_mismatched_id.json'; +import rule577 from './defense_evasion_agent_spoofing_multiple_hosts.json'; +import rule578 from './defense_evasion_parent_process_pid_spoofing.json'; +import rule579 from './impact_microsoft_365_potential_ransomware_activity.json'; +import rule580 from './impact_microsoft_365_unusual_volume_of_file_deletion.json'; +import rule581 from './initial_access_microsoft_365_user_restricted_from_sending_email.json'; +import rule582 from './defense_evasion_elasticache_security_group_creation.json'; +import rule583 from './defense_evasion_elasticache_security_group_modified_or_deleted.json'; +import rule584 from './impact_volume_shadow_copy_deletion_via_powershell.json'; +import rule585 from './persistence_route_53_hosted_zone_associated_with_a_vpc.json'; +import rule586 from './defense_evasion_defender_exclusion_via_powershell.json'; +import rule587 from './defense_evasion_dns_over_https_enabled.json'; +import rule588 from './defense_evasion_whitespace_padding_in_command_line.json'; +import rule589 from './defense_evasion_frontdoor_firewall_policy_deletion.json'; +import rule590 from './credential_access_azure_full_network_packet_capture_detected.json'; +import rule591 from './persistence_webshell_detection.json'; +import rule592 from './defense_evasion_suppression_rule_created.json'; +import rule593 from './impact_efs_filesystem_or_mount_deleted.json'; +import rule594 from './defense_evasion_execution_control_panel_suspicious_args.json'; +import rule595 from './defense_evasion_azure_blob_permissions_modified.json'; +import rule596 from './privilege_escalation_aws_suspicious_saml_activity.json'; +import rule597 from './credential_access_potential_lsa_memdump_via_mirrordump.json'; +import rule598 from './discovery_virtual_machine_fingerprinting_grep.json'; +import rule599 from './impact_backup_file_deletion.json'; +import rule600 from './credential_access_posh_minidump.json'; +import rule601 from './persistence_screensaver_engine_unexpected_child_process.json'; +import rule602 from './persistence_screensaver_plist_file_modification.json'; +import rule603 from './credential_access_suspicious_lsass_access_memdump.json'; +import rule604 from './defense_evasion_suspicious_process_access_direct_syscall.json'; +import rule605 from './discovery_posh_suspicious_api_functions.json'; +import rule606 from './privilege_escalation_via_rogue_named_pipe.json'; +import rule607 from './credential_access_suspicious_lsass_access_via_snapshot.json'; +import rule608 from './defense_evasion_posh_process_injection.json'; +import rule609 from './collection_posh_keylogger.json'; +import rule610 from './defense_evasion_posh_assembly_load.json'; +import rule611 from './defense_evasion_powershell_windows_firewall_disabled.json'; +import rule612 from './execution_posh_portable_executable.json'; +import rule613 from './execution_posh_psreflect.json'; +import rule614 from './credential_access_suspicious_comsvcs_imageload.json'; +import rule615 from './impact_aws_eventbridge_rule_disabled_or_deleted.json'; +import rule616 from './defense_evasion_microsoft_defender_tampering.json'; +import rule617 from './initial_access_azure_active_directory_high_risk_signin_atrisk_or_confirmed.json'; +import rule618 from './persistence_remote_password_reset.json'; +import rule619 from './privilege_escalation_azure_kubernetes_rolebinding_created.json'; +import rule620 from './collection_posh_audio_capture.json'; +import rule621 from './collection_posh_screen_grabber.json'; +import rule622 from './defense_evasion_posh_compressed.json'; +import rule623 from './defense_evasion_suspicious_process_creation_calltrace.json'; +import rule624 from './privilege_escalation_group_policy_iniscript.json'; +import rule625 from './privilege_escalation_group_policy_privileged_groups.json'; +import rule626 from './privilege_escalation_group_policy_scheduled_task.json'; +import rule627 from './defense_evasion_clearing_windows_console_history.json'; +import rule628 from './threat_intel_filebeat8x.json'; +import rule629 from './privilege_escalation_installertakeover.json'; +import rule630 from './credential_access_via_snapshot_lsass_clone_creation.json'; +import rule631 from './persistence_via_bits_job_notify_command.json'; +import rule632 from './execution_suspicious_java_netcon_childproc.json'; +import rule633 from './privilege_escalation_samaccountname_spoofing_attack.json'; +import rule634 from './credential_access_symbolic_link_to_shadow_copy_created.json'; +import rule635 from './credential_access_mfa_push_brute_force.json'; +import rule636 from './persistence_azure_global_administrator_role_assigned.json'; +import rule637 from './persistence_microsoft_365_global_administrator_role_assign.json'; +import rule638 from './lateral_movement_malware_uploaded_onedrive.json'; +import rule639 from './lateral_movement_malware_uploaded_sharepoint.json'; +import rule640 from './defense_evasion_ms_office_suspicious_regmod.json'; +import rule641 from './initial_access_o365_user_reported_phish_malware.json'; +import rule642 from './defense_evasion_microsoft_365_mailboxauditbypassassociation.json'; +import rule643 from './credential_access_disable_kerberos_preauth.json'; +import rule644 from './credential_access_posh_request_ticket.json'; +import rule645 from './credential_access_shadow_credentials.json'; +import rule646 from './privilege_escalation_pkexec_envar_hijack.json'; +import rule647 from './credential_access_seenabledelegationprivilege_assigned_to_user.json'; +import rule648 from './persistence_msds_alloweddelegateto_krbtgt.json'; +import rule649 from './defense_evasion_disable_posh_scriptblocklogging.json'; +import rule650 from './persistence_ad_adminsdholder.json'; +import rule651 from './privilege_escalation_windows_service_via_unusual_client.json'; +import rule652 from './credential_access_dcsync_replication_rights.json'; +import rule653 from './credential_access_lsass_memdump_handle_access.json'; +import rule654 from './credential_access_moving_registry_hive_via_smb.json'; +import rule655 from './credential_access_suspicious_winreg_access_via_sebackup_priv.json'; +import rule656 from './credential_access_spn_attribute_modified.json'; +import rule657 from './persistence_dontexpirepasswd_account.json'; +import rule658 from './execution_apt_binary.json'; +import rule659 from './execution_awk_binary_shell.json'; +import rule660 from './execution_env_binary.json'; +import rule661 from './persistence_sdprop_exclusion_dsheuristics.json'; +import rule662 from './execution_find_binary.json'; +import rule663 from './credential_access_remote_sam_secretsdump.json'; +import rule664 from './defense_evasion_workfolders_control_execution.json'; +import rule665 from './execution_vi_binary.json'; +import rule666 from './execution_expect_binary.json'; +import rule667 from './execution_gcc_binary.json'; +import rule668 from './execution_mysql_binary.json'; +import rule669 from './execution_ssh_binary.json'; +import rule670 from './execution_busybox_binary.json'; +import rule671 from './execution_c89_c99_binary.json'; +import rule672 from './execution_cpulimit_binary.json'; +import rule673 from './execution_crash_binary.json'; +import rule674 from './credential_access_user_impersonation_access.json'; +import rule675 from './execution_flock_binary.json'; export const rawRules = [ rule1, @@ -1320,4 +1341,25 @@ export const rawRules = [ rule652, rule653, rule654, + rule655, + rule656, + rule657, + rule658, + rule659, + rule660, + rule661, + rule662, + rule663, + rule664, + rule665, + rule666, + rule667, + rule668, + rule669, + rule670, + rule671, + rule672, + rule673, + rule674, + rule675, ]; diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_script_executing_powershell.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_script_executing_powershell.json index 4950066d307ff..8bb99f6beaa38 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_script_executing_powershell.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_script_executing_powershell.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Windows Script Executing PowerShell", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : (\"cscript.exe\", \"wscript.exe\") and process.name : \"powershell.exe\"\n", "risk_score": 21, "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_files.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_files.json index 2473b4c3d2b51..ba307ded580b4 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_files.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_files.json @@ -17,7 +17,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Microsoft Exchange Server UM Writing Suspicious Files", - "note": "## Triage and analysis\n\nPositive hits can be checked against the established Microsoft [baselines](https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines).\n\nMicrosoft highly recommends that the best course of action is patching, but this may not protect already compromised systems\nfrom existing intrusions. Other tools for detecting and mitigating can be found within their Exchange support\n[repository](https://github.com/microsoft/CSS-Exchange/tree/main/Security)\n", + "note": "## Triage and analysis\n\nPositive hits can be checked against the established Microsoft [baselines](https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines).\n\nMicrosoft highly recommends that the best course of action is patching, but this may not protect already compromised systems\nfrom existing intrusions. Other tools for detecting and mitigating can be found within their Exchange support\n[repository](https://github.com/microsoft/CSS-Exchange/tree/main/Security)\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type == \"creation\" and\n process.name : (\"UMWorkerProcess.exe\", \"umservice.exe\") and\n file.extension : (\"php\", \"jsp\", \"js\", \"aspx\", \"asmx\", \"asax\", \"cfm\", \"shtml\") and\n (\n file.path : \"?:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\*\" or\n\n (file.path : \"?:\\\\*\\\\Microsoft\\\\Exchange Server*\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth\\\\*\" and\n not (file.path : \"?:\\\\*\\\\Microsoft\\\\Exchange Server*\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth\\\\version\\\\*\" or\n file.name : (\"errorFE.aspx\", \"expiredpassword.aspx\", \"frowny.aspx\", \"GetIdToken.htm\", \"logoff.aspx\",\n \"logon.aspx\", \"OutlookCN.aspx\", \"RedirSuiteServiceProxy.aspx\", \"signout.aspx\"))) or\n\n (file.path : \"?:\\\\*\\\\Microsoft\\\\Exchange Server*\\\\FrontEnd\\\\HttpProxy\\\\ecp\\\\auth\\\\*\" and\n not file.name : \"TimeoutLogoff.aspx\")\n )\n", "references": [ "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers", @@ -52,5 +52,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_process.json index 7f0b57ad7b976..a1b371b84d7ac 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_process.json @@ -16,6 +16,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Microsoft Exchange Server UM Spawning Suspicious Processes", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.parent.name : (\"UMService.exe\", \"UMWorkerProcess.exe\") and\n not process.name : (\"werfault.exe\", \"wermgr.exe\")\n", "references": [ "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers", @@ -50,5 +51,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_worker_child_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_worker_child_process.json index ea4d8c6eae210..f125a3b27e25d 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_worker_child_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_exchange_worker_child_process.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Microsoft Exchange Worker Spawning Suspicious Processes", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.parent.name : \"w3wp.exe\" and process.parent.args : \"MSExchange*AppPool\" and\n (process.name : (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") or\n process.pe.original_file_name in (\"cmd.exe\", \"powershell.exe\", \"pwsh.dll\", \"powershell_ise.exe\"))\n", "references": [ "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers", @@ -47,5 +48,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_office_child_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_office_child_process.json index 17e9195181f3d..c4f812542c752 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_office_child_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_office_child_process.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious MS Office Child Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : (\"eqnedt32.exe\", \"excel.exe\", \"fltldr.exe\", \"msaccess.exe\", \"mspub.exe\", \"powerpnt.exe\", \"winword.exe\") and\n process.name : (\"Microsoft.Workflow.Compiler.exe\", \"arp.exe\", \"atbroker.exe\", \"bginfo.exe\", \"bitsadmin.exe\", \"cdb.exe\", \"certutil.exe\",\n \"cmd.exe\", \"cmstp.exe\", \"control.exe\", \"cscript.exe\", \"csi.exe\", \"dnx.exe\", \"dsget.exe\", \"dsquery.exe\", \"forfiles.exe\", \n \"fsi.exe\", \"ftp.exe\", \"gpresult.exe\", \"hostname.exe\", \"ieexec.exe\", \"iexpress.exe\", \"installutil.exe\", \"ipconfig.exe\", \n \"mshta.exe\", \"msxsl.exe\", \"nbtstat.exe\", \"net.exe\", \"net1.exe\", \"netsh.exe\", \"netstat.exe\", \"nltest.exe\", \"odbcconf.exe\", \n \"ping.exe\", \"powershell.exe\", \"pwsh.exe\", \"qprocess.exe\", \"quser.exe\", \"qwinsta.exe\", \"rcsi.exe\", \"reg.exe\", \"regasm.exe\", \n \"regsvcs.exe\", \"regsvr32.exe\", \"sc.exe\", \"schtasks.exe\", \"systeminfo.exe\", \"tasklist.exe\", \"tracert.exe\", \"whoami.exe\",\n \"wmic.exe\", \"wscript.exe\", \"xwizard.exe\", \"explorer.exe\", \"rundll32.exe\", \"hh.exe\")\n", "risk_score": 47, "rule_id": "a624863f-a70d-417f-a7d2-7a404638d47f", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_outlook_child_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_outlook_child_process.json index baba3386b048e..fdb5fdac2629a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_outlook_child_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_suspicious_ms_outlook_child_process.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious MS Outlook Child Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"outlook.exe\" and\n process.name : (\"Microsoft.Workflow.Compiler.exe\", \"arp.exe\", \"atbroker.exe\", \"bginfo.exe\", \"bitsadmin.exe\",\n \"cdb.exe\", \"certutil.exe\", \"cmd.exe\", \"cmstp.exe\", \"cscript.exe\", \"csi.exe\", \"dnx.exe\", \"dsget.exe\",\n \"dsquery.exe\", \"forfiles.exe\", \"fsi.exe\", \"ftp.exe\", \"gpresult.exe\", \"hostname.exe\", \"ieexec.exe\",\n \"iexpress.exe\", \"installutil.exe\", \"ipconfig.exe\", \"mshta.exe\", \"msxsl.exe\", \"nbtstat.exe\", \"net.exe\",\n \"net1.exe\", \"netsh.exe\", \"netstat.exe\", \"nltest.exe\", \"odbcconf.exe\", \"ping.exe\", \"powershell.exe\",\n \"pwsh.exe\", \"qprocess.exe\", \"quser.exe\", \"qwinsta.exe\", \"rcsi.exe\", \"reg.exe\", \"regasm.exe\",\n \"regsvcs.exe\", \"regsvr32.exe\", \"sc.exe\", \"schtasks.exe\", \"systeminfo.exe\", \"tasklist.exe\",\n \"tracert.exe\", \"whoami.exe\", \"wmic.exe\", \"wscript.exe\", \"xwizard.exe\")\n", "risk_score": 21, "rule_id": "32f4675e-6c49-4ace-80f9-97c9259dca2e", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_unusual_dns_service_children.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_unusual_dns_service_children.json index 3a58eb309f5b6..a842c79a8e43a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_unusual_dns_service_children.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_unusual_dns_service_children.json @@ -15,7 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Unusual Child Process of dns.exe", - "note": "## Triage and analysis\n\n### Investigating Unusual Child Process\nDetection alerts from this rule indicate potential suspicious child processes spawned after exploitation from CVE-2020-1350 (SigRed) has occurred. Here are some possible avenues of investigation:\n- Any suspicious or abnormal child process spawned from dns.exe should be reviewed and investigated with care. It's impossible to predict what an adversary may deploy as the follow-on process after the exploit, but built-in discovery/enumeration utilities should be top of mind (whoami.exe, netstat.exe, systeminfo.exe, tasklist.exe).\n- Built-in Windows programs that contain capabilities used to download and execute additional payloads should also be considered. This is not an exhaustive list, but ideal candidates to start out would be: mshta.exe, powershell.exe, regsvr32.exe, rundll32.exe, wscript.exe, wmic.exe.\n- If the DoS exploit is successful and DNS Server service crashes, be mindful of potential child processes related to werfault.exe occurring.\n- Any subsequent activity following the child process spawned related to execution/network activity should be thoroughly reviewed from the endpoint.", + "note": "## Triage and analysis\n\n### Investigating Unusual Child Process\nDetection alerts from this rule indicate potential suspicious child processes spawned after exploitation from CVE-2020-1350 (SigRed) has occurred. Here are some possible avenues of investigation:\n- Any suspicious or abnormal child process spawned from dns.exe should be reviewed and investigated with care. It's impossible to predict what an adversary may deploy as the follow-on process after the exploit, but built-in discovery/enumeration utilities should be top of mind (whoami.exe, netstat.exe, systeminfo.exe, tasklist.exe).\n- Built-in Windows programs that contain capabilities used to download and execute additional payloads should also be considered. This is not an exhaustive list, but ideal candidates to start out would be: mshta.exe, powershell.exe, regsvr32.exe, rundll32.exe, wscript.exe, wmic.exe.\n- If the DoS exploit is successful and DNS Server service crashes, be mindful of potential child processes related to werfault.exe occurring.\n- Any subsequent activity following the child process spawned related to execution/network activity should be thoroughly reviewed from the endpoint.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and process.parent.name : \"dns.exe\" and\n not process.name : \"conhost.exe\"\n", "references": [ "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", @@ -51,5 +51,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_unusual_dns_service_file_writes.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_unusual_dns_service_file_writes.json index 3ccd4aa440b42..43e33bf36f1cf 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_unusual_dns_service_file_writes.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_unusual_dns_service_file_writes.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Unusual File Modification by dns.exe", - "note": "## Triage and analysis\n\n### Investigating Unusual File Write\nDetection alerts from this rule indicate potential unusual/abnormal file writes from the DNS Server service process (`dns.exe`) after exploitation from CVE-2020-1350 (SigRed) has occurred. Here are some possible avenues of investigation:\n- Post-exploitation, adversaries may write additional files or payloads to the system as additional discovery/exploitation/persistence mechanisms.\n- Any suspicious or abnormal files written from `dns.exe` should be reviewed and investigated with care.", + "note": "## Triage and analysis\n\n### Investigating Unusual File Write\nDetection alerts from this rule indicate potential unusual/abnormal file writes from the DNS Server service process (`dns.exe`) after exploitation from CVE-2020-1350 (SigRed) has occurred. Here are some possible avenues of investigation:\n- Post-exploitation, adversaries may write additional files or payloads to the system as additional discovery/exploitation/persistence mechanisms.\n- Any suspicious or abnormal files written from `dns.exe` should be reviewed and investigated with care.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where process.name : \"dns.exe\" and event.type in (\"creation\", \"deletion\", \"change\") and\n not file.name : \"dns.log\"\n", "references": [ "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", @@ -47,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_via_explorer_suspicious_child_parent_args.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_via_explorer_suspicious_child_parent_args.json index 23e8d3b43faf5..814fea368d719 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_via_explorer_suspicious_child_parent_args.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/initial_access_via_explorer_suspicious_child_parent_args.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Explorer Child Process", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (\n process.name : (\"cscript.exe\", \"wscript.exe\", \"powershell.exe\", \"rundll32.exe\", \"cmd.exe\", \"mshta.exe\", \"regsvr32.exe\") or\n process.pe.original_file_name in (\"cscript.exe\", \"wscript.exe\", \"PowerShell.EXE\", \"RUNDLL32.EXE\", \"Cmd.Exe\", \"MSHTA.EXE\", \"REGSVR32.EXE\")\n ) and\n /* Explorer started via DCOM */\n process.parent.name : \"explorer.exe\" and process.parent.args : \"-Embedding\" and\n not process.parent.args:\n (\n /* Noisy CLSID_SeparateSingleProcessExplorerHost Explorer COM Class IDs */\n \"/factory,{5BD95610-9434-43C2-886C-57852CC8A120}\",\n \"/factory,{ceff45ee-c862-41de-aee2-a022c81eda92}\"\n )\n", "risk_score": 47, "rule_id": "9a5b4e31-6cde-4295-9ff7-6be1b8567e1b", @@ -54,5 +55,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_hta.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_hta.json index 7af0be2b52d48..50178d20af2a1 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_hta.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dcom_hta.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Identifies the use of Distributed Component Object Model (DCOM) to execute commands from a remote host, which are launched via the HTA Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally while attempting to evading detection.", + "description": "Identifies the use of Distributed Component Object Model (DCOM) to execute commands from a remote host, which are launched via the HTA Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally while attempting to evade detection.", "from": "now-9m", "index": [ "winlogbeat-*", @@ -73,5 +73,5 @@ } ], "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dns_server_overflow.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dns_server_overflow.json index ca6484afd077c..e15da7079788e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dns_server_overflow.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_dns_server_overflow.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers which result in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.", + "description": "Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.", "false_positives": [ "Environments that leverage DNS responses over 60k bytes will result in false positives - if this traffic is predictable and expected, it should be filtered out. Additionally, this detection rule could be triggered by an authorized vulnerability scan or compromise assessment." ], @@ -13,7 +13,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "Abnormally Large DNS Response", - "note": "## Triage and analysis\n\n### Investigating Large DNS Responses\nDetection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS\nserver. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350)\nalso known as [SigRed](https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability) during July 2020.\n\n#### Possible investigation steps:\n- This specific rule is sourced from network log activity such as DNS or network level data. It's important to validate\nthe source of the incoming traffic and determine if this activity has been observed previously within an environment.\n- Activity can be further investigated and validated by reviewing available corresponding Intrusion Detection Signatures (IDS) alerts associated with activity.\n- Further examination can include a review of the `dns.question_type` network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data.\n- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale Internet vulnerability scanning.\n- Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.\n\n#### False Positive Analysis\n- Based on this rule which looks for a threshold of 60k bytes, it is possible for activity to be generated under 65k bytes\nand related to legitimate behavior. In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses\nwere all observed as greater than 65k bytes.\n- This activity can be triggered by compliance/vulnerability scanning or compromise assessment, it's\nimportant to determine the source of the activity and potentially allowlist the source host.\n\n\n### Related Rules\n- Unusual Child Process of dns.exe\n- Unusual File Modification by dns.exe\n\n### Response and Remediation\n- Review and implement the above detection logic within your environment using technology such as Endpoint security, Winlogbeat, Packetbeat, or network security monitoring (NSM) platforms such as Zeek or Suricata.\n- Ensure that you have deployed the latest Microsoft [Security Update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350) (Monthly Rollup or Security Only) and restart the\npatched machines. If unable to patch immediately: Microsoft [released](https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability) a registry-based workaround that doesn\u2019t require a\nrestart. This can be used as a temporary solution before the patch is applied.\n- Maintain backups of your critical systems to aid in quick recovery.\n- Perform routine vulnerability scans of your systems, monitor [CISA advisories](https://us-cert.cisa.gov/ncas/current-activity) and patch identified vulnerabilities.\n- If you observe a true positive, implement a remediation plan and monitor host-based artifacts for additional post-exploitation behavior.\n", + "note": "## Triage and analysis\n\n### Investigating Large DNS Responses\nDetection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS\nserver. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350)\nalso known as [SigRed](https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability) during July 2020.\n\n#### Possible investigation steps:\n- This specific rule is sourced from network log activity such as DNS or network level data. It's important to validate\nthe source of the incoming traffic and determine if this activity has been observed previously within an environment.\n- Activity can be further investigated and validated by reviewing available corresponding Intrusion Detection Signatures (IDS) alerts associated with activity.\n- Further examination can include a review of the `dns.question_type` network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data.\n- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale Internet vulnerability scanning.\n- Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.\n\n#### False Positive Analysis\n- Based on this rule, which looks for a threshold of 60k bytes, it is possible for activity to be generated under 65k bytes\nand related to legitimate behavior. In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses\nwere all observed as greater than 65k bytes.\n- This activity can be triggered by compliance/vulnerability scanning or compromise assessment, it's\nimportant to determine the source of the activity and potentially allowlist the source host.\n\n\n### Related Rules\n- Unusual Child Process of dns.exe\n- Unusual File Modification by dns.exe\n\n### Response and Remediation\n- Review and implement the above detection logic within your environment using technology such as Endpoint security, Winlogbeat, Packetbeat, or network security monitoring (NSM) platforms such as Zeek or Suricata.\n- Ensure that you have deployed the latest Microsoft [Security Update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350) (Monthly Rollup or Security Only) and restart the\npatched machines. If unable to patch immediately: Microsoft [released](https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability) a registry-based workaround that doesn\u2019t require a\nrestart. This can be used as a temporary solution before the patch is applied.\n- Maintain backups of your critical systems to aid in quick recovery.\n- Perform routine vulnerability scans of your systems, monitor [CISA advisories](https://us-cert.cisa.gov/ncas/current-activity) and patch identified vulnerabilities.\n- If you observe a true positive, implement a remediation plan and monitor host-based artifacts for additional post-exploitation behavior.\n", "query": "event.category:(network or network_traffic) and destination.port:53 and\n (event.dataset:zeek.dns or type:dns or event.type:connection) and network.bytes > 60000\n", "references": [ "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", @@ -48,5 +48,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_evasion_rdp_shadowing.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_evasion_rdp_shadowing.json index 8656bd4a0712e..4787ab253a04a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_evasion_rdp_shadowing.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_evasion_rdp_shadowing.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Remote Desktop Shadowing Activity", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "/* Identifies the modification of RDP Shadow registry or\n the execution of processes indicative of active shadow RDP session */\n\nany where \n (event.category == \"registry\" and\n registry.path : \"HKLM\\\\Software\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\Shadow\"\n ) or\n (event.category == \"process\" and \n (process.name : (\"RdpSaUacHelper.exe\", \"RdpSaProxy.exe\") and process.parent.name : \"svchost.exe\") or\n (process.pe.original_file_name : \"mstsc.exe\" and process.args : \"/shadow:*\")\n )\n", "references": [ "https://bitsadm.in/blog/spying-on-users-using-rdp-shadowing", @@ -46,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_execution_from_tsclient_mup.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_execution_from_tsclient_mup.json index f3f7c763447c9..ae2561a0b5cd4 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_execution_from_tsclient_mup.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_execution_from_tsclient_mup.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Execution via TSClient Mountpoint", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and process.executable : \"\\\\Device\\\\Mup\\\\tsclient\\\\*.exe\"\n", "references": [ "https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3" @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_malware_uploaded_sharepoint.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_malware_uploaded_sharepoint.json index 52b06e00d68f6..4a114e592b260 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_malware_uploaded_sharepoint.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_malware_uploaded_sharepoint.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Identifies the occurence of files uploaded to SharePoint being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunity to gain initial access to other endpoints in the environment.", + "description": "Identifies the occurence of files uploaded to SharePoint being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunities to gain initial access to other endpoints in the environment.", "false_positives": [ "Benign files can trigger signatures in the built-in virus protection" ], @@ -49,5 +49,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_mount_hidden_or_webdav_share_net.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_mount_hidden_or_webdav_share_net.json index ee16c8f382ec6..e09b06bd42387 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_mount_hidden_or_webdav_share_net.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_mount_hidden_or_webdav_share_net.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Mounting Hidden or WebDav Remote Shares", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n ((process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or ((process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and\n not process.parent.name : \"net.exe\")) and\n process.args : \"use\" and\n /* including hidden and webdav based online shares such as onedrive */\n process.args : (\"\\\\\\\\*\\\\*$*\", \"\\\\\\\\*@SSL\\\\*\", \"http*\") and\n /* excluding shares deletion operation */\n not process.args : \"/d*\"\n", "risk_score": 21, "rule_id": "c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_mounting_smb_share.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_mounting_smb_share.json index 0b32ad10af1c8..44fc8cf6592b0 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_mounting_smb_share.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_mounting_smb_share.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Attempt to Mount SMB Share via Command Line", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (\n process.name : \"mount_smbfs\" or\n (process.name : \"open\" and process.args : \"smb://*\") or\n (process.name : \"mount\" and process.args : \"smbfs\") or\n (process.name : \"osascript\" and process.command_line : \"osascript*mount volume*smb://*\")\n )\n", "references": [ "https://www.freebsd.org/cgi/man.cgi?mount_smbfs", @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_powershell_remoting_target.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_powershell_remoting_target.json index 9749106831904..39999613b1b3f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_powershell_remoting_target.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_powershell_remoting_target.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows for running any Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement.", + "description": "Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows a user to run any Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement.", "false_positives": [ "PowerShell remoting is a dual-use protocol that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." ], @@ -47,5 +47,5 @@ } ], "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_enabled_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_enabled_registry.json index 46a3a25877b5d..37b07aa4b19f0 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_enabled_registry.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_rdp_enabled_registry.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "RDP Enabled via Registry", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where event.type in (\"creation\", \"change\") and\n registry.path : \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Terminal Server\\\\fDenyTSConnections\" and\n registry.data.strings : (\"0\", \"0x00000000\") and not (process.name : \"svchost.exe\" and user.domain == \"NT AUTHORITY\") and\n not process.executable : \"C:\\\\Windows\\\\System32\\\\SystemPropertiesRemote.exe\"\n", "risk_score": 47, "rule_id": "58aa72ca-d968-4f34-b9f7-bea51d75eb50", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_remote_file_copy_hidden_share.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_remote_file_copy_hidden_share.json index a46293b0df5b2..f2d2988afdfa2 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_remote_file_copy_hidden_share.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_remote_file_copy_hidden_share.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Remote File Copy to a Hidden Share", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : (\"cmd.exe\", \"powershell.exe\", \"robocopy.exe\", \"xcopy.exe\") and \n process.args : (\"copy*\", \"move*\", \"cp\", \"mv\") and process.args : \"*$*\"\n", "risk_score": 47, "rule_id": "fa01341d-6662-426b-9d0c-6d81e33c8a9d", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_service_control_spawned_script_int.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_service_control_spawned_script_int.json index 3cf70a8f26739..47ebd1f80e3d1 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_service_control_spawned_script_int.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_service_control_spawned_script_int.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Service Control Spawned via Script Interpreter", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "/* This rule is not compatible with Sysmon due to user.id issues */\n\nprocess where event.type == \"start\" and\n (process.name : \"sc.exe\" or process.pe.original_file_name == \"sc.exe\") and\n process.parent.name : (\"cmd.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\",\n \"wmic.exe\", \"mshta.exe\",\"powershell.exe\", \"pwsh.exe\") and\n process.args:(\"config\", \"create\", \"start\", \"delete\", \"stop\", \"pause\") and\n /* exclude SYSTEM SID - look for service creations by non-SYSTEM user */\n not user.id : \"S-1-5-18\"\n", "risk_score": 21, "rule_id": "e8571d5f-bea1-46c2-9f56-998de2d3ed95", @@ -42,5 +43,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_suspicious_rdp_client_imageload.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_suspicious_rdp_client_imageload.json index 626d4687ea43c..d9d6a0f0ea9d7 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_suspicious_rdp_client_imageload.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_suspicious_rdp_client_imageload.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious RDP ActiveX Client Loaded", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "library where dll.name : \"mstscax.dll\" and\n /* depending on noise in your env add here extra paths */\n process.executable :\n (\n \"C:\\\\Windows\\\\*\",\n \"C:\\\\Users\\\\Public\\\\*\",\n \"C:\\\\Users\\\\Default\\\\*\",\n \"C:\\\\Intel\\\\*\",\n \"C:\\\\PerfLogs\\\\*\",\n \"C:\\\\ProgramData\\\\*\",\n \"\\\\Device\\\\Mup\\\\*\",\n \"\\\\\\\\*\"\n ) and\n /* add here FPs */\n not process.executable : (\"C:\\\\Windows\\\\System32\\\\mstsc.exe\", \"C:\\\\Windows\\\\SysWOW64\\\\mstsc.exe\")\n", "references": [ "https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3" @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_via_startup_folder_rdp_smb.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_via_startup_folder_rdp_smb.json index 56c4e591ff9ff..d9bfbc276d299 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_via_startup_folder_rdp_smb.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_via_startup_folder_rdp_smb.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Lateral Movement via Startup Folder", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type in (\"creation\", \"change\") and\n /* via RDP TSClient mounted share or SMB */\n (process.name : \"mstsc.exe\" or process.pid == 4) and\n file.path : \"C:\\\\*\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\*\"\n", "references": [ "https://www.mdsec.co.uk/2017/06/rdpinception/" @@ -67,5 +68,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_vpn_connection_attempt.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_vpn_connection_attempt.json index 7d9b48febf710..b5df5a0d3f21d 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_vpn_connection_attempt.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/lateral_movement_vpn_connection_attempt.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Virtual Private Network Connection Attempt", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (\n (process.name : \"networksetup\" and process.args : \"-connectpppoeservice\") or\n (process.name : \"scutil\" and process.args : \"--nc\" and process.args : \"start\") or\n (process.name : \"osascript\" and process.command_line : \"osascript*set VPN to service*\")\n )\n", "references": [ "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/osx/manage/vpn.rb", @@ -46,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/mfa_disabled_for_google_workspace_organization.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/mfa_disabled_for_google_workspace_organization.json index 257aca34e3444..29fb27e3d944a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/mfa_disabled_for_google_workspace_organization.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/mfa_disabled_for_google_workspace_organization.json @@ -30,5 +30,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 7 + "version": 9 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/microsoft_365_exchange_dkim_signing_config_disabled.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/microsoft_365_exchange_dkim_signing_config_disabled.json index 6c8b7805bbb06..1b19f94bf898d 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/microsoft_365_exchange_dkim_signing_config_disabled.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/microsoft_365_exchange_dkim_signing_config_disabled.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is disabled in Microsoft 365. With DKIM in Microsoft 365, messages that are sent from Exchange Online will be cryptographically signed. This will allow the receiving email system to validate that the messages were generated by a server that the organization authorized and not being spoofed.", + "description": "Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is disabled in Microsoft 365. With DKIM in Microsoft 365, messages that are sent from Exchange Online will be cryptographically signed. This will allow the receiving email system to validate that the messages were generated by a server that the organization authorized and were not spoofed.", "false_positives": [ "Disabling a DKIM configuration may be done by a system or network administrator. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior." ], @@ -32,5 +32,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_error_message_spike.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_error_message_spike.json index a751087df9676..c190c112ead30 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_error_message_spike.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_error_message_spike.json @@ -12,7 +12,7 @@ "license": "Elastic License v2", "machine_learning_job_id": "high_distinct_count_error_message", "name": "Spike in AWS Error Messages", - "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating Spikes in CloudTrail Errors\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding\nwhat is considered normal behavior within an organization, suspicious or malicious activity can be spotted when deviations\nare observed. This example rule triggers from a large spike in the number of CloudTrail log messages that contain a\nparticular error message. The error message in question was associated with the response to an AWS API command or method call,\nthis has the potential to uncover unknown threats or activity.\n\n#### Possible investigation steps:\n- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_message` field, only manifested recently, it might be related to recent changes in an automation module or script.\n- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation or lateral movement attempts.\n- Consider the user as identified by the `user.name field`. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n\n### False Positive Analysis\n- This rule has the possibility to produce false positives based on unexpected activity occurring such as bugs or recent\nchanges to automation modules or scripting.\n- The adoption of new services or the addition of new functionality to scripts may generate false positives.\n\n### Related Rules\n- Unusual AWS Command for a User\n- Rare AWS Error Code\n\n### Response and Remediation\n- If suspicious or malicious activity is observed, immediately rotate and delete relevant AWS IAM access keys\n- Validate if any unauthorized new users were created, remove these accounts and request password resets for other IAM users\n- Look into enabling multi-factor authentication for users\n- Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS\n", + "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating Spikes in CloudTrail Errors\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding\nwhat is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations\noccur. This example rule triggers from a large spike in the number of CloudTrail log messages that contain a particular\nerror message. The error message in question was associated with the response to an AWS API command or method call, this\nhas the potential to uncover unknown threats or activity.\n\n#### Possible investigation steps:\n- Examine the history of the error. Has it manifested before? If the error, which is visible in the `aws.cloudtrail.error_message` field, only manifested recently, it might be related to recent changes in an automation module or script.\n- Examine the request parameters. These may provide indications as to the nature of the task being performed when the error occurred. Is the error related to unsuccessful attempts to enumerate or access objects, data, or secrets? If so, this can sometimes be a byproduct of discovery, privilege escalation or lateral movement attempts.\n- Consider the user as identified by the `user.name field`. Is this activity part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n\n### False Positive Analysis\n- This rule has the possibility to produce false positives based on unexpected activity occurring such as bugs or recent\nchanges to automation modules or scripting.\n- The adoption of new services or the addition of new functionality to scripts may generate false positives.\n\n### Related Rules\n- Unusual AWS Command for a User\n- Rare AWS Error Code\n\n### Response and Remediation\n- If suspicious or malicious activity is observed, immediately rotate and delete relevant AWS IAM access keys.\n- If any unauthorized new user accounts were created, remove them. Request password resets for other IAM users.\n- Look into enabling multi-factor authentication for users.\n- Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.\n", "references": [ "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" ], @@ -26,5 +26,5 @@ "ML" ], "type": "machine_learning", - "version": 8 + "version": 9 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_country.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_country.json index a9483c3f981c4..7e778083c9d70 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_country.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_cloudtrail_rare_method_by_country.json @@ -12,7 +12,7 @@ "license": "Elastic License v2", "machine_learning_job_id": "rare_method_for_a_country", "name": "Unusual Country For an AWS Command", - "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating an Unusual Country For an AWS Command\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding\nwhat is considered normal behavior within an organization, suspicious or malicious activity can be spotted when deviations\nare observed. This example rule focuses on AWS command activity where the country from the source of the activity has been\nconsidered unusual based on previous history.\n\n#### Possible investigation steps:\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n\n### False Positive Analysis\n- False positives can occur if activity is coming from new employees based in a country with no previous history in AWS,\ntherefore it's important to validate the activity listed in the investigation steps above.\n\n### Related Rules\n- Unusual City For an AWS Command\n- Unusual AWS Command for a User\n- Rare AWS Error Code\n\n### Response and Remediation\n- If suspicious or malicious activity is observed, immediately rotate and delete relevant AWS IAM access keys\n- Validate if any unauthorized new users were created, remove these accounts and request password resets for other IAM users\n- Look into enabling multi-factor authentication for users\n- Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS\n", + "note": "## Config\n\nThe AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n\n## Triage and analysis\n\n### Investigating an Unusual Country For an AWS Command\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding\nwhat is considered normal behavior within an organization, suspicious or malicious activity can be spotted when deviations\nare observed. This example rule focuses on AWS command activity where the country from the source of the activity has been\nconsidered unusual based on previous history.\n\n#### Possible investigation steps:\n- Consider the source IP address and geolocation for the calling user who issued the command. Do they look normal for the calling user? If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts, or could it be sourcing from an EC2 instance that's not under your control? If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the user as identified by the `user.name` field. Is this command part of an expected workflow for the user context? Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context. The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?\n- Examine the history of the command. If the command, which is visible in the `event.action field`, only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, if it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process.\n- Examine the request parameters. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n\n### False Positive Analysis\n- False positives can occur if activity is coming from new employees based in a country with no previous history in AWS,\ntherefore it's important to validate the activity listed in the investigation steps above.\n\n### Related Rules\n- Unusual City For an AWS Command\n- Unusual AWS Command for a User\n- Rare AWS Error Code\n\n### Response and Remediation\n- If suspicious or malicious activity is observed, immediately rotate and delete relevant AWS IAM access keys.\n- Validate if any unauthorized new users were created, remove these accounts and request password resets for other IAM users.\n- Look into enabling multi-factor authentication for users.\n- Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.\n", "references": [ "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" ], @@ -26,5 +26,5 @@ "ML" ], "type": "machine_learning", - "version": 8 + "version": 9 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_rare_process_by_host_windows.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_rare_process_by_host_windows.json index 85b3ec0d846e8..7b1d4629d6b14 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_rare_process_by_host_windows.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/ml_rare_process_by_host_windows.json @@ -15,7 +15,7 @@ "v2_rare_process_by_host_windows_ecs" ], "name": "Unusual Process For a Windows Host", - "note": "## Triage and analysis\n\n### Investigating an Unusual Windows Process\n\nSearching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network.\nUnderstanding what is commonly run within an environment and developing baselines for legitimate activity can help\nuncover potential malware and suspicious behaviors.\n\n#### Possible investigation steps:\n- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.\n- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package.\n- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools.\n\n### False Positive Analysis\n- Validate the unusual Windows process is not related to new benign software installation activity. If related to\nlegitimate software, this can be done by leveraging the exception workflow in the Kibana Security App or Elasticsearch\nAPI to tune this rule to your environment\n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. It's possible that a small number of endpoints\nsuch as servers that have very unique software that might appear to be unusual, but satisfy a specific business need.\n\n### Related Rules\n- Anomalous Windows Process Creation\n- Unusual Windows Path Activity\n- Unusual Windows Process Calling the Metadata Service\n\n### Response and Remediation\n- This rule is related to process execution events and should be immediately reviewed and investigated to determine if malicious.\n- Based on validation and if malicious, the impacted machine should be isolated and analyzed to determine other post-compromise\nbehavior such as setting up persistence or performing lateral movement.\n- Look into preventive measures such as Windows Defender Application Control and AppLocker to gain better control on\nwhat is allowed to run on Windows infrastructure.\n", + "note": "## Triage and analysis\n\n### Investigating an Unusual Windows Process\n\nSearching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network.\nUnderstanding what is commonly run within an environment and developing baselines for legitimate activity can help\nuncover potential malware and suspicious behaviors.\n\n#### Possible investigation steps:\n- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.\n- Examine the process metadata like the values of the Company, Description and Product fields which may indicate whether the program is associated with an expected software vendor or package.\n- Examine arguments and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools.\n\n### False Positive Analysis\n- Validate the unusual Windows process is not related to new benign software installation activity. If related to\nlegitimate software, this can be done by leveraging the exception workflow in the Kibana Security App or Elasticsearch\nAPI to tune this rule to your environment.\n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. It's possible that a small number of endpoints\nsuch as servers that have very unique software that might appear to be unusual, but satisfy a specific business need.\n\n### Related Rules\n- Anomalous Windows Process Creation\n- Unusual Windows Path Activity\n- Unusual Windows Process Calling the Metadata Service\n\n### Response and Remediation\n- This rule is related to process execution events and should be immediately reviewed and investigated to determine if malicious.\n- Based on validation and if malicious, the impacted machine should be isolated and analyzed to determine other post-compromise\nbehavior such as setting up persistence or performing lateral movement.\n- Look into preventive measures such as Windows Defender Application Control and AppLocker to gain better control on\nwhat is allowed to run on Windows infrastructure.\n", "references": [ "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" ], @@ -30,5 +30,5 @@ "ML" ], "type": "machine_learning", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_adobe_hijack_persistence.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_adobe_hijack_persistence.json index 66580e65df4a9..93d253d1020c8 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_adobe_hijack_persistence.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_adobe_hijack_persistence.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Adobe Hijack Persistence", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type == \"creation\" and\n file.path : (\"?:\\\\Program Files (x86)\\\\Adobe\\\\Acrobat Reader DC\\\\Reader\\\\AcroCEF\\\\RdrCEF.exe\",\n \"?:\\\\Program Files\\\\Adobe\\\\Acrobat Reader DC\\\\Reader\\\\AcroCEF\\\\RdrCEF.exe\") and\n not process.name : \"msiexec.exe\"\n", "risk_score": 21, "rule_id": "2bf78aa2-9c56-48de-b139-f169bf99cf86", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_appcertdlls_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_appcertdlls_registry.json index dee8ce22bed2a..c7c6f3f4ba60a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_appcertdlls_registry.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_appcertdlls_registry.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Registry Persistence via AppCert DLL", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where\n/* uncomment once stable length(bytes_written_string) > 0 and */\n registry.path : \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Session Manager\\\\AppCertDLLs\\\\*\"\n", "risk_score": 47, "rule_id": "513f0ffd-b317-4b9c-9494-92ce861f22c7", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_appinitdlls_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_appinitdlls_registry.json index a35dbca8d2c6d..c61d7e11291c6 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_appinitdlls_registry.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_appinitdlls_registry.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Registry Persistence via AppInit DLL", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where\n registry.path : (\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls\", \n \"HKLM\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls\") and\n not process.executable : (\"C:\\\\Windows\\\\System32\\\\msiexec.exe\", \n \"C:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\", \n \"C:\\\\Program Files\\\\Commvault\\\\ContentStore*\\\\Base\\\\cvd.exe\",\n \"C:\\\\Program Files (x86)\\\\Commvault\\\\ContentStore*\\\\Base\\\\cvd.exe\")\n", "risk_score": 47, "rule_id": "d0e159cf-73e9-40d1-a9ed-077e3158a855", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_azure_conditional_access_policy_modified.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_azure_conditional_access_policy_modified.json index 700ae78685257..5ef30a8086887 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_azure_conditional_access_policy_modified.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_azure_conditional_access_policy_modified.json @@ -12,7 +12,7 @@ "license": "Elastic License v2", "name": "Azure Conditional Access Policy Modified", "note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", - "query": "event.dataset:(azure.activitylogs or azure.auditlogs) and\n (\n azure.activitylogs.operation_name:\"Update policy\" or\n azure.auditlogs.operation_name:\"Update policy\"\n ) and\n event.outcome:(Success or success)\n", + "query": "event.dataset:(azure.activitylogs or azure.auditlogs) and\nevent.action:\"Update conditional access policy\" and event.outcome:(Success or success)\n", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview" ], @@ -46,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_azure_global_administrator_role_assigned.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_azure_global_administrator_role_assigned.json index c5420012e7a39..4b22ab50a41aa 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_azure_global_administrator_role_assigned.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_azure_global_administrator_role_assigned.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "In Azure Active Directory (Azure AD), permissions to manage resources are assigned using Roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure Active Directory identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources.", + "description": "In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources.", "from": "now-25m", "index": [ "filebeat-*", @@ -53,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_creation_hidden_login_item_osascript.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_creation_hidden_login_item_osascript.json index 4a1f157cc34ad..d069fb44ec27c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_creation_hidden_login_item_osascript.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_creation_hidden_login_item_osascript.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Creation of Hidden Login Item via Apple Script", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and process.name : \"osascript\" and\n process.command_line : \"osascript*login item*hidden:true*\"\n", "risk_score": 47, "rule_id": "f24bcae1-8980-4b30-b5dd-f851b055c9e7", @@ -71,5 +72,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_creation_modif_launch_deamon_sequence.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_creation_modif_launch_deamon_sequence.json index 70e3f67f10f65..c01a562426ea6 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_creation_modif_launch_deamon_sequence.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_creation_modif_launch_deamon_sequence.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Adversaries may create or modify launch daemons to repeatedly execute malicious payloads as part of persistence.", + "description": "Indicates the creation or modification of a launch daemon, which adversaries may use to repeatedly execute malicious payloads as part of persistence.", "false_positives": [ "Trusted applications persisting via LaunchDaemons" ], @@ -46,5 +46,5 @@ } ], "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_dontexpirepasswd_account.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_dontexpirepasswd_account.json new file mode 100644 index 0000000000000..16e62c4a7e6e0 --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_dontexpirepasswd_account.json @@ -0,0 +1,53 @@ +{ + "author": [ + "Elastic" + ], + "description": "Detects the creation and modification of an account with the \"Don't Expire Password\" option Enabled. Attackers can abuse this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this property.", + "false_positives": [ + "User accounts can be used as service accounts and have their password set never to expire. This is a bad security practice that exposes the account to Credential Access attacks. For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is robust and changed regularly and automatically." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Account configured with never Expiring Password", + "query": "event.action:\"modified-user-account\" and event.code:\"4738\" and message:\"'Don't Expire Password' - Enabled\" and not user.id:\"S-1-5-18\"\n", + "references": [ + "https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire", + "https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html" + ], + "risk_score": 47, + "rule_id": "62a70f6f-3c37-43df-a556-f64fa475fba2", + "severity": "medium", + "tags": [ + "Elastic", + "Host", + "Windows", + "Threat Detection", + "Persistence", + "Active Directory" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1098", + "name": "Account Manipulation", + "reference": "https://attack.mitre.org/techniques/T1098/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_emond_rules_file_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_emond_rules_file_creation.json index d065accf6576f..75e27f6c33678 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_emond_rules_file_creation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_emond_rules_file_creation.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Emond Rules Creation or Modification", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n file.path : (\"/private/etc/emond.d/rules/*.plist\", \"/etc/emon.d/rules/*.plist\")\n", "references": [ "https://www.xorrior.com/emond-persistence/" @@ -51,5 +52,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_launch_agent_deamon_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_launch_agent_deamon_creation.json index 3bc4fd800f740..12350f2b4b483 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_launch_agent_deamon_creation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_launch_agent_deamon_creation.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Creation of Hidden Launch Agent or Daemon", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n file.path : \n (\n \"/System/Library/LaunchAgents/.*.plist\",\n \"/Library/LaunchAgents/.*.plist\",\n \"/Users/*/Library/LaunchAgents/.*.plist\",\n \"/System/Library/LaunchDaemons/.*.plist\",\n \"/Library/LaunchDaemons/.*.plist\"\n )\n", "references": [ "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html" @@ -74,5 +75,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_local_account_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_local_account_creation.json index 24f0f3d4d95b1..fdf6ef77b87e3 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_local_account_creation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_hidden_local_account_creation.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Creation of a Hidden Local User Account", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where registry.path : \"HKLM\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names\\\\*$\\\\\"\n", "references": [ "https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html", @@ -53,5 +54,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_registry_startup_shell_folder_modified.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_registry_startup_shell_folder_modified.json index a658ae60cd03d..a6b1f077c154b 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_registry_startup_shell_folder_modified.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_evasion_registry_startup_shell_folder_modified.json @@ -10,7 +10,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Startup Shell Folder Modification", - "note": "## Triage and analysis\n\n### Investigating Suspicious Startup Shell Activity\n\nTechniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for\npersistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this\nbehavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for\nan attacker.\n\n#### Possible investigation steps:\n- Review the source process and related file tied to the Windows Registry entry\n- Validate the activity is not related to planned patches, updates, network administrator activity or legitimate software\ninstallations\n- Determine if activity is unique by validating if other machines in same organization have similar entry\n\n### False Positive Analysis\n- There is a high possibility of benign legitimate programs being added to Shell folders. This activity could be based\non new software installations, patches, or any kind of network administrator related activity. Before entering further\ninvestigation, it should be verified that this activity is not benign.\n\n### Related Rules\n- Startup or Run Key Registry Modification\n- Persistent Scripts in the Startup Directory\n\n### Response and Remediation\n- Activity should first be validated as a true positive event if so then take immediate action to review,\ninvestigate and potentially isolate activity to prevent further post-compromise behavior\n- The respective binary or program tied to this persistence method should be further analyzed and reviewed to understand\nits behavior and capabilities\n- Since this activity is considered post-exploitation behavior, it's important to understand how the behavior was first\ninitialized such as through a macro-enabled document that was attached in a phishing email. By understanding the source\nof the attack, this information can then be used to search for similar indicators on other machines in the same environment.\n", + "note": "## Triage and analysis\n\n### Investigating Suspicious Startup Shell Activity\n\nTechniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for\npersistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this\nbehavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for\nan attacker.\n\n#### Possible investigation steps:\n- Review the source process and related file tied to the Windows Registry entry.\n- Validate the activity is not related to planned patches, updates, network administrator activity or legitimate software\ninstallations.\n- Determine if activity is unique by validating if other machines in same organization have similar entry.\n\n### False Positive Analysis\n- There is a high possibility of benign legitimate programs being added to Shell folders. This activity could be based\non new software installations, patches, or any kind of network administrator related activity. Before entering further\ninvestigation, it should be verified that this activity is not benign.\n\n### Related Rules\n- Startup or Run Key Registry Modification\n- Persistent Scripts in the Startup Directory\n\n### Response and Remediation\n- Activity should first be validated as a true positive event if so then take immediate action to review,\ninvestigate and potentially isolate activity to prevent further post-compromise behavior.\n- The respective binary or program tied to this persistence method should be further analyzed and reviewed to understand\nits behavior and capabilities.\n- Since this activity is considered post-exploitation behavior, it's important to understand how the behavior was first\ninitialized such as through a macro-enabled document that was attached in a phishing email. By understanding the source\nof the attack, this information can then be used to search for similar indicators on other machines in the same environment.\n", "query": "registry where\n registry.path : (\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\\\Common Startup\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Common Startup\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\\\Startup\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Startup\"\n ) and\n registry.data.strings != null and\n /* Normal Startup Folder Paths */\n not registry.data.strings : (\n \"C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\",\n \"%ProgramData%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\",\n \"%USERPROFILE%\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\",\n \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\"\n )\n", "risk_score": 73, "rule_id": "c8b150f0-0164-475b-a75e-74b47800a9ff", @@ -48,5 +48,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_folder_action_scripts_runtime.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_folder_action_scripts_runtime.json index 5e86647877d8c..5ca2bfe07364a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_folder_action_scripts_runtime.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_folder_action_scripts_runtime.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script.", + "description": "Detects modification of a Folder Action script. A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script.", "from": "now-9m", "index": [ "auditbeat-*", @@ -59,5 +59,5 @@ } ], "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_admin_role_assigned_to_user.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_admin_role_assigned_to_user.json index d0e7e2654685e..1df067ebceeeb 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_admin_role_assigned_to_user.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_admin_role_assigned_to_user.json @@ -50,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 6 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_api_access_granted_via_domain_wide_delegation_of_authority.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_api_access_granted_via_domain_wide_delegation_of_authority.json index a1a8abe98d323..ebe596b18864f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_api_access_granted_via_domain_wide_delegation_of_authority.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_api_access_granted_via_domain_wide_delegation_of_authority.json @@ -50,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 6 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_custom_admin_role_created.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_custom_admin_role_created.json index 1ebf2e5c1f80d..8cd9d55cd5b6c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_custom_admin_role_created.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_custom_admin_role_created.json @@ -50,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 6 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_role_modified.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_role_modified.json index 123d318150601..7588bdaad04e1 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_role_modified.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_google_workspace_role_modified.json @@ -50,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 6 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_gpo_schtask_service_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_gpo_schtask_service_creation.json index ebbe2448c75df..d1a2e8e5f6e95 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_gpo_schtask_service_creation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_gpo_schtask_service_creation.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Creation or Modification of a new GPO Scheduled Task or Service", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n file.path : (\"?:\\\\Windows\\\\SYSVOL\\\\domain\\\\Policies\\\\*\\\\MACHINE\\\\Preferences\\\\ScheduledTasks\\\\ScheduledTasks.xml\",\n \"?:\\\\Windows\\\\SYSVOL\\\\domain\\\\Policies\\\\*\\\\MACHINE\\\\Preferences\\\\Preferences\\\\Services\\\\Services.xml\") and\n not process.name : \"dfsrs.exe\"\n", "risk_score": 21, "rule_id": "c0429aa8-9974-42da-bfb6-53a0a515a145", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_kde_autostart_modification.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_kde_autostart_modification.json index 8e5b7b3fe05e1..347a92cfa8f76 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_kde_autostart_modification.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_kde_autostart_modification.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistence via KDE AutoStart Script or Desktop File Modification", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n file.extension in (\"sh\", \"desktop\") and\n file.path :\n (\n \"/home/*/.config/autostart/*\", \"/root/.config/autostart/*\",\n \"/home/*/.kde/Autostart/*\", \"/root/.kde/Autostart/*\",\n \"/home/*/.kde4/Autostart/*\", \"/root/.kde4/Autostart/*\",\n \"/home/*/.kde/share/autostart/*\", \"/root/.kde/share/autostart/*\",\n \"/home/*/.kde4/share/autostart/*\", \"/root/.kde4/share/autostart/*\",\n \"/home/*/.local/share/autostart/*\", \"/root/.local/share/autostart/*\",\n \"/home/*/.config/autostart-scripts/*\", \"/root/.config/autostart-scripts/*\",\n \"/etc/xdg/autostart/*\", \"/usr/share/autostart/*\"\n )\n", "references": [ "https://userbase.kde.org/System_Settings/Autostart", @@ -46,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_job_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_job_creation.json index 60afcad90333c..91f99808903b9 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_job_creation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_job_creation.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistence via Scheduled Job Creation", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n file.path : \"?:\\\\Windows\\\\Tasks\\\\*\" and file.extension : \"job\"\n", "risk_score": 47, "rule_id": "1327384f-00f3-44d5-9a8c-2373ba071e92", @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_task_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_task_creation.json index 0c58ee2696e58..ff15cfa02e090 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_task_creation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_local_scheduled_task_creation.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "A scheduled task can be used by an adversary to establish persistence, move laterally, and/or escalate privileges.", + "description": "Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.", "false_positives": [ "Legitimate scheduled tasks may be created during installation of new software." ], @@ -15,7 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Local Scheduled Task Creation", - "query": "sequence with maxspan=1m\n [process where event.type != \"end\" and\n ((process.name : (\"cmd.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\", \"wmic.exe\", \"mshta.exe\",\n \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\", \"WmiPrvSe.exe\", \"wsmprovhost.exe\", \"winrshost.exe\") or\n process.pe.original_file_name : (\"cmd.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\", \"wmic.exe\", \"mshta.exe\",\n \"powershell.exe\", \"pwsh.dll\", \"powershell_ise.exe\", \"WmiPrvSe.exe\", \"wsmprovhost.exe\",\n \"winrshost.exe\")) or\n process.code_signature.trusted == false)] by process.entity_id\n [process where event.type == \"start\" and\n (process.name : \"schtasks.exe\" or process.pe.original_file_name == \"schtasks.exe\") and\n process.args : (\"/create\", \"-create\") and process.args : (\"/RU\", \"/SC\", \"/TN\", \"/TR\", \"/F\", \"/XML\") and\n /* exclude SYSTEM Integrity Level - look for task creations by non-SYSTEM user */\n not (process.Ext.token.integrity_level_name : \"System\" or winlog.event_data.IntegrityLevel : \"System\")\n ] by process.parent.entity_id\n", + "query": "sequence with maxspan=1m\n [process where event.type != \"end\" and\n ((process.name : (\"cmd.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\", \"wmic.exe\", \"mshta.exe\",\n \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\", \"WmiPrvSe.exe\", \"wsmprovhost.exe\", \"winrshost.exe\") or\n process.pe.original_file_name : (\"cmd.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\", \"wmic.exe\", \"mshta.exe\",\n \"powershell.exe\", \"pwsh.dll\", \"powershell_ise.exe\", \"WmiPrvSe.exe\", \"wsmprovhost.exe\",\n \"winrshost.exe\")) or\n process.code_signature.trusted == false)] by process.entity_id\n [process where event.type == \"start\" and\n (process.name : \"schtasks.exe\" or process.pe.original_file_name == \"schtasks.exe\") and\n process.args : (\"/create\", \"-create\") and process.args : (\"/RU\", \"/SC\", \"/TN\", \"/TR\", \"/F\", \"/XML\") and\n /* exclude SYSTEM Integrity Level - look for task creations by non-SYSTEM user */\n not (?process.Ext.token.integrity_level_name : \"System\" or ?winlog.event_data.IntegrityLevel : \"System\")\n ] by process.parent.entity_id\n", "risk_score": 21, "rule_id": "afcce5ad-65de-4ed2-8516-5e093d3ac99a", "severity": "low", @@ -50,7 +50,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_login_logout_hooks_defaults.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_login_logout_hooks_defaults.json index ade4f76e3c0dc..ce729c1812824 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_login_logout_hooks_defaults.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_login_logout_hooks_defaults.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistence via Login or Logout Hook", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.name == \"defaults\" and process.args == \"write\" and process.args in (\"LoginHook\", \"LogoutHook\") and\n not process.args :\n (\n \"Support/JAMF/ManagementFrameworkScripts/logouthook.sh\",\n \"Support/JAMF/ManagementFrameworkScripts/loginhook.sh\",\n \"/Library/Application Support/JAMF/ManagementFrameworkScripts/logouthook.sh\",\n \"/Library/Application Support/JAMF/ManagementFrameworkScripts/loginhook.sh\"\n )\n", "references": [ "https://www.virusbulletin.com/uploads/pdf/conference_slides/2014/Wardle-VB2014.pdf", @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_microsoft_365_global_administrator_role_assign.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_microsoft_365_global_administrator_role_assign.json index 701a4f8cfad0c..06bdfe65d515c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_microsoft_365_global_administrator_role_assign.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_microsoft_365_global_administrator_role_assign.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "In Azure Active Directory (Azure AD), permissions to manage resources are assigned using Roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure Active Directory identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources.", + "description": "In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources.", "from": "now-25m", "index": [ "filebeat-*", @@ -53,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_modification_sublime_app_plugin_or_script.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_modification_sublime_app_plugin_or_script.json index 65c9567ecb8dc..73987426827a8 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_modification_sublime_app_plugin_or_script.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_modification_sublime_app_plugin_or_script.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Sublime Plugin or Application Script Modification", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type in (\"change\", \"creation\") and file.extension : \"py\" and\n file.path : \n (\n \"/Users/*/Library/Application Support/Sublime Text*/Packages/*.py\", \n \"/Applications/Sublime Text.app/Contents/MacOS/sublime.py\"\n ) and\n not process.executable : \n (\n \"/Applications/Sublime Text*.app/Contents/MacOS/Sublime Text*\", \n \"/usr/local/Cellar/git/*/bin/git\", \n \"/usr/libexec/xpcproxy\", \n \"/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper\", \n \"/Applications/Sublime Text.app/Contents/MacOS/plugin_host\"\n )\n", "references": [ "https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5" @@ -44,5 +45,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ms_office_addins_file.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ms_office_addins_file.json index bab11214268c6..d01c80193d132 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ms_office_addins_file.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ms_office_addins_file.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistence via Microsoft Office AddIns", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n file.extension : (\"wll\",\"xll\",\"ppa\",\"ppam\",\"xla\",\"xlam\") and\n file.path :\n (\n \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Word\\\\Startup\\\\*\",\n \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\AddIns\\\\*\",\n \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Excel\\\\XLSTART\\\\*\"\n )\n", "references": [ "https://labs.mwrinfosecurity.com/blog/add-in-opportunities-for-office-persistence/" @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ms_outlook_vba_template.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ms_outlook_vba_template.json index 3426fcdbbbbb2..da114ee50ea96 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ms_outlook_vba_template.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_ms_outlook_vba_template.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistence via Microsoft Outlook VBA", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n file.path : \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Outlook\\\\VbaProject.OTM\"\n", "references": [ "https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_powershell_exch_mailbox_activesync_add_device.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_powershell_exch_mailbox_activesync_add_device.json index 6973f97220bcb..ecaa09e538cf7 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_powershell_exch_mailbox_activesync_add_device.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_powershell_exch_mailbox_activesync_add_device.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "New ActiveSyncAllowedDeviceID Added via PowerShell", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name: (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and process.args : \"Set-CASMailbox*ActiveSyncAllowedDeviceIDs*\"\n", "references": [ "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", @@ -56,5 +57,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_priv_escalation_via_accessibility_features.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_priv_escalation_via_accessibility_features.json index fb6e0ec4bc39f..89446880d5a0b 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_priv_escalation_via_accessibility_features.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_priv_escalation_via_accessibility_features.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Modification of Accessibility Binaries", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\", \"info\") and\n process.parent.name : (\"Utilman.exe\", \"winlogon.exe\") and user.name == \"SYSTEM\" and\n process.args :\n (\n \"C:\\\\Windows\\\\System32\\\\osk.exe\",\n \"C:\\\\Windows\\\\System32\\\\Magnify.exe\",\n \"C:\\\\Windows\\\\System32\\\\Narrator.exe\",\n \"C:\\\\Windows\\\\System32\\\\Sethc.exe\",\n \"utilman.exe\",\n \"ATBroker.exe\",\n \"DisplaySwitch.exe\",\n \"sethc.exe\"\n )\n and not process.pe.original_file_name in\n (\n \"osk.exe\",\n \"sethc.exe\",\n \"utilman2.exe\",\n \"DisplaySwitch.exe\",\n \"ATBroker.exe\",\n \"ScreenMagnifier.exe\",\n \"SR.exe\",\n \"Narrator.exe\",\n \"magnify.exe\",\n \"MAGNIFY.EXE\"\n )\n\n/* uncomment once in winlogbeat to avoid bypass with rogue process with matching pe original file name */\n/* and process.code_signature.subject_name == \"Microsoft Windows\" and process.code_signature.status == \"trusted\" */\n", "references": [ "https://www.elastic.co/blog/practical-security-engineering-stateful-detection" @@ -74,5 +75,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 7 + "version": 8 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_registry_uncommon.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_registry_uncommon.json index 70f46879835fd..86fa0b2ed1204 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_registry_uncommon.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_registry_uncommon.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Detects changes to registry persistence keys that are uncommonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner.", + "description": "Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner.", "from": "now-9m", "index": [ "logs-endpoint.events.*" @@ -63,7 +63,9 @@ ] } ], + "timeline_id": "3e47ef71-ebfc-4520-975c-cb27fc090799", + "timeline_title": "Comprehensive Registry Timeline", "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_remote_password_reset.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_remote_password_reset.json index cb79c3be9968a..2931ecc753ea3 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_remote_password_reset.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_remote_password_reset.json @@ -47,7 +47,6 @@ ] } ], - "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_run_key_and_startup_broad.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_run_key_and_startup_broad.json index 06405f2497f2c..9cc1b79e02567 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_run_key_and_startup_broad.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_run_key_and_startup_broad.json @@ -45,7 +45,9 @@ ] } ], + "timeline_id": "3e47ef71-ebfc-4520-975c-cb27fc090799", + "timeline_title": "Comprehensive Registry Timeline", "timestamp_override": "event.ingested", "type": "eql", - "version": 5 + "version": 6 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_engine_unexpected_child_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_engine_unexpected_child_process.json index a81074f4f866a..4177569159cb7 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_engine_unexpected_child_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_engine_unexpected_child_process.json @@ -11,7 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Unexpected Child Process of macOS Screensaver Engine", - "note": "## Triage and analysis\n\n- Analyze the descendant processes of the ScreenSaverEngine process for malicious code and suspicious behavior such\nas a download of a payload from a server\n- Review the installed and activated screensaver on the host. Triage the screensaver (.saver) file that was triggered to\nidentify whether the file is malicious or not.\n", + "note": "## Triage and analysis\n\n- Analyze the descendant processes of the ScreenSaverEngine process for malicious code and suspicious behavior such\nas a download of a payload from a server.\n- Review the installed and activated screensaver on the host. Triage the screensaver (.saver) file that was triggered to\nidentify whether the file is malicious or not.\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and process.parent.name == \"ScreenSaverEngine\"\n", "references": [ "https://posts.specterops.io/saving-your-access-d562bf5bf90b", @@ -46,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_plist_file_modification.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_plist_file_modification.json index dcd7427d7cbcd..850014c75a7e7 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_plist_file_modification.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_screensaver_plist_file_modification.json @@ -11,7 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Screensaver Plist File Modified by Unexpected Process", - "note": "## Triage and analysis\n\n- Analyze the plist file modification event to identify whether the change was expected or not\n- Investigate the process that modified the plist file for malicious code or other suspicious behavior\n- Identify if any suspicious or known malicious screensaver (.saver) files were recently written to or modified on the host", + "note": "## Triage and analysis\n\n- Analyze the plist file modification event to identify whether the change was expected or not\n- Investigate the process that modified the plist file for malicious code or other suspicious behavior\n- Identify if any suspicious or known malicious screensaver (.saver) files were recently written to or modified on the host\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n file.name: \"com.apple.screensaver.*.plist\" and\n file.path : (\n \"/Users/*/Library/Preferences/ByHost/*\",\n \"/Library/Managed Preferences/*\",\n \"/System/Library/Preferences/*\"\n ) and\n /* Filter OS processes modifying screensaver plist files */\n not process.executable : (\n \"/usr/sbin/cfprefsd\",\n \"/usr/libexec/xpcproxy\",\n \"/System/Library/CoreServices/ManagedClient.app/Contents/Resources/MCXCompositor\",\n \"/System/Library/CoreServices/ManagedClient.app/Contents/MacOS/ManagedClient\"\n )\n", "references": [ "https://posts.specterops.io/saving-your-access-d562bf5bf90b", @@ -46,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_sdprop_exclusion_dsheuristics.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_sdprop_exclusion_dsheuristics.json new file mode 100644 index 0000000000000..d17662494b71e --- /dev/null +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_sdprop_exclusion_dsheuristics.json @@ -0,0 +1,45 @@ +{ + "author": [ + "Elastic" + ], + "description": "Identifies a modification on the dsHeuristics attribute on the bit that holds the configuration of groups excluded from the SDProp process. The SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, meaning that groups excluded will remain unchanged. Attackers can abuse this misconfiguration to maintain long-term access to privileged accounts in these groups.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "AdminSDHolder SDProp Exclusion Added", + "note": "## Triage and analysis.\n\n### Investigating AdminSDHolder SDProp Exclusion Added\n\nThe SDProp process compares the permissions on protected objects with those defined on the AdminSDHolder object. If the\npermissions on any of the protected accounts and groups do not match, it resets the permissions on the protected\naccounts and groups to match those defined in the domain AdminSDHolder object.\n\nThe dSHeuristics is a Unicode string attribute, in which each character in the string represents a heuristic that is\nused to determine the behavior of Active Directory.\n\nAdministrators can use the dSHeuristics attribute to exclude privilege groups from the SDProp process by setting the\n16th bit (dwAdminSDExMask) of the string to a certain value, which represents the group(s):\n\n* For example, to exclude the Account Operators group, an administrator would modify the string, so the 16th character\nis set to 1 (i.e., 0000000001000001). \n\nThe usage of this exclusion can leave the accounts unprotected and facilitate the misconfigurations of privilege on the\nexcluded groups, leaving a gap for attackers to add accounts to these groups to maintain long-term persistence with high\nprivileges.\n\nThis rule will monitor changes on the dsHeuristics object where the 16th bit is set to a value other than zero.\n\n#### Possible investigation steps:\n\n- Identify the account that performed the action\n- Confirm whether the account owner is aware of the operation\n- Investigate other alerts related to the user in the last 48 hours.\n- Check the value assigned to the 16th bit of the string on the `winlog.event_data.AttributeValue` field:\n - Account Operators eq 1\n - Server Operators eq 2\n - Print Operators eq 4\n - Backup Operators eq 8\n The field value can range from 0 to f (15). If more than one group is specified, the values will be summed together;\n for example, Backup Operators and Print Operators will set the `c` value on the bit.\n\n### False Positive Analysis\n\n- While this modification can be done legitimately, it is not best practice. Any potential B-TP (Benign True Positive)\nshould be mapped and reviewed by the security team for alternatives as this weakens the security of the privileged group.\n\n### Response and Remediation\n\n- The change can be reverted by setting the dwAdminSDExMask (16th bit) to 0 in dSHeuristics.\n\n## Config\n\nThe 'Audit Directory Service Changes' logging policy must be configured for (Success).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nDS Access > \nAudit Directory Service Changes (Success)\n```\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n\n", + "query": "any where event.action == \"Directory Service Changes\" and\n event.code == \"5136\" and\n length(winlog.event_data.AttributeValue) > 15 and\n winlog.event_data.AttributeValue regex~ \"[0-9]{15}([1-9a-f]).*\"\n", + "references": [ + "https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dsheuristics_bad", + "https://petri.com/active-directory-security-understanding-adminsdholder-object" + ], + "risk_score": 73, + "rule_id": "61d29caf-6c15-4d1e-9ccb-7ad12ccc0bc7", + "severity": "high", + "tags": [ + "Elastic", + "Host", + "Windows", + "Threat Detection", + "Persistence", + "Active Directory" + ], + "threat": [ + { + "framework": "MITRE ATT&CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 +} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_startup_folder_file_written_by_suspicious_process.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_startup_folder_file_written_by_suspicious_process.json index 3155c0094a19d..a18d14e6fb047 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_startup_folder_file_written_by_suspicious_process.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_startup_folder_file_written_by_suspicious_process.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Shortcut File Written or Modified for Persistence", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n user.domain != \"NT AUTHORITY\" and\n file.path : (\"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\*\", \n \"C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp\\\\*\") and\n process.name : (\"cmd.exe\",\n \"powershell.exe\",\n \"wmic.exe\",\n \"mshta.exe\",\n \"pwsh.exe\",\n \"cscript.exe\",\n \"wscript.exe\",\n \"regsvr32.exe\",\n \"RegAsm.exe\",\n \"rundll32.exe\",\n \"EQNEDT32.EXE\",\n \"WINWORD.EXE\",\n \"EXCEL.EXE\",\n \"POWERPNT.EXE\",\n \"MSPUB.EXE\",\n \"MSACCESS.EXE\",\n \"iexplore.exe\",\n \"InstallUtil.exe\")\n", "risk_score": 47, "rule_id": "440e2db4-bc7f-4c96-a068-65b78da59bde", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_startup_folder_scripts.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_startup_folder_scripts.json index 48430958773ff..c77e24bc6db41 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_startup_folder_scripts.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_startup_folder_scripts.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistent Scripts in the Startup Directory", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and user.domain != \"NT AUTHORITY\" and\n \n /* detect shortcuts created by wscript.exe or cscript.exe */\n (file.path : \"C:\\\\*\\\\Programs\\\\Startup\\\\*.lnk\" and\n process.name : (\"wscript.exe\", \"cscript.exe\")) or\n\n /* detect vbs or js files created by any process */\n file.path : (\"C:\\\\*\\\\Programs\\\\Startup\\\\*.vbs\", \n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.vbe\", \n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.wsh\", \n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.wsf\", \n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.js\")\n", "risk_score": 47, "rule_id": "f7c4dc5a-a58d-491d-9f14-9b66507121c0", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_image_load_scheduled_task_ms_office.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_image_load_scheduled_task_ms_office.json index 2cee06706f9d3..6798f8986ae5f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_image_load_scheduled_task_ms_office.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_image_load_scheduled_task_ms_office.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Image Load (taskschd.dll) from MS Office", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "library where process.name : (\"WINWORD.EXE\", \"EXCEL.EXE\", \"POWERPNT.EXE\", \"MSPUB.EXE\", \"MSACCESS.EXE\") and\n event.action : \"load\" and\n event.category : \"library\" and\n dll.name : \"taskschd.dll\"\n", "references": [ "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16", @@ -46,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_scheduled_task_runtime.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_scheduled_task_runtime.json index 812c35350677f..d85587bc57856 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_scheduled_task_runtime.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_suspicious_scheduled_task_runtime.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Execution via Scheduled Task", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n /* Schedule service cmdline on Win10+ */\n process.parent.name : \"svchost.exe\" and process.parent.args : \"Schedule\" and\n /* add suspicious programs here */\n process.pe.original_file_name in\n (\n \"cscript.exe\",\n \"wscript.exe\",\n \"PowerShell.EXE\",\n \"Cmd.Exe\",\n \"MSHTA.EXE\",\n \"RUNDLL32.EXE\",\n \"REGSVR32.EXE\",\n \"MSBuild.exe\",\n \"InstallUtil.exe\",\n \"RegAsm.exe\",\n \"RegSvcs.exe\",\n \"msxsl.exe\",\n \"CONTROL.EXE\",\n \"EXPLORER.EXE\",\n \"Microsoft.Workflow.Compiler.exe\",\n \"msiexec.exe\"\n ) and\n /* add suspicious paths here */\n process.args : (\n \"C:\\\\Users\\\\*\",\n \"C:\\\\ProgramData\\\\*\", \n \"C:\\\\Windows\\\\Temp\\\\*\", \n \"C:\\\\Windows\\\\Tasks\\\\*\", \n \"C:\\\\PerfLogs\\\\*\", \n \"C:\\\\Intel\\\\*\", \n \"C:\\\\Windows\\\\Debug\\\\*\", \n \"C:\\\\HP\\\\*\")\n", "risk_score": 47, "rule_id": "5d1d6907-0747-4d5d-9b24-e4a18853dc0a", @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_system_shells_via_services.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_system_shells_via_services.json index 4d069dd56132e..3f869207d8d97 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_system_shells_via_services.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_system_shells_via_services.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "System Shells via Services", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"services.exe\" and\n process.name : (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and\n \n /* Third party FP's */\n not process.args : \"NVDisplay.ContainerLocalSystem\"\n", "risk_score": 47, "rule_id": "0022d47d-39c7-4f69-a232-4fe9dc7a3acd", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_time_provider_mod.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_time_provider_mod.json index 30900394ec9c3..8c4037fd44893 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_time_provider_mod.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_time_provider_mod.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Windows operating systems are utilizing the time provider architecture in order to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll. Adversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider.", + "description": "Identifies modification of the Time Provider. Adversaries may establish persistence by registering and enabling a malicious DLL as a time provider. Windows uses the time provider architecture to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in the System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll.", "from": "now-9m", "index": [ "logs-endpoint.events.*" @@ -50,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_added_to_privileged_group_ad.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_added_to_privileged_group_ad.json index 1e55f014806f3..70422a0429998 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_added_to_privileged_group_ad.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_added_to_privileged_group_ad.json @@ -7,11 +7,13 @@ "from": "now-9m", "index": [ "winlogbeat-*", - "logs-windows.*" + "logs-windows.*", + "logs-system.*" ], "language": "eql", "license": "Elastic License v2", "name": "User Added to Privileged Group in Active Directory", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "iam where event.action == \"added-member-to-group\" and\n group.name : (\"Admin*\",\n \"Local Administrators\",\n \"Domain Admins\",\n \"Enterprise Admins\",\n \"Backup Admins\",\n \"Schema Admins\",\n \"DnsAdmins\",\n \"Exchange Organization Administrators\")\n", "references": [ "https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory" @@ -45,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_creation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_creation.json index 0777dfccab4bf..ec9b8ed562839 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_creation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_user_account_creation.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "User Account Creation", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.name : (\"net.exe\", \"net1.exe\") and\n not process.parent.name : \"net.exe\" and\n (process.args : \"user\" and process.args : (\"/ad\", \"/add\"))\n", "risk_score": 21, "rule_id": "1aa9181a-492b-4c01-8b16-fa0735786b2b", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_application_shimming.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_application_shimming.json index 13c8829869c8d..cac0497455b68 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_application_shimming.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_application_shimming.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Application Shimming via Sdbinst", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and process.name : \"sdbinst.exe\"\n", "risk_score": 21, "rule_id": "fd4a992d-6130-4802-9ff8-829b89ae801f", @@ -71,5 +72,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 8 + "version": 9 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_bits_job_notify_command.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_bits_job_notify_command.json index 6cd322d20d4e8..8625a3bdedc6a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_bits_job_notify_command.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_bits_job_notify_command.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistence via BITS Job Notify Cmdline", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.parent.name : \"svchost.exe\" and process.parent.args : \"BITS\" and\n not process.executable :\n (\"?:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\System32\\\\wermgr.exe\",\n \"?:\\\\WINDOWS\\\\system32\\\\directxdatabaseupdater.exe\")\n", "references": [ "https://pentestlab.blog/2019/10/30/persistence-bits-jobs/", @@ -48,5 +49,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_hidden_run_key_valuename.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_hidden_run_key_valuename.json index f7589be60ff6e..d7b66aa33106c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_hidden_run_key_valuename.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_hidden_run_key_valuename.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistence via Hidden Run Key Detected", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "/* Registry Path ends with backslash */\nregistry where /* length(registry.data.strings) > 0 and */\n registry.path : (\"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\n \"HKU\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\", \n \"HKLM\\\\Software\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\", \n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\\",\n \"HKU\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\\")\n", "references": [ "https://github.com/outflanknl/SharpHide", @@ -53,5 +54,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_lsa_security_support_provider_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_lsa_security_support_provider_registry.json index 5e796de0460aa..c61fe5b8a17d5 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_lsa_security_support_provider_registry.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_lsa_security_support_provider_registry.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Installation of Security Support Provider", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where\n registry.path : (\"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Lsa\\\\Security Packages*\", \n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Lsa\\\\OSConfig\\\\Security Packages*\") and\n not process.executable : (\"C:\\\\Windows\\\\System32\\\\msiexec.exe\", \"C:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\")\n", "risk_score": 47, "rule_id": "e86da94d-e54b-4fb5-b96c-cecff87e8787", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_telemetrycontroller_scheduledtask_hijack.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_telemetrycontroller_scheduledtask_hijack.json index 0d9cd0cb4020a..e852ed1e330be 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_telemetrycontroller_scheduledtask_hijack.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_telemetrycontroller_scheduledtask_hijack.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistence via TelemetryController Scheduled Task Hijack", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"CompatTelRunner.exe\" and process.args : \"-cv*\" and\n not process.name : (\"conhost.exe\",\n \"DeviceCensus.exe\",\n \"CompatTelRunner.exe\",\n \"DismHost.exe\",\n \"rundll32.exe\",\n \"powershell.exe\")\n", "references": [ "https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/?utm_content=131234033&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_update_orchestrator_service_hijack.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_update_orchestrator_service_hijack.json index e40519f75ee2d..23e80df260e08 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_update_orchestrator_service_hijack.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_update_orchestrator_service_hijack.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistence via Update Orchestrator Service Hijack", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.parent.executable : \"C:\\\\Windows\\\\System32\\\\svchost.exe\" and\n process.parent.args : \"UsoSvc\" and\n not process.executable :\n (\n \"C:\\\\Windows\\\\System32\\\\UsoClient.exe\",\n \"C:\\\\Windows\\\\System32\\\\MusNotification.exe\",\n \"C:\\\\Windows\\\\System32\\\\MusNotificationUx.exe\",\n \"C:\\\\Windows\\\\System32\\\\MusNotifyIcon.exe\",\n \"C:\\\\Windows\\\\System32\\\\WerFault.exe\",\n \"C:\\\\Windows\\\\System32\\\\WerMgr.exe\"\n )\n", "references": [ "https://github.com/irsl/CVE-2020-1313" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_windows_management_instrumentation_event_subscription.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_windows_management_instrumentation_event_subscription.json index 79e887a548bcb..181a51ee552b1 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_windows_management_instrumentation_event_subscription.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_via_windows_management_instrumentation_event_subscription.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Persistence via WMI Event Subscription", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n (process.name : \"wmic.exe\" or process.pe.original_file_name == \"wmic.exe\") and\n process.args : \"create\" and\n process.args : (\"ActiveScriptEventConsumer\", \"CommandLineEventConsumer\")\n", "risk_score": 21, "rule_id": "9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_webshell_detection.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_webshell_detection.json index 3d8a9fc545b1f..0839cf1c04b78 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_webshell_detection.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/persistence_webshell_detection.json @@ -15,7 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Webshell Detection: Script Process Child of Common Web Processes", - "note": "## Triage and analysis\n\nDetections should be investigated to identify if the activity corresponds to legitimate activity. As this rule detects post-exploitation process activity, investigations into this should be prioritized.", + "note": "## Triage and analysis\n\nDetections should be investigated to identify if the activity corresponds to legitimate activity. As this rule detects post-exploitation process activity, investigations into this should be prioritized.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.parent.name : (\"w3wp.exe\", \"httpd.exe\", \"nginx.exe\", \"php.exe\", \"php-cgi.exe\", \"tomcat.exe\") and \n process.name : (\"cmd.exe\", \"cscript.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\", \"wmic.exe\", \"wscript.exe\")\n", "references": [ "https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/" @@ -71,5 +71,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_applescript_with_admin_privs.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_applescript_with_admin_privs.json index 85c97465148a4..8d41551fa4f24 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_applescript_with_admin_privs.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_applescript_with_admin_privs.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Apple Scripting Execution with Administrator Privileges", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and process.name : \"osascript\" and\n process.command_line : \"osascript*with administrator privileges\"\n", "references": [ "https://discussions.apple.com/thread/2266150" @@ -60,5 +61,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_disable_uac_registry.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_disable_uac_registry.json index c31cec2aeaa40..d87e6bf6d5c9a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_disable_uac_registry.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_disable_uac_registry.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Disabling User Account Control via Registry Modification", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "registry where event.type == \"change\" and\n registry.path :\n (\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\EnableLUA\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\ConsentPromptBehaviorAdmin\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\PromptOnSecureDesktop\"\n ) and\n registry.data.strings : (\"0\", \"0x00000000\")\n", "references": [ "https://www.greyhathacker.net/?p=796", @@ -76,5 +77,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_iniscript.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_iniscript.json index f08fc5979a24c..a75c18acbe04e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_iniscript.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_iniscript.json @@ -13,7 +13,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "Startup/Logon Script added to Group Policy Object", - "note": "## Triage and analysis\n\n### Investigating Scheduled Task Execution at Scale via GPO\n\nGroup Policy Objects can be used by attackers as a mechanism for an attacker to instruct an arbitrarily large group of clients to\nexecute specified commands at startup, logon, shutdown, and logoff. This is done by creating/modifying the `scripts.ini` or \n`psscripts.ini` files. The scripts are stored in the following path: `\\Machine\\Scripts\\`, `\\User\\Scripts\\`\n\n#### Possible investigation steps:\n- This attack abuses a legitimate mechanism of the Active Directory, so it is important to determine whether the activity is legitimate\nand the administrator is authorized to perform this operation.\n- Retrieve the contents of the script file, and check for any potentially malicious commands and binaries.\n- If the action is suspicious for the user, check for any other activities done by the user in the last 48 hours.\n\n### False Positive Analysis\n- Verify if the execution is allowed and done under change management, and legitimate.\n\n### Related Rules\n- Group Policy Abuse for Privilege Addition - b9554892-5e0e-424b-83a0-5aef95aa43bf\n- Scheduled Task Execution at Scale via GPO - 15a8ba77-1c13-4274-88fe-6bd14133861e\n\n### Response and Remediation\n- Immediate response should be taken to validate activity, investigate, and potentially isolate activity to prevent further\npost-compromise behavior.\n\n## Config\n\nThe 'Audit Detailed File Share' audit policy is required be configured (Success Failure).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nObject Access > \nAudit Detailed File Share (Success,Failure)\n```\n\nThe 'Audit Directory Service Changes' audit policy is required be configured (Success Failure).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nDS Access > \nAudit Directory Service Changes (Success,Failure)\n```\n", + "note": "## Triage and analysis\n\n### Investigating Scheduled Task Execution at Scale via GPO\n\nGroup Policy Objects (GPOs) can be used by attackers to instruct arbitrarily large groups of\nclients to execute specified commands at startup, logon, shutdown, and logoff. This is done by creating or modifying the\n`scripts.ini` or `psscripts.ini` files. The scripts are stored in the following path: `\\Machine\\Scripts\\`,\n`\\User\\Scripts\\`\n\n#### Possible investigation steps\n\n- This attack abuses a legitimate mechanism of the Active Directory, so it is important to determine whether the\nactivity is legitimate and the administrator is authorized to perform this operation.\n- Retrieve the contents of the script file, and check for any potentially malicious commands and binaries.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Scope which objects have been affected.\n\n### False positive analysis\n\n- Verify if the execution is legitimately authorized and executed under a change management process.\n\n### Related rules\n\n- Group Policy Abuse for Privilege Addition - b9554892-5e0e-424b-83a0-5aef95aa43bf\n- Scheduled Task Execution at Scale via GPO - 15a8ba77-1c13-4274-88fe-6bd14133861e\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- The investigation and containment must be performed in every computer controlled by the GPO, where necessary.\n- Remove the script from the GPO.\n- Check if other GPOs have suspicious scripts attached.\n\n## Config\n\nThe 'Audit Detailed File Share' audit policy must be configured (Success Failure).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nObject Access > \nAudit Detailed File Share (Success,Failure)\n```\n\nThe 'Audit Directory Service Changes' audit policy must be configured (Success Failure).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nDS Access > \nAudit Directory Service Changes (Success,Failure)\n```\n", "query": "(\n event.code:5136 and winlog.event_data.AttributeLDAPDisplayName:(gPCMachineExtensionNames or gPCUserExtensionNames) and\n winlog.event_data.AttributeValue:(*42B5FAAE-6536-11D2-AE5A-0000F87571E3* and\n (*40B66650-4972-11D1-A7CA-0000F87571E3* or *40B6664F-4972-11D1-A7CA-0000F87571E3*))\n)\nor\n(\n event.code:5145 and winlog.event_data.ShareName:\\\\\\\\*\\\\SYSVOL and\n winlog.event_data.RelativeTargetName:(*\\\\scripts.ini or *\\\\psscripts.ini) and\n (message:WriteData or winlog.event_data.AccessList:*%%4417*)\n)\n", "references": [ "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md", @@ -62,5 +62,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_privileged_groups.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_privileged_groups.json index e2f46bc0dd897..5d1fbdf53705f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_privileged_groups.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_privileged_groups.json @@ -10,7 +10,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "Group Policy Abuse for Privilege Addition", - "note": "## Triage and analysis\n\n### Investigating Group Policy Abuse for Privilege Addition\n\nGroup Policy Objects can be used to add rights and/or modify Group Membership on GPOs by changing the contents of an INF\nfile named GptTmpl.inf, which is responsible for storing every setting under the Security Settings container in the GPO.\nThis file is unique for each GPO, and only exists if the GPO contains security settings.\nExample Path: \"\\\\DC.com\\SysVol\\DC.com\\Policies\\{21B9B880-B2FB-4836-9C2D-2013E0D832E9}\\Machine\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf\"\n\n#### Possible investigation steps:\n- This attack abuses a legitimate mechanism of the Active Directory, so it is important to determine whether the activity\nis legitimate and the administrator is authorized to perform this operation.\n- Retrieve the contents of the `GptTmpl.inf` file, and under the `Privilege Rights` section, look for potentially\ndangerous high privileges, for example: SeTakeOwnershipPrivilege, SeEnableDelegationPrivilege, etc.\n- Inspect the user SIDs associated with these privileges\n\n### False Positive Analysis\n- Verify if these User SIDs should have these privileges enabled.\n- Inspect whether the user that has done these modifications should be allowed to do it. The user name can be found in the\n`winlog.event_data.SubjectUserName` field.\n\n### Related Rules\n- Scheduled Task Execution at Scale via GPO\n- Startup/Logon Script added to Group Policy Object\n\n### Response and Remediation\n- Immediate response should be taken to validate activity, investigate, and potentially isolate activity to prevent further\npost-compromise behavior.\n\n## Config\n\nThe 'Audit Directory Service Changes' audit policy is required be configured (Success Failure).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nDS Access > \nAudit Directory Service Changes (Success,Failure)\n```\n", + "note": "## Triage and analysis\n\n### Investigating Group Policy Abuse for Privilege Addition\n\nGroup Policy Objects (GPOs) can be used to add rights and/or modify Group Membership on GPOs by changing the contents of an INF\nfile named GptTmpl.inf, which is responsible for storing every setting under the Security Settings container in the GPO.\nThis file is unique for each GPO, and only exists if the GPO contains security settings.\nExample Path: \"\\\\DC.com\\SysVol\\DC.com\\Policies\\{PolicyGUID}\\Machine\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf\"\n\n#### Possible investigation steps\n\n- This attack abuses a legitimate mechanism of the Active Directory, so it is important to determine whether the\nactivity is legitimate and the administrator is authorized to perform this operation.\n- Retrieve the contents of the `GptTmpl.inf` file, and under the `Privilege Rights` section, look for potentially\ndangerous high privileges, for example: SeTakeOwnershipPrivilege, SeEnableDelegationPrivilege, etc.\n- Inspect the user security identifiers (SIDs) associated with these privileges, and if they should have these privileges.\n\n### False positive analysis\n\n- Inspect whether the user that has done the modifications should be allowed to. The user name can be found in the\n`winlog.event_data.SubjectUserName` field.\n\n### Related rules\n\n- Scheduled Task Execution at Scale via GPO - 15a8ba77-1c13-4274-88fe-6bd14133861e\n- Startup/Logon Script added to Group Policy Object - 16fac1a1-21ee-4ca6-b720-458e3855d046\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- The investigation and containment must be performed in every computer controlled by the GPO, where necessary.\n- Remove the script from the GPO.\n- Check if other GPOs have suspicious scripts attached.\n\n## Config\n\nThe 'Audit Directory Service Changes' audit policy must be configured (Success Failure).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nDS Access > \nAudit Directory Service Changes (Success,Failure)\n```\n", "query": "event.code: \"5136\" and winlog.event_data.AttributeLDAPDisplayName:\"gPCMachineExtensionNames\" and \nwinlog.event_data.AttributeValue:(*827D319E-6EAC-11D2-A4EA-00C04F79F83A* and *803E14A0-B4FB-11D0-A0D0-00A0C90F574B*)\n", "references": [ "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md", @@ -53,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_scheduled_task.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_scheduled_task.json index 01586f1b7409c..d2322eb07066a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_scheduled_task.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_group_policy_scheduled_task.json @@ -10,7 +10,7 @@ "language": "kuery", "license": "Elastic License v2", "name": "Scheduled Task Execution at Scale via GPO", - "note": "## Triage and analysis\n\n### Investigating Scheduled Task Execution at Scale via GPO\n\nGroup Policy Objects can be used by attackers to execute scheduled tasks at scale to compromise objects controlled by a\ngiven GPO. This is done by changing the contents of the `\\Machine\\Preferences\\ScheduledTasks\\ScheduledTasks.xml`\nfile.\n\n#### Possible investigation steps:\n- This attack abuses a legitimate mechanism of the Active Directory, so it is important to determine whether the activity\nis legitimate and the administrator is authorized to perform this operation.\n- Retrieve the contents of the `ScheduledTasks.xml` file, \u00e1nd check the `` and `` XML tags for any\npotentially malicious commands and binaries.\n- If the action is suspicious for the user, check for any other activities done by the user in the last 48 hours.\n\n### False Positive Analysis\n- Verify if the execution is allowed and done under change management, and if the execution is legitimate.\n\n### Related Rules\n- Group Policy Abuse for Privilege Addition\n- Startup/Logon Script added to Group Policy Object\n\n### Response and Remediation\n- Immediate response should be taken to validate activity, investigate, and potentially isolate activity to prevent further\npost-compromise behavior.\n\n## Config\n\nThe 'Audit Detailed File Share' audit policy is required be configured (Success Failure).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nObject Access > \nAudit Detailed File Share (Success,Failure)\n```\n\nThe 'Audit Directory Service Changes' audit policy is required be configured (Success Failure).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nDS Access > \nAudit Directory Service Changes (Success,Failure)\n```\n", + "note": "## Triage and analysis\n\n### Investigating Scheduled Task Execution at Scale via GPO\n\nGroup Policy Objects (GPOs) can be used by attackers to execute scheduled tasks at scale to compromise objects controlled\nby a given GPO. This is done by changing the contents of the `\\Machine\\Preferences\\ScheduledTasks\\ScheduledTasks.xml`\nfile.\n\n#### Possible investigation steps\n\n- This attack abuses a legitimate mechanism of the Active Directory, so it is important to determine whether the activity\nis legitimate and the administrator is authorized to perform this operation.\n- Retrieve the contents of the `ScheduledTasks.xml` file, and check the `` and `` XML tags for any\npotentially malicious commands and binaries.\n- Investigate other alerts related to the user/host in the last 48 hours.\n- Scope which objects have been affected.\n\n### False positive analysis\n\n- Verify if the execution is allowed and done under change management, and if the execution is legitimate.\n\n### Related rules\n\n- Group Policy Abuse for Privilege Addition - b9554892-5e0e-424b-83a0-5aef95aa43bf\n- Startup/Logon Script added to Group Policy Object - 16fac1a1-21ee-4ca6-b720-458e3855d046\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- The investigation and containment must be performed in every computer controlled by the GPO, where necessary.\n- Remove the script from the GPO.\n- Check if other GPOs have suspicious scheduled tasks attached.\n\n## Config\n\nThe 'Audit Detailed File Share' audit policy must be configured (Success Failure).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nObject Access > \nAudit Detailed File Share (Success,Failure)\n```\n\nThe 'Audit Directory Service Changes' audit policy must be configured (Success Failure).\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration > \nPolicies > \nWindows Settings > \nSecurity Settings > \nAdvanced Audit Policies Configuration > \nAudit Policies > \nDS Access > \nAudit Directory Service Changes (Success,Failure)\n```\n", "query": "(event.code: \"5136\" and winlog.event_data.AttributeLDAPDisplayName:(\"gPCMachineExtensionNames\" or \"gPCUserExtensionNames\") and \n winlog.event_data.AttributeValue:(*CAB54552-DEEA-4691-817E-ED4A4D1AFC72* and *AADCED64-746C-4633-A97C-D61349046527*)) \nor\n(event.code: \"5145\" and winlog.event_data.ShareName: \"\\\\\\\\*\\\\SYSVOL\" and winlog.event_data.RelativeTargetName: *ScheduledTasks.xml and\n (message: WriteData or winlog.event_data.AccessList: *%%4417*))\n", "references": [ "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md", @@ -68,5 +68,5 @@ ], "timestamp_override": "event.ingested", "type": "query", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_installertakeover.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_installertakeover.json index 6681bac66c053..423fdeb75889c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_installertakeover.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_installertakeover.json @@ -12,8 +12,8 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Privilege Escalation via InstallerFileTakeOver", - "note": "## Triage and analysis.\n\n### Investigating Potential Priivilege Escalation via InstallerFileTakeOver\n\nInstallerFileTakeOver is a weaponized EoP PoC to the CVE-2021-41379 vulnerability. Upon successful exploitation,\nan unprivileged user will escalate privileges to SYSTEM/NT AUTHORITY.\n\nThis rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself\nto the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked), which is outside the scope of this rule.\n\n#### Possible investigation steps:\n\n- Check for the digital signature of the executable.\n- Look for additional processes spawned by the process, command lines, and network communications.\n- Look for additional alerts involving the host and the user.\n\n### False Positive Analysis\n\n- Verify whether the digital signature exists in the executable, and if it is valid.\n\n### Related Rules\n\n- Suspicious DLL Loaded for Persistence or Privilege Escalation - bfeaf89b-a2a7-48a3-817f-e41829dc61ee\n\n### Response and Remediation\n\n- Immediate response should be taken to validate activity, investigate, and potentially isolate activity to prevent further\npost-compromise behavior.\n", - "query": "/* This rule is compatible with both Sysmon and Elastic Endpoint */\n\nprocess where event.type == \"start\" and \n (process.Ext.token.integrity_level_name : \"System\" or\n winlog.event_data.IntegrityLevel : \"System\") and\n (\n (process.name : \"elevation_service.exe\" and \n not process.pe.original_file_name == \"elevation_service.exe\") or\n\n (process.parent.name : \"elevation_service.exe\" and \n process.name : (\"rundll32.exe\", \"cmd.exe\", \"powershell.exe\")) \n )\n", + "note": "## Triage and analysis.\n\n### Investigating Potential Priivilege Escalation via InstallerFileTakeOver\n\nInstallerFileTakeOver is a weaponized EoP PoC to the CVE-2021-41379 vulnerability. Upon successful exploitation,\nan unprivileged user will escalate privileges to SYSTEM/NT AUTHORITY.\n\nThis rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself\nto the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked), which is outside the scope of this rule.\n\n#### Possible investigation steps:\n\n- Check for the digital signature of the executable.\n- Look for additional processes spawned by the process, command lines, and network communications.\n- Look for additional alerts involving the host and the user.\n\n### False Positive Analysis\n\n- Verify whether the digital signature exists in the executable, and if it is valid.\n\n### Related Rules\n\n- Suspicious DLL Loaded for Persistence or Privilege Escalation - bfeaf89b-a2a7-48a3-817f-e41829dc61ee\n\n### Response and Remediation\n\n- Immediate response steps should be taken to validate, investigate, and potentially contain the activity to prevent\nfurther post-compromise behavior.\n\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", + "query": "/* This rule is compatible with both Sysmon and Elastic Endpoint */\n\nprocess where event.type == \"start\" and \n (?process.Ext.token.integrity_level_name : \"System\" or\n ?winlog.event_data.IntegrityLevel : \"System\") and\n (\n (process.name : \"elevation_service.exe\" and \n not process.pe.original_file_name == \"elevation_service.exe\") or\n\n (process.parent.name : \"elevation_service.exe\" and \n process.name : (\"rundll32.exe\", \"cmd.exe\", \"powershell.exe\")) \n )\n", "references": [ "https://github.com/klinix5/InstallerFileTakeOver" ], @@ -46,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_named_pipe_impersonation.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_named_pipe_impersonation.json index 22a5e6843bf78..f903528dd5918 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_named_pipe_impersonation.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_named_pipe_impersonation.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Privilege Escalation via Named Pipe Impersonation", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.pe.original_file_name in (\"Cmd.Exe\", \"PowerShell.EXE\") and \n process.args : \"echo\" and process.args : \">\" and process.args : \"\\\\\\\\.\\\\pipe\\\\*\"\n", "references": [ "https://www.ired.team/offensive-security/privilege-escalation/windows-namedpipes-privilege-escalation" @@ -45,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_persistence_phantom_dll.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_persistence_phantom_dll.json index e454a387b3883..4f924061b2294 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_persistence_phantom_dll.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_persistence_phantom_dll.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious DLL Loaded for Persistence or Privilege Escalation", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "library where dll.name :\n (\n \"wlbsctrl.dll\",\n \"wbemcomn.dll\",\n \"WptsExtensions.dll\",\n \"Tsmsisrv.dll\",\n \"TSVIPSrv.dll\",\n \"Msfte.dll\",\n \"wow64log.dll\",\n \"WindowsCoreDeviceInfo.dll\",\n \"Ualapi.dll\",\n \"wlanhlp.dll\",\n \"phoneinfo.dll\",\n \"EdgeGdi.dll\",\n \"cdpsgshims.dll\",\n \"windowsperformancerecordercontrol.dll\",\n \"diagtrack_win.dll\"\n ) and \nnot (dll.code_signature.subject_name : (\"Microsoft Windows\", \"Microsoft Corporation\") and dll.code_signature.status : \"trusted\")\n", "references": [ "https://itm4n.github.io/windows-dll-hijacking-clarified/", @@ -80,5 +81,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 2 + "version": 3 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_pkexec_envar_hijack.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_pkexec_envar_hijack.json index 402876ab4ccf7..298cb77347f04 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_pkexec_envar_hijack.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_pkexec_envar_hijack.json @@ -2,7 +2,7 @@ "author": [ "Elastic" ], - "description": "Identifies attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) via unsecure environment variable injection. Successful exploitation allows an unprivileged user to escalate to the root user.", + "description": "Identifies an attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) via unsecure environment variable injection. Successful exploitation allows an unprivileged user to escalate to the root user.", "from": "now-9m", "index": [ "logs-endpoint.events.*" @@ -66,5 +66,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_malicious_driver_file_changes.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_malicious_driver_file_changes.json deleted file mode 100644 index 215397251e8f5..0000000000000 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_malicious_driver_file_changes.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "author": [ - "Elastic" - ], - "description": "Detects the creation or modification of a print driver with an unusual file name. This may indicate attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to CVE-2021-34527 and verify that the impacted system is investigated.", - "from": "now-9m", - "index": [ - "winlogbeat-*", - "logs-endpoint.events.*", - "logs-windows.*" - ], - "language": "eql", - "license": "Elastic License v2", - "name": "Potential PrintNightmare File Modification", - "query": "/* This rule is compatible with both Sysmon and Elastic Endpoint */\n\nfile where process.name : \"spoolsv.exe\" and \n file.name : (\"kernelbase.dll\", \"ntdll.dll\", \"kernel32.dll\", \"winhttp.dll\", \"user32.dll\") and\n file.path : \"?:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\*\"\n", - "references": [ - "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527", - "https://github.com/afwu/PrintNightmare" - ], - "risk_score": 73, - "rule_id": "5e87f165-45c2-4b80-bfa5-52822552c997", - "severity": "high", - "tags": [ - "Elastic", - "Host", - "Windows", - "Threat Detection", - "Privilege Escalation" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1068", - "name": "Exploitation for Privilege Escalation", - "reference": "https://attack.mitre.org/techniques/T1068/" - } - ] - } - ], - "timestamp_override": "event.ingested", - "type": "eql", - "version": 1 -} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_malicious_registry_modification.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_malicious_registry_modification.json deleted file mode 100644 index 7f76c27f369af..0000000000000 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_malicious_registry_modification.json +++ /dev/null @@ -1,48 +0,0 @@ -{ - "author": [ - "Elastic" - ], - "description": "Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to CVE-2021-34527 and verify that the impacted system is investigated.", - "from": "now-9m", - "index": [ - "logs-endpoint.events.*" - ], - "language": "eql", - "license": "Elastic License v2", - "name": "Potential PrintNightmare Exploit Registry Modification", - "query": "/* This rule is not compatible with Sysmon due to schema issues */\n\nregistry where process.name : \"spoolsv.exe\" and\n (registry.path : \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Print\\\\Environments\\\\Windows*\\\\Drivers\\\\Version-3\\\\mimikatz*\\\\Data File\" or\n (registry.path : \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Print\\\\Environments\\\\Windows*\\\\Drivers\\\\Version-3\\\\*\\\\Configuration File\" and\n registry.data.strings : (\"kernelbase.dll\", \"ntdll.dll\", \"kernel32.dll\", \"winhttp.dll\", \"user32.dll\")))\n", - "references": [ - "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527", - "https://github.com/afwu/PrintNightmare" - ], - "risk_score": 73, - "rule_id": "6506c9fd-229e-4722-8f0f-69be759afd2a", - "severity": "high", - "tags": [ - "Elastic", - "Host", - "Windows", - "Threat Detection", - "Privilege Escalation" - ], - "threat": [ - { - "framework": "MITRE ATT&CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1068", - "name": "Exploitation for Privilege Escalation", - "reference": "https://attack.mitre.org/techniques/T1068/" - } - ] - } - ], - "timestamp_override": "event.ingested", - "type": "eql", - "version": 2 -} diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_service_suspicious_file.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_service_suspicious_file.json index 7197c7f979a38..77fe2279b0bc8 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_service_suspicious_file.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_service_suspicious_file.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious PrintSpooler Service Executable File Creation", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and process.name : \"spoolsv.exe\" and\n file.extension : (\"exe\", \"dll\") and\n not file.path : (\"?:\\\\Windows\\\\System32\\\\spool\\\\*\", \"?:\\\\Windows\\\\Temp\\\\*\", \"?:\\\\Users\\\\*\")\n", "references": [ "https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/", @@ -46,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_suspicious_file_deletion.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_suspicious_file_deletion.json index b4d930f99aacd..1b14e8db0f83a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_suspicious_file_deletion.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_suspicious_file_deletion.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious Print Spooler File Deletion", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type : \"deletion\" and\n not process.name : (\"spoolsv.exe\", \"dllhost.exe\", \"explorer.exe\") and\n file.path : \"?:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\*.dll\"\n", "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_suspicious_spl_file.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_suspicious_spl_file.json index 652a9a9466f01..c696aaaf8399e 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_suspicious_spl_file.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_printspooler_suspicious_spl_file.json @@ -12,7 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Suspicious PrintSpooler SPL File Created", - "note": "## Threat intel\n\nRefer to CVEs, CVE-2020-1048 and CVE-2020-1337 for further information on the vulnerability and exploit. Verify that the relevant system is patched.", + "note": "## Threat intel\n\nRefer to CVEs, CVE-2020-1048 and CVE-2020-1337 for further information on the vulnerability and exploit. Verify that the relevant system is patched.\n\n## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type != \"deletion\" and\n file.extension : \"spl\" and\n file.path : \"?:\\\\Windows\\\\System32\\\\spool\\\\PRINTERS\\\\*\" and\n not process.name : (\"spoolsv.exe\",\n \"printfilterpipelinesvc.exe\",\n \"PrintIsolationHost.exe\",\n \"splwow64.exe\",\n \"msiexec.exe\",\n \"poqexec.exe\")\n", "references": [ "https://safebreach.com/Post/How-we-bypassed-CVE-2020-1048-Patch-and-got-CVE-2020-1337" @@ -46,5 +46,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_samaccountname_spoofing_attack.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_samaccountname_spoofing_attack.json index b84b434e1d221..f8859ae7b9b60 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_samaccountname_spoofing_attack.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_samaccountname_spoofing_attack.json @@ -11,6 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Potential Privileged Escalation via SamAccountName Spoofing", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "iam where event.action == \"renamed-user-account\" and\n /* machine account name renamed to user like account name */\n winlog.event_data.OldTargetUserName : \"*$\" and not winlog.event_data.NewTargetUserName : \"*$\"\n", "references": [ "https://support.microsoft.com/en-us/topic/kb5008102-active-directory-security-accounts-manager-hardening-changes-cve-2021-42278-5975b463-4c95-45e1-831a-d120004e258e", @@ -71,5 +72,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_clipup.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_clipup.json index ef775f906584a..86d43189c8207 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_clipup.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_clipup.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and process.name : \"Clipup.exe\" and\n not process.executable : \"C:\\\\Windows\\\\System32\\\\ClipUp.exe\" and process.parent.name : \"dllhost.exe\" and\n /* CLSID of the Elevated COM Interface IEditionUpgradeManager */\n process.parent.args : \"/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}\"\n", "references": [ "https://github.com/hfiref0x/UACME" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_ieinstal.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_ieinstal.json index 0575622b1a2b1..d759d0f2a4875 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_ieinstal.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_ieinstal.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.executable : \"C:\\\\*\\\\AppData\\\\*\\\\Temp\\\\IDC*.tmp\\\\*.exe\" and\n process.parent.name : \"ieinstal.exe\" and process.parent.args : \"-Embedding\"\n\n /* uncomment once in winlogbeat */\n /* and not (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true) */\n", "references": [ "https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comautoapprovallist.html" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_interface_icmluautil.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_interface_icmluautil.json index 913eefc351bec..3e6dfc998b5e4 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_interface_icmluautil.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_com_interface_icmluautil.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "UAC Bypass via ICMLuaUtil Elevated COM Interface", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name == \"dllhost.exe\" and\n process.parent.args in (\"/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}\", \"/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}\") and\n process.pe.original_file_name != \"WerFault.exe\"\n", "risk_score": 73, "rule_id": "68d56fdc-7ffa-4419-8e95-81641bd6f845", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_diskcleanup_hijack.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_diskcleanup_hijack.json index 04ab0eaae3ee4..84cb66211e5e2 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_diskcleanup_hijack.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_diskcleanup_hijack.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "UAC Bypass via DiskCleanup Scheduled Task Hijack", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type == \"start\" and\n process.args : \"/autoclean\" and process.args : \"/d\" and\n not process.executable : (\"C:\\\\Windows\\\\System32\\\\cleanmgr.exe\",\n \"C:\\\\Windows\\\\SysWOW64\\\\cleanmgr.exe\",\n \"C:\\\\Windows\\\\System32\\\\taskhostw.exe\")\n", "risk_score": 47, "rule_id": "1dcc51f6-ba26-49e7-9ef4-2655abb2361e", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 6 + "version": 7 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_dll_sideloading.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_dll_sideloading.json index 126cae9bebaa5..3ee72bac00507 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_dll_sideloading.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_dll_sideloading.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "UAC Bypass Attempt via Privileged IFileOperation COM Interface", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "file where event.type : \"change\" and process.name : \"dllhost.exe\" and\n /* Known modules names side loaded into process running with high or system integrity level for UAC Bypass, update here for new modules */\n file.name : (\"wow64log.dll\", \"comctl32.dll\", \"DismCore.dll\", \"OskSupport.dll\", \"duser.dll\", \"Accessibility.ni.dll\") and\n /* has no impact on rule logic just to avoid OS install related FPs */\n not file.path : (\"C:\\\\Windows\\\\SoftwareDistribution\\\\*\", \"C:\\\\Windows\\\\WinSxS\\\\*\")\n", "references": [ "https://github.com/hfiref0x/UACME" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_event_viewer.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_event_viewer.json index deb500d8d8127..6c02f1d5587af 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_event_viewer.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_event_viewer.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Bypass UAC via Event Viewer", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"eventvwr.exe\" and\n not process.executable : \n (\"?:\\\\Windows\\\\SysWOW64\\\\mmc.exe\", \n \"?:\\\\Windows\\\\System32\\\\mmc.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\")\n", "risk_score": 73, "rule_id": "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62", @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 9 + "version": 10 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_mock_windir.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_mock_windir.json index d32df52daf0a2..7da33e8648100 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_mock_windir.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_mock_windir.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "UAC Bypass Attempt via Windows Directory Masquerading", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.args : (\"C:\\\\Windows \\\\system32\\\\*.exe\", \"C:\\\\Windows \\\\SysWOW64\\\\*.exe\")\n", "references": [ "https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_winfw_mmc_hijack.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_winfw_mmc_hijack.json index eb7d8aede1030..6ca1058cebc7f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_winfw_mmc_hijack.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_uac_bypass_winfw_mmc_hijack.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "UAC Bypass via Windows Firewall Snap-In Hijack", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name == \"mmc.exe\" and\n /* process.Ext.token.integrity_level_name == \"high\" can be added in future for tuning */\n /* args of the Windows Firewall SnapIn */\n process.parent.args == \"WF.msc\" and process.name != \"WerFault.exe\"\n", "references": [ "https://github.com/AzAgarampur/byeintegrity-uac" @@ -52,5 +53,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 4 + "version": 5 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_parentchild_relationship.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_parentchild_relationship.json index d9b7280392f38..5fb9682323ac5 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_parentchild_relationship.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_parentchild_relationship.json @@ -12,6 +12,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Unusual Parent-Child Relationship", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\nprocess.parent.name != null and\n (\n /* suspicious parent processes */\n (process.name:\"autochk.exe\" and not process.parent.name:\"smss.exe\") or\n (process.name:(\"fontdrvhost.exe\", \"dwm.exe\") and not process.parent.name:(\"wininit.exe\", \"winlogon.exe\")) or\n (process.name:(\"consent.exe\", \"RuntimeBroker.exe\", \"TiWorker.exe\") and not process.parent.name:\"svchost.exe\") or\n (process.name:\"SearchIndexer.exe\" and not process.parent.name:\"services.exe\") or\n (process.name:\"SearchProtocolHost.exe\" and not process.parent.name:(\"SearchIndexer.exe\", \"dllhost.exe\")) or\n (process.name:\"dllhost.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n (process.name:\"smss.exe\" and not process.parent.name:(\"System\", \"smss.exe\")) or\n (process.name:\"csrss.exe\" and not process.parent.name:(\"smss.exe\", \"svchost.exe\")) or\n (process.name:\"wininit.exe\" and not process.parent.name:\"smss.exe\") or\n (process.name:\"winlogon.exe\" and not process.parent.name:\"smss.exe\") or\n (process.name:(\"lsass.exe\", \"LsaIso.exe\") and not process.parent.name:\"wininit.exe\") or\n (process.name:\"LogonUI.exe\" and not process.parent.name:(\"wininit.exe\", \"winlogon.exe\")) or\n (process.name:\"services.exe\" and not process.parent.name:\"wininit.exe\") or\n (process.name:\"svchost.exe\" and not process.parent.name:(\"MsMpEng.exe\", \"services.exe\")) or\n (process.name:\"spoolsv.exe\" and not process.parent.name:\"services.exe\") or\n (process.name:\"taskhost.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n (process.name:\"taskhostw.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n (process.name:\"userinit.exe\" and not process.parent.name:(\"dwm.exe\", \"winlogon.exe\")) or\n (process.name:(\"wmiprvse.exe\", \"wsmprovhost.exe\", \"winrshost.exe\") and not process.parent.name:\"svchost.exe\") or\n /* suspicious child processes */\n (process.parent.name:(\"SearchProtocolHost.exe\", \"taskhost.exe\", \"csrss.exe\") and not process.name:(\"werfault.exe\", \"wermgr.exe\", \"WerFaultSecure.exe\")) or\n (process.parent.name:\"autochk.exe\" and not process.name:(\"chkdsk.exe\", \"doskey.exe\", \"WerFault.exe\")) or\n (process.parent.name:\"smss.exe\" and not process.name:(\"autochk.exe\", \"smss.exe\", \"csrss.exe\", \"wininit.exe\", \"winlogon.exe\", \"setupcl.exe\", \"WerFault.exe\")) or\n (process.parent.name:\"wermgr.exe\" and not process.name:(\"WerFaultSecure.exe\", \"wermgr.exe\", \"WerFault.exe\")) or\n (process.parent.name:\"conhost.exe\" and not process.name:(\"mscorsvw.exe\", \"wermgr.exe\", \"WerFault.exe\", \"WerFaultSecure.exe\"))\n )\n", "references": [ "https://github.com/sbousseaden/Slides/blob/master/Hunting%20MindMaps/PNG/Windows%20Processes%20TH.map.png", @@ -53,5 +54,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 10 + "version": 11 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_printspooler_childprocess.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_printspooler_childprocess.json index 17b5df39f8835..15200e98de46f 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_printspooler_childprocess.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_printspooler_childprocess.json @@ -15,7 +15,8 @@ "language": "eql", "license": "Elastic License v2", "name": "Unusual Print Spooler Child Process", - "query": "process where event.type == \"start\" and\n process.parent.name : \"spoolsv.exe\" and\n (process.Ext.token.integrity_level_name : \"System\" or\n winlog.event_data.IntegrityLevel : \"System\") and\n\n /* exclusions for FP control below */\n not process.name : (\"splwow64.exe\", \"PDFCreator.exe\", \"acrodist.exe\", \"spoolsv.exe\", \"msiexec.exe\", \"route.exe\", \"WerFault.exe\") and\n not process.command_line : \"*\\\\WINDOWS\\\\system32\\\\spool\\\\DRIVERS*\" and\n not (process.name : \"net.exe\" and process.command_line : (\"*stop*\", \"*start*\")) and\n not (process.name : (\"cmd.exe\", \"powershell.exe\") and process.command_line : (\"*.spl*\", \"*\\\\program files*\", \"*route add*\")) and\n not (process.name : \"netsh.exe\" and process.command_line : (\"*add portopening*\", \"*rule name*\")) and\n not (process.name : \"regsvr32.exe\" and process.command_line : \"*PrintConfig.dll*\")\n", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", + "query": "process where event.type == \"start\" and\n process.parent.name : \"spoolsv.exe\" and\n (?process.Ext.token.integrity_level_name : \"System\" or\n ?winlog.event_data.IntegrityLevel : \"System\") and\n\n /* exclusions for FP control below */\n not process.name : (\"splwow64.exe\", \"PDFCreator.exe\", \"acrodist.exe\", \"spoolsv.exe\", \"msiexec.exe\", \"route.exe\", \"WerFault.exe\") and\n not process.command_line : \"*\\\\WINDOWS\\\\system32\\\\spool\\\\DRIVERS*\" and\n not (process.name : \"net.exe\" and process.command_line : (\"*stop*\", \"*start*\")) and\n not (process.name : (\"cmd.exe\", \"powershell.exe\") and process.command_line : (\"*.spl*\", \"*\\\\program files*\", \"*route add*\")) and\n not (process.name : \"netsh.exe\" and process.command_line : (\"*add portopening*\", \"*rule name*\")) and\n not (process.name : \"regsvr32.exe\" and process.command_line : \"*PrintConfig.dll*\")\n", "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527", "https://github.com/afwu/PrintNightmare" @@ -49,5 +50,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_svchost_childproc_childless.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_svchost_childproc_childless.json index 0c82142531f68..9757765bf4af0 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_svchost_childproc_childless.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_unusual_svchost_childproc_childless.json @@ -15,6 +15,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Unusual Service Host Child Process - Childless Service", + "note": "## Config\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n", "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"svchost.exe\" and\n\n /* based on svchost service arguments -s svcname where the service is known to be childless */\n\n process.parent.args : (\"WdiSystemHost\",\"LicenseManager\",\n \"StorSvc\",\"CDPSvc\",\"cdbhsvc\",\"BthAvctpSvc\",\"SstpSvc\",\"WdiServiceHost\",\n \"imgsvc\",\"TrkWks\",\"WpnService\",\"IKEEXT\",\"PolicyAgent\",\"CryptSvc\",\n \"netprofm\",\"ProfSvc\",\"StateRepository\",\"camsvc\",\"LanmanWorkstation\",\n \"NlaSvc\",\"EventLog\",\"hidserv\",\"DisplayEnhancementService\",\"ShellHWDetection\",\n \"AppHostSvc\",\"fhsvc\",\"CscService\",\"PushToInstall\") and\n\n /* unknown FPs can be added here */\n\n not process.name : (\"WerFault.exe\",\"WerFaultSecure.exe\",\"wermgr.exe\")\n", "risk_score": 47, "rule_id": "6a8ab9cc-4023-4d17-b5df-1a3e16882ce7", @@ -68,5 +69,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 3 + "version": 4 } diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_via_rogue_named_pipe.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_via_rogue_named_pipe.json index 093833d5bce9f..25de7b35a68ec 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_via_rogue_named_pipe.json +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/privilege_escalation_via_rogue_named_pipe.json @@ -11,7 +11,7 @@ "language": "eql", "license": "Elastic License v2", "name": "Privilege Escalation via Rogue Named Pipe Impersonation", - "note": "## Config\n\nNamed Pipe Creation Events need to be enabled within the Sysmon configuration by including the following settings:\n`condition equal \"contains\" and keyword equal \"pipe\"`\n", + "note": "## Config\n\nNamed Pipe Creation Events need to be enabled within the Sysmon configuration by including the following settings:\n`condition equal \"contains\" and keyword equal \"pipe\"`\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.\n\n", "query": "file where event.action : \"Pipe Created*\" and\n /* normal sysmon named pipe creation events truncate the pipe keyword */\n file.name : \"\\\\*\\\\Pipe\\\\*\"\n", "references": [ "https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/", @@ -47,5 +47,5 @@ ], "timestamp_override": "event.ingested", "type": "eql", - "version": 1 + "version": 2 } From 574119ef5b88666f44a30b235435484d8c6e98c7 Mon Sep 17 00:00:00 2001 From: Stratoula Kalafateli Date: Wed, 6 Apr 2022 10:39:31 +0300 Subject: [PATCH 20/47] [Lens] Fixes flakiness on switchToVisualization search input (#129446) --- x-pack/test/functional/page_objects/lens_page.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/x-pack/test/functional/page_objects/lens_page.ts b/x-pack/test/functional/page_objects/lens_page.ts index 0825d8355466e..5e7922a9b30dc 100644 --- a/x-pack/test/functional/page_objects/lens_page.ts +++ b/x-pack/test/functional/page_objects/lens_page.ts @@ -720,6 +720,8 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont */ async switchToVisualization(subVisualizationId: string, searchTerm?: string) { await this.openChartSwitchPopover(); + const searchInput = await testSubjects.find('lnsChartSwitchSearch'); + await searchInput.focus(); await this.searchOnChartSwitch(subVisualizationId, searchTerm); await testSubjects.click(`lnsChartSwitchPopover_${subVisualizationId}`); await PageObjects.header.waitUntilLoadingHasFinished(); From 4b00b2823d3ad31e8546bb1e9122fae486b7bb1b Mon Sep 17 00:00:00 2001 From: Ari Aviran Date: Wed, 6 Apr 2022 10:52:28 +0300 Subject: [PATCH 21/47] [Cloud Posture] Refactor i18n in benchmarks code (#129453) --- .../pages/benchmarks/benchmarks.test.tsx | 12 +++---- .../public/pages/benchmarks/benchmarks.tsx | 19 +++++++--- .../public/pages/benchmarks/translations.ts | 35 +++++++++---------- 3 files changed, 36 insertions(+), 30 deletions(-) diff --git a/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/benchmarks.test.tsx b/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/benchmarks.test.tsx index 918294794e9d2..cb4ddba3ad64c 100644 --- a/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/benchmarks.test.tsx +++ b/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/benchmarks.test.tsx @@ -14,12 +14,12 @@ import { useKubebeatDataView } from '../../common/api/use_kubebeat_data_view'; import { createCspBenchmarkIntegrationFixture } from '../../test/fixtures/csp_benchmark_integration'; import { createReactQueryResponse } from '../../test/fixtures/react_query'; import { TestProvider } from '../../test/test_provider'; -import { Benchmarks, BENCHMARKS_TABLE_DATA_TEST_SUBJ } from './benchmarks'; import { - ADD_A_CIS_INTEGRATION, - BENCHMARK_INTEGRATIONS, - TABLE_COLUMN_HEADERS, -} from './translations'; + ADD_INTEGRATION_TEST_SUBJ, + Benchmarks, + BENCHMARKS_TABLE_DATA_TEST_SUBJ, +} from './benchmarks'; +import { BENCHMARK_INTEGRATIONS, TABLE_COLUMN_HEADERS } from './translations'; import { useCspBenchmarkIntegrations } from './use_csp_benchmark_integrations'; import { useCisKubernetesIntegration } from '../../common/api/use_cis_kubernetes_integration'; @@ -69,7 +69,7 @@ describe('', () => { it('renders the "add integration" button', () => { renderBenchmarks(); - expect(screen.getByText(ADD_A_CIS_INTEGRATION)).toBeInTheDocument(); + expect(screen.getByTestId(ADD_INTEGRATION_TEST_SUBJ)).toBeInTheDocument(); }); it('renders error state while there is an error', () => { diff --git a/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/benchmarks.tsx b/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/benchmarks.tsx index e303c619a8d01..1b1ac705a63bc 100644 --- a/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/benchmarks.tsx +++ b/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/benchmarks.tsx @@ -24,7 +24,7 @@ import { useCspBreadcrumbs } from '../../common/navigation/use_csp_breadcrumbs'; import { useCISIntegrationLink } from '../../common/navigation/use_navigate_to_cis_integration'; import { CspPageTemplate } from '../../components/csp_page_template'; import { BenchmarksTable } from './benchmarks_table'; -import { ADD_A_CIS_INTEGRATION, BENCHMARK_INTEGRATIONS } from './translations'; +import { BENCHMARK_INTEGRATIONS } from './translations'; import { useCspBenchmarkIntegrations, UseCspBenchmarkIntegrationsProps, @@ -34,14 +34,23 @@ import { SEARCH_PLACEHOLDER } from './translations'; const BENCHMARKS_BREADCRUMBS = [allNavigationItems.benchmarks]; const SEARCH_DEBOUNCE_MS = 300; -export const BENCHMARKS_TABLE_DATA_TEST_SUBJ = 'cspBenchmarksTable'; +export const BENCHMARKS_TABLE_DATA_TEST_SUBJ = 'csp_benchmarks_table'; +export const ADD_INTEGRATION_TEST_SUBJ = 'csp_add_integration'; const AddCisIntegrationButton = () => { const cisIntegrationLink = useCISIntegrationLink(); return ( - - {ADD_A_CIS_INTEGRATION} + + ); }; @@ -71,7 +80,7 @@ const BenchmarkEmptyState = ({ name }: { name: string }) => ( diff --git a/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/translations.ts b/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/translations.ts index dd659a655bb06..601e22994f18d 100644 --- a/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/translations.ts +++ b/x-pack/plugins/cloud_security_posture/public/pages/benchmarks/translations.ts @@ -8,41 +8,38 @@ import { i18n } from '@kbn/i18n'; export const BENCHMARK_INTEGRATIONS = i18n.translate( - 'xpack.csp.benchmarks.benchmark_integrations', + 'xpack.csp.benchmarks.benchmarkIntegrationsTitle', { defaultMessage: 'Benchmark Integrations', } ); -export const LOADING_BENCHMARKS = i18n.translate('xpack.csp.benchmarks.loading_benchmarks', { - defaultMessage: 'Loading your benchmarks...', -}); - -export const ADD_A_CIS_INTEGRATION = i18n.translate('xpack.csp.benchmarks.add_a_cis_integration', { - defaultMessage: 'Add a CIS integration', -}); - export const TABLE_COLUMN_HEADERS = { - INTEGRATION: i18n.translate('xpack.csp.benchmarks.table_column_headers.integrationNameLabel', { + INTEGRATION: i18n.translate('xpack.csp.benchmarks.benchmarksTable.integrationColumnTitle', { defaultMessage: 'Integration', }), INTEGRATION_TYPE: i18n.translate( - 'xpack.csp.benchmarks.table_column_headers.integrationTypeLabel', - { defaultMessage: 'Integration Type' } + 'xpack.csp.benchmarks.benchmarksTable.integrationTypeColumnTitle', + { + defaultMessage: 'Integration Type', + } ), - ACTIVE_RULES: i18n.translate('xpack.csp.benchmarks.table_column_headers.active_rules', { + ACTIVE_RULES: i18n.translate('xpack.csp.benchmarks.benchmarksTable.activeRulesColumnTitle', { defaultMessage: 'Active Rules', }), - AGENT_POLICY: i18n.translate('xpack.csp.benchmarks.table_column_headers.agent_policy', { + AGENT_POLICY: i18n.translate('xpack.csp.benchmarks.benchmarksTable.agentPolicyColumnTitle', { defaultMessage: 'Agent Policy', }), - NUMBER_OF_AGENTS: i18n.translate('xpack.csp.benchmarks.table_column_headers.number_of_agents', { - defaultMessage: 'Number of Agents', - }), - CREATED_BY: i18n.translate('xpack.csp.benchmarks.table_column_headers.created_by', { + NUMBER_OF_AGENTS: i18n.translate( + 'xpack.csp.benchmarks.benchmarksTable.numberOfAgentsColumnTitle', + { + defaultMessage: 'Number of Agents', + } + ), + CREATED_BY: i18n.translate('xpack.csp.benchmarks.benchmarksTable.createdByColumnTitle', { defaultMessage: 'Created by', }), - CREATED_AT: i18n.translate('xpack.csp.benchmarks.table_column_headers.created_at', { + CREATED_AT: i18n.translate('xpack.csp.benchmarks.benchmarksTable.createdAtColumnTitle', { defaultMessage: 'Created at', }), }; From 6105af4f7fdeb338b2643a03daccf5fc8a8410a6 Mon Sep 17 00:00:00 2001 From: Ari Aviran Date: Wed, 6 Apr 2022 11:04:43 +0300 Subject: [PATCH 22/47] [Cloud Posture] Refactor i18n in common code (#129342) --- .../public/common/navigation/translations.ts | 8 ++-- .../public/common/translations.ts | 12 ----- .../components/csp_evaluation_badge.tsx | 8 +++- .../public/components/csp_health_badge.tsx | 29 +++++++++-- .../public/components/csp_loading_state.tsx | 9 ++-- .../components/csp_page_template.test.tsx | 48 ++++++++++--------- .../public/components/csp_page_template.tsx | 20 ++++++-- .../public/components/translations.ts | 38 ++------------- .../public/components/unknown_route.tsx | 11 ++++- .../public/pages/rules/rules.test.tsx | 4 +- 10 files changed, 98 insertions(+), 89 deletions(-) delete mode 100644 x-pack/plugins/cloud_security_posture/public/common/translations.ts diff --git a/x-pack/plugins/cloud_security_posture/public/common/navigation/translations.ts b/x-pack/plugins/cloud_security_posture/public/common/navigation/translations.ts index c434ea55a2829..9a3d105499c1f 100644 --- a/x-pack/plugins/cloud_security_posture/public/common/navigation/translations.ts +++ b/x-pack/plugins/cloud_security_posture/public/common/navigation/translations.ts @@ -7,18 +7,18 @@ import { i18n } from '@kbn/i18n'; -export const CLOUD_POSTURE = i18n.translate('xpack.csp.navigation.cloudPosture', { +export const CLOUD_POSTURE = i18n.translate('xpack.csp.navigation.cloudPostureBreadcrumbLabel', { defaultMessage: 'Cloud Posture', }); -export const FINDINGS = i18n.translate('xpack.csp.navigation.findings', { +export const FINDINGS = i18n.translate('xpack.csp.navigation.findingsPageLabel', { defaultMessage: 'Findings', }); -export const DASHBOARD = i18n.translate('xpack.csp.navigation.dashboard', { +export const DASHBOARD = i18n.translate('xpack.csp.navigation.dashboardPageLabel', { defaultMessage: 'Dashboard', }); -export const MY_BENCHMARKS = i18n.translate('xpack.csp.navigation.my_benchmarks', { +export const MY_BENCHMARKS = i18n.translate('xpack.csp.navigation.myBenchmarksPageLabel', { defaultMessage: 'My Benchmarks', }); diff --git a/x-pack/plugins/cloud_security_posture/public/common/translations.ts b/x-pack/plugins/cloud_security_posture/public/common/translations.ts deleted file mode 100644 index 2aeb21ca33c5f..0000000000000 --- a/x-pack/plugins/cloud_security_posture/public/common/translations.ts +++ /dev/null @@ -1,12 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import { i18n } from '@kbn/i18n'; - -export const CLOUD_SECURITY_POSTURE = i18n.translate('xpack.csp.cloudSecurityPosture', { - defaultMessage: 'Cloud Security Posture', -}); diff --git a/x-pack/plugins/cloud_security_posture/public/components/csp_evaluation_badge.tsx b/x-pack/plugins/cloud_security_posture/public/components/csp_evaluation_badge.tsx index 93aa87c18a9b8..af1cf6c5c43c1 100644 --- a/x-pack/plugins/cloud_security_posture/public/components/csp_evaluation_badge.tsx +++ b/x-pack/plugins/cloud_security_posture/public/components/csp_evaluation_badge.tsx @@ -7,7 +7,7 @@ import React from 'react'; import { EuiBadge, type EuiBadgeProps } from '@elastic/eui'; -import { CSP_EVALUATION_BADGE_FAILED, CSP_EVALUATION_BADGE_PASSED } from './translations'; +import { FormattedMessage } from '@kbn/i18n-react'; interface Props { type: 'passed' | 'failed'; @@ -21,6 +21,10 @@ const getColor = (type: Props['type']): EuiBadgeProps['color'] => { export const CspEvaluationBadge = ({ type }: Props) => ( - {type === 'failed' ? CSP_EVALUATION_BADGE_FAILED : CSP_EVALUATION_BADGE_PASSED} + {type === 'failed' ? ( + + ) : ( + + )} ); diff --git a/x-pack/plugins/cloud_security_posture/public/components/csp_health_badge.tsx b/x-pack/plugins/cloud_security_posture/public/components/csp_health_badge.tsx index 570789086e464..9149a1cfac66e 100644 --- a/x-pack/plugins/cloud_security_posture/public/components/csp_health_badge.tsx +++ b/x-pack/plugins/cloud_security_posture/public/components/csp_health_badge.tsx @@ -7,16 +7,37 @@ import React from 'react'; import { EuiBadge } from '@elastic/eui'; +import { FormattedMessage } from '@kbn/i18n-react'; import type { Score } from '../../common/types'; -import * as TEXT from './translations'; interface Props { value: Score; } export const CspHealthBadge = ({ value }: Props) => { - if (value <= 65) return {TEXT.CRITICAL}; - if (value <= 86) return {TEXT.WARNING}; - if (value <= 100) return {TEXT.HEALTHY}; + if (value <= 65) { + return ( + + + + ); + } + + if (value <= 86) { + return ( + + + + ); + } + + if (value <= 100) { + return ( + + + + ); + } + return null; }; diff --git a/x-pack/plugins/cloud_security_posture/public/components/csp_loading_state.tsx b/x-pack/plugins/cloud_security_posture/public/components/csp_loading_state.tsx index 60586dd3c5c05..4b6059ca76711 100644 --- a/x-pack/plugins/cloud_security_posture/public/components/csp_loading_state.tsx +++ b/x-pack/plugins/cloud_security_posture/public/components/csp_loading_state.tsx @@ -8,10 +8,11 @@ import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner } from '@elastic/eui'; import React from 'react'; -export const cspLoadingStateTestId = 'csp_loading_state'; - -export const CspLoadingState: React.FunctionComponent = ({ children }) => ( - +export const CspLoadingState: React.FunctionComponent<{ ['data-test-subj']?: string }> = ({ + children, + ...rest +}) => ( + diff --git a/x-pack/plugins/cloud_security_posture/public/components/csp_page_template.test.tsx b/x-pack/plugins/cloud_security_posture/public/components/csp_page_template.test.tsx index 8cc8c750b8240..e280bd6f0da89 100644 --- a/x-pack/plugins/cloud_security_posture/public/components/csp_page_template.test.tsx +++ b/x-pack/plugins/cloud_security_posture/public/components/csp_page_template.test.tsx @@ -11,15 +11,19 @@ import { coreMock } from '../../../../../src/core/public/mocks'; import { createNavigationItemFixture } from '../test/fixtures/navigation_item'; import { createReactQueryResponse } from '../test/fixtures/react_query'; import { TestProvider } from '../test/test_provider'; -import { CspPageTemplate, getSideNavItems, isCommonError } from './csp_page_template'; -import { LOADING, PACKAGE_NOT_INSTALLED_TEXT, DEFAULT_NO_DATA_TEXT } from './translations'; +import { + CspPageTemplate, + ERROR_STATE_TEST_SUBJECT, + getSideNavItems, + isCommonError, + LOADING_STATE_TEST_SUBJECT, +} from './csp_page_template'; +import { PACKAGE_NOT_INSTALLED_TEXT, DEFAULT_NO_DATA_TEXT } from './translations'; import { useCisKubernetesIntegration } from '../common/api/use_cis_kubernetes_integration'; import { UseQueryResult } from 'react-query'; const chance = new Chance(); -// Synchronized to the error message in the formatted message in `csp_page_template.tsx` -const ERROR_LOADING_DATA_DEFAULT_MESSAGE = "We couldn't fetch your cloud security posture data"; const packageNotInstalledUniqueTexts = [ PACKAGE_NOT_INSTALLED_TEXT.PAGE_TITLE, PACKAGE_NOT_INSTALLED_TEXT.DESCRIPTION, @@ -85,8 +89,8 @@ describe('', () => { renderCspPageTemplate({ children }); expect(screen.getByText(children)).toBeInTheDocument(); - expect(screen.queryByText(LOADING)).not.toBeInTheDocument(); - expect(screen.queryByText(ERROR_LOADING_DATA_DEFAULT_MESSAGE)).not.toBeInTheDocument(); + expect(screen.queryByTestId(LOADING_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); + expect(screen.queryByTestId(ERROR_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); packageNotInstalledUniqueTexts.forEach((text) => expect(screen.queryByText(text)).not.toBeInTheDocument() ); @@ -105,8 +109,8 @@ describe('', () => { expect(screen.getAllByText(text)[0]).toBeInTheDocument() ); expect(screen.queryByText(children)).not.toBeInTheDocument(); - expect(screen.queryByText(LOADING)).not.toBeInTheDocument(); - expect(screen.queryByText(ERROR_LOADING_DATA_DEFAULT_MESSAGE)).not.toBeInTheDocument(); + expect(screen.queryByTestId(LOADING_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); + expect(screen.queryByTestId(ERROR_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); }); it('renders default loading text when query isLoading', () => { @@ -117,9 +121,9 @@ describe('', () => { const children = chance.sentence(); renderCspPageTemplate({ children, query }); - expect(screen.getByText(LOADING)).toBeInTheDocument(); + expect(screen.getByTestId(LOADING_STATE_TEST_SUBJECT)).toBeInTheDocument(); expect(screen.queryByText(children)).not.toBeInTheDocument(); - expect(screen.queryByText(ERROR_LOADING_DATA_DEFAULT_MESSAGE)).not.toBeInTheDocument(); + expect(screen.queryByTestId(ERROR_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); packageNotInstalledUniqueTexts.forEach((text) => expect(screen.queryByText(text)).not.toBeInTheDocument() ); @@ -144,10 +148,11 @@ describe('', () => { const children = chance.sentence(); renderCspPageTemplate({ children, query }); - [ERROR_LOADING_DATA_DEFAULT_MESSAGE, error, message, statusCode].forEach((text) => + [error, message, statusCode].forEach((text) => expect(screen.getByText(text, { exact: false })).toBeInTheDocument() ); - expect(screen.queryByText(LOADING)).not.toBeInTheDocument(); + expect(screen.getByTestId(ERROR_STATE_TEST_SUBJECT)).toBeInTheDocument(); + expect(screen.queryByTestId(LOADING_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); expect(screen.queryByText(children)).not.toBeInTheDocument(); packageNotInstalledUniqueTexts.forEach((text) => expect(screen.queryByText(text)).not.toBeInTheDocument() @@ -178,10 +183,9 @@ describe('', () => { }); expect(screen.getByText(message)).toBeInTheDocument(); - [ERROR_LOADING_DATA_DEFAULT_MESSAGE, error, statusCode].forEach((text) => - expect(screen.queryByText(text)).not.toBeInTheDocument() - ); - expect(screen.queryByText(LOADING)).not.toBeInTheDocument(); + [error, statusCode].forEach((text) => expect(screen.queryByText(text)).not.toBeInTheDocument()); + expect(screen.queryByTestId(ERROR_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); + expect(screen.queryByTestId(LOADING_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); expect(screen.queryByText(children)).not.toBeInTheDocument(); packageNotInstalledUniqueTexts.forEach((text) => expect(screen.queryByText(text)).not.toBeInTheDocument() @@ -203,8 +207,8 @@ describe('', () => { }); expect(screen.getByText(loading)).toBeInTheDocument(); - expect(screen.queryByText(ERROR_LOADING_DATA_DEFAULT_MESSAGE)).not.toBeInTheDocument(); - expect(screen.queryByText(LOADING)).not.toBeInTheDocument(); + expect(screen.queryByTestId(ERROR_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); + expect(screen.queryByTestId(LOADING_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); expect(screen.queryByText(children)).not.toBeInTheDocument(); packageNotInstalledUniqueTexts.forEach((text) => expect(screen.queryByText(text)).not.toBeInTheDocument() @@ -221,9 +225,9 @@ describe('', () => { renderCspPageTemplate({ children, query }); expect(screen.getByText(DEFAULT_NO_DATA_TEXT.PAGE_TITLE)).toBeInTheDocument(); - expect(screen.queryByText(LOADING)).not.toBeInTheDocument(); + expect(screen.queryByTestId(LOADING_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); expect(screen.queryByText(children)).not.toBeInTheDocument(); - expect(screen.queryByText(ERROR_LOADING_DATA_DEFAULT_MESSAGE)).not.toBeInTheDocument(); + expect(screen.queryByTestId(ERROR_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); packageNotInstalledUniqueTexts.forEach((text) => expect(screen.queryByText(text)).not.toBeInTheDocument() ); @@ -248,9 +252,9 @@ describe('', () => { expect(screen.getByText(pageTitle)).toBeInTheDocument(); expect(screen.getAllByText(solution, { exact: false })[0]).toBeInTheDocument(); - expect(screen.queryByText(LOADING)).not.toBeInTheDocument(); + expect(screen.queryByTestId(LOADING_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); expect(screen.queryByText(children)).not.toBeInTheDocument(); - expect(screen.queryByText(ERROR_LOADING_DATA_DEFAULT_MESSAGE)).not.toBeInTheDocument(); + expect(screen.queryByTestId(ERROR_STATE_TEST_SUBJECT)).not.toBeInTheDocument(); packageNotInstalledUniqueTexts.forEach((text) => expect(screen.queryByText(text)).not.toBeInTheDocument() ); diff --git a/x-pack/plugins/cloud_security_posture/public/components/csp_page_template.tsx b/x-pack/plugins/cloud_security_posture/public/components/csp_page_template.tsx index 8d1d96f2cb9f7..cc973169c2e86 100644 --- a/x-pack/plugins/cloud_security_posture/public/components/csp_page_template.tsx +++ b/x-pack/plugins/cloud_security_posture/public/components/csp_page_template.tsx @@ -15,9 +15,12 @@ import { } from '../../../../../src/plugins/kibana_react/public'; import { allNavigationItems } from '../common/navigation/constants'; import type { CspNavigationItem } from '../common/navigation/types'; -import { CLOUD_SECURITY_POSTURE } from '../common/translations'; import { CspLoadingState } from './csp_loading_state'; -import { DEFAULT_NO_DATA_TEXT, LOADING, PACKAGE_NOT_INSTALLED_TEXT } from './translations'; +import { + CLOUD_SECURITY_POSTURE, + DEFAULT_NO_DATA_TEXT, + PACKAGE_NOT_INSTALLED_TEXT, +} from './translations'; import { useCisKubernetesIntegration } from '../common/api/use_cis_kubernetes_integration'; import { useCISIntegrationLink } from '../common/navigation/use_navigate_to_cis_integration'; @@ -77,6 +80,9 @@ export const DEFAULT_NO_DATA_CONFIG: KibanaPageTemplateProps['noDataConfig'] = { actions: {}, }; +export const LOADING_STATE_TEST_SUBJECT = 'csp_page_template_loading'; +export const ERROR_STATE_TEST_SUBJECT = 'csp_page_template_error'; + const getPackageNotInstalledNoDataConfig = ( cisIntegrationLink: string ): KibanaPageTemplateProps['noDataConfig'] => ({ @@ -94,12 +100,20 @@ const getPackageNotInstalledNoDataConfig = ( }, }); -const DefaultLoading = () => {LOADING}; +const DefaultLoading = () => ( + + + +); const DefaultError = (error: unknown) => ( diff --git a/x-pack/plugins/cloud_security_posture/public/components/translations.ts b/x-pack/plugins/cloud_security_posture/public/components/translations.ts index facbbcc3176da..84d1ae489f8ea 100644 --- a/x-pack/plugins/cloud_security_posture/public/components/translations.ts +++ b/x-pack/plugins/cloud_security_posture/public/components/translations.ts @@ -6,40 +6,6 @@ */ import { i18n } from '@kbn/i18n'; -export const CRITICAL = i18n.translate('xpack.csp.critical', { - defaultMessage: 'Critical', -}); - -export const WARNING = i18n.translate('xpack.csp.warning', { - defaultMessage: 'Warning', -}); - -export const HEALTHY = i18n.translate('xpack.csp.healthy', { - defaultMessage: 'Healthy', -}); - -export const PAGE_NOT_FOUND = i18n.translate('xpack.csp.page_not_found', { - defaultMessage: 'Page not found', -}); - -export const LOADING = i18n.translate('xpack.csp.loading', { - defaultMessage: 'Loading...', -}); - -export const CSP_EVALUATION_BADGE_FAILED = i18n.translate( - 'xpack.csp.cspEvaluationBadge.failedLabelText', - { - defaultMessage: 'FAILED', - } -); - -export const CSP_EVALUATION_BADGE_PASSED = i18n.translate( - 'xpack.csp.cspEvaluationBadge.passedLabelText', - { - defaultMessage: 'PASSED', - } -); - export const PACKAGE_NOT_INSTALLED_TEXT = { PAGE_TITLE: i18n.translate('xpack.csp.cspPageTemplate.packageNotInstalled.pageTitle', { defaultMessage: 'Install Integration to get started', @@ -64,3 +30,7 @@ export const DEFAULT_NO_DATA_TEXT = { defaultMessage: 'Cloud Security Posture', }), }; + +export const CLOUD_SECURITY_POSTURE = i18n.translate('xpack.csp.cspPageTemplate.navigationTitle', { + defaultMessage: 'Cloud Security Posture', +}); diff --git a/x-pack/plugins/cloud_security_posture/public/components/unknown_route.tsx b/x-pack/plugins/cloud_security_posture/public/components/unknown_route.tsx index 90a469ba2dd48..2679d772b9382 100644 --- a/x-pack/plugins/cloud_security_posture/public/components/unknown_route.tsx +++ b/x-pack/plugins/cloud_security_posture/public/components/unknown_route.tsx @@ -7,8 +7,8 @@ import React from 'react'; import { EuiEmptyPrompt } from '@elastic/eui'; +import { FormattedMessage } from '@kbn/i18n-react'; import { CspPageTemplate } from './csp_page_template'; -import * as TEXT from './translations'; export const UnknownRoute = React.memo(() => ( @@ -16,7 +16,14 @@ export const UnknownRoute = React.memo(() => ( data-test-subj="unknownRoute" iconColor="default" iconType="logoElastic" - title={

{TEXT.PAGE_NOT_FOUND}

} + title={ +

+ +

+ } /> )); diff --git a/x-pack/plugins/cloud_security_posture/public/pages/rules/rules.test.tsx b/x-pack/plugins/cloud_security_posture/public/pages/rules/rules.test.tsx index bf5badfca1d95..5801d293114bd 100644 --- a/x-pack/plugins/cloud_security_posture/public/pages/rules/rules.test.tsx +++ b/x-pack/plugins/cloud_security_posture/public/pages/rules/rules.test.tsx @@ -6,13 +6,13 @@ */ import React from 'react'; +import { LOADING_STATE_TEST_SUBJECT } from '../../components/csp_page_template'; import { Rules } from './index'; import { render, screen } from '@testing-library/react'; import { QueryClient } from 'react-query'; import { TestProvider } from '../../test/test_provider'; import { useCspIntegration } from './use_csp_integration'; import { type RouteComponentProps } from 'react-router-dom'; -import { cspLoadingStateTestId } from '../../components/csp_loading_state'; import type { PageUrlParams } from './rules_container'; import * as TEST_SUBJECTS from './test_subjects'; import { useCisKubernetesIntegration } from '../../common/api/use_cis_kubernetes_integration'; @@ -91,7 +91,7 @@ describe('', () => { render(); - expect(screen.getByTestId(cspLoadingStateTestId)).toBeInTheDocument(); + expect(screen.getByTestId(LOADING_STATE_TEST_SUBJECT)).toBeInTheDocument(); }); it('displays success state when result request is resolved', async () => { From 6681d887de8c81ccf41251cedd2d1a52d0063b22 Mon Sep 17 00:00:00 2001 From: Or Ouziel Date: Wed, 6 Apr 2022 11:07:15 +0300 Subject: [PATCH 23/47] [Cloud Posture] search bar styles update (#128361) --- .../public/pages/findings/findings.tsx | 8 +-- .../pages/findings/findings_container.tsx | 30 +++++++---- .../pages/findings/findings_search_bar.tsx | 50 +++++++++++-------- .../public/pages/findings/translations.ts | 9 ++-- .../public/pages/findings/use_findings.ts | 11 +--- 5 files changed, 59 insertions(+), 49 deletions(-) diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/findings.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/findings.tsx index fba8fc37f54d1..4eae5610da15a 100644 --- a/x-pack/plugins/cloud_security_posture/public/pages/findings/findings.tsx +++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/findings.tsx @@ -5,24 +5,18 @@ * 2.0. */ import React from 'react'; -import type { EuiPageHeaderProps } from '@elastic/eui'; import { useKubebeatDataView } from '../../common/api/use_kubebeat_data_view'; import { allNavigationItems } from '../../common/navigation/constants'; import { useCspBreadcrumbs } from '../../common/navigation/use_csp_breadcrumbs'; import { FindingsContainer } from './findings_container'; import { CspPageTemplate } from '../../components/csp_page_template'; -import { FINDINGS } from './translations'; - -const pageHeader: EuiPageHeaderProps = { - pageTitle: FINDINGS, -}; export const Findings = () => { const dataViewQuery = useKubebeatDataView(); useCspBreadcrumbs([allNavigationItems.findings]); return ( - + {dataViewQuery.data && } ); diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_container.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_container.tsx index 0b16f1d877a5e..5b1d60b69e069 100644 --- a/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_container.tsx +++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_container.tsx @@ -5,7 +5,9 @@ * 2.0. */ import React from 'react'; -import { EuiSpacer } from '@elastic/eui'; +import { EuiSpacer, EuiTitle, useEuiTheme } from '@elastic/eui'; +import { css } from '@emotion/react'; +import { FormattedMessage } from '@kbn/i18n-react'; import { FindingsTable } from './findings_table'; import { FindingsSearchBar } from './findings_search_bar'; import * as TEST_SUBJECTS from './test_subjects'; @@ -15,14 +17,9 @@ import { useUrlQuery } from '../../common/hooks/use_url_query'; import { useFindings, type CspFindingsRequest } from './use_findings'; // TODO: define this as a schema with default values -// need to get Query and DateRange schema const getDefaultQuery = (): CspFindingsRequest => ({ query: { language: 'kuery', query: '' }, filters: [], - dateRange: { - from: 'now-15m', - to: 'now', - }, sort: [{ ['@timestamp']: SortDirection.desc }], from: 0, size: 10, @@ -31,7 +28,7 @@ const getDefaultQuery = (): CspFindingsRequest => ({ export const FindingsContainer = ({ dataView }: { dataView: DataView }) => { const { urlQuery: findingsQuery, setUrlQuery, key } = useUrlQuery(getDefaultQuery); const findingsResult = useFindings(dataView, findingsQuery, key); - + const { euiTheme } = useEuiTheme(); return (
{ {...findingsQuery} {...findingsResult} /> - - +
+ + + +
); }; + +const PageTitle = () => ( + +

+ +

+ +); diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_search_bar.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_search_bar.tsx index 11b62da5fce59..ee0202786f042 100644 --- a/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_search_bar.tsx +++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/findings_search_bar.tsx @@ -5,14 +5,17 @@ * 2.0. */ import React from 'react'; +import { css } from '@emotion/react'; +import { EuiThemeComputed, useEuiTheme } from '@elastic/eui'; import { useKibana } from '../../../../../../src/plugins/kibana_react/public'; import * as TEST_SUBJECTS from './test_subjects'; import type { CspFindingsRequest, CspFindingsResponse } from './use_findings'; import type { CspClientPluginStartDeps } from '../../types'; import { PLUGIN_NAME } from '../../../common'; import type { DataView } from '../../../../../../src/plugins/data/common'; +import { FINDINGS_SEARCH_PLACEHOLDER } from './translations'; -type SearchBarQueryProps = Pick; +type SearchBarQueryProps = Pick; interface BaseFindingsSearchBarProps extends SearchBarQueryProps { setQuery(v: Partial): void; @@ -22,12 +25,12 @@ type FindingsSearchBarProps = CspFindingsResponse & BaseFindingsSearchBarProps; export const FindingsSearchBar = ({ dataView, - dateRange, query, filters, status, setQuery, }: FindingsSearchBarProps & { dataView: DataView }) => { + const { euiTheme } = useEuiTheme(); const { unifiedSearch: { ui: { SearchBar }, @@ -35,23 +38,30 @@ export const FindingsSearchBar = ({ } = useKibana().services; return ( - setQuery({ filters: value })} - /> +
+ setQuery({ filters: value })} + placeholder={FINDINGS_SEARCH_PLACEHOLDER} + /> +
); }; + +const getContainerStyle = (theme: EuiThemeComputed) => css` + border-bottom: ${theme.border.thin}; + background-color: ${theme.colors.body}; + padding: ${theme.size.base}; +`; diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/translations.ts b/x-pack/plugins/cloud_security_posture/public/pages/findings/translations.ts index 610f7b8e6e721..5ffa474e7a63d 100644 --- a/x-pack/plugins/cloud_security_posture/public/pages/findings/translations.ts +++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/translations.ts @@ -38,10 +38,6 @@ export const OS = i18n.translate('xpack.csp.findings.osLabel', { defaultMessage: 'OS', }); -export const FINDINGS = i18n.translate('xpack.csp.findings.findingsLabel', { - defaultMessage: 'Findings', -}); - export const RESOURCE = i18n.translate('xpack.csp.findings.resourceLabel', { defaultMessage: 'Resource', }); @@ -190,3 +186,8 @@ export const PLATFORM = i18n.translate('xpack.csp.findings.platformLabel', { export const NO_FINDINGS = i18n.translate('xpack.csp.findings.nonFindingsLabel', { defaultMessage: 'There are no Findings', }); + +export const FINDINGS_SEARCH_PLACEHOLDER = i18n.translate( + 'xpack.csp.findings.searchBar.searchPlaceholder', + { defaultMessage: 'Search findings (eg. resource.section : "API Server")' } +); diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/use_findings.ts b/x-pack/plugins/cloud_security_posture/public/pages/findings/use_findings.ts index 38228e513e31b..f9e2a59d6316c 100644 --- a/x-pack/plugins/cloud_security_posture/public/pages/findings/use_findings.ts +++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/use_findings.ts @@ -8,13 +8,12 @@ import type { Filter } from '@kbn/es-query'; import { type UseQueryResult, useQuery } from 'react-query'; import type { AggregationsAggregate, SearchResponse } from '@elastic/elasticsearch/lib/api/types'; import { number } from 'io-ts'; -import { extractErrorMessage, isNonNullable } from '../../../common/utils/helpers'; +import { extractErrorMessage } from '../../../common/utils/helpers'; import type { DataView, EsQuerySortValue, IKibanaSearchResponse, SerializedSearchSourceFields, - TimeRange, } from '../../../../../../src/plugins/data/common'; import type { CspClientPluginStartDeps } from '../../types'; import { useKibana } from '../../../../../../src/plugins/kibana_react/public'; @@ -30,7 +29,6 @@ interface CspFindings { export interface CspFindingsRequest extends Required> { filters: Filter[]; - dateRange: TimeRange; } type ResponseProps = 'data' | 'error' | 'status'; @@ -86,18 +84,13 @@ const extractFindings = ({ const createFindingsSearchSource = ( { query, - dateRange, dataView, filters, ...rest - }: Omit & { - dataView: DataView; - }, + }: Omit & { dataView: DataView }, queryService: CspClientPluginStartDeps['data']['query'] ): SerializedSearchSourceFields => { if (query) queryService.queryString.setQuery(query); - const timeFilter = queryService.timefilter.timefilter.createFilter(dataView, dateRange); - queryService.filterManager.setFilters([...filters, timeFilter].filter(isNonNullable)); return { ...rest, From f3f3b1ad199780e2ee80c60e845a6ae4a1d6933f Mon Sep 17 00:00:00 2001 From: Joe Reuter Date: Wed, 6 Apr 2022 11:55:30 +0200 Subject: [PATCH 24/47] [Lens] Fix auto session-renewal on non-timebased data views (#129313) --- .../indexpattern.test.ts | 48 +++++++++++++++++-- .../indexpattern_datasource/indexpattern.tsx | 23 +++++---- .../context_middleware/index.test.ts | 47 +++++++++++++++++- .../context_middleware/index.ts | 15 +++++- 4 files changed, 118 insertions(+), 15 deletions(-) diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.test.ts index c1eca2385e761..8dc3125dea57d 100644 --- a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.test.ts +++ b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.test.ts @@ -2467,7 +2467,7 @@ describe('IndexPattern Data Source', () => { }); describe('#isTimeBased', () => { it('should return true if date histogram exists in any layer', () => { - const state = enrichBaseState({ + let state = enrichBaseState({ currentIndexPatternId: '1', layers: { first: { @@ -2520,10 +2520,17 @@ describe('IndexPattern Data Source', () => { }, }, }); + state = { + ...state, + indexPatterns: { + ...state.indexPatterns, + '1': { ...state.indexPatterns['1'], timeFieldName: undefined }, + }, + }; expect(indexPatternDatasource.isTimeBased(state)).toEqual(true); }); it('should return false if date histogram exists but is detached from global time range in every layer', () => { - const state = enrichBaseState({ + let state = enrichBaseState({ currentIndexPatternId: '1', layers: { first: { @@ -2577,10 +2584,17 @@ describe('IndexPattern Data Source', () => { }, }, }); + state = { + ...state, + indexPatterns: { + ...state.indexPatterns, + '1': { ...state.indexPatterns['1'], timeFieldName: undefined }, + }, + }; expect(indexPatternDatasource.isTimeBased(state)).toEqual(false); }); it('should return false if date histogram does not exist in any layer', () => { - const state = enrichBaseState({ + let state = enrichBaseState({ currentIndexPatternId: '1', layers: { first: { @@ -2598,8 +2612,36 @@ describe('IndexPattern Data Source', () => { }, }, }); + state = { + ...state, + indexPatterns: { + ...state.indexPatterns, + '1': { ...state.indexPatterns['1'], timeFieldName: undefined }, + }, + }; expect(indexPatternDatasource.isTimeBased(state)).toEqual(false); }); + it('should return true if the index pattern is time based even if date histogram does not exist in any layer', () => { + const state = enrichBaseState({ + currentIndexPatternId: '1', + layers: { + first: { + indexPatternId: '1', + columnOrder: ['metric'], + columns: { + metric: { + label: 'Count of records', + dataType: 'number', + isBucketed: false, + sourceField: '___records___', + operationType: 'count', + }, + }, + }, + }, + }); + expect(indexPatternDatasource.isTimeBased(state)).toEqual(true); + }); }); describe('#initializeDimension', () => { diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx index d0b644e2bf9b4..1911fe764a086 100644 --- a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx +++ b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx @@ -588,18 +588,23 @@ export function getIndexPatternDatasource({ return ids.filter((id) => !state.indexPatterns[id]); }, isTimeBased: (state) => { - const { layers } = state; + if (!state) return false; + const { layers, indexPatterns } = state; return ( Boolean(layers) && Object.values(layers).some((layer) => { - const buckets = layer.columnOrder.filter((colId) => layer.columns[colId].isBucketed); - return buckets.some((colId) => { - const column = layer.columns[colId]; - return ( - isColumnOfType('date_histogram', column) && - !column.params.ignoreTimeRange - ); - }); + return ( + Boolean(indexPatterns[layer.indexPatternId]?.timeFieldName) || + layer.columnOrder + .filter((colId) => layer.columns[colId].isBucketed) + .some((colId) => { + const column = layer.columns[colId]; + return ( + isColumnOfType('date_histogram', column) && + !column.params.ignoreTimeRange + ); + }) + ); }) ); }, diff --git a/x-pack/plugins/lens/public/state_management/context_middleware/index.test.ts b/x-pack/plugins/lens/public/state_management/context_middleware/index.test.ts index d256fcf9b11e5..e958650d8b5c6 100644 --- a/x-pack/plugins/lens/public/state_management/context_middleware/index.test.ts +++ b/x-pack/plugins/lens/public/state_management/context_middleware/index.test.ts @@ -24,7 +24,13 @@ const createMiddleware = (data: DataPublicPluginStart, state?: Partial ({ lens: state || initialState })), + getState: jest.fn(() => ({ + lens: state || { + ...initialState, + activeDatasourceId: 'testDatasource', + datasourceStates: { testDatasource: { state: {} } }, + }, + })), dispatch: jest.fn(), }; const next = jest.fn(); @@ -39,6 +45,7 @@ describe('contextMiddleware', () => { describe('time update', () => { it('does update the searchSessionId when the state changes and too much time passed', () => { const data = mockDataPlugin(); + storeDeps.datasourceMap.testDatasource.isTimeBased = () => true; (data.nowProvider.get as jest.Mock).mockReturnValue(new Date(Date.now() - 30000)); (data.query.timefilter.timefilter.getTime as jest.Mock).mockReturnValue({ from: 'now-2m', @@ -71,10 +78,46 @@ describe('contextMiddleware', () => { }); expect(next).toHaveBeenCalledWith(action); }); + it('does not update the searchSessionId when current state is not time based', () => { + const data = mockDataPlugin(); + storeDeps.datasourceMap.testDatasource.isTimeBased = () => false; + (data.nowProvider.get as jest.Mock).mockReturnValue(new Date(Date.now() - 30000)); + (data.query.timefilter.timefilter.getTime as jest.Mock).mockReturnValue({ + from: 'now-2m', + to: 'now', + }); + (data.query.timefilter.timefilter.getBounds as jest.Mock).mockReturnValue({ + min: moment(Date.now() - 100000), + max: moment(Date.now() - 30000), + }); + const { next, invoke, store } = createMiddleware(data); + const action = { + type: 'lens/setState', + payload: { + visualization: { + state: {}, + activeId: 'id2', + }, + }, + }; + invoke(action); + expect(store.dispatch).not.toHaveBeenCalledWith({ + payload: { + resolvedDateRange: { + fromDate: '2021-01-10T04:00:00.000Z', + toDate: '2021-01-10T08:00:00.000Z', + }, + searchSessionId: 'sessionId-1', + }, + type: 'lens/setState', + }); + expect(next).toHaveBeenCalledWith(action); + }); describe('when auto-apply is disabled', () => { it('only updates searchSessionId when user applies changes', () => { // setup const data = mockDataPlugin(); + storeDeps.datasourceMap.testDatasource.isTimeBased = () => true; (data.nowProvider.get as jest.Mock).mockReturnValue(new Date(Date.now() - 30000)); (data.query.timefilter.timefilter.getTime as jest.Mock).mockReturnValue({ from: 'now-2m', @@ -86,6 +129,8 @@ describe('contextMiddleware', () => { }); const { invoke, store } = createMiddleware(data, { ...initialState, + activeDatasourceId: 'testDatasource', + datasourceStates: { testDatasource: { state: {}, isLoading: false } }, autoApplyDisabled: true, }); diff --git a/x-pack/plugins/lens/public/state_management/context_middleware/index.ts b/x-pack/plugins/lens/public/state_management/context_middleware/index.ts index 3ca806d17dcb7..ada5bc3c1c39e 100644 --- a/x-pack/plugins/lens/public/state_management/context_middleware/index.ts +++ b/x-pack/plugins/lens/public/state_management/context_middleware/index.ts @@ -16,10 +16,20 @@ import { applyChanges, selectAutoApplyEnabled, } from '..'; -import { LensAppState } from '../types'; +import { LensAppState, LensState } from '../types'; import { getResolvedDateRange, containsDynamicMath } from '../../utils'; import { subscribeToExternalContext } from './subscribe_to_external_context'; import { onActiveDataChange } from '../lens_slice'; +import { DatasourceMap } from '../../types'; + +function isTimeBased(state: LensState, datasourceMap: DatasourceMap) { + const { activeDatasourceId, datasourceStates } = state.lens; + return Boolean( + activeDatasourceId && + datasourceStates[activeDatasourceId] && + datasourceMap[activeDatasourceId].isTimeBased?.(datasourceStates[activeDatasourceId].state) + ); +} export const contextMiddleware = (storeDeps: LensStoreDeps) => (store: MiddlewareAPI) => { const unsubscribeFromExternalContext = subscribeToExternalContext( @@ -31,7 +41,8 @@ export const contextMiddleware = (storeDeps: LensStoreDeps) => (store: Middlewar if ( !(action.payload as Partial)?.searchSessionId && !onActiveDataChange.match(action) && - (selectAutoApplyEnabled(store.getState()) || applyChanges.match(action)) + (selectAutoApplyEnabled(store.getState()) || applyChanges.match(action)) && + isTimeBased(store.getState(), storeDeps.datasourceMap) ) { updateTimeRange(storeDeps.lensServices.data, store.dispatch); } From db67505849d14e4ee868dafdc398152956dfcbf1 Mon Sep 17 00:00:00 2001 From: Diana Derevyankina <54894989+DziyanaDzeraviankina@users.noreply.github.com> Date: Wed, 6 Apr 2022 13:46:58 +0300 Subject: [PATCH 25/47] Replace "Save and return" button with "Save" for Lens visualization created from Discover histogram or visualised field to avoid confusion (#129053) * Replace "Save and return" button with "Save" for Lens visualization created from Discover histogram to avoid confusion * Remove passing originatingApp as trigger options at all to replace "Save and return" with "Save" for the field visualized from Discover Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> --- src/plugins/discover/common/index.ts | 1 - .../main/components/sidebar/lib/visualize_trigger_utils.ts | 2 -- 2 files changed, 3 deletions(-) diff --git a/src/plugins/discover/common/index.ts b/src/plugins/discover/common/index.ts index f2a9e53fc067c..98ce5fc3b0b2b 100644 --- a/src/plugins/discover/common/index.ts +++ b/src/plugins/discover/common/index.ts @@ -6,7 +6,6 @@ * Side Public License, v 1. */ -export const APP_ID = 'discover'; export const DEFAULT_COLUMNS_SETTING = 'defaultColumns'; export const SAMPLE_SIZE_SETTING = 'discover:sampleSize'; export const SORT_DEFAULT_ORDER_SETTING = 'discover:sort:defaultOrder'; diff --git a/src/plugins/discover/public/application/main/components/sidebar/lib/visualize_trigger_utils.ts b/src/plugins/discover/public/application/main/components/sidebar/lib/visualize_trigger_utils.ts index 50ca2cae1bcc7..ff9406c21c02f 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/lib/visualize_trigger_utils.ts +++ b/src/plugins/discover/public/application/main/components/sidebar/lib/visualize_trigger_utils.ts @@ -15,7 +15,6 @@ import { import { getUiActions } from '../../../../../kibana_services'; import type { DataViewField } from '../../../../../../../data_views/public'; import { KBN_FIELD_TYPES } from '../../../../../../../data/public'; -import { APP_ID } from '../../../../../../common'; function getTriggerConstant(type: string) { return type === KBN_FIELD_TYPES.GEO_POINT || type === KBN_FIELD_TYPES.GEO_SHAPE @@ -54,7 +53,6 @@ export function triggerVisualizeActions( indexPatternId, fieldName: field.name, contextualFields, - originatingApp: APP_ID, }; getUiActions().getTrigger(trigger).exec(triggerOptions); } From 3105f5ce6dcc84ea959c0639a976ded08b2b8eee Mon Sep 17 00:00:00 2001 From: Pablo Machado Date: Wed, 6 Apr 2022 12:50:32 +0200 Subject: [PATCH 26/47] Fix alerts and external alerts filters on Hots and Users pages (#129451) --- .../use_lens_attributes.test.tsx | 10 +++++----- .../use_lens_attributes.tsx | 10 +++++++--- .../components/visualization_actions/utils.ts | 2 +- .../public/hosts/pages/hosts.tsx | 16 ++++++++-------- .../public/hosts/pages/hosts_tabs.tsx | 9 +++++++-- .../pages/navigation/alerts_query_tab_body.tsx | 7 ++----- .../hosts/pages/navigation/sessions_tab_body.tsx | 7 ++----- .../public/hosts/pages/types.ts | 2 ++ .../overview/components/event_counts/index.tsx | 4 ++-- .../public/users/pages/details/details_tabs.tsx | 6 ++---- .../public/users/pages/details/helpers.ts | 2 +- .../public/users/pages/types.ts | 2 ++ .../public/users/pages/users.tsx | 9 ++++++++- .../public/users/pages/users_tabs.tsx | 9 +++++++-- 14 files changed, 56 insertions(+), 39 deletions(-) diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/use_lens_attributes.test.tsx b/x-pack/plugins/security_solution/public/common/components/visualization_actions/use_lens_attributes.test.tsx index 72257a76d43c8..426afa6233d49 100644 --- a/x-pack/plugins/security_solution/public/common/components/visualization_actions/use_lens_attributes.test.tsx +++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/use_lens_attributes.test.tsx @@ -18,7 +18,7 @@ import { } from '../../mock'; import { getExternalAlertLensAttributes } from './lens_attributes/common/external_alert'; import { useLensAttributes } from './use_lens_attributes'; -import { filterHostExternalAlertData, getHostDetailsPageFilter, getIndexFilters } from './utils'; +import { hostNameExistsFilter, getHostDetailsPageFilter, getIndexFilters } from './utils'; import { createStore, State } from '../../store'; jest.mock('../../containers/sourcerer', () => ({ @@ -80,7 +80,7 @@ describe('useLensAttributes', () => { store = createStore(myState, SUB_PLUGINS_REDUCER, kibanaObservable, storage); }); - it('should should add query', () => { + it('should add query', () => { const wrapper = ({ children }: { children: React.ReactElement }) => ( {children} ); @@ -96,7 +96,7 @@ describe('useLensAttributes', () => { expect(result?.current?.state.query).toEqual({ query: 'host.name: *', language: 'kql' }); }); - it('should should add filters', () => { + it('should add filters', () => { const wrapper = ({ children }: { children: React.ReactElement }) => ( {children} ); @@ -113,12 +113,12 @@ describe('useLensAttributes', () => { ...getExternalAlertLensAttributes().state.filters, ...filterFromSearchBar, ...getHostDetailsPageFilter('mockHost'), - ...filterHostExternalAlertData, + ...hostNameExistsFilter, ...getIndexFilters(['auditbeat-*']), ]); }); - it('should should add data view id to references', () => { + it('should add data view id to references', () => { const wrapper = ({ children }: { children: React.ReactElement }) => ( {children} ); diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/use_lens_attributes.tsx b/x-pack/plugins/security_solution/public/common/components/visualization_actions/use_lens_attributes.tsx index 123cff112456c..042a606a6571c 100644 --- a/x-pack/plugins/security_solution/public/common/components/visualization_actions/use_lens_attributes.tsx +++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/use_lens_attributes.tsx @@ -7,6 +7,7 @@ import { useMemo } from 'react'; import { SecurityPageName } from '../../../../common/constants'; +import { HostsTableType } from '../../../hosts/store/model'; import { NetworkRouteType } from '../../../network/pages/navigation/types'; import { useSourcererDataView } from '../../containers/sourcerer'; import { useDeepEqualSelector } from '../../hooks/use_selector'; @@ -16,7 +17,7 @@ import { LensAttributes, GetLensAttributes } from './types'; import { getHostDetailsPageFilter, filterNetworkExternalAlertData, - filterHostExternalAlertData, + hostNameExistsFilter, getIndexFilters, } from './utils'; @@ -40,8 +41,11 @@ export const useLensAttributes = ({ const [{ detailName, pageName, tabName }] = useRouteSpy(); const tabsFilters = useMemo(() => { - if (pageName === SecurityPageName.hosts && tabName === 'externalAlerts') { - return filterHostExternalAlertData; + if ( + pageName === SecurityPageName.hosts && + (tabName === HostsTableType.alerts || tabName === HostsTableType.events) + ) { + return hostNameExistsFilter; } if (pageName === SecurityPageName.network && tabName === NetworkRouteType.alerts) { diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/utils.ts b/x-pack/plugins/security_solution/public/common/components/visualization_actions/utils.ts index 9a6df2ab6ab99..94e09f0d95c83 100644 --- a/x-pack/plugins/security_solution/public/common/components/visualization_actions/utils.ts +++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/utils.ts @@ -30,7 +30,7 @@ export const getHostDetailsPageFilter = (hostName?: string): Filter[] => ] : []; -export const filterHostExternalAlertData: Filter[] = [ +export const hostNameExistsFilter: Filter[] = [ { query: { bool: { diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx index 8d2255655b685..859e20607a4f7 100644 --- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx +++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx @@ -11,8 +11,8 @@ import { noop } from 'lodash/fp'; import React, { useCallback, useMemo, useRef } from 'react'; import { useDispatch } from 'react-redux'; import { useParams } from 'react-router-dom'; +import { Filter } from '@kbn/es-query'; import { isTab } from '../../../../timelines/public'; - import { SecurityPageName } from '../../app/types'; import { UpdateDateRange } from '../../common/components/charts/common'; import { FiltersGlobal } from '../../common/components/filters_global'; @@ -54,9 +54,10 @@ import { useDeepEqualSelector, useShallowEqualSelector } from '../../common/hook import { useInvalidFilterQuery } from '../../common/hooks/use_invalid_filter_query'; import { ID } from '../containers/hosts'; import { useIsExperimentalFeatureEnabled } from '../../common/hooks/use_experimental_features'; -import { filterHostExternalAlertData } from '../../common/components/visualization_actions/utils'; + import { LandingPageComponent } from '../../common/components/landing_page'; import { Loader } from '../../common/components/loader'; +import { hostNameExistsFilter } from '../../common/components/visualization_actions/utils'; /** * Need a 100% height here to account for the graph/analyze tool, which sets no explicit height parameters, but fills the available space. @@ -99,17 +100,15 @@ const HostsComponent = () => { const capabilities = useMlCapabilities(); const { uiSettings } = useKibana().services; const { tabName } = useParams<{ tabName: string }>(); - const tabsFilters = React.useMemo(() => { - if (tabName === HostsTableType.alerts) { - return filters.length > 0 - ? [...filters, ...filterHostExternalAlertData] - : filterHostExternalAlertData; + const tabsFilters: Filter[] = React.useMemo(() => { + if (tabName === HostsTableType.alerts || tabName === HostsTableType.events) { + return filters.length > 0 ? [...filters, ...hostNameExistsFilter] : hostNameExistsFilter; } if (tabName === HostsTableType.risk) { const severityFilter = generateSeverityFilter(severitySelection); - return [...severityFilter, ...filterHostExternalAlertData, ...filters]; + return [...severityFilter, ...hostNameExistsFilter, ...filters]; } return filters; }, [severitySelection, tabName, filters]); @@ -242,6 +241,7 @@ const HostsComponent = () => { setQuery={setQuery} from={from} type={hostsModel.HostsType.page} + pageFilters={tabsFilters} /> diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts_tabs.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts_tabs.tsx index ed2a1ec983b20..af619db5e9fa0 100644 --- a/x-pack/plugins/security_solution/public/hosts/pages/hosts_tabs.tsx +++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts_tabs.tsx @@ -33,6 +33,7 @@ export const HostsTabs = memo( deleteQuery, docValueFields, filterQuery, + pageFilters, from, indexNames, isInitializing, @@ -99,10 +100,14 @@ export const HostsTabs = memo( - + - + diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/alerts_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/alerts_query_tab_body.tsx index 548520676184a..d19e22b4406ba 100644 --- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/alerts_query_tab_body.tsx +++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/alerts_query_tab_body.tsx @@ -9,16 +9,13 @@ import React, { useMemo } from 'react'; import { TimelineId } from '../../../../common/types/timeline'; import { AlertsView } from '../../../common/components/alerts_viewer'; -import { filterHostExternalAlertData } from '../../../common/components/visualization_actions/utils'; +import { hostNameExistsFilter } from '../../../common/components/visualization_actions/utils'; import { AlertsComponentQueryProps } from './types'; export const HostAlertsQueryTabBody = React.memo((alertsProps: AlertsComponentQueryProps) => { const { pageFilters, ...rest } = alertsProps; const hostPageFilters = useMemo( - () => - pageFilters != null - ? [...filterHostExternalAlertData, ...pageFilters] - : filterHostExternalAlertData, + () => (pageFilters != null ? [...hostNameExistsFilter, ...pageFilters] : hostNameExistsFilter), [pageFilters] ); diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/sessions_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/sessions_tab_body.tsx index 0ff47a104ca21..4ad98f84eb854 100644 --- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/sessions_tab_body.tsx +++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/sessions_tab_body.tsx @@ -8,16 +8,13 @@ import React, { useMemo } from 'react'; import { TimelineId } from '../../../../common/types/timeline'; import { SessionsView } from '../../../common/components/sessions_viewer'; -import { filterHostExternalAlertData } from '../../../common/components/visualization_actions/utils'; +import { hostNameExistsFilter } from '../../../common/components/visualization_actions/utils'; import { AlertsComponentQueryProps } from './types'; export const SessionsTabBody = React.memo((alertsProps: AlertsComponentQueryProps) => { const { pageFilters, filterQuery, ...rest } = alertsProps; const hostPageFilters = useMemo( - () => - pageFilters != null - ? [...filterHostExternalAlertData, ...pageFilters] - : filterHostExternalAlertData, + () => (pageFilters != null ? [...hostNameExistsFilter, ...pageFilters] : hostNameExistsFilter), [pageFilters] ); diff --git a/x-pack/plugins/security_solution/public/hosts/pages/types.ts b/x-pack/plugins/security_solution/public/hosts/pages/types.ts index c7fd743ee5e44..83c23834cc13b 100644 --- a/x-pack/plugins/security_solution/public/hosts/pages/types.ts +++ b/x-pack/plugins/security_solution/public/hosts/pages/types.ts @@ -7,6 +7,7 @@ import { ActionCreator } from 'typescript-fsa'; +import { Filter } from '@kbn/es-query'; import { hostsModel } from '../store'; import { GlobalTimeArgs } from '../../common/containers/use_global_time'; import { InputsModelId } from '../../common/store/inputs/constants'; @@ -18,6 +19,7 @@ export const hostDetailsPagePath = `${HOSTS_PATH}/:detailName`; export type HostsTabsProps = GlobalTimeArgs & { docValueFields: DocValueFields[]; filterQuery: string; + pageFilters?: Filter[]; indexNames: string[]; type: hostsModel.HostsType; setAbsoluteRangeDatePicker: ActionCreator<{ diff --git a/x-pack/plugins/security_solution/public/overview/components/event_counts/index.tsx b/x-pack/plugins/security_solution/public/overview/components/event_counts/index.tsx index efc5a61d227c0..114813ea50a4f 100644 --- a/x-pack/plugins/security_solution/public/overview/components/event_counts/index.tsx +++ b/x-pack/plugins/security_solution/public/overview/components/event_counts/index.tsx @@ -19,7 +19,7 @@ import { getEsQueryConfig } from '../../../../../../../src/plugins/data/common'; import { GlobalTimeArgs } from '../../../common/containers/use_global_time'; import { useInvalidFilterQuery } from '../../../common/hooks/use_invalid_filter_query'; import { - filterHostExternalAlertData, + hostNameExistsFilter, filterNetworkExternalAlertData, } from '../../../common/components/visualization_actions/utils'; @@ -51,7 +51,7 @@ const EventCountsComponent: React.FC = ({ config: getEsQueryConfig(uiSettings), indexPattern, queries: [query], - filters: [...filters, ...filterHostExternalAlertData], + filters: [...filters, ...hostNameExistsFilter], }), [filters, indexPattern, query, uiSettings] ); diff --git a/x-pack/plugins/security_solution/public/users/pages/details/details_tabs.tsx b/x-pack/plugins/security_solution/public/users/pages/details/details_tabs.tsx index 25ada310b74b7..e23cac75b6cdf 100644 --- a/x-pack/plugins/security_solution/public/users/pages/details/details_tabs.tsx +++ b/x-pack/plugins/security_solution/public/users/pages/details/details_tabs.tsx @@ -19,7 +19,7 @@ import { usersDetailsPagePath } from '../constants'; import { TimelineId } from '../../../../common/types'; import { EventsQueryTabBody } from '../../../common/components/events_tab/events_query_tab_body'; import { AlertsView } from '../../../common/components/alerts_viewer'; -import { filterUserExternalAlertData } from './helpers'; +import { userNameExistsFilter } from './helpers'; export const UsersDetailsTabs = React.memo( ({ @@ -64,9 +64,7 @@ export const UsersDetailsTabs = React.memo( const alertsPageFilters = useMemo( () => - pageFilters != null - ? [...filterUserExternalAlertData, ...pageFilters] - : filterUserExternalAlertData, + pageFilters != null ? [...userNameExistsFilter, ...pageFilters] : userNameExistsFilter, [pageFilters] ); diff --git a/x-pack/plugins/security_solution/public/users/pages/details/helpers.ts b/x-pack/plugins/security_solution/public/users/pages/details/helpers.ts index daa02df2fb9ca..bca7ff5c6c336 100644 --- a/x-pack/plugins/security_solution/public/users/pages/details/helpers.ts +++ b/x-pack/plugins/security_solution/public/users/pages/details/helpers.ts @@ -31,7 +31,7 @@ export const getUsersDetailsPageFilters = (userName: string): Filter[] => [ }, ]; -export const filterUserExternalAlertData: Filter[] = [ +export const userNameExistsFilter: Filter[] = [ { query: { bool: { diff --git a/x-pack/plugins/security_solution/public/users/pages/types.ts b/x-pack/plugins/security_solution/public/users/pages/types.ts index 12b6fd0b8749c..787f5def1a18c 100644 --- a/x-pack/plugins/security_solution/public/users/pages/types.ts +++ b/x-pack/plugins/security_solution/public/users/pages/types.ts @@ -6,6 +6,7 @@ */ import { ActionCreator } from 'typescript-fsa'; +import { Filter } from '@kbn/es-query'; import { GlobalTimeArgs } from '../../common/containers/use_global_time'; import { usersModel } from '../../users/store'; @@ -15,6 +16,7 @@ import { InputsModelId } from '../../common/store/inputs/constants'; export type UsersTabsProps = GlobalTimeArgs & { docValueFields: DocValueFields[]; filterQuery: string; + pageFilters?: Filter[]; indexNames: string[]; type: usersModel.UsersType; setAbsoluteRangeDatePicker: ActionCreator<{ diff --git a/x-pack/plugins/security_solution/public/users/pages/users.tsx b/x-pack/plugins/security_solution/public/users/pages/users.tsx index ae5b485142f9c..046cf5ead65b7 100644 --- a/x-pack/plugins/security_solution/public/users/pages/users.tsx +++ b/x-pack/plugins/security_solution/public/users/pages/users.tsx @@ -11,6 +11,7 @@ import { noop } from 'lodash/fp'; import React, { useCallback, useMemo, useRef } from 'react'; import { useDispatch } from 'react-redux'; import { useParams } from 'react-router-dom'; +import { Filter } from '@kbn/es-query'; import { isTab } from '../../../../timelines/public'; import { SecurityPageName } from '../../app/types'; import { FiltersGlobal } from '../../common/components/filters_global'; @@ -49,6 +50,7 @@ import { hasMlUserPermissions } from '../../../common/machine_learning/has_ml_us import { useMlCapabilities } from '../../common/components/ml/hooks/use_ml_capabilities'; import { useIsExperimentalFeatureEnabled } from '../../common/hooks/use_experimental_features'; import { LandingPageComponent } from '../../common/components/landing_page'; +import { userNameExistsFilter } from './details/helpers'; const ID = 'UsersQueryId'; @@ -86,7 +88,11 @@ const UsersComponent = () => { const { uiSettings } = useKibana().services; const { tabName } = useParams<{ tabName: string }>(); - const tabsFilters = React.useMemo(() => { + const tabsFilters: Filter[] = React.useMemo(() => { + if (tabName === UsersTableType.alerts || tabName === UsersTableType.events) { + return filters.length > 0 ? [...filters, ...userNameExistsFilter] : userNameExistsFilter; + } + if (tabName === UsersTableType.risk) { const severityFilter = generateSeverityFilter(severitySelection); @@ -216,6 +222,7 @@ const UsersComponent = () => { setQuery={setQuery} to={to} type={usersModel.UsersType.page} + pageFilters={tabsFilters} /> diff --git a/x-pack/plugins/security_solution/public/users/pages/users_tabs.tsx b/x-pack/plugins/security_solution/public/users/pages/users_tabs.tsx index c0e3fb3e4ab18..fb2cecee75ea6 100644 --- a/x-pack/plugins/security_solution/public/users/pages/users_tabs.tsx +++ b/x-pack/plugins/security_solution/public/users/pages/users_tabs.tsx @@ -27,6 +27,7 @@ export const UsersTabs = memo( ({ deleteQuery, filterQuery, + pageFilters, from, indexNames, isInitializing, @@ -90,13 +91,17 @@ export const UsersTabs = memo( - + From 11722fb920a50df45ced2c6d6d3db97201556947 Mon Sep 17 00:00:00 2001 From: Joe Reuter Date: Wed, 6 Apr 2022 13:31:11 +0200 Subject: [PATCH 27/47] [Lens] Make suggestions depend on active data (#129326) --- .../editor_frame/editor_frame.test.tsx | 34 ++++++------------- .../editor_frame/state_helpers.ts | 19 +---------- .../editor_frame/suggestion_panel.tsx | 25 +++++++++++--- .../lens/public/state_management/selectors.ts | 5 ++- x-pack/plugins/lens/public/types.ts | 9 +---- 5 files changed, 36 insertions(+), 56 deletions(-) diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.test.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.test.tsx index a54161863ed24..faf36a3b519c5 100644 --- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.test.tsx +++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.test.tsx @@ -408,8 +408,7 @@ describe('editor_frame', () => { setDatasourceState(updatedState); }); - // validation requires to calls this getConfiguration API - expect(mockVisualization.getConfiguration).toHaveBeenCalledTimes(6); + expect(mockVisualization.getConfiguration).toHaveBeenCalledTimes(2); expect(mockVisualization.getConfiguration).toHaveBeenLastCalledWith( expect.objectContaining({ state: updatedState, @@ -487,8 +486,7 @@ describe('editor_frame', () => { setDatasourceState({}); }); - // validation requires to calls this getConfiguration API - expect(mockVisualization.getConfiguration).toHaveBeenCalledTimes(6); + expect(mockVisualization.getConfiguration).toHaveBeenCalledTimes(2); expect(mockVisualization.getConfiguration).toHaveBeenLastCalledWith( expect.objectContaining({ frame: expect.objectContaining({ @@ -847,8 +845,7 @@ describe('editor_frame', () => { instance.find('[data-test-subj="lnsSuggestion"]').at(2).simulate('click'); }); - // validation requires to calls this getConfiguration API - expect(mockVisualization.getConfiguration).toHaveBeenCalledTimes(6); + expect(mockVisualization.getConfiguration).toHaveBeenCalledTimes(2); expect(mockVisualization.getConfiguration).toHaveBeenLastCalledWith( expect.objectContaining({ state: suggestionVisState, @@ -928,7 +925,7 @@ describe('editor_frame', () => { }, { score: 0.6, - state: {}, + state: suggestionVisState, title: 'Suggestion2', previewIcon: 'empty', }, @@ -939,7 +936,7 @@ describe('editor_frame', () => { getSuggestions: () => [ { score: 0.8, - state: suggestionVisState, + state: {}, title: 'Suggestion3', previewIcon: 'empty', }, @@ -980,6 +977,8 @@ describe('editor_frame', () => { }) ).instance; + instance.update(); + act(() => { instance.find('[data-test-subj="mockVisA"]').find(DragDrop).prop('onDrop')!( { @@ -992,7 +991,7 @@ describe('editor_frame', () => { ); }); - expect(mockVisualization2.getConfiguration).toHaveBeenCalledWith( + expect(mockVisualization.getConfiguration).toHaveBeenCalledWith( expect.objectContaining({ state: suggestionVisState, }) @@ -1035,20 +1034,8 @@ describe('editor_frame', () => { visualizationMap: { testVis: { ...mockVisualization, - getSuggestions: () => [ - { - score: 0.2, - state: {}, - title: 'Suggestion1', - previewIcon: 'empty', - }, - { - score: 0.6, - state: {}, - title: 'Suggestion2', - previewIcon: 'empty', - }, - ], + // do not return suggestions for the currently active vis, otherwise it will be chosen + getSuggestions: () => [], }, testVis2: { ...mockVisualization2, @@ -1079,6 +1066,7 @@ describe('editor_frame', () => { } as EditorFrameProps; instance = (await mountWithProvider()).instance; + instance.update(); act(() => { instance.find(DragDrop).filter('[dataTestSubj="lnsWorkspace"]').prop('onDrop')!( diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/state_helpers.ts b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/state_helpers.ts index 40db06285d0b6..95626b7657e59 100644 --- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/state_helpers.ts +++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/state_helpers.ts @@ -15,7 +15,6 @@ import { FramePublicAPI, InitializationOptions, Visualization, - VisualizationDimensionGroupConfig, VisualizationMap, VisualizeEditorContext, } from '../../types'; @@ -197,24 +196,8 @@ export const validateDatasourceAndVisualization = ( currentVisualizationState: unknown | undefined, frameAPI: Pick ): ErrorMessage[] | undefined => { - const layersGroups = currentVisualizationState - ? currentVisualization - ?.getLayerIds(currentVisualizationState) - .reduce>((memo, layerId) => { - const groups = currentVisualization?.getConfiguration({ - frame: frameAPI, - layerId, - state: currentVisualizationState, - }).groups; - if (groups) { - memo[layerId] = groups; - } - return memo; - }, {}) - : undefined; - const datasourceValidationErrors = currentDatasourceState - ? currentDataSource?.getErrorMessages(currentDatasourceState, layersGroups) + ? currentDataSource?.getErrorMessages(currentDatasourceState) : undefined; const visualizationValidationErrors = currentVisualizationState diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx index 0257dafa9ccc8..69de606a77ca7 100644 --- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx +++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx @@ -41,7 +41,11 @@ import { } from '../../../../../../src/plugins/expressions/public'; import { prependDatasourceExpression } from './expression_helpers'; import { trackUiEvent, trackSuggestionEvent } from '../../lens_ui_telemetry'; -import { getMissingIndexPattern, validateDatasourceAndVisualization } from './state_helpers'; +import { + getMissingIndexPattern, + validateDatasourceAndVisualization, + getDatasourceLayers, +} from './state_helpers'; import { rollbackSuggestion, selectExecutionContextSearch, @@ -226,16 +230,28 @@ export function SuggestionPanel({ visualizationId, visualizationState: suggestionVisualizationState, datasourceState: suggestionDatasourceState, - datasourceId: suggetionDatasourceId, + datasourceId: suggestionDatasourceId, }) => { return ( !hide && validateDatasourceAndVisualization( - suggetionDatasourceId ? datasourceMap[suggetionDatasourceId] : null, + suggestionDatasourceId ? datasourceMap[suggestionDatasourceId] : null, suggestionDatasourceState, visualizationMap[visualizationId], suggestionVisualizationState, - frame + { + datasourceLayers: getDatasourceLayers( + suggestionDatasourceId + ? { + [suggestionDatasourceId]: { + isLoading: true, + state: suggestionDatasourceState, + }, + } + : {}, + datasourceMap + ), + } ) == null ); } @@ -284,6 +300,7 @@ export function SuggestionPanel({ activeDatasourceId, datasourceMap, visualizationMap, + frame.activeData, ]); const context: ExecutionContextSearch = useLensSelector(selectExecutionContextSearch); diff --git a/x-pack/plugins/lens/public/state_management/selectors.ts b/x-pack/plugins/lens/public/state_management/selectors.ts index aab72c3239e8a..351496ca3e37b 100644 --- a/x-pack/plugins/lens/public/state_management/selectors.ts +++ b/x-pack/plugins/lens/public/state_management/selectors.ts @@ -6,9 +6,8 @@ */ import { createSelector } from '@reduxjs/toolkit'; -// eslint-disable-next-line @kbn/eslint/no-restricted-paths -import { SavedObjectReference } from 'kibana/server'; import { FilterManager } from 'src/plugins/data/public'; +import { SavedObjectReference } from 'kibana/public'; import { LensState } from './types'; import { Datasource, DatasourceMap, VisualizationMap } from '../types'; import { getDatasourceLayers } from '../editor_frame_service/editor_frame'; @@ -160,7 +159,7 @@ export const selectDatasourceLayers = createSelector( export const selectFramePublicAPI = createSelector( [ - selectDatasourceStates, + selectCurrentDatasourceStates, selectActiveData, selectInjectedDependencies as SelectInjectedDependenciesFunction, ], diff --git a/x-pack/plugins/lens/public/types.ts b/x-pack/plugins/lens/public/types.ts index cfa23320dc561..a46493de668ba 100644 --- a/x-pack/plugins/lens/public/types.ts +++ b/x-pack/plugins/lens/public/types.ts @@ -296,14 +296,7 @@ export interface Datasource { ) => Array>; getPublicAPI: (props: PublicAPIProps) => DatasourcePublicAPI; - getErrorMessages: ( - state: T, - layersGroups?: Record, - dateRange?: { - fromDate: string; - toDate: string; - } - ) => + getErrorMessages: (state: T) => | Array<{ shortMessage: string; longMessage: React.ReactNode; From 39cf5d57f1f8be53fafc8dd1cec8f0ff16275d7c Mon Sep 17 00:00:00 2001 From: Shahzad Date: Wed, 6 Apr 2022 13:43:33 +0200 Subject: [PATCH 28/47] [Monitor management] Update to use new add monitor endpoint (#129447) Co-authored-by: Abdul Zahid --- .../monitor_management/monitor_types.ts | 30 ++++----- .../hooks/use_inline_errors.test.tsx | 2 +- .../hooks/use_inline_errors_count.test.tsx | 2 +- .../hooks/use_locations.test.tsx | 1 + .../monitor_list/invalid_monitors.tsx | 1 + .../monitor_list/monitor_async_error.tsx | 19 ++++-- .../monitor_list/monitor_list.test.tsx | 1 + .../public/lib/__mocks__/uptime_store.mock.ts | 1 + .../synthetics_service/service_api_client.ts | 5 +- .../synthetics_service/synthetics_service.ts | 67 +++++++++++-------- .../synthetics_service/add_monitor.ts | 16 ++--- .../uptime/rest/monitor_states_real_data.ts | 8 ++- 12 files changed, 91 insertions(+), 62 deletions(-) diff --git a/x-pack/plugins/uptime/common/runtime_types/monitor_management/monitor_types.ts b/x-pack/plugins/uptime/common/runtime_types/monitor_management/monitor_types.ts index 872ccdbb71ec8..1e8b89ce065fa 100644 --- a/x-pack/plugins/uptime/common/runtime_types/monitor_management/monitor_types.ts +++ b/x-pack/plugins/uptime/common/runtime_types/monitor_management/monitor_types.ts @@ -306,23 +306,19 @@ export type EncryptedSyntheticsMonitorWithId = t.TypeOf< typeof EncryptedSyntheticsMonitorWithIdCodec >; -export const MonitorManagementListResultCodec = t.intersection([ - t.type({ - monitors: t.array( - t.interface({ - id: t.string, - attributes: EncryptedSyntheticsMonitorCodec, - updated_at: t.string, - }) - ), - page: t.number, - perPage: t.number, - total: t.union([t.number, t.null]), - }), - t.partial({ - syncErrors: ServiceLocationErrors, - }), -]); +export const MonitorManagementListResultCodec = t.type({ + monitors: t.array( + t.interface({ + id: t.string, + attributes: EncryptedSyntheticsMonitorCodec, + updated_at: t.string, + }) + ), + page: t.number, + perPage: t.number, + total: t.union([t.number, t.null]), + syncErrors: t.union([ServiceLocationErrors, t.null]), +}); export type MonitorManagementListResult = t.TypeOf; diff --git a/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_inline_errors.test.tsx b/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_inline_errors.test.tsx index c0c1145e5cc2f..649b009687e33 100644 --- a/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_inline_errors.test.tsx +++ b/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_inline_errors.test.tsx @@ -70,7 +70,7 @@ describe('useInlineErrors', function () { { error: { monitorList: null, serviceLocations: null, enablement: null }, enablement: null, - list: { monitors: [], page: 1, perPage: 10, total: null }, + list: { monitors: [], page: 1, perPage: 10, total: null, syncErrors: null }, loading: { monitorList: false, serviceLocations: false, enablement: false }, locations: [], syntheticsService: { diff --git a/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_inline_errors_count.test.tsx b/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_inline_errors_count.test.tsx index c56ca40c59aad..e973e3dd1a7f1 100644 --- a/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_inline_errors_count.test.tsx +++ b/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_inline_errors_count.test.tsx @@ -68,7 +68,7 @@ describe('useInlineErrorsCount', function () { 'heartbeat-8*,heartbeat-7*,synthetics-*', { error: { monitorList: null, serviceLocations: null, enablement: null }, - list: { monitors: [], page: 1, perPage: 10, total: null }, + list: { monitors: [], page: 1, perPage: 10, total: null, syncErrors: null }, enablement: null, loading: { monitorList: false, serviceLocations: false, enablement: false }, locations: [], diff --git a/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_locations.test.tsx b/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_locations.test.tsx index fdb1c57712020..46b8981b74a0f 100644 --- a/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_locations.test.tsx +++ b/x-pack/plugins/uptime/public/components/monitor_management/hooks/use_locations.test.tsx @@ -40,6 +40,7 @@ describe('useExpViewTimeRange', function () { page: 1, total: 0, monitors: [], + syncErrors: null, }, locations: [], enablement: null, diff --git a/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/invalid_monitors.tsx b/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/invalid_monitors.tsx index 87a6cf2dc1d2b..342b9c6547b1b 100644 --- a/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/invalid_monitors.tsx +++ b/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/invalid_monitors.tsx @@ -48,6 +48,7 @@ export const InvalidMonitors = ({ page: pageState.pageIndex, perPage: pageState.pageSize, total: invalidTotal ?? 0, + syncErrors: null, }, enablement: null, error: { monitorList: null, serviceLocations: null, enablement: null }, diff --git a/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/monitor_async_error.tsx b/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/monitor_async_error.tsx index c9e9dba2027a4..48aeaf3648a0b 100644 --- a/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/monitor_async_error.tsx +++ b/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/monitor_async_error.tsx @@ -36,11 +36,15 @@ export const MonitorAsyncError = () => { />

    - {Object.values(syncErrors).map((e) => { + {Object.values(syncErrors ?? {}).map((e) => { return ( -
  • {`${ - locations.find((location) => location.id === e.locationId)?.label - } - ${STATUS_LABEL}: ${e.error.status}; ${REASON_LABEL}: ${e.error.reason}.`}
    • +
  • + {`${ + locations.find((location) => location.id === e.locationId)?.label + } - ${STATUS_LABEL}: ${e.error?.status ?? NOT_AVAILABLE_LABEL}; ${REASON_LABEL}: ${ + e.error?.reason ?? NOT_AVAILABLE_LABEL + }`} +
    • ); })}
@@ -67,6 +71,13 @@ const STATUS_LABEL = i18n.translate( } ); +const NOT_AVAILABLE_LABEL = i18n.translate( + 'xpack.uptime.monitorManagement.monitorSync.failure.notAvailable', + { + defaultMessage: 'Not available', + } +); + const DISMISS_LABEL = i18n.translate( 'xpack.uptime.monitorManagement.monitorSync.failure.dismissLabel', { diff --git a/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/monitor_list.test.tsx b/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/monitor_list.test.tsx index 8d0bd67616576..40eb185a65f0c 100644 --- a/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/monitor_list.test.tsx +++ b/x-pack/plugins/uptime/public/components/monitor_management/monitor_list/monitor_list.test.tsx @@ -48,6 +48,7 @@ describe('', () => { page: 1, total: 6, monitors, + syncErrors: null, }, locations: [], enablement: null, diff --git a/x-pack/plugins/uptime/public/lib/__mocks__/uptime_store.mock.ts b/x-pack/plugins/uptime/public/lib/__mocks__/uptime_store.mock.ts index 1bb86877f9861..0286e884a68d7 100644 --- a/x-pack/plugins/uptime/public/lib/__mocks__/uptime_store.mock.ts +++ b/x-pack/plugins/uptime/public/lib/__mocks__/uptime_store.mock.ts @@ -69,6 +69,7 @@ export const mockState: AppState = { perPage: 10, total: null, monitors: [], + syncErrors: null, }, locations: [], loading: { diff --git a/x-pack/plugins/uptime/server/lib/synthetics_service/service_api_client.ts b/x-pack/plugins/uptime/server/lib/synthetics_service/service_api_client.ts index 68d4ebd385f07..3397dcad94e95 100644 --- a/x-pack/plugins/uptime/server/lib/synthetics_service/service_api_client.ts +++ b/x-pack/plugins/uptime/server/lib/synthetics_service/service_api_client.ts @@ -74,7 +74,7 @@ export class ServiceAPIClient { } async put(data: ServiceData) { - return this.callAPI('POST', data); + return this.callAPI('PUT', data); } async delete(data: ServiceData) { @@ -170,6 +170,9 @@ export class ServiceAPIClient { catchError((err) => { pushErrors.push({ locationId: id, error: err.response?.data }); this.logger.error(err); + if (err.response?.data?.reason) { + this.logger.error(err.response?.data?.reason); + } // we don't want to throw an unhandled exception here return of(true); }) diff --git a/x-pack/plugins/uptime/server/lib/synthetics_service/synthetics_service.ts b/x-pack/plugins/uptime/server/lib/synthetics_service/synthetics_service.ts index 24630cd0ec738..c6fa280f2f163 100644 --- a/x-pack/plugins/uptime/server/lib/synthetics_service/synthetics_service.ts +++ b/x-pack/plugins/uptime/server/lib/synthetics_service/synthetics_service.ts @@ -45,6 +45,11 @@ const SYNTHETICS_SERVICE_SYNC_MONITORS_TASK_TYPE = const SYNTHETICS_SERVICE_SYNC_MONITORS_TASK_ID = 'UPTIME:SyntheticsService:sync-task'; const SYNTHETICS_SERVICE_SYNC_INTERVAL_DEFAULT = '5m'; +type SyntheticsConfig = SyntheticsMonitorWithId & { + fields_under_root?: boolean; + fields?: { config_id: string; run_once?: boolean; test_run_id?: string }; +}; + export class SyntheticsService { private logger: Logger; private readonly server: UptimeServerSetup; @@ -218,14 +223,32 @@ export class SyntheticsService { }; } - async pushConfigs( - configs?: Array< - SyntheticsMonitorWithId & { - fields_under_root?: boolean; - fields?: { config_id: string }; - } - > - ) { + async addConfig(config: SyntheticsConfig) { + const monitors = this.formatConfigs([config]); + + this.apiKey = await this.getApiKey(); + + if (!this.apiKey) { + return null; + } + + const data = { + monitors, + output: await this.getOutput(this.apiKey), + }; + + this.logger.debug(`1 monitor will be pushed to synthetics service.`); + + try { + this.syncErrors = await this.apiClient.post(data); + return this.syncErrors; + } catch (e) { + this.logger.error(e); + throw e; + } + } + + async pushConfigs(configs?: SyntheticsConfig[]) { const monitors = this.formatConfigs(configs || (await this.getMonitorConfigs())); if (monitors.length === 0) { this.logger.debug('No monitor found which can be pushed to service.'); @@ -246,21 +269,15 @@ export class SyntheticsService { this.logger.debug(`${monitors.length} monitors will be pushed to synthetics service.`); try { - return await this.apiClient.post(data); + this.syncErrors = await this.apiClient.put(data); + return this.syncErrors; } catch (e) { this.logger.error(e); throw e; } } - async runOnceConfigs( - configs?: Array< - SyntheticsMonitorWithId & { - fields_under_root?: boolean; - fields?: { run_once: boolean; config_id: string }; - } - > - ) { + async runOnceConfigs(configs?: SyntheticsConfig[]) { const monitors = this.formatConfigs(configs || (await this.getMonitorConfigs())); if (monitors.length === 0) { return; @@ -284,15 +301,7 @@ export class SyntheticsService { } } - async triggerConfigs( - request?: KibanaRequest, - configs?: Array< - SyntheticsMonitorWithId & { - fields_under_root?: boolean; - fields?: { config_id: string; test_run_id: string }; - } - > - ) { + async triggerConfigs(request?: KibanaRequest, configs?: SyntheticsConfig[]) { const monitors = this.formatConfigs(configs || (await this.getMonitorConfigs())); if (monitors.length === 0) { return; @@ -328,7 +337,11 @@ export class SyntheticsService { monitors: this.formatConfigs(configs), output: await this.getOutput(this.apiKey), }; - return await this.apiClient.delete(data); + const result = await this.apiClient.delete(data); + if (this.syncErrors && this.syncErrors?.length > 0) { + this.syncErrors = await this.pushConfigs(); + } + return result; } async deleteAllConfigs() { diff --git a/x-pack/plugins/uptime/server/rest_api/synthetics_service/add_monitor.ts b/x-pack/plugins/uptime/server/rest_api/synthetics_service/add_monitor.ts index 19bc5050ddfcc..521dae85e85db 100644 --- a/x-pack/plugins/uptime/server/rest_api/synthetics_service/add_monitor.ts +++ b/x-pack/plugins/uptime/server/rest_api/synthetics_service/add_monitor.ts @@ -45,16 +45,14 @@ export const addSyntheticsMonitorRoute: UMRestApiRouteFactory = () => ({ const { syntheticsService } = server; - const errors = await syntheticsService.pushConfigs([ - { - ...monitor, - id: newMonitor.id, - fields: { - config_id: newMonitor.id, - }, - fields_under_root: true, + const errors = await syntheticsService.addConfig({ + ...monitor, + id: newMonitor.id, + fields: { + config_id: newMonitor.id, }, - ]); + fields_under_root: true, + }); sendTelemetryEvents( server.logger, diff --git a/x-pack/test/api_integration/apis/uptime/rest/monitor_states_real_data.ts b/x-pack/test/api_integration/apis/uptime/rest/monitor_states_real_data.ts index 909a485057f85..68d17cf3a4dd2 100644 --- a/x-pack/test/api_integration/apis/uptime/rest/monitor_states_real_data.ts +++ b/x-pack/test/api_integration/apis/uptime/rest/monitor_states_real_data.ts @@ -8,7 +8,10 @@ import expect from '@kbn/expect'; import { isRight } from 'fp-ts/lib/Either'; import { FtrProviderContext } from '../../../ftr_provider_context'; -import { MonitorSummariesResultType } from '../../../../../plugins/uptime/common/runtime_types'; +import { + MonitorSummariesResult, + MonitorSummariesResultType, +} from '../../../../../plugins/uptime/common/runtime_types'; import { API_URLS } from '../../../../../plugins/uptime/common/constants'; interface ExpectedMonitorStatesPage { @@ -40,7 +43,8 @@ const checkMonitorStatesResponse = ({ const decoded = MonitorSummariesResultType.decode(response); expect(isRight(decoded)).to.be.ok(); if (isRight(decoded)) { - const { summaries, prevPagePagination, nextPagePagination } = decoded.right; + const { summaries, prevPagePagination, nextPagePagination } = + decoded.right as MonitorSummariesResult; expect(summaries).to.have.length(size); expect(summaries?.map((s) => s.monitor_id)).to.eql(statesIds); expect( From 8af56aaf8181b4639f0ee169f8189790975f12a4 Mon Sep 17 00:00:00 2001 From: Matthew Kime Date: Wed, 6 Apr 2022 07:24:59 -0500 Subject: [PATCH 29/47] reset selection after data view delete (#129552) --- .../components/index_pattern_table/index_pattern_table.tsx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/plugins/data_view_management/public/components/index_pattern_table/index_pattern_table.tsx b/src/plugins/data_view_management/public/components/index_pattern_table/index_pattern_table.tsx index 2de06c20c4040..578a0b198bbe8 100644 --- a/src/plugins/data_view_management/public/components/index_pattern_table/index_pattern_table.tsx +++ b/src/plugins/data_view_management/public/components/index_pattern_table/index_pattern_table.tsx @@ -94,7 +94,10 @@ export const IndexPatternTable = ({ dataViews, overlays, uiSettings, - onDelete: () => loadDataViews(), + onDelete: () => { + setSelectedItems([]); + loadDataViews(); + }, }); if (selectedItems.length === 0) { return; From 1a48388cbd90e5f3170e4b1e6cf256790c908641 Mon Sep 17 00:00:00 2001 From: Andrew Tate Date: Wed, 6 Apr 2022 08:02:08 -0500 Subject: [PATCH 30/47] [Lens] apply pinned filters to Lens (#129503) --- .../init_middleware/load_initial.ts | 2 +- .../public/state_management/load_initial.test.tsx | 13 +++++++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/x-pack/plugins/lens/public/state_management/init_middleware/load_initial.ts b/x-pack/plugins/lens/public/state_management/init_middleware/load_initial.ts index c9009ab395e7c..e25c57ac129c9 100644 --- a/x-pack/plugins/lens/public/state_management/init_middleware/load_initial.ts +++ b/x-pack/plugins/lens/public/state_management/init_middleware/load_initial.ts @@ -186,7 +186,7 @@ export function loadInitial( setState({ isSaveable: true, sharingSavedObjectProps, - filters, + filters: data.query.filterManager.getFilters(), query: doc.state.query, searchSessionId: dashboardFeatureFlag.allowByValueEmbeddables && diff --git a/x-pack/plugins/lens/public/state_management/load_initial.test.tsx b/x-pack/plugins/lens/public/state_management/load_initial.test.tsx index cc57a44fc21ca..9ae27a9c0073e 100644 --- a/x-pack/plugins/lens/public/state_management/load_initial.test.tsx +++ b/x-pack/plugins/lens/public/state_management/load_initial.test.tsx @@ -17,6 +17,7 @@ import { Location, History } from 'history'; import { act } from 'react-dom/test-utils'; import { LensEmbeddableInput } from '../embeddable'; import { loadInitial } from './lens_slice'; +import { Filter } from '@kbn/es-query'; const history = { location: { @@ -214,9 +215,16 @@ describe('Initializing the store', () => { }); it('loads a document and uses query and filters if initial input is provided', async () => { - const { store, deps } = await makeLensStore({ preloadedState }); + const { store, deps } = makeLensStore({ preloadedState }); + + const mockFilters = 'some filters from the filter manager' as unknown as Filter[]; + + jest + .spyOn(deps.lensServices.data.query.filterManager, 'getFilters') + .mockReturnValue(mockFilters); + await act(async () => { - await store.dispatch(loadInitial(defaultProps)); + store.dispatch(loadInitial(defaultProps)); }); expect(deps.lensServices.attributeService.unwrapAttributes).toHaveBeenCalledWith({ @@ -233,6 +241,7 @@ describe('Initializing the store', () => { query: 'kuery', isLoading: false, activeDatasourceId: 'testDatasource', + filters: mockFilters, }), }); }); From 9606cf17d1be171cd5418de8ac457955068eaaf7 Mon Sep 17 00:00:00 2001 From: Nicolas Chaulet Date: Wed, 6 Apr 2022 09:43:22 -0400 Subject: [PATCH 31/47] [Fleet] Do not enable view agent dashboard for agent policy without monitoring (#129509) --- .../components/agent_dashboard_link.test.tsx | 47 +++++++++++++++++-- .../components/agent_dashboard_link.tsx | 27 +++++++++-- .../agents/agent_details_page/index.tsx | 2 +- 3 files changed, 68 insertions(+), 8 deletions(-) diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx index ef9e1251c40e2..3fc27cfbc9263 100644 --- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx +++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx @@ -8,7 +8,7 @@ import React from 'react'; import { createFleetTestRendererMock } from '../../../../../../mock'; -import type { Agent } from '../../../../types'; +import type { Agent, AgentPolicy } from '../../../../types'; import { useGetPackageInfoByKey } from '../../../../../../hooks/use_request/epm'; import { AgentDashboardLink } from './agent_dashboard_link'; @@ -26,7 +26,7 @@ jest.mock('../../../../../../hooks/use_fleet_status', () => ({ jest.mock('../../../../../../hooks/use_request/epm'); describe('AgentDashboardLink', () => { - it('should enable the button if elastic_agent package is installed', async () => { + it('should enable the button if elastic_agent package is installed and policy has monitoring enabled', async () => { mockedUseGetPackageInfoByKey.mockReturnValue({ isLoading: false, data: { @@ -44,6 +44,11 @@ describe('AgentDashboardLink', () => { id: 'agent-id-123', } as unknown as Agent } + agentPolicy={ + { + monitoring_enabled: ['logs', 'metrics'], + } as unknown as AgentPolicy + } /> ); @@ -51,7 +56,7 @@ describe('AgentDashboardLink', () => { expect(result.getByRole('link').hasAttribute('href')).toBeTruthy(); }); - it('should not enable the button if elastic_agent package is installed', async () => { + it('should not enable the button if elastic_agent package is not installed and policy has monitoring enabled', async () => { mockedUseGetPackageInfoByKey.mockReturnValue({ isLoading: false, data: { @@ -69,6 +74,42 @@ describe('AgentDashboardLink', () => { id: 'agent-id-123', } as unknown as Agent } + agentPolicy={ + { + monitoring_enabled: ['logs', 'metrics'], + } as unknown as AgentPolicy + } + /> + ); + + expect(result.queryByRole('link')).toBeNull(); + expect(result.queryByRole('button')).not.toBeNull(); + expect(result.getByRole('button').hasAttribute('disabled')).toBeTruthy(); + }); + + it('should not enable the button if elastic_agent package is installed and policy do not have monitoring enabled', async () => { + mockedUseGetPackageInfoByKey.mockReturnValue({ + isLoading: false, + data: { + item: { + status: 'installed', + }, + }, + } as ReturnType); + const testRenderer = createFleetTestRendererMock(); + + const result = testRenderer.render( + ); diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx index 9449e5370b7cd..191fcea481bb5 100644 --- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx +++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx @@ -10,7 +10,7 @@ import { FormattedMessage } from '@kbn/i18n-react'; import { EuiButton, EuiToolTip } from '@elastic/eui'; import { useGetPackageInfoByKey, useKibanaLink } from '../../../../hooks'; -import type { Agent } from '../../../../types'; +import type { Agent, AgentPolicy } from '../../../../types'; import { FLEET_ELASTIC_AGENT_PACKAGE, FLEET_ELASTIC_AGENT_DETAILS_DASHBOARD_ID, @@ -34,10 +34,14 @@ function useAgentDashboardLink(agent: Agent) { export const AgentDashboardLink: React.FunctionComponent<{ agent: Agent; -}> = ({ agent }) => { + agentPolicy?: AgentPolicy; +}> = ({ agent, agentPolicy }) => { const { isInstalled, link, isLoading } = useAgentDashboardLink(agent); - const buttonArgs = !isInstalled || isLoading ? { disabled: true } : { href: link }; + const isLogAndMetricsEnabled = agentPolicy?.monitoring_enabled?.length ?? 0 > 0; + + const buttonArgs = + !isInstalled || isLoading || !isLogAndMetricsEnabled ? { disabled: true } : { href: link }; const button = ( @@ -48,12 +52,27 @@ export const AgentDashboardLink: React.FunctionComponent<{ ); + if (!isLogAndMetricsEnabled) { + return ( + + } + > + {button} + + ); + } + if (!isInstalled) { return ( } diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/index.tsx index 91c84f1be4713..5654f4a18d1d3 100644 --- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/index.tsx +++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/index.tsx @@ -124,7 +124,7 @@ export const AgentDetailsPage: React.FunctionComponent = () => { )} - + From 4a7084e0035cab583b5d1ad6130af6376eaa13ec Mon Sep 17 00:00:00 2001 From: Paul Tavares <56442535+paul-tavares@users.noreply.github.com> Date: Wed, 6 Apr 2022 10:28:38 -0400 Subject: [PATCH 32/47] [Security Solution][Endpoint] Fix Host Isolation Exceptions summary card showing in Fleet with Basic license (#129408) * Enable use of `useEndpointPrivileges()` from component rendered in fleet's context * Fix Host Isolation exceptions showing up even if user does not have access --- .../security_solution_start_dependencies.tsx | 28 ++++++++ .../endpoint/use_endpoint_privileges.ts | 9 ++- .../index.tsx | 72 ++++++++++--------- .../endpoint_policy_edit_extension.tsx | 5 +- .../with_security_context.tsx | 12 +++- 5 files changed, 85 insertions(+), 41 deletions(-) create mode 100644 x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/security_solution_start_dependencies.tsx diff --git a/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/security_solution_start_dependencies.tsx b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/security_solution_start_dependencies.tsx new file mode 100644 index 0000000000000..26298b0e13c58 --- /dev/null +++ b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/security_solution_start_dependencies.tsx @@ -0,0 +1,28 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React, { useContext } from 'react'; +import { StartPlugins } from '../../../../types'; + +/** + * For use with the Fleet UI extensions, where `useKibana().services.**` does not return the services + * provided to the Security Solution plugin. + */ +export const SecuritySolutionStartDependenciesContext = React.createContext< + undefined | Pick +>(undefined); + +/** + * Hook used in `useEndpointPrivileges()` when that hook is being invoked from outside of + * security solution, as is the case with UI extensions that are rendered within the Fleet + * pages. + */ +export const useSecuritySolutionStartDependencies = (): + | undefined + | Pick => { + return useContext(SecuritySolutionStartDependenciesContext); +}; diff --git a/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.ts b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.ts index e6c7b9a5d0e95..dcd602290d85c 100644 --- a/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.ts +++ b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.ts @@ -18,6 +18,7 @@ import { getEndpointAuthzInitialState, } from '../../../../../common/endpoint/service/authz'; import { FleetAuthz } from '../../../../../../fleet/common'; +import { useSecuritySolutionStartDependencies } from './security_solution_start_dependencies'; /** * Retrieve the endpoint privileges for the current user. @@ -27,7 +28,11 @@ import { FleetAuthz } from '../../../../../../fleet/common'; */ export const useEndpointPrivileges = (): Immutable => { const user = useCurrentUser(); - const fleetServices = useKibana().services.fleet; + const fleetServicesFromUseKibana = useKibana().services.fleet; + // The `fleetServicesFromPluginStart` will be defined when this hooks called from a component + // that is being rendered under the Fleet context (UI extensions). The `fleetServicesFromUseKibana` + // above will be `undefined` in this case. + const fleetServicesFromPluginStart = useSecuritySolutionStartDependencies()?.fleet; const isMounted = useRef(true); const licenseService = useLicense(); const [fleetCheckDone, setFleetCheckDone] = useState(false); @@ -35,6 +40,8 @@ export const useEndpointPrivileges = (): Immutable => { const [userRolesCheckDone, setUserRolesCheckDone] = useState(false); const [userRoles, setUserRoles] = useState>([]); + const fleetServices = fleetServicesFromUseKibana ?? fleetServicesFromPluginStart; + const privileges = useMemo(() => { const privilegeList: EndpointPrivileges = Object.freeze({ loading: !fleetCheckDone || !userRolesCheckDone || !user, diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/index.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/index.tsx index 0da28d6ed7d1b..b6b91d8d64e4f 100644 --- a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/index.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_package_custom_extension/index.tsx @@ -11,7 +11,6 @@ import { EuiSpacer } from '@elastic/eui'; import React, { memo, useMemo } from 'react'; import { useHttp } from '../../../../../../common/lib/kibana/hooks'; import { PackageCustomExtensionComponentProps } from '../../../../../../../../fleet/public'; -import { ReactQueryClientProvider } from '../../../../../../common/containers/query_client/query_client_provider'; import { FleetArtifactsCard } from './components/fleet_artifacts_card'; import { getBlocklistsListPath, @@ -23,6 +22,7 @@ import { TrustedAppsApiClient } from '../../../../trusted_apps/service/trusted_a import { EventFiltersApiClient } from '../../../../event_filters/service/event_filters_api_client'; import { HostIsolationExceptionsApiClient } from '../../../../host_isolation_exceptions/host_isolation_exceptions_api_client'; import { BlocklistsApiClient } from '../../../../blocklist/services'; +import { useCanSeeHostIsolationExceptionsMenu } from '../../../../host_isolation_exceptions/view/hooks'; export const TRUSTED_APPS_LABELS = { artifactsSummaryApiError: (error: string) => @@ -96,6 +96,8 @@ export const BLOCKLISTS_LABELS = { export const EndpointPackageCustomExtension = memo( (props) => { const http = useHttp(); + const canSeeHostIsolationExceptions = useCanSeeHostIsolationExceptionsMenu(); + const trustedAppsApiClientInstance = useMemo( () => TrustedAppsApiClient.getInstance(http), [http] @@ -115,39 +117,41 @@ export const EndpointPackageCustomExtension = memo - - - - - - - - - + + + + {canSeeHostIsolationExceptions && ( + <> + + + + )} + +
); } diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_policy_edit_extension.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_policy_edit_extension.tsx index 690cb2dc734bd..24aad4e9ed686 100644 --- a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_policy_edit_extension.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/endpoint_policy_edit_extension.tsx @@ -31,7 +31,6 @@ import { policyDetailsForUpdate, } from '../../store/policy_details/selectors'; -import { ReactQueryClientProvider } from '../../../../../common/containers/query_client/query_client_provider'; import { useUserPrivileges } from '../../../../../common/components/user_privileges'; import { FleetIntegrationArtifactsCard } from './endpoint_package_custom_extension/components/fleet_integration_artifacts_card'; import { BlocklistsApiClient } from '../../../blocklist/services'; @@ -137,10 +136,10 @@ export const TRUSTED_APPS_LABELS = { export const EndpointPolicyEditExtension = memo( ({ policy, onChange }) => { return ( - + <> - + ); } ); diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/with_security_context.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/with_security_context.tsx index 5153fbb73ba71..06a099ed119ab 100644 --- a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/with_security_context.tsx +++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/with_security_context.tsx @@ -15,6 +15,8 @@ import { managementReducer } from '../../../../store/reducer'; import { managementMiddlewareFactory } from '../../../../store/middleware'; import { appReducer } from '../../../../../common/store/app'; import { ExperimentalFeaturesService } from '../../../../../common/experimental_features_service'; +import { SecuritySolutionStartDependenciesContext } from '../../../../../common/components/user_privileges/endpoint/security_solution_start_dependencies'; +import { ReactQueryClientProvider } from '../../../../../common/containers/query_client/query_client_provider'; type ComposeType = typeof compose; declare global { @@ -69,9 +71,13 @@ export const withSecurityContext =

({ return ( - - - + + + + + + + ); }); From d2be8b5231d22e0d0e7e8e4b66c3a5ea0b3ccf74 Mon Sep 17 00:00:00 2001 From: Max Kovalev Date: Wed, 6 Apr 2022 18:20:56 +0300 Subject: [PATCH 33/47] [Maps] replace src/plugins/kibana_react ExitFullScreenButton with src/plugins/shared_ux ExitFullScreenButton (#128051) * #125786 - replacing of usage exitFullScreen button from kibana_react to sharedUX plugin * 125786 - changing the way of using SharedUX plugin in maps due to CI failure * 125786 - correcting time values in tests * 125786 - updating reference screenshots; reverting test * 125786 - changed data subject name for full screen button test * 125786 - updated test and baseline screenshots * 125786 - updated screenshots * 125786 - updated screenshots * 125786 - running test for creating screenshoots on CI side * 125786 - news screenshots; fix for ally test; revert sample_data.js Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> --- x-pack/plugins/maps/kibana.json | 3 +- .../map_container/map_container.tsx | 8 ++---- x-pack/plugins/maps/public/kibana_services.ts | 1 + x-pack/plugins/maps/public/plugin.ts | 2 ++ x-pack/plugins/maps/public/render_app.tsx | 26 ++++++++++-------- x-pack/plugins/maps/tsconfig.json | 1 + x-pack/test/accessibility/apps/maps.ts | 2 +- .../test/functional/apps/maps/sample_data.js | 9 ++++-- .../test/functional/page_objects/gis_page.ts | 10 +++---- .../screenshots/baseline/ecommerce_map.png | Bin 68442 -> 50514 bytes .../screenshots/baseline/flights_map.png | Bin 104337 -> 47234 bytes .../screenshots/baseline/web_logs_map.png | Bin 134984 -> 122717 bytes 12 files changed, 36 insertions(+), 26 deletions(-) diff --git a/x-pack/plugins/maps/kibana.json b/x-pack/plugins/maps/kibana.json index 5a2d1410c8ebc..a19f160127eb3 100644 --- a/x-pack/plugins/maps/kibana.json +++ b/x-pack/plugins/maps/kibana.json @@ -25,7 +25,8 @@ "mapsEms", "savedObjects", "share", - "presentationUtil" + "presentationUtil", + "sharedUX" ], "optionalPlugins": [ "cloud", diff --git a/x-pack/plugins/maps/public/connected_components/map_container/map_container.tsx b/x-pack/plugins/maps/public/connected_components/map_container/map_container.tsx index 581460f318583..6a4162f65a7fb 100644 --- a/x-pack/plugins/maps/public/connected_components/map_container/map_container.tsx +++ b/x-pack/plugins/maps/public/connected_components/map_container/map_container.tsx @@ -15,14 +15,14 @@ import { Filter } from '@kbn/es-query'; import { ActionExecutionContext, Action } from 'src/plugins/ui_actions/public'; import { Observable } from 'rxjs'; import moment from 'moment'; +import { ExitFullScreenButton } from '@kbn/shared-ux-components'; import { MBMap } from '../mb_map'; import { RightSideControls } from '../right_side_controls'; import { Timeslider } from '../timeslider'; import { ToolbarOverlay } from '../toolbar_overlay'; import { EditLayerPanel } from '../edit_layer_panel'; import { AddLayerPanel } from '../add_layer_panel'; -import { ExitFullScreenButton } from '../../../../../../src/plugins/kibana_react/public'; -import { getCoreChrome, getData } from '../../kibana_services'; +import { getData } from '../../kibana_services'; import { RawValue } from '../../../common/constants'; import { FLYOUT_STATE } from '../../reducers/ui'; import { MapSettings } from '../../reducers/map'; @@ -207,9 +207,7 @@ export class MapContainer extends Component { let exitFullScreenButton; if (isFullScreen) { - exitFullScreenButton = ( - - ); + exitFullScreenButton = ; } const shareAttributes = this.props.isSharable ? { diff --git a/x-pack/plugins/maps/public/kibana_services.ts b/x-pack/plugins/maps/public/kibana_services.ts index 8d7492829c40f..f2345d2102a12 100644 --- a/x-pack/plugins/maps/public/kibana_services.ts +++ b/x-pack/plugins/maps/public/kibana_services.ts @@ -65,6 +65,7 @@ export const getSecurityService = () => pluginsStart.security; export const getSpacesApi = () => pluginsStart.spaces; export const getTheme = () => coreStart.theme; export const getUsageCollection = () => pluginsStart.usageCollection; +export const getSharedUXPluginContext = () => pluginsStart.sharedUX; // xpack.maps.* kibana.yml settings from this plugin let mapAppConfig: MapsConfigType; diff --git a/x-pack/plugins/maps/public/plugin.ts b/x-pack/plugins/maps/public/plugin.ts index 2aa661f2c4668..2ab91462cfe7e 100644 --- a/x-pack/plugins/maps/public/plugin.ts +++ b/x-pack/plugins/maps/public/plugin.ts @@ -79,6 +79,7 @@ import type { CloudSetup } from '../../cloud/public'; import type { LensPublicSetup } from '../../lens/public'; import { setupLensChoroplethChart } from './lens'; +import { SharedUXPluginStart } from '../../../../src/plugins/shared_ux/public'; export interface MapsPluginSetupDependencies { cloud?: CloudSetup; @@ -114,6 +115,7 @@ export interface MapsPluginStartDependencies { spaces?: SpacesPluginStart; mapsEms: MapsEmsPluginPublicStart; usageCollection?: UsageCollectionSetup; + sharedUX: SharedUXPluginStart; } /** diff --git a/x-pack/plugins/maps/public/render_app.tsx b/x-pack/plugins/maps/public/render_app.tsx index aa5e1ee29833d..8a3ea87905512 100644 --- a/x-pack/plugins/maps/public/render_app.tsx +++ b/x-pack/plugins/maps/public/render_app.tsx @@ -10,6 +10,7 @@ import { render, unmountComponentAtNode } from 'react-dom'; import { Router, Switch, Route, Redirect, RouteComponentProps } from 'react-router-dom'; import { i18n } from '@kbn/i18n'; import type { AppMountParameters } from 'kibana/public'; +import { SharedUxServicesProvider } from '@kbn/shared-ux-services'; import { KibanaThemeProvider } from '../../../../src/plugins/kibana_react/public'; import { getCoreChrome, @@ -18,6 +19,7 @@ import { getToasts, getEmbeddableService, getDocLinks, + getSharedUXPluginContext, } from './kibana_services'; import { createKbnUrlStateStorage, @@ -94,17 +96,19 @@ export async function renderApp( } return ( - + + + ); } diff --git a/x-pack/plugins/maps/tsconfig.json b/x-pack/plugins/maps/tsconfig.json index 1c8951a6cae3a..5d5f4223fab9a 100644 --- a/x-pack/plugins/maps/tsconfig.json +++ b/x-pack/plugins/maps/tsconfig.json @@ -32,6 +32,7 @@ { "path": "../../../src/plugins/usage_collection/tsconfig.json" }, { "path": "../../../src/plugins/kibana_react/tsconfig.json" }, { "path": "../../../src/plugins/kibana_utils/tsconfig.json" }, + { "path": "../../../src/plugins/shared_ux/tsconfig.json" }, { "path": "../cloud/tsconfig.json" }, { "path": "../features/tsconfig.json" }, { "path": "../lens/tsconfig.json" }, diff --git a/x-pack/test/accessibility/apps/maps.ts b/x-pack/test/accessibility/apps/maps.ts index d38cf44f39fba..c5b824c330829 100644 --- a/x-pack/test/accessibility/apps/maps.ts +++ b/x-pack/test/accessibility/apps/maps.ts @@ -82,7 +82,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { }); it('displays exit full screen logo button', async () => { - await testSubjects.click('exitFullScreenModeLogo'); + await testSubjects.click('exitFullScreenModeButton'); await a11y.testAppSnapshot(); }); diff --git a/x-pack/test/functional/apps/maps/sample_data.js b/x-pack/test/functional/apps/maps/sample_data.js index 5c0c4af46e2a9..35733e8d75ffb 100644 --- a/x-pack/test/functional/apps/maps/sample_data.js +++ b/x-pack/test/functional/apps/maps/sample_data.js @@ -91,9 +91,12 @@ export default function ({ getPageObjects, getService, updateBaselines }) { [UI_SETTINGS.TIMEPICKER_QUICK_RANGES]: SAMPLE_DATA_RANGE, }); //running the rest of the tests with limited roles - await security.testUser.setRoles(['global_maps_all', 'kibana_sample_read'], { - skipBrowserRefresh: true, - }); + await security.testUser.setRoles( + ['global_maps_all', 'geoall_data_writer', 'kibana_sample_read'], + { + skipBrowserRefresh: true, + } + ); }); after(async () => { diff --git a/x-pack/test/functional/page_objects/gis_page.ts b/x-pack/test/functional/page_objects/gis_page.ts index 33f28795277af..909a96706575b 100644 --- a/x-pack/test/functional/page_objects/gis_page.ts +++ b/x-pack/test/functional/page_objects/gis_page.ts @@ -64,7 +64,7 @@ export class GisPageObject extends FtrService { this.log.debug(`enterFullScreen`); await this.testSubjects.click('mapsFullScreenMode'); await this.retry.try(async () => { - await this.testSubjects.exists('exitFullScreenModeLogo'); + await this.testSubjects.exists('exitFullScreenModeButton'); }); await this.waitForLayersToLoad(); } @@ -72,9 +72,9 @@ export class GisPageObject extends FtrService { // TODO combine with dashboard full screen into a service async existFullScreen() { this.log.debug(`existFullScreen`); - const isFullScreen = await this.testSubjects.exists('exitFullScreenModeLogo'); + const isFullScreen = await this.testSubjects.exists('exitFullScreenModeButton'); if (isFullScreen) { - await this.testSubjects.click('exitFullScreenModeLogo'); + await this.testSubjects.click('exitFullScreenModeButton'); } } @@ -544,11 +544,11 @@ export class GisPageObject extends FtrService { } async exitFullScreenLogoButtonExists() { - return await this.testSubjects.exists('exitFullScreenModeLogo'); + return await this.testSubjects.exists('exitFullScreenModeButton'); } async getExitFullScreenLogoButton() { - return await this.testSubjects.find('exitFullScreenModeLogo'); + return await this.testSubjects.find('exitFullScreenModeButton'); } async clickExitFullScreenTextButton() { diff --git a/x-pack/test/functional/screenshots/baseline/ecommerce_map.png b/x-pack/test/functional/screenshots/baseline/ecommerce_map.png index 8b0e308b7ecb5feddf9f8b9ed75c0cf09267e3c7..df13f7d563bfe8052e4b6e07df8b06225756cab3 100644 GIT binary patch literal 50514 zcmeEubySq?*Y22@Ac`m`p&+RsEsfFwB1or7H%K?HMN0`tgLF$bn1CSNEz%4PLkxBH zGvoVxXRUMAI_LlI=kk5QnP;Boj=isaUDv+B_wggi^JmD&}b zfA;(MPKEQ-1?tyg-}?hU(Osftd#d@a_ek%C5zFi60|d%1s_e0-$#YKwdmjY_4uZ1mMM{JNtPKl*~QSsP;Gtp$gxc& zRn@wQ(Uvb1*s-%8O9i(d7v4Ta>1S<}oSth-bf#s^eC+~ zchPm+i%*G$tWi;0w36#PFHhlKY481YL_fXsQ&z3&Dg2GnOfHK!bX8DbN_=kMF8R#x zZ(+xnPpN2hny49><5kx#mFum9 zxC@2_dV2y485sPYU$~z2s@+l1{Z0!;*8loV{0c9e7d@ii9iiHT9w8OUDtR|}(d^>i z`Bqx}A*1f8GfqC3MnHXQHw*7s_KfeZSZ4Q1!J~uGn z+FaBONOfKIrP-o-m%NN^iAqo<5l=Cxw5%Z}mJT&{iu-#DTIYD8!23!`$v4c2*K5b!S+75y`AuT*gS$iOQHmh=I2c~Ji2?vvI!}y zCN^x_f<`t?hu=56S#}qGB)qlPZNx()m{4ko`{>hMfz2IZ-}M$vCL@sBbS+-<3Q=i@WB9aPtY!>e^zvpTl58t(9! zwW;O~GzL;=7UL3VGW?bAbOg@?xM&}iS%}<7ZV|_s~k*xb>ioLnP^6LVIvepQ5{ysNeFe=>Q` z38i71r`YlNq8uyco8FJ{OU;u$iN&A|zORs~i7SYyN5Hz`7r3Cbl+-!Cfx>Z^Z9Ov9 zV`=B!`qzqko(EHE+S-9Xe*93=aFM)Tv22}fkw35Fj_GMEyzNq>gUb)j!rT6|(l_P0 zzLYBW)R|!Gd6!%65+=z!@&@7*P3mqfRw-gxo{pDg| zOdnD!QK*G#dw@vU{_|l}a>>2LA;&s?T*AFE8=r(?XF9nsEpoTng=gJyVfyeq?hP+Y zz2!eAaNk-Nksl8>@qW9U#^_^W7HgkdHD`4U_YQYH=EiK5`cTQJtSA0{pKMITc5OKv zL`96N(sFgsmfJ)49CGL^CGcHNLw$N{ z9!Zh8k+f50_wP8%hdr!<(dD!wt;O>c9xbd^Ztgor?cJfXbE+WJgz7Gy+Z0zoynw8H%I-0$-Y)XBec_Uu_C6Xm+3y6|z) zyD#>=vhS5}?PjIrFs5`FzqI_!fgjo&9_Q;+USIZ{-TuB!Ol&jmIu^7gY$u=tI3ZIv z#!HQ#uVbLVF@5IeUl80^QBlzxsVXcaPjH&-kaJJ?j9*5jddiozWa$a69`louUH@XD zKm`6-3v9VZ8*{oY8|mCDOZxF^ts?is_FXP~K8$cio(@J3PE#0PZ6Ei=Oij~DYmBH0 z?@lZqOwW~1d|uRBc84mly*TD=5M=UeoyWgxksT|>-~Ro<~_tC@LQ<_n%n zY$jHi|5H-D@y=o&&wWHjDp86Fr=&ymMG4+eRV=T(CFMZRL|>xR6I&bCUX=vleOPUYw(LysuJu_t(aF@^4+Fznp-pr!pSex)HWdsT+Wgm2!2DB`J^lS7vdnC5kCs^TUfA|^)8hNWJ6xL*Sp+=sR>+sn{bC#})3 zGG;PRN+iSR#GvsPI-WZ!6(b!?EB*Z0vuD>LdCZ?ZOTtu8X;SdL#+Rsa=ah-js~D<1 z|Bq@sCIxYwoD_WiDV^Mpe6HfxiszhZeMY7)2pdAlv7bJ{v_IQ#ED|S|)kfO~e#J`$ zyXH!pcQ(Wjlu0X}o-`F+cfRWKeKPpQ3)~$(kFqIUkci7y*sr~OWE@}vfe!BdSZSk( zUwT+k0erf~$mBaG4H{-)d2aUZ3uRADh5Pv2JNy&4Z8O{c#m5JsnZMey@>9tK>))I? zf=BAjh!FZ{`RLNM?z#qy4#j+n;r6{9)|mO zH@UqFt+-$K(Bf`py)L~bz)JrnP@pXt7XjFPk70))i(E>#>4gfX`R+c1TSYsKy{hvR z5VG4lW;1#4EjQkEswrGeP0a`34W|PaYBX&aDp7dI!8anfz}0eKf8)(aU^=rT#3do8!vvs>bm4iln?)sMy}tp~DO7MVSA! z*Kb`trzoBzOS_-V0dSP-BPuZOsh~cJ-{9fcxAXVcg}2*WW}U^pH?1}OPF(xp?vEa& z!Zgkwz}mI!xwmlnQQ`Ny{kT-B-x=i(41PCzdwV~QEjP3s?zPFg&%*RzgIL~CxF`19 z1R3IXz2eY%!HQVK1KX8Q|MlwwJU;~F|L<M^!X>7I(u178;`aV}6I*hux}mlrwF0 zoS0e=D}L#MmMEZFg(g-&@{I0A$f*w`;<^9en|} zKNB2+broscUmkSh?(9{gXO8mi*W$eQ;&A+)-E1qO>Rm#0`~J}#5Q_s6Z=FI zL89JE0iZ!gSGLUU_x=*_-_ty6=Yk*FA4uAtY{a1ZCa!plUophK z72(C$AoaE*nb{8-I%~GR*Y59fyZ?5MDe=MY&?iSs))kAJjfQvbjBxbLsD8)0GyOwv z;c0JQG5ILay6@1ax_J3OZI4+(~g4%*GcSp}h%I?>?$Z1QC6 zlIfkl+jqC=J4!M0foLdg$MRP4*m9ezHd<*+Q@2^d7eDZJ3yu@P5T4D2ATvgKPjxPD zAshsXsBG$oJ={}J^>ZZ^nS6WIe$)o)^=oS{Zr{HBJ-2L>9GIpiC23P(fJYrwU!Jx< zd_nM1hJ_#=zjhO{=c$$Ve4Hj00&(`r?AGq;pjkf1JD@G^4ah(MDUiHsQ%%UN%k%cZ zqQN!@fsp`daj6;oZI3y~Xe-^}{~K3HJ;$ZK2i^k(L;VnZ5}(W95`7iB{D8?oop4{L zZ@4Mz3{}rostGxafx$;kbcBk2wFaA!9D+ zA%|PHo|K?dciUcuhn39s-^XQMVXJQGVNl*SmhhV&Gc`?SH<{Oqo#vFf%s0Q9?9of?XgL{-O_8)clTzDj(}v&e%~D?@uYj0y zCXb#e&HSS@uBRbOwpBfEk8$Nv?~ElR+fv6r+lP$se$dtUif1TWIYZ^ zoBM4<>Gu%`Pw$(H_=iY`zWDAVv94(QQLp=Ty+F7DnR9&p&{4Bt75peZk8-ciN`Re4 zE_~DSHBd+(TNb;Ia3B6X&BYEA$pJX(4Ki>H0?a2^)7#IU2 zkX^o(bvigsF#(l%NdiBD%3iKyzCE|}#Rz-c3#cm9Y?NYz0f~44^Ve^d8hEJs#J@P~ zp@P4_w)5JSg!|WzE`sxWfq{H$t$GEOm3-U#HOo6APTSw99_?!>kO1+0Z@_zRH~9ch zO{f_g7H%omX_1J7&ffPB9^ISfX*0MXIqH17b?@6;=9YGi3l}LVDWp--v4Io+8kqKH zb4=&;D7}N~UW`AlhX2IAw{teqV(iVQ#1O|Ag=(kB1rVJ_tu?*zUzH3J;9H-WF2E;d zq9&lGbHf`Z54RlzIpTJUwep;^ThL;_<4TVC8NeaVaVb+Dl_eVR;J&` zUF{C7=A0S4c1Mly*dI-yydFwB(DC~*g-dPBOFX`Q+ASVDnk{rXbY@5E3a51Z44O_@ z?C%bmz`YvYaMswMp_0s0eLS7DoY#w=^4%ucTQ{Ub0geC_XG-D=vX;44@oOpD#pIm_LLauHg4+H`Gn-7S3mAl`dtSR0=SLFoXqb63VA4c z96v+}6Rsl{ZD>3Y5WEO3?Q?Me(Yp$7f*-0!h}QLSl@(@vmBhH4L`%TK&)n>B#Xo$a zn2?&7=c_1O+y{PhexE-`i!dr243L{NOTQzPw`E#O&C=e;e9Im zT<030of}U03%YX7Qir7pMR!qPu0k33jY;{|hK_E_s7>aRbsyIEF~RTr)6gh75hmpf zM453A;c5)}0bY1~rj_P>E|%<^$=ktZ`amxpYL`G;pT$31mf3it?5S0Zvt2SET_6># zl|+Pr0?Ch3cY56Ot=GxPMC#>KAi7PWml{)Ga{ySWUw$~i53fGT`KUg<=&MHjHWjmR zdj!D}R28O7Ml?)S0(^7u2JT)cVIALp{} zvVt(oqOm;(t#WI&2vwCo?b-wr+XTWF9I5#3<>%wG$H(XNC2GuR|9MQtIuG5Bu2Jic z{VmY9J%{%$Z;frCS1Z~)Z^ZLqO3t%zz3shgig%4s#I_$$&Qo81`1q9Xwtw077ZxU? zI+*oEc-1|JjeijK=CqPDQDC<$i11<+PcHoM#ftA8OA)f^FzoyjWmI>WYNy}V32t-$ zI9S+Wt6)$Scpla|Ep*7&17RCpd5K1Uu)q0tPS-T3UXF5m#q#csIE}e_unO&U@Z4-H zNUkGm6WnqW6T5w9q}1416B>dsuAyIyM0yoYV`K@@J!tW&<{>xVgmaMWrkWy=4SXU z-c0j7l0rs4_}Uv0J?_ia+&-F{VDS5|Ry5Sz?Rv>m`0t~o zn}|;&RVq<%>)=`<;&o#|Wz|!6{wg12Fh~$+jux`AXk+iYO?L%-2T^ryWUGJXkQSOE zZ9>?eDsB4%Z62imZTyAmTW@-Eh~Q@D<->b2I88c9FXGfqFWf7rF7urmvl9Y%qg_-} zM-X`VYDiF=kGK5ZvpsWXUZn5Q+g60Z!}{GvXwmkv2OKZK!<^do%-0H-3J*uhEfSmP zMJ>D!)UNR4n3Q|x^KAP2wR=AraAr6^;V@;SPR(_2&YuX^^`P;qR%xV3FT#YTyWd(z z;)ykqum46bRC}oz|0bW|$c@>S(|}FDoa>O3fw+P!|43#?QQBK)5x)8{4T%%BM1cL~Xcg+cIY}xhaiBrkTLQlc*JI@UjqM0tGcl z04{dYjxd1tpkZ=%C&XZY+9e?7xUZVUZpm6eb0_OR%zI8Xqz5Q?!|3tbdlcOn$Z~Ty! z=K5nGk!*D|08aR`0OAEK@9{w(8~UC`f-^cY`VvJl9p`i=Vq>_Ckg83THsLwPW@(fp z4}g5{Hn9zjIao{L3g$zO`1g47p}{cK6q4oB+cUs+l%1r9;gtPa`)$kL2f+CWKYNAd=5wS`0jD zJ!j`zLR$^!Z}q7%k={%ENU>YsAeN7HV~<#>N$+t`gQE|WxQ+eH08WY3HNJXhz~Yhq z&8#0v4I#Tk4N0Po^&D*;W>3Z{2DtDGF~Y{~#o0oBrL}JR#r2B(kq8xHV#y``>od^Y zNL#)jfV&^?r4zwE124Y;tP>In2qUc_?0nw@;=`~WBy@yKv?sk<1x1mYz>3$Gs4&@c z)Gh6wI#wRX4cIK_SJS{4>2Kbo+}oc(WCwY3GqcTBT|;PT+n^s8K4?e6-_x9VV4ryg zj#B(>BRMr|jR*H7u z?(5}42ED-_BaRdSMXYXRJvGeC*{i(IH@~J`Y95wN`|65TS=|){-6ZntB`JW+i zXs3Mm*p^n-rb$&XTUp;a=-oXgkCJy$g=2d)k_n{~Hl1;~@pL&FDN97>p{HfIkYVNB zGwnQa)cfb(f`_A`y|$HnWvS|B#J3YT}9?-KR1n))$X86wem) zXg)7-#}mj;TcD1Ki%tXuKJq+A+WkT^M|ulir(89&Q5OqVf3q#_2g<%I-ocl_PmU!Z zXv6gC4e5oW=}r*-bvZuhr=c!(2-*E27aNo~|L=>2(TH)d*Ts@!eoMNVEG9N~S17T&TIzGCH$)||NFxq5|0 zZvSuuh3X#)Exg?vr-O*xE^Q#C2UEHSw>;byP4~un624ENvu$b^Zr;2ZNNb56xkxbP zrn%?MGeTY9SANXT24+yOXZlXGjqf?}YyfnAqa}W+*(iyE?kNe{eAFRUr?W^K8Mgq+6f5Dk6oUeRWgWT z%DT=qcvU|*a^QCM&lGNtB-1~a5=rl9G@6#^yuFN6)5t4Fa9wUKRM}82Yu%nAF)^{} zQ0d~WgsRfG>)wwNI@4WCnfn{kMs0l06rI@1LL5{PZ3#R@zLJ=eBU?7+QH9-F&iAJB z*uFBvs!=TEy0xTyc(9*+g09MOxi?EW`+ZatBP%Pbw&y#kcyz+q*6^?}n&gg*ctO`J-8zpMcOztBeu&`*T=#p( zs;*}y!87lcOaucTpT-@{Ql<1qaU1Ev`_c*u3S5JS8(s3`aDPHdfs7~)Bc@xo#BbfY z<+4;UQ*6*o%4OOu#T_FDuMC!1C1{kGrm7bi_K?3MAtg1PYz*PEn+=BGn4FkM{^m{8 z{PeDIZ;ra3zke95MgOP!K|fs1T~02JPx!~yMg`=e zIi*=5W#H`Jd}pe^j>nDxS)fFlfJE|Y?0CbQP1_1BmxG;|5(tHwy|w1bxwIHqzljRO z`_Xz>uWN~8ma6G+cJB_vmUfjx&wIuvlV~)Y?&dQdt#;NZvy5}uTu@JLb6u`U4-LII zV*Ty>i+cw%i7y}yd@s?@gBV?Zee~q3`!%jx5kK`i^R%l>1Ew6RkY~Q}_6Czr=LK2H z$2E3jT}0oWQ!q44+gu!?Pw&c1mJG^*)${Z9RS0ipj2z14wisk!VtNRt-$H4rBWE_Y1J`q%(h&-8;`i=k4v1kZyCi9qsH{-yHd!I}hb#6|v``kDSQvQPI2 z;G>{DcXoH1O-ml~UDEi_VhAH?)@N5XtAjIdHS4YX$ zPXk>qU%t%ejxB~o)@P4;uk54|6GRbAYd_n5KV3dS1-9ijsXwepE(O2C?B{=uv0sy8 zCqFk>>t01jC6qHcsV}YQ>|D{*)I>r~j?EtZ_GWXa(7+#J*7W>a7?_t#;6*iLgw}*N zZrrE@M`+_GeL}|lS0}TwviOWLLLwv6BXwM)M=I^R;O=H49SSkfK4ZFfPffehF4JLT z(V^L#8~!r$@TkJ3ha9<|HRC!R8~pL(&C4VtPEF>58||Wl1$y3;F0(hzQweDidW+`Q z9aOq(%qIPFjNoDDLm3%^vLXA)M&i`8Gl6xzApyC9O@hlM3~cPpJBAV6=gPGGkug6!8@c$m4lOM45pmPWGSdS*sO>2Gh( zXFHsfR8|g$1%C13MX}`wAD88@8e8DC=4SH_fE!NNP4m?B^lU)ChYueriiy2;b9XN> z?O}3<`(gLi+roo`6D6tKm0DtWBJHN#LapldRRHChnwz`6ydo%h_U+^y^+K@|Cr-={ zmYC(vcxg%1H8nj%G7BIF-JAPFK_P^k+dKoH#q4M3t)`Y1Wf&mqnmm#!_jnw<;0x-r z^J{N!W-cyexHDY*L5n34Nx3^(<&UkZSKmTsyZFV_!(8nu6?vhZl#j{Dtj5E74e#dW z(i0+rf`a0m{`is`>Bo+kusf|h-G|j6=P(R-AS!B5q5;d+Q)nP_;`s5#zCP7Z0QF4g z^=ZZ%H|~QQ(+8-AOaZn>E{tAYMOHRozArz&xR^6amQFoar9z8^g7<}3SGs)P%M)k2 zQ)RAbJC4|M^}5{H2h>bN;)9fQekxK|<>5oW6ps6kOii;QShTYs^cY!KmJZh@klC?Z zHS$8fem>y?sG6UjkKLF{hWwmspz`e2w5mykd^KI0{At>k7x!mkB0M}iH7DnG+&!BI zol$EFkhDF7V!|GK5{UBMi$f#9R%ov+>z{H0gN__7H}?fSR70>N^nWrBOcVBNbaa%R zJdi!6#dNSZlhSp8Z3l}r-C3KOaXZkRH{v9pT3pOk$<=WFN+b;zRbqNI?YCE+Sqzu2 z-aHV48G5bj5&TzWz9YT1wWZqdj^gsQYuUrYS{5Uf$o|3yUAD))voXAY2x)RLbpAg+ z&UK|Tv#}{O1X1;s+e|1aDWyP#Vq{}0=-p{u+Sqm+JuObq(-p`wnsLply2I9U{Og-D zgoG+uTColb{Yem-W`o5hP&sSgkxVjvZ%A7jsX~7tpz1C*>9SksXM>P0@2!BHW!2Ty zRaR2k%W_;>_khVlWe)i@9qnm|#bTSD7i45*&8r3?>U>Z4FFE1WH#9U|pKbwqk$d#$ zQCexJKpMryAr4E!nSk7?tE;QgytamcwW+D8(RZJ{R8&;#{wRL-&D*#0-+eE+?5#E+ z>koLI1^8Ohs;Q&HlH9>SMMcF`s$p>V>ZCQF0e6&su-(e<`v?Fp4wXgL)zw`mlq|WZ z@r>IuDzJy>y70B%-G+<*NYt{ll8r-m5;I09;2qJQ)r3Zb!a#@hNiX0?H;dE9!|mp;B7$|tfo zw`gg*XRF+I9U%B`(bF>nk${I`hsF-le*KaSB;$~fNLHwFSX?XSxq8koFtBI*n>VIk zFDO$clEnqE3MONR-7pz2=e|sO#cZNJ5RftK%hUD@g=AXk#ley%@Z?d?L-!x`^;xjR zFYYmIj6~egsCBDA7Ovbz50;Vf?%l_6eD;dg)}H`MkrEE!0prYYTpkTgf!w^K_DKX% zMkPVWouyniU#DhcI>rjg3heIKVP0dS6aX6YojY={pvo{-mM`+ikA&QNg~By~T9cHs zRd6KDYD~z$$OsNrj4C2G`TdHBiHT|c%I@y=w$nikEP};gF~YB+xy)1oOCelbFg>bJ zv~Dc+7l;xGtaznx7!(8coQ9-qntJhb&Mpfu-eo$D4zry^G)xf^M>OVF41!!Z=)a^0a$ zR8-V_S9;rtE&rgPKIZ)Dk0xDdCfh6Hkf|^3T}QH<(sR#dz`WFdRS(Cke7?BXy0;^H zj*?ac?8j~{W&k7I35P&}mEv?<(yH0t9MUK< z30yCft9O1v>thxxI(I-mnA|_etv$6G29j&k*gz?Whc**r>v}4*BoHcGv=yF3Tc8B z1A}f0UXcEoa$+#FtzuA2GV|BGwkx`pUndQj)_wSV^JS;8q z-cj(U(M;WX$l9WMUs=3lSLKxgo6wPm#cvq;g+-9E_ftQM4e=1Ixu{Xd0(%L6fIOOo z{LaeA2<}>hBb`y_B%yn2X6;L|TD1O4o3-j0UA4R@@JcA!U^1Tq5i)kicNP3f3_yi(xFNltcVvCT2Q~&FqrTj)0*LCpst^( zuH!@PcW8D-MmtD(DBrYI*$;oPcxMe;I+MwsxvM^DzzI@L>-;tD>R}nU<7cY(fDcuy zTQ`vaMX3fMWX@^H#z2LHap;+Eq+mTtjkM^}UJF<})rLvqY@NaSFJy{2o5&e=|K%QAw+H-!%oqtVHKkwGQl!qU^n4w@56x0T|?t|(L!XpcGNQu>$ z4ojJg#47~?BFb(+Y173akf0!fWcZ5w^`YMJS^xIBPUsE9Ka)kfaxY7yVb0Fw~2hF}=B(^q{87%kSBvdl&sq`NNQ{$NwF2At>rxjgp7!LiPVZ{|`mJ z@L*zQegZ{+PA)pda-_0{&rw4oy0f#BgoK0^Xh?WO1e36^uH%?{nMAlFB;~@pC>a|A})P z?dZ;Y(gUUfNK*z*P9?;JsXM^1w!{l+0xin#Jpk>7P%NN&$v`LDFrb>{5`?r>vX%2| zu~{Gz?4Sk(Qt+$5xH@4!r_g9ki=2suAoPgin6jc`XnhbBtEZ>umV6yz0+N;{Llm2czL#`OVY52d7#GCldC zLST!XogJY@yGvE_;4lPt7%LSSws7hm5T}s{c&x9V0y6-H z0+qifPn#bxu{07DVhRh{k)@ZGmNp$IO!d&Yn&iH_8O`sQ2O^NZXy7(@7!X03wll3w zzkVq_dp3SJ)c{lWlJUV8ue_r`MiK4*^l9Qu&e>OAsIz;Zm}ZbK&a@@uk5oCDZOnE6 z`^zG|m;&k)B1R%A>-Fp7V8Sep)>IAJgYgGs0dcm*JP&K&!bywL#;F%`yUTTv@CUJT z;!ZzojTi`}eMOu6g}Q9GiG?qB_)~{uQ<}^RpevMerzGe*Z(jsaJnaaP|8o z;C4aW=KYC4Y-`q8v{DIsi8rV zmzNhin;Zn<>`4vqaMSk0e;~Ei*48+me?KK}k_)+ao>D-KXVhteH$fP{DKj$@Nepl^ z0WdA}Z@x_ZDZ6@mHYIm2qf^UdUf?x%uZ34~% zu=ofF3&ijUfB$|K29rl@9SaVD*&R`+Ymii?*F~0QX6U6g3ZB2|&DYI`Oh+OZ3+5`9 zQR{UOLMC9BvR^%i(?fN8Q><&Nt04ew($c;Wth#vxdJU#a!xe}zh)BDcne-c?ZyU$0 z8Gu0VZZ38K2xP#Iw*W$w_S(07U=sx`1%AdPD`hB49ODR=?X+yJPK^e@j^cv{Us*SS zYkm&@t6K8dL5LKp-L8Zqi=1F`2<}XVA**QD!qsOC3LV)sfY;5X5oT#nG2qcEK6>;H z7M0|}g+y>6Vakn$Mb7mlLyIq}MtWLTf@wi_1FoVmeY$<_TO;X!wfUhbP$}mD-MXut z*GZ_T@`c>785z~Gq}k#prW|;+SxyX@1H=czrJg1~{4OJ&vpIJR?0|6iX#@$;4#g@R2)HqnJ|z6p-N9m7aHvAe zxf06}4e(1<3=C2sE3)E_z1Z8f0WSv%cWr$vVsFBd*v-T_HcdI8MGj8?c>5Y>6o6N} z0Sl2WpCFWFr!uGZtoBg^>Cf>OSq4t;ZytMjnUXSZV`D?ZF<#1ukY%|yH-_}KS|V6l zeWyf_lzWo?$Yk};4~=T4f*BWpUGT4v(SU+BYkJQZn!;;4jhMbJkkMRrv+ZLCg|N5Q z1AkSC^3$2tIP5}ETQ?vqV$X#l{R8*S0V4pbC| z!O5u{taUIs=-}PfE=%w!vT|}ZUK2q%gKw1fu^2Fn;jgl~I%D#e#QHBu5WN6I5FTsq zht8DjFn3S0mhmgHRDf1ee*8EQ(VL*XLlY7bASchA6b-ar8Yq%HI5+^mCBlxbJf!uw zAkUbaZ3zX95n@gvCT+Y2)&we+bSJbaa=~1iOY)}tGYrDZOZYBc#FU>oe*CyG_^;SM z{;Wu&VQe0;?XgIHY>^3QITGq8p7gK^ZzVE_}{wDTvLWew+0C z)w?3_b0G+Yf$m2>(4fYlAx(t7A?diVU@jMXPXU-M^f+QeLqp$x_`rZr1Za)GYJz*w z#nq>kj9@P)M^SG=Wr#KCMJbtmqLBs*J_714bYhSxA@GS%puD;R7cS#=5jd%p(60fmKK$U+JHG|)5Sq7<~W?*0d5*`u~jA2lX5iN#cfcC!(Jw}e8+Eb)2 zxnt+j5yuo#Io@qe8i7T4%rfgiUa{Kk_z_~GI6Pr;`Ia1W1Dfg<*nhzb$FSuhxHBC6gCnq@a)lHNPd6_X*q?#$2e8i}-Dp<>My}^%1*q0X7tDMQ z)*NUc$c1>(4%J)@gjPTw1cu>})lmy&@i;Z)x#xwGTNP(Aj-ssJKx#jRi9#k5hLf78 zjx$m)-07ZcdciwlIUq|aj@`~QchbX`+ALO>+7A>k2c6PX-D z{qB#=fq?-a6pv+PWdl2(%+1Y#O`!^o5-iAEMV(O_<#{r8F))#O1-FJLOsvX=!b3um zfKWo_Fajq6FZ5BF4BaaQWo6~2*4EyRWJ$z-hvHIRUT%6M0N_%k;oe}DhwZJo+HOe*fzI2ELkd}kF{GjPRB%`(f9QC4Q=F7W!4 z6*aPM8m0Pa5h_=Vtg&CctY6sFXRHGKH4+L6xovok*Vt>+ag?<_k)$$8k|0g5LB#9AK(#XHdQ0wYKB1gHcy5Acpd`gIGC5LTb-~-D+H2Y zhm=2u77T;!p-13o#UshZA6MM>(lu!_UF~uZeuM3Y3*k?B^{+@*czQR83$fkJ<-X*h z-dQE_fo1lFW-`r5>ni9w!6p@r8Q>3tp|mKG9bkS38wsO~$F2^I-PyZ`?y1pK9ve~x z+2rTrv#mV?SqpzYry{ON`5(j!KKL@ir>3EV-q(yS>&!4aNU6X7h0nIQLR0+m<>)fK zFrBf&M@HHF^?hgi8Yh=3^AvKbe;Ij9QLr+0ZnTUU&&9{Zuf~sH;)GVtKbDg6$x%Ts z?>ph1f+{~AfK0-Rxfzt@#@ONh7$jPxfd_EiZzpy%;@uN_cULiAF-~iNey7ib+&@W1 zOQ!!gF|zD!X`KqiP4b7KE)Ava*LX%UW1e5qFVZmJCWpU0cd4alLM=164O5#ltsXvt zE!`gtLY!gPESc97uneX`y9*o?_pC*Lb0vdKe(1kQM8TH=KLBA0KRk$-TtKN$p1Ya| zJ;l2T3pm_}3py97ipKkJb+cx4kmoL2BaTRS>-%>xE{j1Wy0A=*U8EBO zdTkKei@+Zyp?FSBr9wZ;ey&rzGwRi^uFg(7V9mCzXosrsxVT(m8j0CnO{;KP3dTEm zC5tt={Fzoo5uqt@{EnurvAlzo_Suw9zmJRn!3s?o(kxbK@R5MU0>nqi+s0DWGT5qe zNVf|7Z-I#u&b!9lT%MhY-wD~tTFw1{F&$=tIx&Stp37v2q=!9f4K%qK7z*)54i#Eh z_^mA^Ap2o;9)VfSYjp@p_@Pw|CIZ^bv_IprNb=e;a@7=2m@^hQ_lC`RPDaI-mhwIJim> z)`g|#gKid(#$q_wvX9n13>`4<1+d8l#n9a)1Z-KaKA;17*&tnW0C}^a?gHvDv9LsZ zc^XU$ZVN(y_-Cr=AH}vq|0?Y=vkC*8J?M-Q_G!*CjToE1KA`q(&=H~LCMKCWZmZ(Z z$Lj4@?#R4fOq&U%4)F_Aa@3L%6RDvc1Z|%zjiGUhDidq;qfn4&>@7gfnA`9uOf@xvbe5Xt*l#p~9ol@iSGv_IlZs4q2%~uPL&=la4PY}1Kzd#Sp zl9ZAo@^&sWJ-!p}+>(4cvvM^!fyhzA$8Qi}!A+I%h>8S&23WHl>a z&(^tkAb4m16L;C@khK4Ho(FNE;N$|r>VbknrN=-sC$qS?xc;3Vbi)u>Vy)Q-<#Slb z05=686wQ&WeV?9v6Ig`yIPe9`FOD__HntAi{e?(f9nXFH#gQu2Cuy<@U{DEc$;S(1 z0^o`wE*i9tA0-IoLSu*ltVzhVoYIJ$^%>^dw`Gx7b#rq=+&v_89zJ@cVr{*$ygCSV z=~n%XS=cPi64P+R1hD=sf{cQVjSVmcfk4ZuMQ)_o8^5L)`X1m4Y2KeF=WI_75^`yM zarDY_=)@pg8GeX?6frSFRThTs^c^zU-_6-CnID{$RV#pBeRM~sS`86ZU@)03%m>q2 zSy>?m4-kpH-X@$6VbaTxKrNkmI50jAdi(QdkrC&aIHVm2*so@`yUqxr4aoiFOP3I) zuT*8k9n({0rHeF|p(j|fsSBqt4tCl+O;>(@@q70!4^si4kw=1@9xyl0fx<)m>PsRL zv!KSqf#<>jlb%|4*FY-a+IpktA_L`PNM{x}8`u+uwwPt3!9|Ct7DI6{vBu^h8N+Pl zsmqt4lrr79(*uLu0OVCUD@@A>?I}nC;G{_V3u-Y^;h^TJX!>`}b;CKL6sSqi$pp^{ zsd0cng8;?Lt4*-*2A>Hppvs%TJq0%uI>$~ARi(2wmlK9c%p$=Ru^X}|W2B{>A=B+E++yPP(&sCdX>Ggz#6tKFW` zU464w1?jcdR5L~TZG?BQa|F_%J*I+2v$i*YXi!U=4wu{HZhiau74ecF4dy3*hQ*_e zWDEi21To!DpaDB-r2{th=hV(3BYC+fcJVQ{^}tfgku0cPeHzglo*Y-tRZhI)p9C&3 zP-J8VIv7ZnZeVCOoMiKZrY;=V0B1N0PWR11QbEHa0wft-)kq%18xx$1fWv4Cfbv4y zzmFkD3XzsHhtWIa2~*9HW^fn+(!ECr4S{OEJgU7u)7FRRIN0=ASiZ=vxg3W^_+jvE zJ>+nP))aDTiGb2c1i23S^3av;hGeoBtJQ{qWp5HB!udXUzCLIoI4naXy!RM>F;8TV zX%DpFk;4qo*D!|a24?iVnOIP;Ad;T|by%uif7I50jc|FrnC)61`DkXghBr?ztvein zK>EqZnU^8UDmlf)DkYT#nZ7hV?{410)u<7QL&l=VF-(y%Pk8b=7+o_fIZZ#7Vv;BI z4lHiffLo)_N#0h$To1+}bl@R{m7%21V3AXEUHpor#oK!G^A0Gw*x-LZDaX{hDu^><*BWguh!^?|K$XmKXi7C^kI zvGFmSwCPC_C6G39c(A}9g*LG@dcZ#t-u@_bW7+di6OPFi!ihQXSbf%)x{XP$=JXJ7 zaM|o%VamIG_+y4OFQ@&QX0ORG5A%Cnhb6AVP;e^A0_$y;1bBCIML~iz9mWc-eIpW{ zg(|8Ho<|l17Jli0b*e32T<9bt+8LGws-6ruD*{$^5SQ7|BLdp`L`1|3oLfqyBtRv# zDG5~vdjdY+xmq2@r>vFX^;rZC4KVQYYa)$^vuB?`OCa4H8V_&;6&4^BT4m^PRhw3=tFH+VlMd$w0_p`?LKq(FjJ@14etDJNXI;z0n$1 zG@NBn2C)av5UgTReDVbI`4|!O3^D<^fFYTVR#yPwnBi??hn6Ee0@3|&vtnq*fd`&j zuLaT>awf8@tPHkbcHkLU0CX{Po({U_miy%llck}hf$#y?f8?YV907{oQl~VJ$%&Wy z!#O)~0?XB4JQ+D~C_iHf@GafRE8_*{%V3H>;VcLoJ_1?;#8K7Gt{7T9G|-tC6W~Em zB_cYS3D|mnznZd&iYf3upff6P6ry#g&9nqy{vqUGd>dljLx}=kb+Ftf84P^H_|3>* zXftZ5ev)1cvS+{UaO+UOC=cN+$eB`Fi_vOz=pALK-0XRJcNRH}2Hg!HTMW`htwlu| zxd2W1y?L;Wh>}B&XM(w*+wFJ)&NWaWgx>q7erSjBdm!(>qBu$bpZDP~IY`1TJ2+DV zev3TFXb=aT(6)KUff9Rwzu(K;7lY|7x zD%l<5cXY+fry>#)ffrcn_s|(exD#|DntuN50K&{^&_sejCa8obAa$U6LKXV>zuJ4x zuqdy!ZFr1P6C2rEu_GF>fr`=;q}UM@RH}3f9Vt=;gdvugs31}#NV6bqC`#{Gq6i2` z9qA%XK#KG-z;|At`^op~eSg2tp5w@oL}6y``(EoRXSvp2f2}~_dklGy;=KrNCCMoH zw{25_#+8UYxl+hAsi%bWhV*d54a}T$hn`rJ*;11uO(^z>d?3aU&S7~kVj&P;(2g{f zX70oHmLtg66h-M1*NL%qqBZfxgz^KKf*^+OhiOt}wIE=}Bafd|i!YZ+F)sNPnd*f9 zwFDsbW62j-t7{y5USHaDdMnBys2Y7h{Xnq;npZ*e4J6*Q2<*V-kYE_so0EF1dH6jP zlt`OA61EYQ<0w&7AjbvY$`|Cwh4oAFE$|<@G3JL4Uq?fc2)nh*)Wk4RgPRlsPj?}& zGqe>E2vyNRQc?js{W*>~VdgG)Va39^fHhOA{Z~O6Pn0aQ%Ap|U>5(A!JOynN2Cc2; zvRjA2HX_jhn0Y@rF-|%p+*=l)_h9SCq<;n>3+7t@k3T%vNggfnJwCwVicqX8A>4=< zzFR?!M5%wg=GA#zBpby;LnSG7Bkm5`XKeV(?LR_Z^E=~5Myxe)lU7!RJWEiUAh1$S z#^PAIV#OAeqGqvaM?kTbBd9>zsP$M6uq9u`$WRC$Y4`vOt3l>wkv-aKI*cy2Jo=Pv zk{N;?0qZqgYWw%^cmE3V5O<2iiMX$*ruC9#G|!(qhlKMOS42H3@>fOo6clZ0pqFB^ zhWOX73;(VK&_r2k*Huk&$|Pw5f9ouUGsjVQuF5c{()mZ|kCFV!#bvHi=_(ovPCWwL zhG=XLq-!a4_5srjU)A?D~S`QP37cF*0~t zT~{}jQXS%aI+R;x?@}&(Jx4JO**59-9Y(ouRp+49Sqi-b)i@!4z6Ius=8$SZBD-Eo)D5mh3gB6dt_0{dkpR{{^9Xv)^Mafb+4)OqNOjWiow z=3}tKdgR$Sa%b&!CUa`l4SV1t+COJzWtlBn?|KW%%DHF`7HjH?k({jzEAG9{^|_e& z8Usm40n~cn5wO?DufYvH2!f3Ic$hZU7YfwP1l3RL4`tUn9zumi+2hmeTZA_aeyLJM ztr9E7#s>_(Uaoh^R4k+b{r>=z$}H?Xs^%arEvg#2@ZoHdrc}!UzV_3n3U#=bzvP6> zu43lp`wF1aJV6>7m?QeGt;2dRL2er8D-a}Qq)~A&N&zRN;6y+wAVstZo-iuR`5RFf zd~;4a4PBcwF1q&=7o2(;Z0SdS!<{QcP_#&me7s7)J;3ZF{k(s}*+L3;Q1E_*hOEk5 zeIXMR!04VdGwfqfa`FRb0L(*P5bVck%6#g@6j1$qXcW+N-}H#p?dWJD@gj8vvUk=7 z_nv=oM@w=zW|MdNZi}#=a)gJADu0tUdp&7eSe5+nO)A1=PU_yji#amGSFcRrZyl! zrRIbAgVNNgsQ>NTw-hw&CI;E;pJa+|-o9N93k%8NW57;=ktPreYs{|6eK-HkoliBL zku6XSm_apEA%C!fABGwvu-{LA4aJSv+gdl zGq?7FXzv0j1HGsvBbB-uq&t%d!J5H&xtne^zFX{xy<-fC1DX_#7_%=Wk8corA$sA% zdz*++4bqkpvyug136-5EVif{_CaA2Bfd)B~DW5+ZyRX=F0PDMOPSOm(xldtkN=EY3 zq8}Nlnxv0~Xq28!Qoq!WIjCTfEhwhoTPR`QB#MoxfMC=X z_UwY?rsH4F_X+tAcE?;TPdZh$s>@?pP~~91UYxzTh0@J*hvVrVg%3@0gRkN)AHb@@ zOPl`-WLYZ0P@fP5-@WlC}8c zX3oqIOT5VYr}^W6)o-u|)vl2O0WZ5>2xPtq#_|F3*JoZ?;lT#kp-Jl- z{l*>3BXUwcM{jBztN>zO)Hm}B5s&GsFnf7_< zFGcz@J=4q09(cSMH0U2vLpjd9X3ga^UW7P$`Ax&(TvVw8l%=u~G#WA!U!Ji@J{&RV zxgcS|*7y|oZC|k#&WQc!wd+pI5e)jzF2R_@g?W%L;ESt07==iA4>PH!BOFf@#U$^ClWxpJ@H+TDE#nxrN z{J8&q;$ev&&#jwvU|rT`@4RAFsf4FkY=8|+#o_K(>%o3|)V?Gf>h| z35;n@Rk1}1#b45sl(j=CDc~RtRTEHm7`wJPNQ#SVz_FL($ZKL^!cCRFD_i*ccel9E z+UYVobr)&vP{#u~3rDPr1m8|_J4Aevd{cqIM2SNy4_q|iZ&1vrL?pnHLrDk~V+9~C z!Rmfgx)sy_GC>!ZRz>+P&gH$gMiH?+ADs)@+YAt_pl0`|Mk*b~x4FOP;v=dfOG}ji z0)D0djNmR%z5_tyRW9j>+qZ99=jy>>1iWM-KKNT`U|2P6VCxQ4z(He9KRY07_-?xQez1SGdJx3rFHs1yOlif+GknO8}}<3e&|8S0Dx&+c7^2Lfi&KVvqHUMVs_H` z+{I+^qUsfvK3j_;xnLFs&^t%qe&9k&018Bt78ZgaZYQYf^2^GUQGSyQQ(Feb-ao(X z;vardIU^RJs;wOj2%UtXp6I8|Hr;q}X3K7(eo$|N+>bp^P&(@W2l$M%1Gg49B6F+8 zXo?PgE_s!dgP%TmX`g4GO}~hFwFs`rW&WZ?c0q#Mw)wzv2&s^^9lCH3F6!;U8^M?K z4GcgEn~k2opljk{WHD*;={3@{4i6kAz*FesD2E4$+Z>^WK~1f4PHr*CDvXZ5g|1}1 zoc!_QA=&y?$15d zMJ7Rzt)iDltgs<`7Hl|vc#p(c?djc2r1bRRz3lg*C!{3nRXEf8LD^C|K4Da01^Ui=STDgM+Ds(U~^z~`RMOR zN{rRI17Q)O0F*>&LtSst#|2nsM?C=J#_82hr{q) z&v+qf2e<-3IO%1d`u9KAmiuS<@igsw{%8E3>XMJY`v7&I>;pwrX+M&#{D~9l8X8q| z%syNYBL^Rbzr7U4qkt-J!KC(ucP&F>b`7_0F9ZXxXIp!HjJ`su2$dQ1U%h4!py4gp z&<&8`7ix7agbc4xbl#*xrS=s77#S3(Lq}S-*9igiMSw(z>sVwF>H|ocNk4J-?%mj3 zw8BA|fu2`+$W&4Bp#?<-WZ)mMR<2Oo#*U}?=(Z8ygPdOp2b=+j6c9kf;-S8Y-33aE z%-;Au;XpyKzJ`Z$j^dks+%z+Y;^Xh}a3CrKOKO1TCs=Wyy$o8i0d~%$Dw1s}=r02L z$W9R)98Ahd5yw7#!mxnukn0X#&lf?2b}lFYWtj_`}n)0MTMEVxM@~=4J71h3lFaXsnO{L^9GU$7S~2+yowyt?R7dHSMVY zJ_fA-HV*2*%+ffTDVJ(8Q=Fzg%!KV9%H&njms1G_qL>ETD9}8Jb1Kc^vcf)oJi{J& z`gA7|7<=u%oCLy6j&6wXsII^TrJf1FPL4uarSSyofv|;!@*x-M688<14&fbTMHt|= zf=1i?b-oJ@>`3zCgYEbfV7f{GyoAfieIrN7+lU{A>N|2jCIBdhdkpn7Ovz*(rd2Yt zSS?nd;zgN=K;v0*$)eyT^u?-ix^<$hIj^|nh@nKGgGj+Q?a-#m4@rjfngH<(`>#*M z-GS`F>B#R<>a4KWx0bV@$|GGipB%dGD5WPiX&iu9K*4ohzZ!Dk;|jN=)T(0pB6E>X zlF|qzBZzlNlc4iPiw-R-rPVartLq~uv5wwbe z8_`+D1f=;Y=&%*x8bGIyf0?}XT;JE*8)4-F&kbib#}2ao=EJ6 zdf=5aW7J$Q+k+}5NMY6moaz&D#>(A-aSfEV5PuS#hb>4AOy*4Z(4uuo@dDf&ia^qy zlK2V~3L?H~MU*e~&Z|~K%MKE!{jTiVyRXlsNeHg8I*&DgV$(}IArDtpcw^-{y7?A+ zFdLTzL@&wq>3Oo|!`4?Y>Je%GR>T2&{*juu(TnUk2DA#&z9gJ=;r zZc?LlQNET^Q$YL!GS4XhHo-1K8Xy6#`tv^LK8eo+M2yiiCkzyCC* zfDvI(Z+5x_Ajquxb=oOsbxGi18NhFJXaeXB>(ujasG|8vBvxarKKgin(Z9XU+yeufcP~~CFp*hL_p5y2gX@B%D zn(cr$oQTzRUnN=^D(9`8!-TL7JQU3JB~z0x-2!}GHIgsTCnzM&+u(Y>?T6-(iWO#& za-!bzm)iD)VlBixc<`XpIu2jE`rFrj^%en+NM7K3lxw|0(VCEg+-bDMZ=)Q^g)k|A zbQUIvXf1{spwuEEZy@pu+T)h_N3iSTkhBZVJtL5sVxG%kR9U1LCt3iT=;n!Ir+$k$ zl*GCQ?DFjyk$hc4zba!TY#Jh9u#t3>;!v}Quknzds&quTv`kPp8a2)qC_8YP?MG7^ z=%8!5PzGeSx-6P|6@rM3a>+s&9!6p9&;7k6y!{?){-#>-RCCew@p*aYq*Da%Ot;Y) zt;6#HDoK6c?npZzHi?a+nGV;lkD+p{Pgw+TaU^0OS=Kkop=hf>qKj77b5X^bukzOr>d;;xY*D)h zwdP4etC4;X<4Dqo+Fri&u(SA@#WcQ$6!4Hvk@kV`b#ND?7Xr1h8WG}i)^NSe_07+D zDeQSMl#D_o!lI;s!5m0UZz+#xrQT3w#9}QrNA)dp#W;^it6p|9j)dml~RN3(0 zrblRq+J&R3(QAXD2rfA>?uuNa0v-jwwl%!0Jt_pL4gpiXlO3(m|7h3~|BGBq!gaKH z>W2;;dNS@2DCMk%svC}NC4GJU>s9BmqVi`fqgJn|i$Xre8lXWfB=Liw$qQPPP@9K` zpfkdyLZ4S;&900%br4)Gf*KoSCd6R8?YKT=1RfEm0pke>m1x`t=}drD9F-W}{Q{E- zVo*5A0?U^gzF1zS6?|O`S4Z_2sLoUP>1Z_;sq>A39gm>O_OdO}RSYj1yg1Bh?OH8% zVOkxvbZIEfe*#V8>#98nVJjNZ51A`>OQHsX^^Hh!&@1@qlPE{9AXH5*olU5M^J@>e zhDaGe1BJRdNRu=!30>525~2V_a4o6Fg;j7y`{~MO>@d1SnISHeCpuk2GnhTrApkA8 zI+S|o@=t=r9Q4cK9EJ)iv9s6^ok^HtP{-IrCUQ9nDn&I`(t#3b55_P~5QNa$W0zZtjsBwV0s{ltAh0V*q@bdjxjE|-m4Q5XRFe6Dc zBc{Fd3C*qIpBTBcbtaGM@SbCXsimn0Ait4c^9?F?t#ap<_Rx*?pF6lOd)7E2?+qR12iT^%6aIszfmyo8utO_ z)G!l@%=h4GlFq#NVVVnv&W>Nssl``4(W>zPAp4ixsq&DypMq*uV37@cB%#d7{*YCY zm!2Zq32_G|FgDu*IBd6Hj~b&`%-YkRXxVEm&;|2(=AUeRoiHYyZeB zqzv|a5m~13jmAPuFI~FiGcF|{a12OVR&?*V$~rUN<=MZGv4iAjyb)Mj{@aBxeA6TiSYrqlv(Lz?9VI6%DwFiKU}p>f%WU`(gkXpj zNuDtH{7SyQ6Pcsw0=EwjfeNT&J^4s7k6c37W&F+gw)~rw-C1lUO18j;cqA{Kgt}1~ z<2I<e&> ztP~hBJ!l9E%uoiRb~Q+AX@JsgFG8w3*^Cj;FuHC;X1FLnp9Zx-PR1AcH1UvHP1+L{ zni`*g02aC!R7UdT^dj@_>eT{zCjC z*Yok^H(ukp!2$rEFqD+X>B(S89&2zJ4w{_kVY2A+P>niw&2fVukWAjt6JX7>G&OBNOrZAw91n!k7h~W6 z0EsyKGVt2}yB45Zn=J1r-Z}uUSqXgnZy*au2{WTOmS%5+R?`57&C+b%(8o^)gvH=RI5P82-2ALPXHk! z|3r6c(_+9p?ZCX>gW6RAh6Pc;*Z2^ybK0wBN-fxuYJnz=VeS#3+9bfi6IRAB7?HCt zuUR*t*%~NjPAc;ch{dtGq%Pf~?Eib-mz6=c|ZRmPI*ay@v-I zY{zn?qtnYAohMXM8HU~*P25**hze=ifyZbP`d=w{K4`vz7+jnPZykD5V}69p*Imrz z@d^dJ2*B?+ki-gdCg!enK2CEl20?g!Ed53VxfOhZsvLOxmQ9O-z{F z0B~OcU_mOfW`T|wpj2(`Z6E_?WI@{YQ=Xo`02nkz2KEYl``{Ois&CH%>5h8_G^Lb8FHOc&kW^cJuuT*G!?o-jD5AdgV_L<|EYZE~ecPDnna35r;ps)!tL zf?ys5DKxN)r(&hx7JUBXpQRk5H&^uR%O5FIAc9O5J|n#+RRW{{#^#N)a>d3Y!V%ps zjPh*~lW^{S#+M);%(i8>LTw66C^>-F@A1Exy`-t49 zekm5q!W3_duje<-8{p^F^!1y2oErYQ6{qqrLl%=M_~1Dmh$^Qh2L+8CR&3h6*mTdA zN&y~WPu{Z6soGZDEI5XC3d$OGyee*$%d;P6j-MI{fdr%}s`3PoPt1;~K!}qsHbM|X z!pu+d`)q4+w=dAXDoAnS%$_YW3E@|ywnhC)=I*Wh{5N}NGu#4x{C*0P)?0i&m<)hI z2z{F{V-9Z$RqNJ0dqy6Odtf~d|C2!W_(~V^?e*OE+hkn&|NlR?{AF?`8Mw(vf-}S@ z7YNU)y6ok=sxCm^e7C~X_r{G}yX=FE=Skn+!%Zd-4k`k0QT0RqlAp*ekhb$go;GJZA0&4wz1&t4+vExrT7*l0?W3JNQ3J-Seu;kOULB#> zB|-g)YWplk>d<#d1Rxo-&_kPe%4{;&tn$XxsH`6(x81M!B=)*8_OYj@C#!k^!^(U` z+%S!;qgReSN{KEx`EuoqN}a*pgI?D1$3$$~R=wsu28ym#wPzk9b?krM9$bD&@n)|< zPB(9Jd6HIUXvDi%BUjDvzt86)CtNNZ`+*S)9(LxvYji0(fvsSEhG16w)X5Ny>M;!U$+_~z?cRtVUSXsC4?r*BiCPD?h z1!+Pz4sIPyySaD3yS^?>BRhE6U=;f#m&k?K4^b7(XTbpmdI{Z{pSWq4?gB23mUD4v zYDdaK)|2sb0bAqk>sXvnh8xRW;r$GcK;BG{dMvaWRNz_+U*!90WH)8F|9X=s=ZAqy zw}v`2QXU@2bP?2i)xD)GP$!^5Oj4dX|BlrhK3_S(ZSP-B>>cbbDs*~q%0{Xp-uuAi z9lE>-PS3xc)57?S3WE(gP6SonVOd%AJm#ZLA8AuBreEBWb>vdA)lMwDCr>3t`MY#xmL$q=d~e38>3=F1M?R$ zGG_8sAkmMG>FzO3^O~6T(eUuMHE88s0O$_03HVGf!y0WU^0DXfoNX&N$}L#7?fvbQ z!agB-qopcSpfK!-Ys6o75(lLOqh_yj#u$i;2YRJnvDcX?B{mc78ZdYy7 zp#H{O;8Ab=(T(asN5WK zSqbk;fXyIU-wtTo!3NWS9G%8oJncc4%OH_F0R>n&Qr`}|J!rTNT4qpXgrd(PQQz{c z9(3d;D83{v^*(^VV*u<<6eJ&HGQ%w+o*bkBZCBslCq&qUHr8+FoDcr!4E0J@RP*u`Ph#r)?NcgGGhEI%1ef z#k2FWq(mg9BHg~LBfSB-eb^a3lY0|INec}=Vng&#ogjgeNU-pz+*mMVQ5yOu`7+2E zPDm6wzRubWcO)O7#h`(@l~e;034&%qJyC|SFDmsHDzEUWtp|`r6Spvq`6!GwYN%)p zg#76irVq{bm#~Whd@mST4{j0d;bu%VMba;};&!GW~hZMeJ{Q3JL41?f1a_nw^FK_Q6sNyMk)!34jC;>^NS!6oG}}$FbmFg3QaW8b!{P z=;$x^hv&Hk%=*s~eWNb~srFH9Iw%`6L){AnTd~|Az6b^oiurQd-L+^{AW{&7v%cjD zd$s!!(LbVM+G=X~dAUxozqVGG=~^S2Mua_Vj4dqo_VOYM3}iif;cXwz8lJ-AHabfH zz@Z{RU0iGzjonXHX3{rcTC-p0S4>5r`LopP0&`$?CTW*rK@b(@e>}|k?3<(xF2?TJ zL*KG~YTgRCJmJ!({tTXl2yA;)4wKzZdM<;$m|{=?bq=V5T02SP00Mt1OjXgj&}fxacxPJ}PlTUPhq-&L3(J?Tnm>7c+I=a&4;oHdC zH5(0|u-@wOv#Jh)btd4Oq|X5X0+>NV4G<~FZgLAuPke%Kopj4+FCk_T!K_hJ=$@&( z=yBEaO2o)+M<=H!%;Ci)U*ySAqjnjn(AWqZke$08@ zj9w6Mr5AW4dOjA+I~cLF1rk4sc9;f5AAtTk527BREi|o&6hIv?7_#9H-wXg?%B)&m z;NOe+*9$ACMoZ^pfHDq7mH;ZKJ?sOc*X>6?aQg-?*awgm>IFzJIy9$M7oar5P@_Kt zxzX|4ytNdZB&DS2hGRC1P0NAch7E}DU>C?yhxYz-cWu&VJiG<>p3f9usXx_53JWZ4$S0XiG_|7>RM(Brt-qQI1XeYw0+fXe-h)fO`z=IT{$mEZkLS`m1 zTjQD1%xsJbST7f4I(RBqvu)^?uOj}g4nZhRu{Qv)uqS+cs#>g6YIkNqY+;`0|4q*?>cUd!d}%W1{PsF80`d^$-Ni$Fr@+WqS+~Ax*+c@zq|`%FI-&K6U^IC1_HXZ61wat^xRZ*BGLj&Q7peH37{7$;P=`??eBm$t0u#rwRW@0(Q zodJAU3S*v9N>`zLQ3XLqBQAj(%PA>L?UPfg5)|g)XEpgK%ZdA2=WCeoAnT$Bq2=0W zb<_*>A@`>yflk4*vRIO+qevtt*Z@rsBLtqbsbswZ_y%UJ z-5{$80OSM^J~p*|;Ad4q!uqD9IHb)yz1!dG?~h98qe(-FRfaaH5;UCvPa8%lL#0Oo z3?vb#=%RPN!A=5x0%uIj&b`f3@z^P(b`Pub9E`IS>1F75_E*Xd1^dQpWcGT6SD!^Yn4>ZO%GxHD5?5ZMCyqiig~$# z`%9OyNf4HFB$5|)780H}-}TYC5pu?Anjy*Sx=kltg_?OhIv8>^+dt%wO;xuHArr0qPbS)g5QZmJK`07z z2r&J>vg<~1@gDB_0YJVu_MsExL0sY+45s48H=uE10Ggw0Z)5Gz{h?W9s2hAefLq@J zrr&h9G+!J9G@@2R^y_wQFxiI_jENWqRY0Hyd1esoW39RX zjbPtyri+9m=8+3|PC(-tlbac}d72GM6gFf>1|q8}pk!iy1p}sm9an*S)yy&A^=wcM z#~?klDV2a&2T&QMdn^aq1iBou!4Q?lM;6h9TrcvIqr^5rVMdEgz)f5bg+38%*vr$d zTNs7Ch!Y!ZFO!A($XZ7katoTD2>OpOD#ErP%7HpXZLB|MU>-xI=%eJ6-oL&Dkfq2g z1oNYGZ6^c=?j9g)q;Ny{XnF7O^KYWz?)(=?JX9lIi#w!e0rr(O|fpwIy%;UZM06$HPGQ?%%oFQsQYUsoHScP(L zZ*Lm*3b+mKsQB82J_V8e4aJ!35JE=lYFKWdq>ECEiNZNC2dR1oyvJYLNp?5%l0+Or zL_#tu6iK+X*vEo2mju@pYc@Sn0{H~AzJK=Qm>Cp6W_VL4RNELp*c;Fj4mC-vKTl3L z*17eJUW>tak9;k-mGP{mD^}sft5>fC_rwYTT_hC~E)U8(GETa=xmlm5%z*8E8h7nI z2!QnvSG;?4K=qlEo^=q4Twisi=pA?MbZ`cHpDoU=K!?D>X2($mzF++mD!VX3Gf@1A z%=HN)!6kqYY0f+5JrHvSp#b`Cf!a8dM41A2r{i^SU`VLVu`|dtI(-?VgBh8DlMJ`~ z??wGSI#393wjJPQtdHjOx?FVPln6c(HHtQFqa1H{eb}dXC8_sM)1ow8c3d*|fAvr_ z*TcB_j+yFd)3OFlJEa~c_ZFkHUfq?s3BsbxhQ+UWs$;op+f{=%StP`N`6WoWGQE`@SY{v#DG6D?;&^4EuhxlG!y zQ3I8m=|Sr&^O;pDwZ=Om?A(tovZz&xd9`8bM+4tebF0=ENcaZCaQ{3nNyIhI%Vtto z`LXJyYja=MKid1Kqae5K<=F*{k8i#==x(cz95`_0ongYGN00dA%sgIq=5gOLaM%+o zH?{7>t=8nsgBTj*<;T8m1ZdLY@^=v@x?4xP&Pk&N55P#r7I$SCHr}YvuYA{<5~ zMCw^Qw2roBefR1Vxy|$YW99FJ&3dt_Cc?er7gvUx*7wo*|0ncsTY>H@w}Aio>Ed=< z8qi@RBs|dgY__J&rcnnrjxOq0vNqKb|Oe>SyGlcvI@At*| zk*gT=C~UHrn}a^h3jmG5v%m$?V1i=%c>ocLe*Z+E-uC}<+i~Y(MgI9$-wPi+k(%#! z20vu+k8=uAdH(wg`*2UDU;n*J|ErdU+f+k+&urUz3R(A-`k%kAdt;5&0b%b0o`)1(1qzoQQW7~fN0wtEUb`kz%d38&>@NxLS6n@` zr|nAvFQ;f|;do#I*W&k`ZT*sMpC!cBf7b$>?Qw{4$TEwY7#or7afnNz_2%~S`;Nap zql9BH=6?^joch+A%g4!!Wi3aK{vH` ztx`(*UdFz!qy{X42g)DCt09U@0ba`s7v2@S4kc{UO5T>c#^$(J=);HW!6KjOhT;Vs zi%7`C7o&s**YPLt#+z4@BSzSN@NS5=OSpQ zZ0a4`AVSm4!?;L2X(N>TKuJx3Qr%0c)D%FG?}%>qFMMY9;Tiz>mXKY0LdVi#rZ=uR zI)Wxem^sP00MTd5c{@AH$(~phegnWQqv(c1pqJ=3AIm)R;z~-nAbq3Cg;+uLyGUsl zb|NGgez|4MI~hUpp$W#Sr_ff5*!j^8rdar)`H0E=`J4~dS5n=a7u$U{KlGi&zTM6K+o z34%|~6rSax&zEunX)8X zY7qpc))=>uytNZ(2`0hlx=ulZ5ROK^9e+SeM%y}Xqj-ytvh|l|xrP`bu91D&F&oxh zqnwGMf=vMzO1niHOmpbYpB6s-!vZV@*tI;wTmQO%IUoKz&mN$D{dkD9l%I~h20GBn z#x&?&^M|vCv%Ubzs4@&Nm&mHb$_T-nI(>jlTYcptV`2(1YI1mu^Ot97qpbnTT3P{U z9u1*3EXMSUg0>1aJLSWMP+^^KtB^EbndgC%-PLbVIxS~idoi~KA6tNyV6UVl`a|)i z+rmQnZ#~!8e>khEWA@lxOddp)*1M0VF$XLD^)jty=qU40YWL?0#OXtYNM{7le>X?5 zV)H>$Xb-k&__`7;_|yqN+4H@v_{zm7r{i%21^|*qF?2p~d-8{0p&+yz4uo7`D=mMt z_#qgjz8Qr6F|TN>cYiDzC&f5boi zu_1qO)v8t2IMJ(>r8i+J20d*pFfa|Xn56hR`Zi3gglWo?+?nZa>_tw&kgQh~H3V%$uBID!*xKZE1VG;z3PMkuO9$cxJVC7oe^PuF=(UoAODMk7$QQWg0 zqa+lhM_ynoj?@&VzsmTrd%o~4+FEF#cH!0)%w2uKlZ!d>ihFzjwgDp;9@-mnnD9;B zg=V>RNyx|{zwx9Ob61C=E7n;v-KW=^P$1x5v}jR~#pU|DXv+3bP{|Y+vV+HJ-?hD*vO?NZew~bt4wPdE)Ez?g_uea6v`M}JN z9#x1upj4uJsl+zZ&M{Ku-b$jA{&k-vmKYHkDQ9kOe#=Jl2A|>8>7RWcY|T*G8eu$N0>#%Yc16+1FRmx$M1MQ1 z{Gnt(T}!Lxlby{ICAps{bujiVu#;yOidq6Zs9sZ<+gm|VDU{QUXzFtyx=zkz8tut+l%e4p@z4^PW0EAJUyOWZW` z8<_v9#cO&qjnn(tLEe8 z<=f4CzR>JurLecef|(nC$RlFa`Tgdw zaioeo>e6jU;Vd)Qf-E;PgOA4<$xT&bH*Ig#0-sX3s-rRf1 z5yB(qkCk;kX%vTcC!;*C)x~tu;rXn2Dt41pG8RjZ+qU0Vut#6SX+Octr$zzdCWpx4 zLK&mZ;T~@2Zu77(^eP$v_)D0_!AbsF>iyrP>eF9BM4dghuk31btn|tH=D51P$n@dO za!xLnCOEmWernOX@!1IxQ*Nb+L2=Ih^nr-binMuatoDJTsrz&~QY9a9-Mx!8 z#%6Sw+FBIQA zeeN3;o7i-hF=e-QVZ*cM0q;8~T>);ydOa#tD>^gYtU6>RI5UuBK%)H!tZa)jRm2Ho1R zXZLFJ#Qm-BMvrBW#+({`UA);|vr>0lCjHBmzRm{80b`2{7fn^RrgGrUPc>DRA!kQJ z8j82@vh24pzZOKU9Qd=a@6}hMwp9g2~m_&}M z`ogu6dt`OS3f7Da&k`T)4=MQUA`{Hb8~YcFPi~pu_LdC+%8-&slYTsLNH@`9VB;e=Se>mk{ZW6oIqO4G{~nP>XFvJ zmz=m@(^b^rBmd;`a7IHRdcOqQ_R@D)I~dT=%G7mNQWoAhV`nOgMv2?$(Xwc`g&HM@QXL5>3KY z_**z%m$#K$27BJGt`=jX=`2#O)o63+DZn||UVKoIDZ<9i;%9|T$jM}^zcInyubQOp z4hwdhR>Rt$;;uxap<1(sTC1kQmiQQ%gk#yeyE$umlU^lsGF`=oYn_>C(OF+v&7T$& z7cL*Fjd}gdG`DYZo~w7t!7cyJF0V|*==Gd zHY&?>yu7wDr0Pkbp0~%F#^wTJd(DyO?r* z*lQ@~>W0NrPLt>RPi&MEoBZ(nT|mwQg&_F`xhLm!NQ`OM?jGYHObu&^-j5=Z*S{tOrx2$GHcX8cpD{|SsWV24l>}>l>M_h-UN84od z;y(D5<+xb?9%5xWH1bkim~&0JzpLzsifX0Cc+S+T+XLDxBWdx^O|+EybM?Grc>{vW zvhB_#*BKUYdS4dwXG}Q?OFDh|+R*ZL!(utOLT&P%$n4;?wB+!&XB0`8d#LWc2mS6l z@c#jPj#Fcu29sCr3Dl^p@=lA(zL(28r86Yc+Z)I!ygT}SE^qYAI%@IbtfMPhW7nMD z7F#&`8dg;Q#VKUbrIX0KH%T-S;mQLtWYhlwx z)=4+mUpX`rTeh62I9)L>??hI;fJSHG@DuiOqxVP5+A^4X1!Ot>FD^&3o+_Wf)FMuR@l1v?d>(<@vol&Jcs6_~1O^>jVO3Tp#$_ZBD|t{$$_K7fr0+EC+!w}FtKM%RE} z(8|IFE^?b?8ODUvqmcBLJvseBJ z6e-y6DBys{K3_5ZR1$J2e;oD>_sxqwafNXgm5c#Z=W4C)e4*2{e4-U)U7B+GET_b_ z2!}ZCz|Qb`XF0?gHcze+lFR4H_HKSPWrPuu?*ewqD2LVG71*q;^mSEuprj8;0|w6bCufc_Y`HPOk1Nlk+l9sS*lluxsPAK9sd#Cpzz4 zlOrP~CEQfBR?n6Bx@CE&WkWt!1&gPk2mPH% z)i^f3t{Q!F_Xa?Ic7brQbVG~SGd^t?AM>3S3S@3n>7$8L6U+S`q+i&A%Ccx|5F4cGNc;{3H$HDtSr14l31 z+oqxEx=&ZZxuWCqDZQ>Ky}8k`u@f;X?q9ZkpKCK=r>2cQ@6iWizwoadB}ZK$Zy*lRtDf$iPpYjxkfmv z!}L^r$p?FFwX#nQ7Imh|HRdf2rwSA5+jAydHcfmP({`;I8Nld^vN6jW)hX%M-gkM& zz71o#@Y&gf6i7?C`W<6y;L&kTdWE`X+1XS$xy0+;>FO{2l)kJ{)+@SZXIw{T=0NE& zM~KrkIY}eyl9F(}8rzTkn#IFa54t1h1aqt`4PazK%RQ}D48O`B`D(ez8(o4559HOc?d`ZYZ-E=W%HJbWCl>#iR-Q8ha<*Cto{nqCRfJe)ZAn zIqG%X-$~ZKzTKuJ9uKW1Cgt5hE*Z3@bK7}&MjE54S;;2~b!_vv9nZb-u5wAy5$fsb z7jhY!@+pv5Rinx?429p~;K_dBwBAp=EiV@oITjRX+8qw~BU&IpezSm|PPJp>OYN_( z7WBPVzZZtnSOX*mku>g1)szl6H(r+%A9jDo>bZMRx=MKS$~~)FmB$YlDr}ik~qT77oip!zE<(@%gf|CCte-X7XuG)_n=f z8&Fjxi4S3lq>tZ=C^hw-;-TuDS~G=RHLzl@5XDTfC9#>Cw9E(FYaQ8A+w+Gf^WWnp z8sVfMb{UIZE$-6%VIfbt?Bd!fma1M;O@qYN2AQcx+jKd126*2KwguW9@zO8(^m?Vk z&`2N#HI!FWv_uQ%1fX~}fXs~el_Pg>CiD?mgRZ2h(m+4q@h9R{XKxfIw=2tbbq%)6 z?z^>mQOQq9Ei@E|88nDFoRyIP&92Y1rq<9(+F%6{`jw+~ z&sHW6?_as6_m%kY7vEz_b|RZ(*IqpOCaC|aw$tbdiaVEk-tA6tHjc~k81qS#xu+1| z*#8?h?1@%A*8r}|pC4`Wui0E< zF0y0Z<#wN_Vb?9b^8S*J*3^71%SA6RwcDokT^@9P@jcn&hTaNddC4^v0r*=12n!1l zQcp=UK{HT0UC>6y|Kcc68`_e!IM;(mH)Al3GB3nkcfo)dVNSq z)6k#`B+J0`QfpshJ__D77(zDj0P|!G=&8MbUb3kfEk$&?;*;dPW0HkrqF5=Ue{^&L zVMeolwmzK0+ppZMv=eXy6j zc|7IT9q*szt_^^)whg}4cQ`LX2rbj`0I}`VL4nN*)SKu~*GRsg@p@=6u3X!`%3!ob zkm*01Gc`d3ZiS0@_22Ud$i;AaCdX>v_B-DV=j(BRJ>K=)#IftT^vaz**KY4|)xWN` z1+z@w=;MiMJUz4j#vowJD9wMfOy(X%{j035u6}Xu(f$b~iTMYv@lpC^yjD#>o>nSr zEx}^PIRaShpRF0C0Qt0c+sQ9>{o1~4{m~o^8|ymRc`Z@5b`)VCTpyM~^P^ikoWiBK z=CCCh?Jyp7baZH5TO0EVlQQXTpF1nxVqgnB%ba&qeYU5*!B0Xs8)u-dugqUdS^nO( zLQSTt*m51)Q+|G#SL8M4t)sPKZr;T|XPtr_y#ZrOaEd77HwR7iA3XWCiyewPG~>27 zdAue3m9Lnuu5aP{#-L{DY0T`wDxN9HnQ4k2^-gBY`a`cGA*>@mt4c#>Se)K$-!A`e z^8clZ0gO-+<DR_cRulYxr*%>0*AFW0->5KruG2X&P4(yAAHUs9<;D9<&D66mIIYkIsSC@Q z0gnFDk&?QqCRS&QlUpidK4n!O`fK`m?<*}@yH0`2$IR4}7~L!u&y}Gy4z(9sR<12P zcxUKz(X>JJV-`!yWb{GmXy1XPq@>YL%X9uha5n(|9lvH-PdfJhW+K!H?h|zVdJEig zOzMyKp3bJLc55{SX?%*`SH9)RRZy+Od;)2G^X5(T>1V&v!=3?Z(=rk3C({ZfCH6qaCqkHB@_!r`d)(mh~g-YDN_`8#i+D04-f zNZDh;8n=0dHa&f8;vbE0^t$rYhm$6AWjjxXj`pc3Oo?s3t{Q3HIHQ6rOgjAot8|-Z z>;9vi4?>kjP8D`~czlhEOK^Mim|b|#GfacG@ZeojL*`FMr$5U$;YYP6Ogzy1-;R1M zD_EMeyXWL!I;nv>|x4tu8 zdq#xEOh?T`?5It}m(lgTTkZ|L{KItUN0W(cyOEO1m9kIHgeqwT4YI1Or$2HssXR&j z{lLD|(F>ko3MBz-{9t=vWebng8H?6Y4k3hcgBsrN-rx7O{=aih5CwUng6><3L_{n^pht3=uaj3Mj6%)O?kFs3yY>shQv9Lk zRWwc8M5F7zLcQ>G)A>sQk?$C5IEKt9TSI^Tc-)AJkq8GGnuMZTnyjnpdW2ODNc`_uNdy9Og(s4F(OQ zC;GRKXhjTMmXbBrbJlXVXSStcA>i})Y5sYMKR&EvAbcSDYD>&Q_%JoVN_39!;S2RS za>9FY7xD*$_l-FZiOyuHGM%R-eBrP}>q~g=s}V#*O!$y2F{qw=FVp$sOs7o;_t^jy z=@-aY$f)j9d#HZ9Ot@Ax%hsH9tn>U3#e*N$U?mscM}0jt^Pkt(1-8k;ic+>%o!FsU zn8(QjE(BQ)qdV(u0F3v(3Q~yt!4R+d{elpw#pMhCZk)O&Zq-6grW5fcT9X-+x3^D!?$1I{$aik9 zCIXf_dtn<{Op&4Bt+u!MKuGYzX%ht9Krrmt|g0gn|jiK;q3Ef zuIKq2hDsYH6iI$c$rFsRVeANs;wYWq?h|Ngt*L?JUro{Ca{8R_U8vbL_!(8FTc+86CV*EhHn@j`LP| zRG;zo8(W0wfQ@KWLVgU*GyUGmTsBD;18aNxENgosq=Ckauu}R(+Om)nOrJ~|wCLwN>@~&db#xQe z$7GphjlQ77{Qz9uujVd_MHu?b6i=SKX)UYqw4H;+8M>>ipES-K`1{~?bXgT4$G_3Y ziu@^)Bs9UMQ{uNc4#jO`1m>p!UdqUVFf<9eJEi}U&%t;-`kgs%-F=qawMBkS-{=cC z)@BA zx^Bt$(?Rr_P&tco*QyQ4X!eJ19&KF)evuZ+H~78vjlpo# zdBPeH$JREW>Yiq_e7N1rLQJsuI7K-5rQAbVM2S1kHMwL;&dP1a4Zy`3S+^##x4CZC4& z8(Jz(Cp{;NvP(XPX~&xjp350hMmYPEv^8<3C;f|$q7ZOTW(Np!pFsAo#S6K!fF};5 zmi%F?vz%*=ZFD=K!Q{D2MjX!DGl9sr;!f6=mA2nFp49sQe2mFGat;^DMHuY*sw+48bnuonv13Z$Lc+O=>+*B#AknkX0=8Q`>i8!Ai8G9)3d80Z*=|^jfLMo zu|(lx<@2ym+oT>cu*gpinJw!Eq1SZ?rvdyrn5@jhc{<1rFzaL2S++I$JIY0sU#OOb zw=#P_O7q@x@|YV$UYqnh3hPL39rr=id93s*>`A+g*()0iDlD!;`3fjy?;}Q-0?u@p zDPFaEZ2I_0CY4szU7z6|ee0iCnFH&#<$igYUkyI%xvCjeAC04yar><@2q$zmuMPi& z9$a^dd})BBdudc#?ofOMjp2rOU4!1=*iNEE6O-%&Tqfj@~Bj+ zc$$V{>0){ghmy{w%!+S z3MZ|bnR6F5;TY6K_b`Ra)hg<$-&Br8!yq>(ML||D?`EU!;rl-(&(7k~n>AuGlnevi z=k8yg_(Y*0oMiSYf7|Og3|6INfLwjczBtP!wHm_l@j9?Kp zH8>Dts3t-43%76`{x_SBW<_4E^PN~d7q8dqiU;H2e+1J*xTScVfHZ3+~tw)a}5VsJULdE%M9t? z(TIg=YtL@Xywh%Y6FvV@VjiIxd!jy`?E37?7k#75wsAwvtTPrM?E=Go?!x2D0{xLe z8_}_Y8?E|P#kmcyvALt(%eGZY7DFAvTBz+pusr-AM}Awnbnx0;z=43l_e^dim2DN{}lEe8{Ou%={kGK+$9FYAn&vZJ@!ik+bj4^#2t&pYTNsfM!}5aI11pL;`_ULZIL>AW-z&y9`ber!uB5vBUxsN84G6&D#?`Vr{cq z&mG;MgOB>TUO-6P$sH?P4GgaR^47X<56-#xKpDc-rdlZR*}a6A`tGMP4IPDJE*siF zX9i1uS~ICo@q;tZ^;NOmHawK$deFHw9^u75X*LhHK*;}cmWb(dNmzd&l)^crUR0IF zY^n) zg&xdS?p~lV+9Jt{HnVGXHB4vyxzxjYcHSn#3PcYVNG{rC%@)w=yM$7(zOa;t`I7xi zAqN}`4iYGrDO0osAdj#tU@ki<#*XlgB<&%XQBcS$dZC+C`$Qq zIZ7Y0!p;HAocy>s6Lrt%y@@;A6AT~wO2O7p_jFH4hT#l^_M0Ak3#=L$vD=!xKNT5G zH#bkQ22M4DvbSU>bZIJRD1zpTv?Hff253FefIMYL!cp%f0cFQ3c*6K+j!%${E55Hw ze6F{r>Y2IFv#~QQ6l5mi2IM{{VjWFFw`-Vc7}M#%FEkQeczbJmRdOp@#Nx!2AIMh{ z!uRm^SFWZ@y4vPz1@TK#SHAO*v9N+-%|5{g;bP6QCPJCG_pi= zm>pkLo0R<}js%jow2r$$peFCHyXm1f>onhBi` zQwjR4K|;__+&dP<&{J}MfRd?jZaz45wl{-zAoS#^GN>&^!8)VhF;tdV=U|cj@P$lI zrz6p4DbGi-+;ZcNoWEoBtaYqX%GfG7F|)aj*E_hR4}e{5igGs2Dl<+pPlm>31BW`;je6QN(V+W<9qOnkjW0gs;&>Z$A@Uc#DvQWk?c(l%p;13J0x4guxM{>&s zdbzh=|LhRhHbF*=01 zx)m-SVx6itF3>DZW27?h$Tf)CweN!nuh)C0b>5o+GE#n8&j?XP59zU5sHN$1FXs9h zUrT&0|74L)KZMK*fHoVel z*!e`W+{azWJAr=#D~|ilpS#)fMG?oA2dgf<6b(vMH^y?eoPf z71RMdp7CG45y;wcB0#NiPJWkgs6LOe?V2_e8LRP>UMbhq)r!eu$;=9V2ol^A3Xqsb zznruWOh6W;DoNydOB|Q>-&3c%fg3dqRt0%>tm%S^~-soH;%_byk-I$ zUWb=-crS3XoBfA#(?GqpB}%!;F}om}Sgyr-Z}2wOvf=ahL@cwx zTZR4&M3usNJ)>V|?h`&WQ~yQ=OLHE#&EIjzQTs`ThRTyyxyT|3y6bhtnf_~W^@RP| zs5Oyyf}QLf{r2WiidQO*EehDmT$LZ)L8sCAuyumow9{=?I<050bA64EGtFs4qMD>E zjh{UevePtUyT-QAVDvSN6U{fx)tc&uMy;ehO$8>reNA z>{j}ER7RO)ASJTw#9>dfe!;tbLq*0@=d&|iD`7%k(~3Ojwwrz|onU2APHq^Em9I^8 zE=u?57IoF<9(HEZDMkLS0;k`%)47SrfR%wNINYL4eE8m1SEgT-J=m75{&k0U+~4Si zZ)phUqS`v@C|T02fJzQrS+w>Fw=9&B&u&tu!_w^Q$90yGt$s3M>O*mWz&ZJck#oP& z$7L$m*tflUCLx~M6E;}7a0^F;5~G*82JX~4;6@X8r2mz@k97D z_!M3nd7}K8kojnq5=omCaSCAqcB@E$Is6K|q>_{?fX`iW0Dl0!mcR$42X_%Ns|S@I<YdvBlDAM2EsdcP&w7rf-VykMne~44cL0--~ z-mSv*IobEYay?T}-!~W!gQZZl+mo zlT`)lo>QLMe0$m6bA8$_^PS-w{otslK+P&mjsTXDXpK)6jlp`L)an^D&M&iS^@!MN z;dw)?EfXQ8h}V_(zIxH%6iR44NSJuqY_Nslj3eQ4YPxI}! zB)NJ<^tMDoHr_6|OZ5XTxjeCROd)8N>t|B<((?h?YPSb9rZbmRLyq zyiPb*F(XHx=7Vl93Nvn;xz(az>;;?he6f25P8ZrW)&>@4l6e zwYs)>FlV3V{j!m!f)K*axROEy^Zq9icv(F-YgR z_JU6M?-%Ajp38Vm%99XSQ6g(S=GQzl@_q33w^(0Omnqgc;e2YDp?uO09uI#h&?vft zYuaYlgc1;-OtC`4ezB87xJ60Ao&`R)7Rm_+0UsymFvl0K*@Q;Vu60RKX*+Pc2q$W0 zArP9-t0{FeozHpac9y%R;!zP;rn5a@a&m4K;^VtleB^W!!9EtZVzgFDgF>wz;|@bV z%;ETJ;$#>0?qR&xh;(>#KCroIh$Os7g#RvW_gD67^U8YW))YjS!I`s_j9u9_uP{<> z4+6uJ%;vWuFT_p7xN^i~K{H<^h8MZt=(_D5Lstq|E<6roLuMk`^|K&X|E4%zc#K8-< z)jC;GXVaJ>+!k)a-stXOWGpd@|D~6tA1Z6cRhaehV>YR1v1i6dn`kPl3vxg|wGXni zvkM(vzB8A+x^dNox7^W)Kdy5N9p5o-ZkHI}_K=;X>&AGElg%*cC4$pXhH1I($Va}# zJPEg@QL;j@nEm2hW-;aK`|Y`n&S}3{SDQX@Kj5QIvdB&NxW7F7Bj0+(Pz=hLTw#WSH*OM+6>k}O@8tYKv0vxnp`m-mYmhu2sV;P{)jLt zquAtqtBH@MDZLE1k!P5>x zg+M| z$K#0AMM(R($6$~shH5TWyUuvNOR#De%3z^sA%qz}=86k0efWz3c|V@A_^^WzoTdWq z7sxG`E^~_J?1`_8iUGA4XD=!7F!}Mt>}girZjNq#&j_#WrU&#YN5yM?i4T$CX@i&9 z7J?=7ib$d#WR%u%jg5*vgUeqHtVC}#`=NawS>aQ&b~H_3b>TKUvjvv~L8Vr+Iu`R< zs-fYktw|h8pyB#Ntd?s^qDBrSz~0#iEcUgQQckTXHp$w<_478m$4V&Wr~Nk)g9g|` z?Si$Jq9OQPipJ^F6HG|)mEm|$@aHRM*>hKC5N9T%aSF?<;!uf+MVpY!>p@BywRYY@ z@J27?a%93{=LnNG((Q;BpLf`U@mOC{QsZc%VY{NNM7WC~ddmc7tqfVO>wa_fE<%DXld000DzP6=etDbI|KHfhh#>YSaIaC5b^4nYlIoh%(M@pP;f zf$`c^!{}^q()O>0!=f zxMH@PUWFGx&v0MyS=b8q2`i?ho0&7m=z= z^hx)D$HP0}CZWMDno{T7<(1p5i?V4G->hEpe_H)Eme#C+A1x5~g#O|`C7$b*kC0lI zII&xqP3=EHk2{7t#B*H(NUJXyeuD z!f>O-$<-4NOjCu(zLz8#VB~buH(RFo@?|)$2{AYWz=-gn}{ztPXr^ z)pl>++^F4)Yi=zaccxKtc*XXw107%9Dm5QkGD+lCnU(>kfDJvAivt2im_|pBPR}G& zd$?%B@pZWShp(sJ;MhQJlkTt?r@}1VOq|6X;E$YFa^CkoF1`|TC?7FH}xRH@bFvOB2xCS zV>xXg(7&rgqGl=ULBaBYrV!Sm5^@}RTTSEJww&rn0;YWZdU_4@_=UyQ!=Ol zWlcg?O|_8KMPmJW>$T~)dOR8B@|(fX3zX(@fZ4@kQNt<}?s#P8AfeR#yZ@U40e}m00Vg3Z!lw0lgC`tY;s8 zIauxdJ?zR@oZ^(IL;Yah@}+Z+)1|!fMD{hGzBv9m1ir}TRPBXb#v2OevoYCoe0cSs z%ILMp*HsNQAKf^9AA_FbX|yvwf89IrEhg2_h`BQK>rxHt*a^0Nhkf@{ zqhiL_Jb1ba%OCyV%)z|E9ZSFUM%WI+eikX8=&l^>F6Y?38a&KfuDgE$!9E zs2xqN7Y_C<;S-NVjRp+P`Yiy`AJzeWF6?EWmuO!5%{;AVcnd}lGfrXGf}89ZS~+3} zaT0b+${9EeeN{J$#+OQ$+wRI_t4Zy)d1H>gYorZCsd+i%Z-XJB%_3bD^*5Bh9F)ju z9dE^!qDQmzHX{g7%0Xy6)U%W9Ci|=H)e6-#lz=R)^pEP4bH(q2P}`Brucr*_PA)`L z#IWF9zyDyMKP@(zTlTd2z1w&JbIQw=_EvRJM!MQ^e~V~(bp(zpljY@2VLyYi9=Md72lZt2Zs~7pH-0PO>(prj zJ%>ALi(z7XO7OLM9G~|R24BFQ0>=iQX?4!3BcX(7?cT z@7L>WJLY|OU{*7{rPK#XvhRI({+Z5Kujf_gvUtIDR%7GK=v++WBq*2&!+ip!O}W*OhfG-4em;@BQD-P%4w2;`M*LrgTU2GWdfxiXE_ zpBRFcNG|3u+^)>fg%mpejzmr4_b&4qah=GlNX!zo{p47K?#x#oQedVWcfJa3D#3A7 zbE8~oyd3WOu%-yMb@-|ERVS5Ij(n>=$giExELv5%`eBBbiLhwTneOtw76*FijAhs2 z%YyMb{l|;*{0^x)4fIf0XV48YAWjEEli_tn*d@~iu!MNkLp9x;8ZKQn2^Ffix=E6l z&{=bxy-N!eA}n!$bo$kV9&@}>FZpjqjf*Yb3#@U0a!t<-pCnu~>3f#h(xrtg%2gJm zvWQh|ZjU&2`CcmCdH6LPS3}U^dFn_Tr-k^%(d#VDQ>J3O z^xmy0N+V1c8N2(;etj-Nc0Zk9$Z?9wv+kulyf8K$c>QshJ#!D3{WNbY z&frM@YGK>lgx=nkJ$UuxrXLTLtZ0cHJ-N>df)6FFx;BWdZdYss87W@BXV`85pR6s; zjpO%*Y8R}$6iu3ler$-Zk;$HfAf0zd^&I2Im8QWJ^(|!)NXI;C-WS#+|0Ib^+o5Bh z#YEfVFebzayZ(Oq&}j<_!<@u{gCy>ngZYZ%CnX;ECV`ikj4?dG*mg?x7CL0lRb@vf z_Jj;Ju{L7=7hhSi@&1RPa(?QEYQQ!v4uFC%&fnoI)?Vq1h!kH%9EVse1%U?@ z3g&(`y-83?%%PC$U(^I6*^>~7nqWbosPRJsBpA5YmvMC7cVNwWo`RJ#ldVE(rg=7z zxW7Ar3Cem8=XukDvcs+2LqXQ!Yqas)k7?M5<{N@ecJviWv=AyI4{F-cJ&2BjHW)%) zAo1iaZK-fdyM|_7dNlkq+(cPLkrmj&;lOxun{4_aBwQyknA$B0-AC>2pwc7+%LLZ(hv1b*dAB_34;Ykp2?28Io&Px#^;ktdbBdkl6`rqW zSFr1vgX`$M>7#n0b`)_vhFeVZaGs!&_+wQiS|Ow8r(I;kM{=C_z{Z`W`;s&)jv_)Q zJV}~(l<0CCsf}=TzUY=SiQ4nA-*t*}c zi_$kdDv~-klHuns`d__7=Y$!Pe*E0i3t%92{~pU?6yFmO|yjW3c*sj1)&^ ze8xiXwIob6KPL@Knyh`rSE<%J_Rdai+lMr68Uj%|Ps!!%3d~fL3M_1u`19RV@KD6O ziNyGCZj1|1f9k)?=HGV2PUTQjVPZbTfETGbkS0o&Y#7$3j7p%(|Of_V#%rTETJW*HDHQXir%#Y`)p9etS zwYk(~U0NGxA$=sGd+{+H+AmUy%e!IQ&f1%B+tj{0bE^6%m_0MAMYADOGlAyH%%(PE zz{N&SrK_S2e6;t>e_1#D7vXg9?f-&2pDVVU&OlLF0|8@SoiFw?dx@Nx`R%cw%n zG22bhp<7aUS0C(*S?)5i)qdO}(4W3hUlLKj3J(

H4+2rFj%u^!5yqU_ zdyXtLQiF(Tr=Lju$R4r5*Zf?L4yX(~(Sd6xK`3vwOYZw*fWHlUxVnSE69u;w<BybcJWVhufNe~i5Icy5>)Cm~&R_UoF%xUQ(%`iSt;7F-ZfN@F zL1N($?fhb+WdwG^^d|Xz!d%3wYK=r#tv*q(*^9M#N4xpPp8|QA4QpmJ|@%(BzW4g(BH)Z4%nAf4348l#?A&qTuyvoU%DGAw2 z!fesJ6pp1e8zVnU|HZMRJ0CSYqst*!%ay>-dWG~utf6lK@S(($56Bz~-Vp1R!iHgs z=W_dmgS0WfDbslHk*s2*W6NW%C^72mzC4#?Mf>>J%jkjIO<|?ax*)VB1brM1c$LZ4 z$pGfZ3SbaN6yUbhFrJxc>oVhlGT+}{AY)Z99^pCbw{;MrIv_Iq0lq6x zv1-dSZ({JUN098IAh`@dY~?Ox;76s9bMm;p43~6Y{CXGdVMUuGEUvH0&zFQ3jR11b zfAE$K**NnOJ&4}9-)rf{ayf^JIZ0JTY1YUB&?s!5RYVx%VSPidu!i4e>|Q6!Az_HA zp+OE3Q{D{lg1Uw8t?zi@pF4?w*4#r@{$)ehi)R+B%!JN?a^RfPa?}h1b{&I&B$5kb z)G|WWL-SpuTe?bv3Oe?(-xE~{6rKWs#o_g+}~ z43&R7Ek79U_oK^8ep`?$`doX*hOZeQUT!BhecUNiRoXaPi5z1wyKzN4)>F!1Okb+j z3I&x^51sap+GkZ18X;@eaFeD68~9>0)Y8or-|33LmrRMPlH|!9d!Vdy=x0R5i_88j z$^>~+ud4 zLMQ0jK> zBIA=~%}a)uLMs{0>kr?aF#=zLlyWW2MU2?EYFxw4Cu#2*9j|Mb;fBWW zc(5a});$j(75bKi_&@Z_H~5<)Dmog%;89uQcNc2>x$WMPeZk7oO`jv)uB8OK@oXm_ zp17s>txX^oP$cF?2RHxdR1;eiXdVvtOQK_ULjJ*mi{0VfsnY3FG2?j`<=~yQ$Sc+* zECEvl+xhnAECpSi*uLfW)3NMrLfZr#0^DD%m8>O{U=xeB87RpfAZCZtSy~CinWBgu z-4`$VrRmDqHcro_O)e+dFPy0A#{rEDVsWz`nyu?h$K}Cp<{hQ}C*9JDB+E_DJjTABx>()FN{@ zxwy1R_b!pun9LV`pGH0?n@)<1#r+!S zg&%#H?N=}f2hpZ|2suABe7BJp@by!AdAu>%N?H&hGkM>h7o7R%U4^T@dDX8_ znlCGJwW9B83xLXIf$g>M)~u~N)t_59HWuU~qTybAw-nn4nc;~#x8RVgu*x|KIx&)t zZ3TJqD&6k`);?v3c2gI|rU(B4j>4DF8qO#Y`WsbDF-hDWaD^!Or%ah#pt8?!rJV3$ zvtVGmGPo_4lydcZ_!XFbc50=o0M?&q=`b<_V&&8;B72 zRHDi{UVO|2n+Mi#54z}a77OR^q@b`&Vz1u!b$4sx>1}V^m`}P+sLIggQxs<5E|zEf zw&U3Y`J05ipGY;XcPp&?3L86c@0&lJ%ic;tQhB92x_g3Esc4LL`v#IqAY5WL9G8M=G~lBD!X29W1?HJIUmd@CX3Evp*7JVHqHfxug0fnr@zpw?AvMgH zf?`vw%gzO6!YmvlH^%3=g2=X6^;l$hH@QV+4-D9f$A+LDW`1xD_Y=>J80`^CC zgp%AgeRKL8(w`UpM24Ri)+4{#e&FTXkIwXoiLiLnY4<5(c85^rs2>6~E}Ei0W=A0K0m`&23n}gJ4@Upc((- zvt5|hcgiSMXpI%8#0&aZ~kPuUv-|gN#XnB5c=PR05IAB!t@+) zqq4n`qm6Rb0Tidy&W=;VMgU&)%bR{)zjM@o(FPL99nFE3O07u%u zGZCJ6HucJtXmDhoA(ysRrCGh|@h1kuL*b)YwZnMW9=e8hwn)K8u}AjA9dyd9o(cuL zZnD4vgzdSt53JXWI<}l>-<`=zEPMD1jkZ#RCvg85>BGcf+c3wKr*zlRN{{R(pRI*E z_=hh}KBAA0EXOeGwcCep7?P2_(rz?&)`dH7{S)ImrlWVRk46ma8wpvN_kV^5a1;!D zUJZt?H`%54@FM1g@fJW4|>Y2_edT0kkJDgHj^6iPuXa;#RSWf7u)z0926`_jaq`j zcyhH^X$cNHwWG)AXL#Q43SY(m@g*Vbjp?RSliWq&Og&I!%*d7yqn8!9_Z>*pk6oh-UzR@_ufd);+#_9l4Si%?d0p3<%2S#qsY@Hm?jti+l7KB{HYIE zr(j}E4&th3I>WR2-)BX=A6HqMl*zaiumf0aDYzVIbLSE3yEAoOk4#P)!V|T$>sT^~ zSzJ<1D_UW7(sf6BE)x|NL_+q^Uq$%mE|z?blv1Q?PRjrw5p{9{qCOgFFyn2PH^l!v zzg7_>%I<*at-20mXLtGZQ||9$7MXG#xoXl!R)6e)H}GSFDi3Jd>m@ggwA#%9PF@3h z*+b4Ta(06IRC`Qy8<|_DeKm- z@Qp6ZuRgP)1MWJW2;+Kxi*MFd)nK>P^mjVPiRups{x>9YKF z;miy<0rlms?2d6A z<}OS*Li*t6XzLd<|EAR=5q{agv$ifGJF@bMia2oOFB&=%Wqe9kB7vvgtWGg6zL&;r z0wdj8Jr!qklz3W=Y0H2>p$I?j02a3>JmevhMRPyUf(F>+>INXL5-b@WSLlUgv$vbS zo07crzW7>2OSwLdN?vw}i}oAM*+psmNiiQPlGv81F3VnIRa~O7>4_-%gof|gz9%3H zBGoT)BtHd+7v%#O(>oc)Kul!9QSM?V>8CI@;_MMb-!V0OSr6)0N>BGcQS6}CTZM+L zbo&M*VazFK9ianxH zd-p8<%d|>mB%4wnvSG6;sk*UVto|5T>`M1u#CkceI^2A${5>sU#=cR;AQHu1sMc%} z?*B!vvzMYXPJ!$xomu)1z82#D$hS)3M|z@>en32pCD}iVpkQ1 zzS1!vb{&Ve?ezGT`s(yWwtvm~7Alh+Qq?_6G!Ieh|K;4?v0A?Ib5#H!dxEkBpH&tJ z3RL|fG!co#w_?4AC#co+%W??s6Puz)C3DvcdgxRK752oN+!(>p$| zqTI27qf+PLMLBYL!jg!4&!3MR_d}G%arxCaiccd7pQ^!75{UbV(Yq zqR*CzS!{8+QqB{~jtQLx^I7lRHQwKTJB6LDpY>|J`hqrtAke{a=X@mJjv}yae722# zIlcnO_4?^X_AE#X3JFadQSQARwYYzNaD6FT=W~490$jFU7sD={|Q^%@%UgR(4^&Xp)7nQim$E!8?{L z_T9;Yfk7-?icXo)n!wqr1yg#Ku4HFn>)*kgPH|#`EKPSQKEaddq_QbkdyW+0BPN3_ zue6K>v&0&Ap@n zb@5PxaxTh_JCXz^`ORVPum6dsQIH@2yjuOr|?krA?)P@g`R4O<;dPz4HwOCfyE`0w-&__2kKW}+w5*EOb z0HHS83XxiGj#5^6+II?Nha~w43s;#!fU-)0^GlbiKEvfHf(5~A;NIxZTSPlqB2e)C z@OOeQZH^UWd>Rl|QoVMGVqcTKe@srnW zu{gbp$^!v_u8^!owjRb;tLW^9)c=FE3+yGzK#?lFL^#7oK&2NRQN$>;?y0!^6zjqk!kr*!HAWGu4|`#)A$Cim+67nH?#iR z^HHL>%&eFgbYvzmPnOip3@VA=@-7M=xF3@X5EiC#0t#t3NDpAC8jR8FpGTxzG=XT) z!`-?g=#mluZDw|>0$X$2vVo&unhFkLD=wMD>wqi{@-}nU3BkIhh`t-v$H@d)Q+pa= z_NsMz8dY;Ko&{?^oy0TriQ&!R&nLSnJ|te#D%J-U^IOY@4p6GcnPst9SHIA4QU$h= z4g#9Nk&YWb@BR-EuXjD+TptOkdFm5z4&K*lSuvBxT|R~8{0DBGtuI8jxI(Q24#(%JCZOOd-dHxO<5e!%QKwA4 zAw{6eWrf1xbg{TvEB6?W{5)`rLcuYh zp9a`b!%kzcwB|{quq)KgR^K=Sx0$3 z63@o0xxm&^$v(%?&YoDVchA)ETsk~ykhOg4G#qz9p2v>mo!_NCntU4y-W1U;G*p4W7|14k z(b2)_W4#z{fvWe)%BF3b5Mzc&v;Gb7c|H)nQ=k@iJ#MHOVOb zC=0!c$}d5`|J!l;)pK;|%Cn>+k$29;`p_{h&AD>=?Bi-Hcbxgxa+i~aakG$ zEv?Kre7UTlCy3?ma5X^)Gj1iL%n}_|Cd~e@qt=gDPnb<&^M|;Vqh1+Tn`5le3<#$K zm}@vJG_71&oa783}#uwb^HJYk#3Do%$E0=eDx1 zoneRkAto*!^~>#gc*S==vi_rflAtcvB;gH@B2`7HP(%A&7e60iSKq#mTN5na-86U) z(8FP^%g+5hYQJtn*?q!pj7{!HjY%8A+OP%K<>7qx;MKqgRlac@!H19j97w(?g|-*- zR4rW(%{?P*yAEF5tZu=U)AqH*E%12R@UyK1Z~l$9!y=_)7c%-2nDib+QlllR%2$gW z-D_AgCggPtLa(LR!s_Sl|GRYI>qQUkhpj{14bJ1Dtu}6tkn0tz`$b1be~EbC-wU)4 z;HtMdNXaZghy3Ml z8an}&eB@Ln7?y&bxYxSGgx-?Kw|7x z-2|`eN9{YXm7gO33;3Ub8w}{n&hPKhR?}KFF2ie`TH(kMg369?08@eKMSf z`GT`CE$>q*R$}7+ZK+gS;>g)T<4?;zZ73buVO=`x*i2Ig4Z!d3c~6IOJ^$0fAdRXo zLHn-6%Hck1*1rLBLe8u- z$`OsMlu@usnrgWGkubHJXVPl(s2zZTG(d zrsi--7k(;T{5zAzZmpscqvzUezyDfsIf-cN%9+fIEPAwm_rOO+*L`M|LWOUCZ=>t5 zlfCfhZ#~QR_elPQcmEc*rBsja4ZGJLVGoK{U4T0ugazrlfAyuBh;L-H)BhYv z7MgTHu1bHht+3ei;@_O?EAC~|IY>0^?Z1MEm|`18g;;70P2Mg1MWr@YNuItdOC|CF zf0gPoaRlh^TodFM$e;|EAiX%y-P5s@qPX&|3+d47C|)v5K;fmN8O z8xB|U-Aqi92nA+Fk0KBQnp*RX%omC+F@_`d4Mz|SjgqUAco^);cY5o`OYL)xu-#lE z^Np#d>$0#z>*JMf3&&3H&HuyRd&l+I{{O>oy6lmaBnqi0N<(`X84X1u?KEj?@4`hC z($+?jilVe9(Ns}VX=}W-_g?q&=o+8v_xu0;=YHJp$M^erxKN$valVe%>$#58ow>2t zGgWC$E{~Xwa?$iU<-G1)MtNHN2mB6qt}AI~8qKrKlU?cUkIL93r%U=D<#oRd9T}@u zpyIcT>E$AvM@kxPYBhqzootPajYqo#^Mo(Hl#}*m5>K7(a~jBCpKNwAS5;L_s+5@R zILSP7e&^1eNzVNt-!ET^&V4C>g)0@GZ1jtXbQOtKJlJ03UFm=DBCko^Tie0$MypC2 z`@+@_w@1HuyIO~8DJUm$29-Jdy3cMo+n;9m?fI$LSFeg2S{5dNKnLONGdYiwfdLSx!GFzPFhr$*d{!OSq`u zn>TMVW_se2u^RiOFvPJjxNI>DYbQ(9?Q6Q@<>*6PK?;7I^(G zp(7{nu9r48Hr^=O_ttdfb_%8LTb%6#IRn>Mnu}Yd_G&FU7CvC`L*ezMwYaL}Iy-Qs zx8CCC=eJ(H2LYb)X=-F7*1({|m({eWx2H!@ODmGEQjG7+ZX2acyTJ&{j4(#?Y#yz- zU-YBZkqi9nVHPJms4bRdhl7Q!407i>xv8(B9?9tI>l;*r1y{OGBxg+h^0Mkrsb!N+ z$Q~&j>u(SY(sFe;{b*P4euv-BJS;!1VeiQ7O(=+h#$K`#VL9Xe@{=( zRH~AalF3n5+$;Xjxm#ANG-t9o)QcDO{IztIw+`ZI}jivJo7v1qKZmz5wlx%K@N7t0Ddx7s)O91@j;aoSB=6)yF>lt zMGht#R#sq@`~m|5#U>lA>a8lp`7Aq%`O{Kgq^MWiT*dU{*+~zB54ToG`@Ven5@ox0 zer8;@GD7^KmR8Gz?x?8E%lKMxJmcxl+^#;AZVRIhEwjzF1C4>-uq`#$xvm0$e@l1n z+&L9=21j`AAt53AL!Y0zbmtvSj!c=>8mfav%x#Kk>BNc}rIZi9|upV-&0zuXGoHYgmm^4-6R+1WzVdHC~}Fk!x$ni}C&cbbvk zQQmld!m)9$Q5!0lDE1N`fk zQSyz;w~$Dz+P6flyzK6C=A~})wQl;};uB}BtVS2os^{h=j(>}jH!TtOEvT?&Yci#w!}v>!Wxp(}P>*DjEsM+)7G zp1VT9b;K`wG<@(&v(sQxcTS}1Ot(4~J6Pz3j>PbNh4&4&qcSptvF_vx2eJlpAMD`S z$8zSuS<_245sp2v>NYi($kuu!Hc~7XCd7l4mecnm;9_y~=v+4Ox7Lq~OQg7vko&MLWUq&Y-@g6;Tlw8u>^r%(6eo*IKMzi9M z62H-xf;q7TS+<>-w`nDW;xE4`Ee+tb`gV$5ztsPrw7{LPb==uU(wZHO<%Qb*M2GD$ zpN1fQEU2DlX)2z6xHEvX5vwme8LhY0jl@XKA8eVfup7bX>BN?*_;bxxUdOTDhpxQc zvu^vL;;Lv_KND36BW(D70V%C)`x^`6T8l?z0}qurP{V7l^B)Y5QOPhOTX!UU(3zby z#OBG|$xfF+C#~Ft@x-Mby0|dUXV#ehS|yoHYo;owD$Tq_-L@WYCR`=)Se847pI*!P z1`|r%85JOhU5*ab)7xA9MlB63^F>@7hf{xwvcza`<%@&_E;Reu%Xtg^8p;D34pG}px8q?@~^b}ys2oAUj2P8MW8cp3=@vea3l}+hd*z1G zIl8i{M4%27zw=x>bLIEgi=!wd!%z1%hf5fLeR@1LKE4c%P4kCgQm0K*rcK$~s|AXe zYKFaoQ9QUHd9=g;>w zW!Y8U3kmU;iRMpv{~|7lH+nxNxCxW%RNF4=ugAMl%IMoa4?jElHrFtYAfzIC9{=2y{zzz)jWp z{B=|4^QGi!pc${@sThU_VCafrf|$0;Mk`LBX?+P5Kw*TqC`|tE-C)pdbxf6|9jZ>VRGP<+;#6Mzi$2hG92OKN9YG!lh;R z{lb|}Ksj5qnC!WRym_^|>lu85`3wzyzP}E{>dYqhWN4=|41evd1kq}9PPDi!Vw;Mi z6&WU3w0(4@inf$oII}yz+ik9$LB#sEZQ@{aj#EP=vqOiE*i`Fn{N6Rv7B}i<+4KgQ zJGV0ii`toyVdLDV%PgC8o#71{m^d~wL0Y6+VS>!HEY7+SkoVf$OeRvo#j-+}+JQo? z#Iud)>FG&*N2-}DuVSn}T8VS7S_=V592^{qn0H)3)m2r#W!!mU=Jo}QzWco;7wlaZ zXIl&>`s#7tx|z;RzrRI|4lXVX28-AjNz8XEka|P6>~6_(lbFn?jLyw!hz!c$q9 zPSf(+z_@#)s~Q`_P}Twjq^X6~1)lQSuK(k;3Im^k+)7%eFbps~`~Wo#&p0Ix{f~dH z$><6(wggn`!ecKVYAdMz{@q`6Af3f)`(YU@k`*4cL1X$2bT5aiZwd(8F$7I^5?M^c)$P`P_yJ{dN$v&!lsO;u#kIutR{Xx%iW?v>Ly{qX( zLD=nc$G7U+_ajj&GCm=bg8&gW`LMdSIdp;%(pwg03csi)i*besz8BTH7*||8ki(mh zt2Hyx7vM74Bp477uzLV%TNce$a{kp4I&uAnl}Syp^$or~Dw+^9;n-VFouD*<=T8CTac z%f!pl)n~mly!+$3;b6|BJhrpe=;R-i*70)`sLOR52>T!m6O93Amo;ASb(!uus(#B& zC%yBu&uA#_yH76t#q!r`X@MT}6hKAKSUo`ly*khTPFPwf}2Lbvi@ zb`>Hm1S5pk==-Z(H$H97k~*}U^0b!}l6zBe0j*?M)<7m_t(Kb$84bIDc?cHYC^ofgFx6m|b(mh=;`q#1x1XAM&e0slaT(t^aFi0lCc!FRobhH-f#eYq8fx`n1%1ao zmPfzG>Z@O#D|>&v`r9tW?0>QVRWS;Yg!B`vKpNx+TGt~n;kK&29l-e&_t_(!fU@Nk zjMr*9nNIvPP9#u&df3}73|IgC`}Y^o(X9AVX>dHk(d9z;V`U>h)4C4bR(I@pOTUi%%gjnD{pS(wQ357v?519lH+&}X1_i#8M(Khfen=W3d61NC*7Mq+2zeP zInVcM0h#pqxz5k%=esX+7%5>NO^%#Dq^x0cX`{&Rr?&0XFTsAJ6{6f&dhNhNDpj`G zV9R7W8yOjmJT!M^i8}qTG)&ma5)X`eYaLhdo3!Q-Og7s|Rp8y+$(%v`U!U$zmn!G_ zMu5;qCVB{i$aeHo4Ke(;P zL-TOxdsieP<~BXjsgiDSmF--JKUoJCtBZubvpf>ohwWl|Q@^t`pt~ks`Ls7v_)VHs z2Ko6nyCt=c&5ZR1Jv>}as7%Y^d<*q`wS3v*y(bj`-huJRt!-tKD+a8o<+^5VfDx0? zmsG}kon2#T0LXLd|Ck0Xy+Ev zY;0)&B^-u7(-YkwHHQo4D;_hi_3y76+Y|E^X2hmD{D=kyK+(vxh1~VShYxoL#_q(R z2ZR~Hb4Vq`ogkp~i~@)9@aU=mKFluFkXsmZTb%v=;|Eb5K(>6#%S>3M4@yH=uq;(c z@A-U4C3AoHn~rQe!7q`Lk~FI}%0aM5n^sY`DnIHlkU=FiW;gZI_eD}tQo&KOZn9>} zC_^*aYj7&Tz3Es>u8S2=ZCBnxZyqn23?x=;p6Kd#-eMzXb0PY5EzU(Q`mNc@))C<} zaNW)osHeLj%^bY(`+zz}30g zyhW#mmF)z{kcY@T*Sd=65#-k=X~p?Hc3GaC=&OAk5U-rpWLKZ0e;s8*m}rA(nm%Mm zLWo2+>{a7s0I++ggz;qbUpTUqD#N=l57J3^nLX#q)5miY}gC^k806JK#Lg# zOs?5ELk@|3^QIh9ZLSzfHRG2jCojGSp$XVv}6MtrUxRmERHEG`VTZ^#VBz^qpg7)J5`_^l6sr2 z3d;2dNM{mvT)G&Hob88I{S6}=*ubK^lh854pv;GZt)n4eUlEa`p=rN({d?&h@)R`0-2}DxI4B$a3LZ8kprycV!PhH2;EQbP?o{l6{D> z^V<)RLI(Fnel|qjXi!y^97mg-jEqa;wI#*4_N6*kT0;SgG(hzzbefLPmN|o^HH=)G zj`Z74X7rNgOT-hf2Z$F%dNng3#jzEhgi+A!3+nM_KTVST@Gr=AT~BXs>>2t(fe%b~gzU|kc?nI6 z&#Z9XqQ}ISsZ3w{ATNno=)1@!I&^#u;@-- zSuSZ`b(irPqA`zPfQzw5I*)KJzFkJCyZ#sM$S3Lop;Dx6gZ=vMSCE{y9)LUYB|==3 z8tLW=>BfpkbLkUA;3B)77!0VF>({Oo=ij6mZM{uvfZ1c(PSlHsjDo43Jvz&R4BHDI zGVotJ52XhGCt%k2#8dGg%gn~Ju}U&lR#vKNY7K!6JI}Z9(eyaIRA=)2LFh>_biffb z5(z@S!N+`{>MO>6ZxfG%;0P4N=Q2BSF6m(7{?HSZq7b@l`A!SW63LSY!CF%v>4|=@ zKLeP>s>!Anj7R?6;3`Uf?~^4{h4D8kf+(4DP)*AU^h(Z2m5q)G)cEQzYDtmR^}QK;2@mqq?EX9N|5p&%0fc+5KyvQn<&0HjPnVllFgf-4K%+=*nj#ph>V>rE@2usN{CH`~vR0dTbuL3R zW3r=xR)Wy2{mVL0&M(!{%wiK06^Ju%sWV8FQio+*@>z&>NIEf8jIK{x6~1^#&b9R~ zsH$jaGzp06B$qSZcO&vQ-nCi{1)Hc%(;w+`A45gQG%$eW!ysyFLbQ^-C+~I;A=VXg z8WnT90yj-GL*gDqE{w%k74P-X16m`3;F1-Ho{e_j4UL5OW9Z^tczkMv?b`JI=!7A5 z7JV80nAF7a+bcT{n>)x>2(>>Tw}ak_b1&r(TdRSw7UpN|W>RW?{J?uK<4iA(5gd+T z?l3o8G>Ut&-my4fm#2oIU>|-UAT8CMgVOh$^adhZ5G6m$;1ZM8^og$5D#7%E2@0|q zVKb#Y>${s-bn#Bhg`Am~Gv`dnEF!EMEM0VVe3^C(QMo0CZqjy;d(A?d>3^gJJVve` zbH(jQz}~VdVI2^uO3ul zf;>op?k@pc0Ix|Zuhbodk78?zhMCAnWPJR==vZ9mbX&HHgHGo%m=F zMG@V#Y3AhXQ{6h(P_p8uN2xJxiwpRXZkGlYqnPIp5V(;5dFM?ce;%uKg=1t@@y#b)6~i-|Imx3QjS(p1Ux{oMb=$Q`tIF z(U*23V*u@X#(>Q%r}aP{L?=!ya~A-s7_9pFGX&l9dG%=Tk2hu64x?4+2InrPn0$%* z@sdBNEcWoF7Yh34dN|_9Ze7nTp^hw7D;>0*y688s{fGitvp6{1n4;IbF~e}M=cl@T zep|h{_p^HA#2njV@n!DH7<$CE!vi6cAEWQ0vT_h;NBF!EjP{B(dnkQLq-N?DXY+*H z@k-IgpEaU$3tDyNI*)ec+5u+g6bx|1j#QmmHSTYN8&L<@sDODJe(Eh2|}ErzNV+)%7tdEb`pWtceCIWDv6- zil13JDXS@pCzlmQ%!?Vr$S=vpmu(yu1}B>&Bi-6t^ra$m>))q12*(SU6x(=9JTaHB z))Gh@5Xy8rDIwZjoPE8nIrh!ZG1=x{g_kl+3Ku(m#4s6Wwa_y!YPg=SaIugXeQlb86tSoYy|%j5mRj)U_fZ|t%q2kV^VdW?+}FJ177^YqMqrW_e2FnqXw zAmd#M>tglP2}~5Ner^&#bFaO}u!r(~Nuh@B=Kx7F1P#E{ZVraG6@>F8KOEw`qMBML z{;dJG;x-TFhyYIIE&w}eUEOxu!DLY1B|3;XV5WK`tD2`NK5jJlzIlbF%PhMzs4g>6 zD2aO@G4+A=rQtc#iC)PAes>=gv(rk5XkpPryh#-x5C*!wpUKZ+XK2uj&68-#q>h@;WrZCXXjKXnIOjP>bYy~cgC$%X2|~;1qb$k3GrfuC zvmt6~YD?gb_+b@DT@Z<+A$tMLsl+aKG@RrUAW5LS-^zya8OoC>`8QPAT>(e8opd@) zr~Vq-*XmqU5{ZCHK+G#L#bMXq13$C#K8n8Za8cW^irNke&S3>sTpF4z)A1R-L7 zAZ>FIWk(DL$=Ui!!hwl$LR`{@LT=Uf2gv#`LGp*Ja*+578zrV%iKT(j2L)T&7YT_l z+?JZl04yI;;~i8SLncn3UN!T*+M{;ruDx&fvW(on%?1{sUmkLFx<@&WC?Fe?IW{)w z+WV3zI$bE3>qFQ8fi-02z~->km2@fIEIjOf(r-WMlY~bQ(P?~qoDfFLW33-ldx&&h zfY^=%o^iWPmpK%PHv1G77Lwf-&&Ht zAY26A`<2}BH|F|tQ^Uf)?y->FxPeiigOsLeT2r9g0@clo{unV-!~puqg`(;EVMG&| zso#JZPQJwAg!y9N&!0bSE3@0~GFAcXzt+eS0LyDztZa5UbLLY2AhTPgp070b<3Im6 zadvf%G~K36{$|VQHa(7it}d0}xppnb+T~RrmOuY^$$vok_zJphj~}gEox>)zXVVF3 zb3Z-a&dF6l(@i^$4ORU~O}YGIpW$Hgq;S!l{nX$b$xlT^x&om*JJ$c{;jwkorhN35 zX#mWjp`m=Elr1}U6yrW+wY9bHzw`C=-63XwWTOX7a=o0q{6@Gg&o9Qv*G_!6fA3zg zO%z2+szV@6w`e0A4sjC!MscSJJ^a&w+vw>>VU%4|Qu+h|V9lB}2X9n34dxWVXFHwe zI&Tk8M8^5~K%Qg{bznf=W8-cvk;%3K4`9Z9u>Pn(?3C7Pwku-;ebo$BI5_bAuE<(5 zKDm6R;)X~!Jz~11$}CRduyvU2H80?GcE*Lc0>3B9I!rU zlTgs6JPUF!lVb z(+1&gpQL2ocTdkh|NKM1^yeq2Y1hBM+FV~>FNW;XA+^*8KyFzxblbPcunu;){+dyQRCI6ebvf=SRThzsNwZab?=}m*Q#n{?uH%hn4jXc+eImrV5~ByKnt}a216dHAaSjWCZr`^KWzS^q6d) zD!9CAo{>N1)Mu-!pYe2&v)GJ>@j@nmBl@xp#op0z%eHNw+Px(!ihWpO)iW$(`?pd? z7Lz{~R9E}CyHk)@r~rM&)l{sQ)snexgy{)%b_SiAXhMoM{K#b9@ zFNO2o#O38lQY0iK?CtHfc?0I0Uw+p4pvSv;`}Vu_)elMvZhw5f&(q7Rq_UD-Kp+sR zNrKeWGK=3|_wL%b>agnjeC;FWU&=8co>K^lC!_AwWM&9)?7evl6EidOgVQXu5>tEd z-TRtzW>v*_H*emYvF!bFvL}KfBfXoBSW zQDFchTI%%a5vUCm?SmY@JPKxI$9m6atn{umT^`oJ+Y1$gO-Seo@@e-WU@IQKvy~k` z?EwQ{;id0$C!Azx4hg>xow>RhcXveR)9PBjq4DvYUzGg^58g*9T+FiVSH$brl;SUM z(9+Vv;J;mNz&R}I>g+6rY5NRCK?=#FA+_I=N>4660t$Bl)Vb?5aRI$`(?55ej`G1{ z&={fy6VCDK0t=FItPySt4q(RjLPJB1j}AFxWMtsy4?%msc>eq`Il1-ap@K!_Es>u- zNkLy6nw+F!kbE*qsmgV6`k7|#{XzTbt5^3vemqf|8inug@4s#B+O?>vYSo?HwfGI|CE zNjKV0BiXkVNt(|nr2|}C8hPy}0=cy+?r&vJN7y1(F?ua!R-Schr0b8GnCEVrDg`qb zwP^X|WBd+YeEB#uw0Gux%bm-SCXzPG^XXjGOMl(Yx{}VlkwQ!B?R8fos2%l8QHoRQ zzSX~X?_N^p%*+Z#MsdAU(}$BAo0=E|Om;w8nlG!}gA%pOd2d|%2y(_dvnG*L^Og#P z7%e}%kzOp;J~D(X9UAa7gd9W^Xh^e3>5NND69my`KYaM%+??}vZp|-b55by|mX|No zd3VJ4$00nOlh)S!kSKH!Nkw>Px6-TgH{sSNxy;%I9#$(vU&D4_b^XD&^C8TWyTVpo zZ!J4zupEWB_;(Hcte&sE(70PdFT3AETlkr3DvNr?ci4#0|DmZV91`wZE2_LI#GhaE z$2esqk zw{HDz&dD_)XLs%oTI8Ixg$yjS2yznznv%9-{$HPLe1kd4-k&oyjSfP>8 zQH>&GY04-18%P-8+PCMQwL;WLy`292;|(LUE(7eesp)ARz2Z%%ic^TYaXVIkLO_gI zxm(1#70RnF=s4W;b+oj!wUu`$SFc_LVEUHgxu2cg0~8(a9B$b{M|bD5&Q(NY5_Yn% z`Q6753j~HbqF=fV>Rj0wW)~?7iz6s{Dt1n^#GdLrH#g||SI`#+1_t=eo5Kn`XtPoc z=r(Wm$&++>eH`rpV~;dJ*Z>OY@a}Hd*-=r|zhL5b!pG8v0g;gV`Sa(F&d#gJ^>tZx z-00ZZ_=`wHxkKslhuZf}=kwaT8+T*kWc&^z3kxHk-{|{25QOE_%O`fpi?{bw=NPy+ zet%7yKbW^jLRG8Rt*po5U_s1nu&iwlI>xqaB2c`tqg|UldsSOO%8kVUyI8Jm|uS%}} z@-6BNw?i{RiN)BLpv+UVv(?Fl3Z&;lZILkv#u@Rmva;>gjvUuB>ZexyaX#7LoT8%Q z>NRWj?%)3>#)I-A$besHs8_i`6mnH^5n{pQhLM3nr;vgxC|koYJT%l=Zy2eMjt1|< z4NEa-7Gcr2e@5As>p;nW9I#9U!<%pFO)rRJ0+bhm3us3F$ow zj$`C@Nu*DvCNuA~^ziQ4u(C0cP;QbYfjV7^rf3JNd+J5{eL zoRDoqyn1Q0l@!-0v3sm??IT~l3Bva_S3wY~jzlNlANJIj$Ho7~*oIFw$s&ZzK- zAASfSieywXjS}Fu+y`n|{??}VGMwBCI$laxAEyGb}q3dXkq`^~|z+_wJ>qXJlOE-^mj!=L~uEQ(@r<48tM7zhMZfzj}MU z5)-*^-n@ypVcGb)ZgQz`y>5c9y~7qyH8f#0FU-4VwL4x* z6c#ROH-fnM1yn_C&zk&{(obe-x+$s}Z6{7GK8>G{;|dB2qQ}Ny?Qxn*!wA93508y~ zDk!);+2R)2(V>TwzY4mqOk+@u(dTY!o#cA_5|>?E{v1FN$)cM`I4i2F%RzHSlvM&7 zo^@vaMyDA-=#_Mfy_I64>#@iz0G6n7Ub99a`EZfXPmkYz!hd}W;A02CQWVx`$HUX; zs;8BdwxN;ax3omUDSrYj@GZK1QgX7eMJoktY!v|__$STfBg9Hbn}RJ2c(y?x^dTaO z41Oh_Q0v0>Lwle`F4IPB|FLS-=!aFz>XEAs;3jJCEZ>Aec)FI3<7>1mJq#7Tjk|=7 zIXa4fmhS}~KeF>7YmfR|8sxEGXgfdI+Qa}+1`=&nP4Zv+GizA= zt#4#xC6K;)9LNb>){ zz>uFmy3+1Z8gU%&N1 zdk_8=aK!qRG^mV2_OGu0lLdH*hLF&I8ZyKh{LPQRp=b))b#Jd?K(BGfe_Hj`@$7^) zfUX#e9F&Eb+8YGanC%@LP`ztbuePAmV&>8L<6NjfjfXtBVxG0=8D>_&!NGs52+-uY z`tHhEdHF6#3xD3Zvw71dcfb~4Od!3`sVRFM9UYl)yPod{-4!DjXzJeSt^$Q4P!0b? zbI>)u&~l~N9V)+`;8nP|PN8sl03n%&Xq5*!IQ9t(GsIL&pFjU~!))|X;NDlS4nXKE zE-(LFS(zw>HCvR|)MO$cs;I~Veih*8vvtiu0IoXk(j#0j31VvmP#*gPZx=4aIGLye~YZX{U?Y{KYAcKtucpHtBTYsabg z?yX+AahLtKTztck$ruU&uLfxigo>dxen+I{_wQ@Ietuvd9SD06#Q^%lU0|+^i4$h^ zNvx0+v>~|yZmcvnH?OrvvCM({ftXkzIT93N4yP6k4Dl_O4_`aycHF;z9}i*k)~yAg zIb3y>Z5D6s1~mZ;6#!RvppD|1YY$VT<>WrKw6u)hKP@RK31(G__CVx#q{C$I8*Ah` z3**CY`~&S)TLLPHS92|3x;=InVxjDb*&}ORU0tI+Z9TF18`q18i*xTdF-Hdj`(8X3 ze(PRw&C|4l`}U>18y%PUk)Tlq*=1;Af=yJE5n~JkZ1u*CU4XRQ!_pa;s8tY@a~Bt! zG~MQHNQ=R4IVK~s7C}B8NDc();fDu4;pE}*iF8}2Pca<*OnMD=c`%v8ktt;Nf`;#l^7?A(4_LLxk)*=2~yMEqET9ZAu{rv)UKQ%SwFH}@s{t&b8yt?`qY?}I97g7AXTWG8pF4wAFtTE3X zJ{?OxhhUF5x-Q7_!{TCJHI4Z+bWz_YPtG=^nrgHaHHtT=_cNK9y^mG8bEL(}lsb7+ z!rbB4GJ}CSbt82*w?#>f-M@@y7W?sN>EC4d;0sTjSdKJL7ZO4Vlo!}nP_M(#8hOxg zCFX`sf_`BmDnWS0KlwsU>hS|zt(iqPT>4BiAEe+m%fUQQN9}Rc8(?f(wrAzFM#n+Vuxe&DHDIzrg#JAt8$Y@y8$jzXz>FVwGaIU?mQ{JNo?&5kz={ z)j3($ntXnsp4V8z)YW@t-jZ(h=s5e|{7W^(DC4K#uElV1L&epT<3$73l=E*?k3yI` zYE+vrAK9CcFYYkiY9^Gne7}fDh_a@`9ga(J>O(uRM6x)Sg_5(NJ1UuI-je&?tSQ7{ zw2NFcc>A^HY+>NNtlz0xZrd0bN-%4#{dirkKTa4K`S?_=m#5y*q`7~uxZenjkznyc zMsxpHgEz#l9NL~~-F*Vc0Oj%#W61Pik%M&!H9=zK`s{|by-abMiQlJ%Pu&^QNOcd7 z@#Dz~p6dJ1{QlLI45hrS!oiK=hN|~r|G$qp7sVE&aq<&J=8+uFu3o_ddP4iboJQSbJhCujSI<{EakpM>dLnH`0r7G%z!Q$`FSbOsePX~->RK3 z>9Bs*8TWA3L{41f%%}5+6#nnB()RrI-OEZ#e}PLmyX?Ek?On7uy(Z{_997gR{fFh|ZWtihUO96Vo+wx9mkS1!`zY z6>$hj*~jLeJIOdo%G)O|;MXr5`7j~Ewu%mCn8=8h47^s7r&m4jzQJNS+ijm?c6^uS zmS@D92tB-2+ScAJ4a|G|_;JCR?SDNxJUx-~Ns`{N~+Y28$3Qf zJ~$1w&KiyIdmYM}oUM2f6B8t~0LA?)3}?E_C`A>@F@1KC0n%B+|M4HB~IS`S#X2aGmaHfRJk(8XvOx;W@< zI&+XoFw3C`u(Poh+K34W?PyIJ#LoTav%vIzMW88qERg!6g05VdH7-x41+9(xoeou|pYLR0?v6tevL)Q|6qw_uPk{7ZtK_LY??^+@E zgp1g`QcFwd?`@Q^m2IC)Z|f4kQT zz+})*^>*~_3*Z;)ejF+RN(R}>&K8r8l+buSQPkP&_fL7=yEo@@08d*r&FmaW@j#9< ztO#qvGln{-`F;`p`72m2c-VimqJx9cdw_8RFx@E0AQCg2gVOlKTp2J!jiRRYr?Z>N zk-~oX^ywa)29|bqc2@7lzJZ?fPQPrs@&VtlFgX*GLqMU?T>!`Xg@uE0oX8XTUUx7< zUL02iBxU|T9<8Pljg$-&EFB1WCe7KwND=q}2n@rqLN@d~E?ndJAT&H20N;%}fMC8g zw7d|y4RTGQzro#N1Lzj}f#sZWur?b9njszsu4ZX`a2m;+66C98r7GLON@8)&YB>!JNPJ&YRuHH&b9_xHYzl4%g?}42*Z}Mu zuHtL_RnJeY1AIj+YLjdbmkr$tJ1Z+1Z8&5&%H$2sYXNT>l9N0T=GPo2JBUP-x2kUd zO$b8d**tn%Qt_G}^{rkUd ztHpcyrh}}2=3p|){g3cK=aB`7FJq*h4kJ9zb0gJjxRLJG=^fC0RPC zF9E-uX2z~#`933oeTp2LH;tsDr!V?+e=F%&GBw+UohA#99a%_)ilyGh2J?g+I!r zcKa0wRxh!DpFVw}P}jcjW|m}%saEL`i~45&;ptQCF{0^N47DD=b^CTK`gE*oL_|b3 z0-e~KI{Z7yZoDujhDm^O$a-|@^l8*C4VW2n!q13?F|!{Fxqc@e09dlU1_Z7cgsJ(M-ql zM*Oce7T-Z(_4Yt>_D9)$pHTkaKHsP8M|7rtKN+2`(r^CnEAKU0{$Gf2NeBG*FZ}z* z#pe!UkKwG^`72lKKTP!XnV?$UHuTf)E-*^*4GcVOU|>LiiS&gF-%jOm)lg-qGws<> z_Q|~^wS4Ycx&ogv-OO+Fe<8||GkDTSp1*@;2`xts-UrT0Q;6t@mPtmjc8V(IG#fw! zKU|a>;gP|?B{+&w4zXDX^$bPU8KGEcLM1iqTwISJ0bV$N{=CrwG#3L{2i$pcAJI-_ zQ@AxUzuSlh@zpx0rJ7vD5Jml66$r(@Ov8u5XW6qSzlNQY(+e9v8Da%M&b`FMK`pn( zORJd1^EU#vyjTyZUbpB`bb9&|+&|FEts0|Fq-E*fsHW&(8%doy#ba2p3#uKlYsue4 zNFSv|x(Zqsk;XsMYjr#l9mv;tw`t23MV*MDAq!2{>CP=h(B5#Uh6ZyHUOYrV5Ovg) z?vWkp^XSgYxSY7~FCQr&CcR@PVo*5UPz;9=Aq5;^2!s!{>@Ac&yx!zyObolUw6suo zMf|+|5*IRKB+?f?9WO`VK;XU|#%q*=1x$AW7-A3Kfy|VhlM@UD6lQnA0u+ox>gkV7 z8&ZjigJej3juX1l=mt6trS#uoc#Qa76tEt^0em@+Wye_@BX$3FZ9gBMA8rSX^;SXm zCkpGW$7SK`v@z+zL~J~9FI#u)SnUph7jN&_gHpm@#gjORCh%n{F*>h1ve z5k5YlfIR!rQ*eO~3awbz(JWsMi^FPsdT@v)-z=@&LWuZ^tx(3JAb3E?yKv>oJ@gE{ z%&9~PsIc$HtUs0pv}5W&N1G<<00lIOSiTUJF&$YydUJ+zg6u+q^{*Qs2o7T2#9)g; z0LLYJ$Xjb@X{k``@@~Ztw|(C}`sWbP$j59aPz}+9VLW={B+Ki|oB$(xIXHTrQ|I9O zp%A`7Qv$@U&#+=gGq{R#0%2kfTSCiEgUbJI$&-YN8(qPD=+Gz0{7A&9hj2=E7{?0Q zIy+Yo4H&5kvH7uTG{TF}A#m1w*#O!OXGA>G!GO%Z5fKAxZy>)R51kf) z@uxsBNM%>sH0r$j3N(bNxFT$w5(FfiK3M@7`oK8vcbJUW!I;D+VB8;6OFc9zAGxPC z+1;rjHQF@GR%qA82PM&tjKP$EL*mWoL$24 z`%9dXQVGkwK7SsF{CD(w9X`&{u}3uZ6KATeAjr$j;5}4d|uF$$>F~$W{z`5Gg=su)`s9H{}HhX1>IYgcW|H#P56Jaa1 zr4tnymK3~zCWJgY&@<%9YPryYJ|G20xR>nfBC}aNE%@sI8+4<4WZ1gQ#S#1A>B_87cm2A8zPvUFeKG6*n?mJQC`W5ITU6i04*Op zSYH~%t#Itvu~;&isUYH48>qL+b2a2vuHN?j&Q z4L}l7v0al5Jw&`NFYa7znEXUGMqtYdVJ;tE-;ekuPW4M#4EVLeVfcm91<%p)sG5%) z?c1-u(-8>8&(;Ri27PJm?EI`@*F^ljR|rt&vr;WZ!V`kBs9tI2P%!YYw?Z#Nz^(gd zO79A-1V<;QYLFv3^T5yuOd`yzPoJc)dhnrW;M3qjhHtgqsWH-rx_~o+zC`d?a)?@z z4QX+%pbL16Oan|N4a)(@;5_EdVz^_hOFNEbJcomB-Shpv<5iz@hKB^nAgbVnE})&( zKqgNKdt}EQdQFS@CUp=G3~Or_H%(*_5U==LRu=z#?#!cIZHRncg*6UwXBV)Sw)P&9 zk0N1)H~pACh}iDpy!?6(o)H!minUY_m&Ohe>jP|ln&l`0b{9c5D3f&CL?O@39tTIa?_aT``Fm-;(!d_wXb_1 z(3j(c*l~ozaIfTbZse^}I44Kz4v`E=;S&f_^sH51hOUFv&DMT0O7JC)S%xC$@%6O| zAL2dGqIGfXgp?mR`&Hgx(&R8rT2pE@qk!bVBXBZ~len~qIDcV*)s#19h#~7E`?YBO zQrGBssT6g313aYh#p~?XIg7#bLmS8j2xmE_{D=$x3=)rS18WOvMr0TfLa^bRl1 z;3Sd9u&`aY#!|#lxzbZEsjKfINk!NOEPMAplWM?b#(9)O1O@{Y*45QXhP%ObBYh8j z9r*y7e5eRe5ctTK!R<$K+;xwnWF&bA7`!wjh5^ny)fH-v^o}UT7P$D9?b}a-fpE_b zUL!=LC08722%FvU2vV}khiT)G28t>S&6;2aBtyxg>z;8#9w0j(GjVTn1YpZo`3 zraq&8xKFtf<|G0i&+y%lCtALVfk7ImD>fHW$^&M}2zbC3Aa0omsNJ8y0jWO_yI^ws zy%!0H*%&KBeSPAaAhzgS;+nCMXPBOZ<^qr|f!ya&QDhz_?}_xQXZXG*{%nkV z_!VTVR&Ct%6ps#SA%Ld+sfG&-P^sFA95#9sr0DcHM?#cCg3TQP2Drtq8ynR>78Gzh zNdRbOSgKkbUfKZr_9xBeF@xh0!lzci$%1>V&Z&sT1y2olvazXg^^llgZoLT`05bA$=%!$;P|`-R z(>60Q%0jES96#L@-tl6asX|-lZPMA*t)OI2W;>weE%&Cd7vnsz;?kz6r-d247p)}n!(4% zcf-nx1u`YYD`hqJq?MZT9f%-)ez!mCJOex()2*S7FnEKqP7qI3IW3Crs2+=dLD09j8~bI;pWS6 zX;U#-kyFxxXQe zM9xVX7%lD-3_-m8Y9+!kFVQNMP0bK*`k-yG;_${W)}L7XjUKmAqB!+$r0Ft#3C!~W zY68Nzo}nQs=N<|V*c|5*ZbNi}R*3~_2bv+h85w^s&=%GA*KU011^r3S%7U>7kW*kH zuocN(ge7n~ot}cFKyTW*Wy^_ZnE)vE%tT~Dmqr;=JyV-V+=esCP5*DJs)HL`q!9sX z0+UD@qE=$A~Yc>*yqQA1v;5`Gwr28Vjcm(Xx=*Me^Q=yiFw5E?3a&jt8}_|8RmapB1uH*VawdUKf*8v-WV1)OPtew<*x@c8j2 zBF`aqMR~Pt+pYR?DO+2CRkTbma4n=(QW_4V(zmx6eAMH|ARs6Y@dB{3H=j}#FCeW3 zwFDWz-$@_6M**`bL&L*+1qJCLVj^}aGe#2q*qo7(3dfJ%B$|$ovDDwN9Cxr8S~9R< z88-GkPtT7!?_dG~a%@1rEE}ium0}g|0Eq{P*rC}Iu!1&6GF_SzVVueddKj9dU66Sg zdyyTH^fC~+-*xX;K%;R!j>K*74$3taTvJDOXf&AY7PkD8pq(#YcCFGQC>!OP;Rn(%a<>| zf@{S_wxctZgqw=I%}ewje@^9r#5s0yuVqjF2IpW<_drL%n^>Xw02XaR3&rdwg-l{K zwY8JasUdP~wY8sN*#wGghYkvo)t_V3#9kI;{$EGh!>Awt5jc7&43m`tCgPfzhJR1-p+HG~FjWGpjw<5^6 ztJki5j$$DZ8MNs;Sj1mcD)}kUhIffr-$VCR#4%P1Ntuvv0cu4SJ;Fk0*Dfq6fclbH zY4j8|S=`Bk=|O#%yPAk0_)O34JZiKJ-W`eNx&53(cnNQzp(VNosUf9VkPX7I!K`3o zWIU3Den6xb*fATE>(_@h$oGPT7(kFgW(_3p4891tvMc=pjYmlScq5b8J;<-H!CnIG zk#EuC7}io@42DdkUJIdDfCe}=CJ4S~Tb_rFO=61(Kcpj=ff%y^)J>!p9{c#*L=VNO zhc=MHLpE9%%&k!EU}7;5h5rVGm5WGg=Z$5f0d|c1t@hv%FO~q}kSPa}p3c^8XlPgs z`a>+E+8>wbbq}Um3LRacl}yj0FKf;XN@M}RX&R5l(eWet@Y^K}hF`l?VE`D5xWXXA zH9W%zpf{;Rya{4(N1dn8CG}$o)pyIg^>W%Mu57fon#%n@>_!L)v}>Cymc5bfAFTm0 z&l;TSfI{i>SKR*^KS@WQKfeiDN6>3gf*8{N*Eq<3T9)xN|6Yf3{r8jc^WUb3Z+@@% z@c%8ZD$UFOedSUM6VQ=XtXP3O6|@fuo8Ow``UeoqFpdPL)}BII<3HZKn<#1%6ACIU z=<)sn)#4knTrulLOAd1tYE#_&R(0k$-y54?&u>?U(zxXWvPEbhOX-1*o&WtljG)nY zzCPi81$W>3%{{U7kD9J`bBtIO+}Ebj4Nw}BPRkV7*T>wD;b3sQXUFoM`1 zRk`Qn^<1ky#0w;R({9b+u(L3~!b(6#ObqoBBSPP1V*mDML_kEKdF3%nR`fav-uUS2 zbgt_a{iZK!DWQtOnY_qOX0TcPm&{{z&17Kc^ht}9%4YqzfOJN6#`4B;Idgm3qt7`p zr7h1~exrIn;4d3o*Flom1-b*8wuIK68Wd7YGh7%lk` z94M7J*Iz>1gR0(sy=e~8H=7Edh8qi8jvc_5s5R9Dj1l|%!*L(`?E@_p5qt*| zh8aDSJA8K9oj;gadNlVUuJ4D^9~%D@BQYL|yqT%k!$1zRcQwv@^l9myYM)aq;+$GB zBv+92TRnRF-saq(T?JilM@t@+^K&wviW>1raPK%#b!hrfBYjcPjZla8wlopujh>q# zWxbJObE8#V_IJ(f+vhw#UQ40_&`=;XUyPeaM?=HvNh&giEpl47yQy~f##Lw^d-m?V z2~${(Z7XOuIhQ~QE7a@>^IW+3z|4i&^m&}-4H3Fe;!ldR$c`0deqY!rbBNin$YF31){FrN6^EHbCn4j(YR&Di$9@g4EFhe~RHj7)6EW5z$b={D?S-&>thWLsdlYlH!gY=2qi0JAMrg#BT_=JYaVn$^^i{}X~hqv|w?rI2_#;w<{ z4}q{J%W6*Ium{5tZ3^Lt7(oQH0uZf$EskL56+9Mvg$R5&ykfJ#rnx3WOG@fLw;f1w z**Hi;vfMbs69edk>4;L1hF*?WKoz!Gd_^pWf;SsU6Gkl(fqMmk_+#Ztoc-j66|Z3m zUZ;zfyb*~UoE;F~PcfdULNv^$YsShwh8{=4`qr{1=PsV7GWMv%oPhaqdnp)}DWO*2|4S&5fV!iBecXa@}m@1!ypFmEQ|1srihE*S5f zh{g~kFY6rpf7pA^s3!CE-y3z*u`-S#DosZektWh>EMozrC<4+|nsgy_NMb`q5m0(Z zq)81B=}kpJTIhrxkP;w3fB>O|oa<(0pa0%3p0%DA&wAE6XKmJ+aYi6_`L(NlzBF^J{Rs||m~A=K(d4hN^4!S}4DR~%JxLhwHGbXp%f6c5xom{V`Vob^CBYuG<$P7@4i~D{{r)k(g~@v=g+#C(L_#k-23a}6Y=eB*QRE%xRYE* z3!k2p9V{Xl(X`$9X&k?ygYTVdYl1&)%5~!zIW~fgUM?SbvQ`B z4jq{FXI0J%3DIG#q`=t3l;}4TSE(HYbGuJrTg5ppZ}lTs{tljU+52B%}tV1@i8*vFg%2 z$#oV`1{=49ghxnl*#%u0QLK6)d@{U#;4&NMLkBad#2)&{2Ypx-8w-i2R+~drr06on z)}5cAoV3+hRaNz3S;l#M!0NffY0aMDb+DBptZoRIpEtBG=#2H0NTq}Yp>733QMGWN z9YGyBmKUH_t83aDoKxtD35GO~a0?M&Fc76t21B}8RVce-v@%@{!m4dB^AJpOe*S_Q z9v<$}KM$v^s~Zj;Ap%}Sns8zk@6%r*o#xQOYX(hbQ4rATGC)upDUf4FfW8%d5#iyM z&!wuO4j1;G%8rR3HInVd93@L)EmKl@%)b-isD;A)KM}wiL;<_{pU$_Yg)GqK&1?(x zfzXVA#mYC=s8Vz{XploNiU~pR|fMI|yQwd<6^}s$vhmMr7ECLa#RJ4)RCF1M}yQ@2Zb`oIMup%@`XGXCA zOgj!SQKWK=0L%g_V6&A_bIOo6m|9vYA7huV;s#@AS3LX@T^VkZB(gByA$WZ8=V6s# zM^^*S#D*wa@GAsGM4C?6X1xm+p}hEm6{RRhQ(xh4w`^8zuxujKoUldeyF8)D4}k|m z#r@gc+>b9IRP%ngp-CXHAqe=ayqXgT0|tR9B1O+~)GPurJlAIN{GLE)*ETVU2M072 z{39uPRo2?J%7efB{lHft4_ODLQD~?&+X9{djORL+{T8eXUTgYNqR&-?C4|8J#>U2w z3uaTi5d{Sx&Ne~=d^DnE06nqyA#d>(3iiw)U|KR$*ylW%5;6Ybu*MI_L?l2?lDk}m z)X$iW@pRwlc6rp}^{xRrSX6;N0-h2zT3S7FQ@=(%Cfb@X4zjbopCDbW0?7v*y3}1D zsT(0opsdoV4207Jfv+kkzZXSr2O=uS^BbIM{($UT7Xh9JQxahvWE4y{e1uu~RqsAR z`0zPU0PWfcr2rxLBn8T!hp2BOge~7*1?(IUD;UlQ%N%Y#AROUDjU&;hU0il=;ZbtB z^5M)*O-|-V&{N<~BO&5Zh^1@^7C;l9e1wrR!Vp6b`*My$v!hyYR!hEXp|L$t;?Meq z`lBVWP$B{G2!051NX0MQkZ+iPS%avCASf;v(VM|ON$O?%Dq|FP z`3@Zo*9?h=Z7X-vN{P-0S{eX006j!l@G5QToz9aTUL~J46sIBU0Nbl7)XDjWhJ_&@ zcZ4tq@wy1O0eOT}4M6m0D3Tq6qqG?TsKF2*$^%3=GfK5E8*nEG^{Z|NyW(3Ox9(H$ z>$l((vdJd!Q+Kb(|NaCXlugSF8BSoiMZk|;fU1aw7{^L|iWhA9C9C5x+Q71esfeuj zeOX{k#6X*YJR&@>-QBOT;OkzY4n==6D0)?aHHGV?)>@kw=sLvq$#Czfp#T4C^>%PL?tB1~rr^dH;;KLimF=cu zNQmnqXhfL-7wsnW)f05&p%4rrB-FwX`X8LYS@cumY8lukc%i?=<_i#78}im6+#L=% zb9vI%M1|ur4U7^5NOq4RZ<|wMDcyblIrM`g!VIoCh*SZR3xds39k$z$#?_3BY+YlC zCS_JeMrpmiqp!wfuV;XZT_+5iE*x%I1ziRROdm>p00byZlIFs9m!!@@VlWMy24rgv z9)&tu0a=qhnA zUTSuHfDF{(t%34sdc!Su5t#xA4+Nq^LJ(2O)L#ZB7s7W!Op-RJRGWrf#WmasOp8>w z3j}qF+^alEP)tk{VkQg7i2~q-kLWlk_mc*=IYMG>B3y^P1u+?-@i`fpv9Q!uzj$$_ z=+GDB8?3>FmmY9whjIfcXd(JDI9Z22KAHbDc5WD8Zw+R^%;WEY8u1W*D4p_w^Zg>M zzG%M>j%B?D1>5~0y$n-3BQ>yOs+0?vDsm7Xq64c(1T4XNurhQVS8kg!>6v&e+fn|1 z_L@>S?An1wV+Y3|0yTpOYAhT!;{cxALc9h@_nt$P6{LF~CG9N4fJ29dmxsJ}aBXqV zm!=E*91zYAL^{gg zfZ!J)R{xH_1gyq<2%wLGftS;R!0+W|KDA#o|M3>V_rb321+DTi;5>E8VcxB6`)H`L z)US64S(TMXVLa%N!==D@5yAF@p3!3DNX#}YB3j1SheHRsGGZn&9DKnQ8AIriV1`5? znntZ_qGi+h$YUXv1{iqlP`u~^wb%&j7ID20Ht5!Lfp9hgPK3`P!lI8t(0!24=>H>3 z!X32^!dJkFN`VTe9(YCqxGog1MCu{S9}k8OqCJIJF}71HRRHlq=%BD;Y+Vh)bl@~x zE_8Wq-PZs1#&Dj1zBznP*7jW5dOza`I0wNBYAUa8DT_e9v~1871>Oci9fZbdA0l{i zc2&&ffN)b|<2cwiWk|;E#)t+J6amN~S9x50fB;NjM1%{z8nh!G^`8)rHAj8?d)BHvquiM)}F8cCzjQ8cOE?C zEyQLc%2UnZs!fM(aKG!+Gp(?Ufo?}dNNAvu6@`RQCt>?QgbWajPZX#IBryqa!LI(E zymL!Cv}FF?(T>YLz8|vvEf}&S#Utea>s!jvi-37!0iG@LsBnrv17pM|INiJC5uENp zpds2pMScmCc;5kIdA?m)%`ZGV+K4E`hl>=HNKK=hpmsFIz!5WuU7tZ_flyZNl`hE0 zgkm?}F7@c>9G721^*jt?DK#J`6T*>3>VDv&$do{AV$Mg7!AOc`i%1Mt2U7T%x>)?@ z=nD_7gsfX`RvJaZoQ`2b&eJEzPUH!I9z>rc4Xg~cY#vTym)i(g6_J-gjK1K}HC*M} z$uL4b`DKiSZ+JF!pfEqP}jtCD;?#r-Erd>Bo zHKcU57hY=!P34!!JWo%kJB%imIa>Zuz*~$avj);z3+PjFkC~2?GTWSpu52p1A=|y> zzbEcJ%W`ldt)XbM3m8%Sb=9=05VP5Jw56U7MsTS}4F5yN5G%t4j9%;351R@%;1{I~ zdl3{K+mn(meG0C5=3`byeVk*(a*8jXNJF$mizT_vfV`19x8psVYJ}UC!svTZ?X#N1 zS$jPVdfOS+A>F=lj#Xy3LTZByNfi#*a1RWduxI6V&`x4|V$lWCS+T>XZ={l`npPcF z+Tk~OVm{48wpSMDbp4KHJM#MP5wz$9-;NGt@|HjRXyZYr2Mz4T!ox#H)2MdQCPMgk z(C|SfnQS}q=AR!o0SOdvYbxIGqC`nmEWDzk*XSP+ItF)wmE`ep%9-wUszN!DuqZI% zg-4!P`2PKCc&MziMA~MeBt4zuH%3tZ{%;Y*lCLuzq z>)vTFS=N6yH~?zmTW80RP#TyEKz3DuTEGxwVvks9H2-K$9UYm}mH=Um&`^H+=&&?& zLzjMqPRu6}{7qP>?O=Up<$m1@=@R|kGPcjZpZ({<5Dq@ntQsKO4J;K#LVY@W^>m_9D;Jb&OZ2bqD@9C|NW@FoX zW6PUmV>=SK_3T^9o=Px3yaB}N!{`*1yf4`#u&m1}%+etQ+KQG@!hTy*= z`1e`#f9vE_>xXzF9b8ed8B1im=cL-~tYz4q{PYHU4h{95R$yf#=SR~9n6n53838jQ zt|Pw+n9=cYih-EU4&)3k9Q2|h!i`{ao4)S{hkybVP((m*#7dEjBvhOcY9LhDeJmK< zBM|!*ahf+2!DdE;(h!>pY~DU$tyxZcAk4F|sU@)e^5je^Y-(FFnBXIgLKw9PFijB$ zq`OZdRwO9nL_+?39Q;C6s7kUaL}EnFV0Vlm=t0C3g>*3@$RGzSYnw18ql%?e1@M1_ z3Ni`>6IoFxNIxU-H^ggcDz|LfWH{@A(FDPZ3jjS(MS@;CdlkWn7wZs3ZYul$Y*68m zkk?g)fcHZrK!SjyCP{cxB!mV&J0d3nu?Q$>v;}74^XM(@3?EQS(nOpqek9NUTAxJ* zm#d*eYzt5gf{pdZtzvIy62Tib2V^x8iO{!-L82*;lTU%{%95yQhZ_=&$eo_skK6z_ z-iTWQ+4x(*NbsiTp}$BlKZ5w*f*aqx+tCX_mE^PLH-n)yw74tomf2LZj{#yv+=)wr<7y}%K3Mm$f=1m%6gwoqFK1;-|II$}#f zX&mBBvn$SBLbUM^4MPNfj+pw0ctaJidJ)MAi#XS=^dh2I?>}!I&TW_v5b8lfCMgk&m+UXMppxDM%>2$LAzP`V&e9-*~TkbbRB?`>Eud2Zb0HXGUthxk*4R;lB zLHHDr8rYKVI_1aRmRt%{ZpUPxlo!knK~0C5G<0(yx)X@`3(F=6QGk>K{TQS@WJ?AE zoWZV9rhe$(L+k>fm?vit3~e3YRtT`Bkh+>C#1aSen<5l#;N4>&J2?(T56#kjb|F9k z7JyukX7DG7!$CQs3Isdy+cgwAOYGrskui1c(iecW3MR%a1Z2wXHIayjZP;{Wf>Qzz z)F^PC6_7Q62#Fz|0{-5;8#G^$AgHgJ@yyTP4KA`y8x$2LvW7K5=cklve@KEre>1 zsA}vCXM!_Q2VqP-$=p{8bc85>20(?4J3sYVBfQX zvNmW^iefF*$`CVzjqMt#z#G4DpJD9Wn=T+#I;*2ce!Enb6){spYfa9_S1#A| z`!tv?tekcyHI|`&43sRF##;M9S9^ z;uwSLCvEY}rdW5PHRxVE$`v~=l<7R{C@>%r-2jm$O=GKA)L&*EY^G=&CVFZ2#YO|L2RNQ?`zc>~7=~m2IGok_7R( zs{|veZozmEuY@#8VfN#6xi)QA5o+cQ8a;Wfs!67@RW9i|Q$QfT1BKgcUpgR~iJxY< zf4?Th!cI+67K+Mfj(3zAo(bVgm7%ZbHgfbOPcj*ls{XJ8U8Z83rXCJC_OSNmc`9MUe5_y zP^WMvo;L2j_|9)MmY|^y8UN_=AeDvg5lxF`zF7#c+cpo-C(JZObBP<6`4%#tdcuxn zmEh^_bp^SPv`zK%_;mYdJ<@E&(a3R|kD6Rm8lk!5BnIo^QOF`P&y-W1*5e zQ4HH72A`i%L}pi5d~a7;cU>j8fMg&sQlt5?z-M#h0;_qS+TV+C?o27n*(h0f3WX)T z$(BUpwFIn2Q~sCdq7Vk}E;Vc_C&#;AcO%=U?W`}M;u+(HTn=yH!_ZGHz!GX&!WEy{ z&F%4MEzV096kQDB>{pxW1V+0PnCBI6I2!jl!E|iYl#e`-UsI1A>r704bo<=_nTfV! zujro}`*x3&P)r-~nrohgQ-#+=E6pF9Y}T@#B~eU0@v0!4)XAAt`=$x}m{{gIcl2S6=?EQpe1GynbZ@HX0bZBO zyVy%l-r(IF;jd%3uR1j4zg+t?zljy}~(m_ZfaV|`w#k%@v z14X_0<75(RINZm*mgmHPpV*auy)gNOzY<2flh_-6+-B8<3MN=?DB^aKv-^&!+@YWH z2+pePm1%=?w1EZ4!zo{#Efw(N@zRQO-B@^GhOV&|poF7LLcssyM9^!ESB@zSowUG)P6)0MK|)YtI)yb_KC_3uRuCVQ;F%* zw2)nD|BlC-_7?fG)vTtg5uZsL^r6OauOyweLF$~Xu|L#t72IOUHi6-Fdm&rk*QKnwA83xKAECA)ysVE0y8O>nsjU?qB zDqTSjwyC>TRn1fyJ1QRXqi6j1O3f1<{PFj>zVbVBV@HLjiK+QicwB`XN;7jNst4h%oFX$9?tHjAWQl!G@b2u1y_~ zY}wgmZNn!)GriMfY3ci3A(tN}a4B$urVFVWp499I|EwzT7_jL2 zCq8SF9UHUd67BgG{ss+PQ|&J!!aCM)`uf(Y4ddL;VV~I5xA;>HKgupM80;@5FT=qx z7BE}QdFo#;pklKo1{fFiy~0&SFRRuEw>LC2#88-w8yy>p&K-VHYduy4T|IQava!K3 zR%{<@!>@mnf=UKgxn!n`Y7@@qxj64>)m^3%ED-NgNW|Bv28ZcRg(l)F;`xuS^-}dM z#==e*cWLz?6O(&kgr!9LAh;y?y|B-vS)#czvW(_=GU7lqokOp0u{)!6W@@S|^^py0 zCYLFFe1YU0%#Tb*g~k3tOMMKc)xM#Lz9`XrCW`)K(J`mQE2Q4mCT84q@;$2ogK%_ZVd7U;eDzBkD z$+=!aI?KH{U$s+f#EA*Ke;TfW&&8OR%ZVZCRM2P}U-v_UBj&$X=|`lyz)?XQ;S7Cq%7+Q+tj z=(Ew%u9N;kE5E&OxoaxqlX(5=1HY5zlTelD zHCxGeTE4g-q(8%znF>~tTA51A$K8Bh{IEQ&$vFdU4)qt4GBWCyTuvRoVaj8gW;SMY zR*)FUnyBKVkXgL(tW9?psMu=Nw+IX4R4Y-RNw6s4i?~bn;o-;@ix_iScO?i1iHsyW zm|9i|H;kC+=YFdBII_^GE6?DAG}1l}^G4&UO?%Z_sn=qUO0qn>;n*I3vV&bMXvVF6 z+iu=)KR(Y7gZ5MHU=hZm2Yn$}6%E0#kPr=Jr9K>GeX_@v6x&aG0}06Dlz}YY1u8i< z{wc*Y8sJXJUAsk%%NX_IC?#>oqZW+EVP<#w8<7xm5@hP!^1_O8D{o@_%d%YqsP*+3 z$PVt@R+mO<^qxz+k&jEb+HO`Bhx|!r`0?Qj)XmIt^G0MDWaRWi4*dj&GD2%1YU9U< z+06l2qqwO^v_=INa0@?EJu+ z28jHz7l$?LkQ-pQ^$6*ixMG^tgW>*-eCmdLtZE0^*S)<*7ld*$N|2^WYwZE@3jqBk!&C(d>C z;(BWOiK(K}HOpB!!~s~GF0j>*oeu?>8qdTjqi(m3G5^J}^7Xvp93Hiw?wzZ(Gaoh% zE?vV#7~UZTuHx9EaL^@>@;6%MWE!KL0_E%_1gVhoKO9e z@}=e6Shp!Wy6qLJxq-D}MKrly9lZu?F0&_(aj;}8NG}bu-dnfP!19oiVa^wR*Cln5 z1|tRHy)5&>^dy5&^LICyvvb_tRte2GY$*{vk)D>2*^?@0mMd86l)|Bq;*O6mSze2| z2;#P0ByaEm+Grhwg#aA|N7=jkB9Bchu4c?nh;nc(4yMEFbcn z)NK0gLo63m_S{O~LfIG${Zxf(YXz$2&xxg<5aa=z^I7L^%`E-027J5iim ztBV;UV=1P#n@SG-D~ii2+G<$`{MEF9spf_$g>|#Aa#+)f-XxtJ6>RP=QW+PoRMZ5; z9R%hw6y}6#Qu`~{bq&v|Krc6>hEXQRo^cHuv7Vp9gRbr9xBkwdAnL5I zMpulpb((G77$;X{3q6)SmBs1N$h2h|Jg8OVv(qCjnGPh_#Z;zhySm0DB@>?{m#*Q= zW@}P8DA$2wasD-8*(&U{vbsAk-| zB<04SgUT0`yk`tThKQZWhU!XOl^gneb!)>&tU~D$>=q})<<`0n=i4^}=V_bYXi9{s zeVZGk0_tB?%_i7;&j!c24+!AO);GaePzgc9c4^fYUpBg4M$@C1ssf!0EAMJ_3Z_o< zfZKo|i}u=oVT6xID|4_!WwM82q9t?yS#BD$?$?)lShaFAcTS2-+WsHNZU$NE5dQUP z#t8RfND`M_gCMiH-c7*=1%8!k@N@<3%j*28+76qM^1j)BxqStRkiubSGFuJoV@NFK zW+_;+3i}!zv-&+5_Os>uQcMLBWT4Q~P6C#F@d}jU1eUzEGS127Ba13jRcU4vQCk0~ zUfi_9sjH-4%2r>VRw_zfBq9bMwJi2d-7(L3hy zDkusszVAoVo=fq)Y3%IIvz?BOWO&5)(;BCX+u1|-WylvPVz+5!tVBq12pKxAS8U8~ zsBtMtt1wCAms9bEv*~GZaS7aBc7=Vz>m@@U8X!wEFeH^%Nv-L3T1*JqjCqcAc5$01 zFwCi#P2IWKmQrb}gCP~Bax<<~m`Hx|aSAGU1%j_{tFiKF31Zx#CA1q{y*Y{W96?gg z%fQZHSq-RmveuAWeKFnb?Z=JjNK^@Sf5}u(Ss+yn#)wk0Lrx!5kiEg}_PEQ?eWstj z8h0F}G(OjlAtf9=hldo&WJ@JRdVTq9k4s2^&3LEPgXXcC9Q~y@cz?L7X8D3N_i-B8 z7ZYcnWlxVtX!I0Y{gI@JjD$+?DO`os(@p#7*pGO8u$Wr_9GYb{Ihra=%0n}n6a{bl zfLtXt<|+w?6*-8oo}*v|`-HK?nL35)!6rNwV<4)?ns(85kCQJ_-(;L(**b0r!LIKK z&a?Gkx##A5ee67Hu>c1;=ZfS(ml64Ofhc-G4&sDkbFC7h#l>k}rsD-@>%}GmvJpBl zaHc$ZL0L*g-sMq(y3D{ia_?g%ze?G%eN4Y!K!qlrx*{@L8Jn4Bd*kYQo0h56@`<7g zw1ja?LX0HS{o`sUL*et+z}2-JDc68(UpdtHoAdy}WGWY>k35K^|I}^B$O(t_x3%jm zLeVoE$tOw&rQL3w@T!O=1^W!x)l;vT(FCRx{Em(jLQ1w2K@JK_5`0EpKFR0XDwK*mXdzrKM7G33FqiQ%Tg6#OPGlF(5zlq|FtB+EN=- zJVRHpI8=tHL5-A@Hk4}IF&XqBc9hSjm((q;c7)Dfbhndo92ACvsk*TU_WCL^MhqVP zc`Wo&^gvY>^e`x_cDx)ilHKR)@;xr*ig-`AdB=eyl=o~Md2uK%OsrIMv=o6vX5npC}!+gdzras4T#DG zg(SdKgpD?w&|Gm6F*qouvgaJD=(JdupUwFccJ~H26Z1aL+*hD=C^&9Vv!~0cgR86a z0#++?3__1(jO6OKcz1GD*~met?6%yLTP%PZnRs(d?!3bCR22VGp#_CD6A7_JN++%| zp5?Phe#5==z-`TB=H$r#Ly#rbzoXv;J8PQJ=orImXaR-$YKUtENu?O0*^PB+oH5;N z_&d&=G2o^`h9eX1Fh?bpi^^JU(40cms86y|JEDZwWNqz?1nQ~=eFTiV3?cD`7F|U* zC$_c8p(4V>>y4=AWFiU8C1@0H>V}^9hQ^BBh#a<PY%&X-NH+Jh4FB){avD|M);;#dTSj(1K6KH&gA$OZJKi%a@2kUJsUWuu=vP-#j| zZfD%Nd-BeeN4u`wzOv_|%UibXr^+N~d}V~50lTPy-+uF`#BRJDh>DY=KuJA;J`IuC z-uLz&@NU%?9{iMCo^7)H@pjvW)6o5=W1GF_arRtCjJ*#%TK%45d;GZJL~lw`QY=N} ze&^rxU16*_(hWGNMBJjO+3Yi|5H+ zj)$*azZTA|5DYOHp6)@rOttxc(L9*eT;iHiR1gNe1q9pci;Yf z)xv=>d9FuMRWmZ0kDdW1wDo67_sofXM}1WK6b!tx4rc|f3kjVw;^L@ZBI@aT(%nUO z{j@br9IT2e30xbQXZzr$enRGT+MQUMQ!&yQm!X^92#to{@Cxoup@O*^cM9VolI+fEVkDBGeaEg}WYt+t z#lBZ!rEa(*+b~9hr#D74 zv1bFCzsUPFDl3Q^idxcCn0pGaktMi&cPobnt1k}+dB68gdHhSg+Jjkzp?XQSvbAlCuWPt{`39lEn-9kyTg{rE_0|WNP_#$R*+_$4m z6OU<7Qy%u?!DW zl9=R@eh1%*=TiQ5x96DW?vGlDiXd=x8dH51Iuw7oWJtNzZ)(6h?TTt`O}R;X#3{5(wNh*i_T!~iuFz>x}w5{T-qG7yV z{B}NtIgG}Ne7td)3)@ib3@UHNFX1Dup~>8G^X8I`4m@&Az)$18UtLVrY;ikg`aY_? z5{YijyQ*MNq+wnc(XgtF=6b$M`Dm{CVyDBgLTpu&8E%j+wql#PQDCp-GIQUoNSgCoZr`YBOCVn%ocrF+dOc7KA;+D=De>{Y7ntBnz&Ih&nZOs!aii*dEhlBeP9 z!g!-xtn9qNVH2*VLcT)!a4p(;;C$XC-UEs84V4~6`kR4r&#zlcsiQ@i8#ZI3#lMolTm}oB(;KNEraG2spTN0}mrw2P}R#i;tfGT3V z#YD)Cbbb2S1gcSep~Tw{=VRP0(_XsRHH8P1b!GoPNn%_ER?OFKJrk?N$oV%o*UWP6xSu5_Ww;o7_lXqNe}OA4W7m&n_$WYeE|kg~Oi>`5Bi z{=7cATlTqqQZ8BQ`JN(&)rKGioaerd!CeYxpXTVzzFsJ`9``yljr~fN`(->KE>eV( zz(}rqVTdaCBv*a;Ugh`vD<9+W?B(ryLL(m2U~S6%y*7EtpWcW)TxETQDy6Hv?|-{? ztz9yZS4lNHT4uhzS>aeW>lD(Z>%1^?D@NQ8I=MZv919Hgy7=#1d_(-J5#HCa(1rcp z%d;cz{MLUrJQW_NU#5;Z_}LVnbvA%&!GpyrHqiq$5wlg8=I>gv#FMV?N3hmIuhLd* zCP}>P*8&pn*-3jpoiWTlN+Lra`X^Nz;>!auvL184K{rdP^H}i{YhcX{EsyFZr#U9y zNugSI%t@cWdrp@4=&e=!wt`!?-rr#4D3`t1)tlozxLv$U!b_=`X|Y?h)=b$pbn%d3{pY!THQuIrG$mSB6F&wX{Az`$@McrhBvf;IvzlYh%ru zn47-c_jtWOnYQ@6bbbRXD{6)qsr-~fNH-XE3S>tvu$IeXt6meULQa!N1wc$k5{_e$gN;Xd4b=!n`z)nJ+FJeXTebpyYY)y zkXL-|?t>NsYx`|T8N=fJnz?4YANA}$Qf}o+i))o7TSrr`lRg|Z64Npq)4W~Cxf#xR z&3NAu`U|n_{=ZhwXYqrx3WPf#{&T-SGQxgicm%4w?1(lESwr{O4n zk;(_pD~FXg9*GL+;pf+V zs6G`d9qw|vT5R9(y;wk8sHGxREU|yh-q3Z67n7VoZkBZH3T+-2 z86|k`yZNZ=#YNC9R;wsY#tt2O`Nx;qAlLpdLF4G}YT*l?nT!%I1+TJxdx0ayJ>?P# z1zL=8%bXHeaK!~!C5LR&Ae~H-$D4O1k+!^%3fRG~f@)Xa7oNU{te5w0!lCPF_Zv-U z8*r4R9bC7yEvM?9>yw@eExO-Ve2gr$%|P8*xn$qG91}gZApL( zPN09K_NlL+FnCi_Gi`lG9JH@ru(rK8v2>qLH^-zI%I_xo$~dFP*Uu+YuYKH}7M-cEN6A(VvN@|1f(FY>Q(e(K2T1 znhM=96+yt5n*TOr)lK0RBEOBVe0M0x1Vc~qvNp}gPP z1>2U-wR<;C2*u7^zkVI0r7E9Lk2Qv}zFS%*40lOLER}-9190oUE|qH1;<*()A~|oo zu^7vcDxYgRMv^oCRd@Hms(j!q0R2u0^JM^k* z^Hs~NjNq9E3LPJBd}zQ#iBB5mO1CCJXJno-=Cmoc;8~qES&}I?M=s>h`Ny!Nw#%#u zTj3J+xeam@+Kas&k+fdeKNuBOe?aD2D_Dkheaol4<1Pnz(@OkdtBaDN?67QFeFFbk zf*(=Z#?Y=X(7AX~n&9)js9X*mI8rgC!_46$mT+e^Ex5x&Z(8IT4xWJ#`QV2 zmJ2$Ck~u8|*+J-8OxxEZ4Hc z_BE?U{b%02yA+Iv_Gc#_c0T1RtIifX2CJdG@#QJagZHhv9PW@=-4ywV{F(j9AL~;u zxVB9*@Gx}=P9sMv4c4T`c-)&PqVxlt=AX)X)!J7#3}e)yCn=qpTfwjERAHXn5O5rpW{` z4_`PZ{G|1~>TwoqRI-*`s%~U*8EtsWUVRX_WgM})^jrdM=40y%`*_Xb{0IX%#`3`hw(KCzy027I zVhooT)niq>)Of2R#~sZBhVH(yf%(jgQE8Po$C--y`raPHDdN*TAx*{NVy))|tGFKJ z%1;nUPA&|3bKsuesd55^pZcVtrK_sV9%drHg;~9Z7=~!E@>?~j*~lB62CW|SffL#sS_B`IXQGBuf<94cXqw}(R?DMfRvE}4@6(+z3)p1g z>_StT(#-spZ^djxQ%PrMSNFS2`|NR148X-m&TkZ1k9;kv`m%f=(DXZQVUps*Y_jok zp-p++@%e zx_EZ)=19!R?BK*V4pwk|@uPS*!j?&UEdf zqmUi4>Ur&m7-6&2?m?@Vy~A-0UwVaclpDokj;RME(E;qASof{zMVM>1C)!GO0AEVE zk8t0$-&DV(?T958$IWw$tGjUjz6x8lRuwo^!_QsDP{h&#URA{?@GT3-n(lViT*tlb z{&1W?W}=p-MP#j~QtT9}bt3ZxZ^cQjGi@DO?T+!4<6 zI1B4vJKVr$dY^x>z2+sFbwnd(m`HMeqDA#NN4CA1zVCY6#Z8%UojqyF9EGusd++|g zS$i3j1DjKRQR_0rD~!i4zj8A!F;s`=A|gJN(w z8z8QtInNn(`M9g#fVGKexz5WleJgR>V+|qXWFx7c6lJah(`)ytn{%G@en*!&RxkK`9 zv)@S#<9;1yOpUz29saqP-hMZS`v$;Y#N3@<8?}$Sx1^hSoA_WOYuA0P4_8H2MS?dC zCP<``H$$ABEvG0xbbD=aS?N?>v0~2Xh4Pxr&Wd0dt;*~gm01J zszUX+FaKuT-s&PUdf=>p02Gaz0|E(=p9ca4)abXoAGKSYN$|>vUFTYJ91*nl^cOVa z1SaTJ8ylO%i~Knb(Wy?e{c?yX4K!hC9oebg&V3j&MfA#)oyvap?8CX7yt@O>d24JL zjBAxMeeM^qKP9I+a_T~!^HufN9r6wBPvt1E=^9F6VchC=ob+So8-}+EPc2Sb3GKu6 zUiNuzh%ez<7rJefLQQO2icmNnVf>)?8*(0wHjKdw2!)pXiQbYON~P|CA3|S0Hm<9! zyA^Yul3#r1Op(eT@});&idHrYFhI^XVn3Htu)a?)#{WkBog*CShJXB)&WF=cW4Z+H$0^9 z6lEvalx~pumt+6S>FKZT>Kvr_)3t%xAMQE*@rUqx+2?%ch^Kh>F8|^rup%Z0Etc zzo6IxeXhhv(_R*8JAI!(t$3cTSm3Urk-6F^Hl5j;jQ0;_ z0BBRbT|TZ?a>5alTl|?dl7_oKML(k&{?k{y{Yr0I;Q`)}lCRHmWbgec=107U{U21z{L&I8M&=D!5*gLcJ>19t%x6pkOVBJ)VC{r7oq3HHzs{IBGKZ0P6Mri@ z)$Dd0P0st7?6W^gZO;i$?)>9F-i=JA_+r>)G&I9+dpq>c)|JjVCGPm$lkI%Oxi2CX zneLNkA4MD9;w(|Nh=0xV7tS@;fg0(Gm=yTpW4(h|tGUfH~rK5_90ar}+c0~*7C zB2+xQ8Sj39|5)6H33qhr1Mv?hha`p`z!vf!m*>^_LQl*yEBu9CZJGjlq3M5O#w{qj z4`ET6gbj9utJ34a+G{4cf9@U#yn{Yr?a35WxEO+wD$RpldbnHAHt^faAta7jrgVIC zB~UAFBpf4NW%2Bl_3|l?D*aqAo#N#9KI14!%K$Jf&7@r2!9JNxjf%cwO2hW4P4PGC zCCvU3G$fj>8Z%rh`bXWPl-JSm+{)qIdr2kBGOk@#pX})DHJYr?W*+!(``L%1nG#Xb z-n^$xFd^{2=X1%IsK@$p+-*-^*Yt={9yDu0M5_E4Hagstzzz zm@}ddI4c2x=Dw)>*H-`wwthN_L&bv~bC*KU8jO|_irvi(e9#f+et zDkJgN+NTwney*F5glX7ynwoKYc&Y1f^UqByi>Kkh? zp>Be*YoTvbX}`CV;_cht*?r;55cpeagapXy{a-!@&5O>3{4E(z+w;r`bMGi9@?f)2+UXJ9Vy{9?5F9V5M86 zxJ~Qxt||kpCPt#ye(SM&vpCVW`UG;CLtO7ChqwtDbuJlu zU{?lnW$Gna(-kH<@|47sQNqdPRT4r{6IjvIPHWq``ra8Y=8tLs#0~vsSZKLm+a+4L z?x4hnojd4iLn`N=JoLZMf#0tDrS>J7WrZ!iN^)&+ZG@N&lP*0KmR{W~7hiGhtdu{0 zeuub2bK_`o)AgxD@+7yn(sQ9IwfwbxYx8)mpS(%rD*=omUg6w<5X#KAS{doMcj99E z7d$YVc37>mVzliE*p-7p2f2w~c2vy|)LWz$dCS4ud0}rTGuJ;+XE#tBm>okRP)P}F z=L~bUr+iQ&&?9DYmRyb9cb-!Xcit~E&KoJHryPD!+``js(L9KG?)6V@(fWS*mu5HE zOE#6m=mKZd!p_@;tKU8X1U*%t)q{fI2jIE`d^!&i<;^zm&3T@2?$3MK_p*)_CHA|J zC_Jp~Ce`JFufJx=@ge391n7p{dEaV1=czolUUFpHTL`q|S=gTCq1jXBu_HC}p|3^1 z{}hXW3c^3EG!g_CKK=WY{gz_xyCHYU#n|2dc_f$6BM_)oY@vEyw=j8JA(O7pZ{^RE zTpTPDZu)e&teY@|?+@`9zXn_g zlDawf`U>Hw{bY9{58yHO-3a2LL_HAf?%e%y+a1JnH(8Z5tO+t8pKKD|WrPZ3XHy=IChb z!^YxQywW>x+M&(LH(f+kDc7 z>$qeAb#ThS^!5=0a%+5>Mg3a;V1huP)7ssG77gE>7w0aMSfx4e`qlC15&#Xi0N1)J zhkWaLjb;1^`L~d`0bjWeSQ!C7zb8dXTI_=1Sy;@y%r9x%m|Q2ZqDbQN^oNk3HoAv&}_Pe1Zy_=HSM5fPGt+!B2l`yG-r_J_3LSmFyXdkKIxGht6 z_rbF(z0E7H+V=v+FPz3qeK1{2f@I#qj=!v0UE_+#o?^+)F6>xv=tCf1k$%J-bF=S% z3`W=}suVg`s`Y5>65HMa1RhbOETLKEC#mf@%e{8${#^B2%qDjxnw>tlqq78Wvftvh zzEQ)P^m)yQ*EayT_ImP7sHk=qm9=s5+W^lj<*ToeZuY&#es=P3B~<$fySu}ydfzUa z$YJrYK57tkiCA}-Tgmw^-U`04QdOCj_qVsll`@5r?b*H!Xa!hZzct#mlKM@zJl;|y zSk8HcZRl4m48d-jk{7BbdtN@5PZpV#N<79Fejtscts;p+vFUkqtKgvxPsG zI!achcO5*AoLZ446lcOcVMObEY4Z4|TenV%F@!rabstVQG}9Zz6tr~03aD)=cJDqb z&Cvd^c#LD~${HBzy?%vI)88W<1xYqJpHaW|05rfGJ|SFyk5r~*6L)p?cgSUZWMl{b zZtd=FcwTRr=ZC6Y>zhEH-jd}djO9=%t&;EgyKz`Ebo2U=oo&-`FY9$2h9LasldyUk zJal#w-X){A!3`9i4Yu0H_ngA`+5X*vD=xiP@tk|_dpYmRk**7)2tV?eqQ?aq-`c<; zCBHc#sad`6k;%*vr&bX;r^4R_ntST%dT%;ATWQ2ED%~y-14DOc-T(}RLA*pB2c9zP zT_%qC`KzS*2xW$hY{UJmq3Uu4^uwn!vC45*r}{!BH!eBC&f1hK;1%LNeC6qq4@@07 z$3V&#><*9NF>7;L)5Fa)8lC*5Ihwfpb7h6T&wQP?VmHl6^;*OO&8~yv#VM{mKbu=5 z157aMhmGZ5V!R2FvdhPv(aq}ve?=a`Jk?Qm6Kf+Z!Yk9i7%~nRO;2x|wHIR1x9AZTAU1>e+lBtKYewu)LM< z8JOpF{mZA5Ot1mH1vYcD(=xYatRU;A_>9l6&^#YD`5@)C<_?PQzs>cZst;Th&$}&d zwiKu-psqXL^1R4iS@*P^%J$c%&_wS5zH>3Lc3xb&vE*9Zy31nOM)$j`it~?Uf*6C* z@?9hJAO>|h&&SN`1Xp|evsuzQnytq>{}|)W>ss#`uUYE@;j^7&pSmf>%EgjfBv&v> zY8TGXeNr39Zlsj#`^LR{tJe1y2IB44h5YVsG_ejnGWiX{48WR2=3sOIRRv}dUm?xB z_l>*f{Awa((^W)bLY4=-kQgP|YLo3!!?$08W>);AKo=5;O22)HGEAs^2d7%eawlxu zx;Yzx2ad<+fASE7eP(SS=*vyQx?6d>9jGp+I96>!vAq8*!`+e*Z@0{{RGyGstb3YD z;`ooPH_Bj6q-Yp_C3e?o(DS)?lup0)E#mylUM!nYF6F*|KVPrLcaD*jywi7cyv%+i z*tVQ|N@mc`fN&VVH{XSJgLuH%Td|UHZvqUDEq9y@7dH9PgQj>~v|xic77~Mml<_MF z%f5F?+QnOK;JNHokEg+w#&1jFCB`o)g+_|~6YyGHi|JgP7z~4Gouc@hIKavih|Fin z;Z6H|YP?aJD5>I0(J@l?qi7uD$rf3(s-F1<{QhH$M_zxpuo-qcwO#1n4Rq4pv9G?0 z#_f_I0I7bXT~e~FW@k(Qn$oPj^inldCOkU2eo$KESXhO`M5%?auA9{Vs_NYTncm|# zKGk8(W#eo}hVF|LM;8%tndQ`))xK?&6+@BYL7R#&ONfk9k%(qG(zkMXl#@$}wBx8u zZhdvoqq&S4Ll<nR+(I{v_KLXuNTOCQa=3+#AV zHw+UZ^v%{xHn>?9oj)nba-Er5sDG^rF|LbOE!AjJK)=_~*?F)gYK?QWQXF*2=o-oR zqC_kZixf_^CB?8c5VqTF5lQ%z=EPT?f8{V>@+&Rt**%cT-?FRnLCCJx%m3fJ%x^T& zNKiHf<%Mv^%22y3Mx-NPx(85^fL<&S|vblm~uB8un9{>+F_t=eeWJB7nuq7~AB8Ew@KrrZ# zHZc1{OfrqcQnCg=>GJ`hCfW9|1E39FZyV0GX49Gt#y3X7>ennDy0B4DsVfG2pCWO;o(t{ z3B71X#VoWMtXNu3UAdi-qW*~U1~Gh7&&7mk<^-S=pn}?BQr174So7^e#Mmp|Yu+1C zQ0P9mZ&y>(Isi|Q0~e!?UQhheVhcrWJoI%)?IaJhp_%1XQ7p}fSliXbFnbHPW`usc zE$Q~6DfxwciFc3lItt@10rT#?g*y(G#-U}j07bd_0jV~(!VGX!WTy@lsT_V+5gIKm zbf(oiRRJ^Mufu!q;Iy)>39W6Ra#VM6YU*l8*3o59@^}C?NlYa%OHXZ$x zWYjq&8ER@+1_g^lUbH)|6&}DB)J=ppFL!uf;(j3+Fl~?KcwuC_!Mgxd zuc3@(5vOPR$9?gX`fin8XmA!kRXt=s)ivODSQcvLl?Qsh-T&TI!V&$F#L^ zv_vbuV-tyIv zA$V!BpEG6&{s|}0d(x9`PP~eTA~&9yzq1_yR;us`cRG(k%y?w9%rLQ=Lxu=U;h)`Pq>BB2g(OjlE*!b3qw}L&u-YBe0S7%`R@EvN2VWqB=fc!lG+Z z3C7>NUW0VI;{y{dw(oAp~nr|zDW2K3QXqa)mLo9|a$`BTmeC#PughV@&{tOzCCfHglGs}5wZ0x}4kA$dU z-8K9VE-Py1=84`^yR~Fy0nfLJwX?BZ_r-Se9Qx4=RJvegqMrJ`s@i+~)_m%=n4pk6 zdG0$;gqUd1It7qU()SkOjo8cyO`7KIFY#Wgh;5{{XmD BMZy38 diff --git a/x-pack/test/functional/screenshots/baseline/flights_map.png b/x-pack/test/functional/screenshots/baseline/flights_map.png index 23ece6fb7fa3a05321a67808334492db25250848..320a0940e2461eb8147f4d9009c9992aa5291936 100644 GIT binary patch literal 47234 zcmafb1z1ym`0o@HMN$ML2ZBKxl+-|^L_kT2fkCIV)P^7>5`usr-L)Ytqf}73do+jx zMt5%aY{KtnjKrTJ0-zG^TBe zcb!*{kL6ayqd$y&DqnNy%(?emgQ8j6_?Wlp5F6)*n6HMJ`ik2se1RKh*TFB>3Dy1Z5Np8wb;Q1a3Oo=JXx{``M!>loNL@_tf4_LLc5 zrWq{UGV{R@b;frzey8nyEygy`rlQ3w5S71>cXBmcEH#fY29=S2%NPfO`a5k~`C(40Xl**{+ z%LZzE(`|}?2Wj4eSLvyOGDI5j-14$Ow~^8XGNYN3Ce=^i@SRr!gTgJs*N0-4@E3KX$HtSSn*Q6k|re0-TDR9%>*A(0VDggL(zAI|GS^sQG9y9HLI4ejsJVv!Hv9xUR@=B;2sN zAdH6-t5Py1&#=@3`u<@5pZV{rV`*HlsrgF1*sL12S#!Oc(64e_RFfL+GOxXpc}WS& zNX=q6qwMV-0QUZdhscS!Z`<0`8vSgm z){12Y&R`+s?{b8ZU+#8!YSp8bzz1y|za-{mCD(jbVN3I6ZHvNYi!V?|_^|dD0nIrw zP*?%}2odMD6z}3^@?i!K!XaX7;h4 zWdniGp}Q0M879yjYJp_K1joH;zQt>`cXPBW@vt<8`Xl{VzK3-JpH1>+saDa8hjxZ& zD>`@8 zzuBYLJ&{<&%9{5@F-X7)8Cd-6ao&pi5^Bf>+e5v}te<#VcySi9P=K;2(Pkrmp)hxz z?aL2Q%aEnsF3o{OfyH_o{n&isA>g=rPZ{$LF4z|ylD{Y-FrK){@W+)f9~G;DA@QmCqV2z}EsM2UjtqQ&(E!Yb za7M({A{468L(b8$n4wM>g6%5HiiOgIR8+T?Y0bRn%eg@TN%rwXs*5|mEOjm~cSX&# z=6U{^9(g;cuC2OM@eC&t_=1$(t@DWspk6vALz(3|U$)2Pq)SjMNFOzikBSIG!~R~d~~qb!nTZ!=$Hijm|vMq6SZ{L-&iOxe?@{>>h>uq-PWn`rz$HqoyOeP zXQ>ifT&T=&yiYL?2u3@np$}zGo=5#KR<%ES6 zYBLBL_vXL!8;i@2O~q&;D1r5C{_wIXpG+NVw-kRKoV7a%{SsaN5nMS5uj#CQ`Rezs z4#IT{)3oT?@FBzb2|c0r)Y^nQo9a5c$o^XQE^R9-6*(J~Z|8KE?$=|vqF+xfS5DgL z+>u)iMRW*vyc^Z~mHf(!4+M%Dt+6WbjGgJjK-zjC4?1yc#&^H~t z66nHiy{FRCS`3o7;YsY`iDuE9#AWFl(gj!~ z1m3`z=H9?%+QGjOMLS%lR=u-mzN!SiBZG3*u1V|ysZ@68+&I&`=lE)CzUJn3%ljAs znSy-d=(S`ylHFe5b}uq1KioEum6Wize-^DWgqOq5d73I7EZ_1^fDP$F-CPeK_JlQn zK%@0Wq^t{9r(X|8Cv+XJNogRlt(#K!!!urs^EWwO33=FG5C1AanV&yoITIfpbwi@~ zeQ2nNd*>2ELoXfDQ0Mw+g_(ZrgS1Hgwx}0Z@2Y79zIZ5qsc&qDv9Op^v1Hctf-DG> z)UqON-=Fy90W+#{;BUE%;qv0=%|)HsZM_+A4sjZ(G>>^Cq2Tp{U2H*>v$;+8_gYP3 zG0Q3Aw+#`G7u$ZDDg^q34PD+U1A*0LFTs(+hx2F8fLv}=;_O4%zr9K`j@QZ;Olx0thg!93 z*tqtqK)SaK!&_l*iK_sexlSp21a5LnA2lf#1+`=kgBnZt^<%I131>jo&nN?yl9U4k z%5-m|ELz-|6zVrwy){@z;_nc&Jz}j#Cx{$az(jBy{p;(Tg|LW-$2v(jTT{q+&f+u5 z;;e(n>J@`#&vMUgYao(jI1~KhYDuA;NiWe0jq=0x?k~QaA{EC4c`kRiK z^!u%Gk^{>>^Wy`RaI3U7qFVx4rs;!bQ1)8`)Uq$hQY$M#jo^3eEWXN<_8u|37eaoC zKKmyq5Xjaf%3+@J^sjC?1(L`;x%s^CO9Ifa_(60sOzgkU+*BlGB{Xl*lnsV&NuH(% zzJvF&{``h~}lFHgf3 zCxtTe7r!DCDzr5qJ8z9)HkyD0Bi~w*HSb*EZo~_Y_N@{UP2l1Xv#+uL=o!;*xw14a z{5&p_UyJ#xsnDIyA4gP>R9g{LwbSV`FWP^wfH%+mlocsuP&BZL9@r{0pn$*a|ig@1DN=;&@W-( z)PFrrx(PN*2wd@=dNaQNecg#wFE%E+o|7z+?EZfJMCBw*tZ4USwXzkoFc6zzDiw`M zw|&U)2)Ii|TJQL9Tg}r>XPY_c^-LqfZh85Mwtzt09wSv(*^P~i3Q;J#7lB}V(psS} z!!yJT02tY~ljo+i(cGN;rYGQ3|6Q_$KyGKN1Xv~nv#88L_eTWpjlRPfNvV>7j;K)N z)zjx9A@>(ROc47I=PAedGQ5DFs&yKm{^J6Fn4x_#`yEdYA2VCIQz{h=`%=Dw`#>v}mf0)-;I(&v0Q4d8_oKC=UGRpof zJqvT0UR8dvG`{onK8LiHH4}FkhI4koT6J5pEa>3WD9NtGFFbhra8$9JOm5M-sQg6X zLB3;;fLJnp>btNSQy^^;o#usPi~`1|@!I@ppP*vk1b;N3qK(VU&dyF`jCs6NN;mM| zu5z5aAe-q>4WVdwVrOS(Os<+)Q6Xv&GQF$tBDvE zr0Lo;O~?kEbD7(+K^2m($?=beu`oplrGn9rn&drhSauM6$vx>A(Nh+Mpdgpev4@^g)+Lw`mU--HrC-0>RdeK`iTUl~5}Y!#nr=Ln3v4N@}@BeFjyd!9sbkleLXJDa%k`!j=a`G zL1W^*H|+qQga2(SBjMh;4**K(RFT^9U9<8Zhta2d`+cWKfh-v8z1I|#E~mT%a>6Hq z-!yiCtitvXMK2>}t06~NCYMvs0Ga_D+VB(?&dBx~Eo5G5r*2rC#sqbnTc#|S5^~wj zm41{nY942bIh~L!=A+XE&!zj2E#UK)@RyQunGTgd$(a=!9kgO>2bD??MVfX&^jCgd zJZ&)=^bQD59Mc7gj}S$+qq=c|PypW=Y#`~{{39L?Y}_Al^`GGp+H%SzyDgo>WmJrO zOOs<69BM03+g>nCw;z`e5G3^1{F#<2sCL*c|0tXaKg?KN9s|H0gNQHuZLO*w!)J5T z($e(ffU)x9IpRq<7W`=ah}hO>K_z}OCL6jPWo)=r^+@&c_C${^_l(stD){l}V4ekA zYF@phk>t`aqC1P=P~KkssN5KuGD>?WBSYHazBe68DR(<T|&>cG=2K@4^`Z_~N^) z<^z3plYRRufRtuf>8%tNE5$UIB;YH%vOB_84%-xu9e2bI>iJ-qR$}b>sn)>Ce5XDr zbI<&8^Vz!`z!5&%T*B|Vj20IVQ@5NOC2`xW+pBQ_h%b({rHY|IDEf~W3mAYGQ zGe?Y-79gu!-p;sb5ex}BjA5Cz^9#S};AdlnTM+#2D^g*`H%R(mo4)B2- zHJdGTPj4>Rbtr>cpiNT;_)ykOM3v?!l0$~yQcX|c8a;iR_S2pn_5AQf4y(aCC{=CR*2fI!@pj`vsI^J^2%wP^|){O6>3D?Fxu#wXj_+WNW*y@SIg z$a!i2Ip7uO@Gcq|Hkgr*7^D&>inH_OHltyGQ3S&F$f9?R1hvqxD`R)~fG`;g#L$7Lc+^(Ahr;Nwzix!$LU2((M6YI@-{3U1v;t zcyjggUXApoxw!^m_fA_iDQCl*&GS#W?iox{LkuMM5&_fe`&R~9EEkH~&Z{#v%z?UN z(;6ZsRFBi%s>CZrx>j6%#+B}UH7=`1|R)vQwvC?gCKQkpcV`JlmRS};M zIQvp3Z6sUGni})uZF1_WH%;UtR^OaewgbhLtkut6|2->#NXQ&cl^YO~7%l zDk<4u36oi~7r^hP>K3g}Zz!sX7a0_YlBFyVcUY@*ivxEFKj;GMAM95oi(!nrQn@G9 z6NTHpo^_oGB2=eHfEfJt7pycE;;SZAm|)7i>a}*q9)tE0v+tTVw3$F0Lp#i4s!Cy_ zO7%5vY6UC1QVV4&CW~DWYRyh&fDmMNgt4IY{WL%D<8R0UW$yIX;)Ti5UfIyH>}*|v zvJ-+x`aAflbIj7#nU6?FIlhS6Y2LaLWjA_Pt#pKA%QgTUZ+r<*{nD)gA(vn0Hn)EE zk&sMoj)P&DSzu^--7(V#D$r;siCaB1CyaWbm0HzSerJF$W^sHf^FRqdI7p7LVf1$ zIC()?*+Z=xCWTD*EV63dez)r<+})q~Fc?w9qx@Vh_YCNJW!;{4#?CN8RdIKz*o)C; ze?Oa5hZJ<{ogkFIR)7BzrPOPPkHwoTBnpPm^+xyGVrQ~%XcP$|hEy=#X|FU)5TiKn z68mI@laZ}J*UANiuL2@GPd%Y(kto80zUVZ$MCJ;7U$?^^i33=xTA> zlY4R&G*98VtX)_%q;MC7!Mf6JPgKo$3xQ;t+yMl!9JRwtIqdMcv(6>Mjm02uJWz1R zmn7DvIXDJ2r-2l#SrqrtaSscZhP_T}BN)T8D&i!Km@fR9g)e{?SOu}UHP4?RZ19Kp zQkNh5m|T?SsBbOo_+Sx`c<-kcMhjM$?bx@cP?SqZCukkx%N=c%DhFuyJOvK7O|A99e7y^j^_oUa;LQaYP=vTF)s+h}xku1)(Sawk|t!VH&W6$!F3) z&YBZ|NI35I2@4;`X1FeD$f$ZDu#a+*535!@_L@9$DTsY=NT%PD-Jk`1ilgp}{6XT3 zWBmzy&|5vfL5p^tlor|f6q8@zPG?-YgAG<>tuo3<*(G7S7cM6p8b1g&Fc*4$pva@$M^Qfj`+`D+V*7b1_8EK~918%qt#FyE74~Tx5AlPNC);}B-r9Y{em|0ky zO>{2fN{`*#d*jKi%=GkY0B}`E zb}1Rd1GFhFemebHTw-esu5Od8L^x8!OBNF;3R-WVUKkx=0n)D${(y!TBErJW1YD8} z2uM*#AS$0&on-N1WqH`h{w14<^8V2oOog2oiyOP-npCu`KVVY+UA~=MPsoDH1QK7f z-ei6x9!^Ke2Q)rU2cwzUlqwoIe70_=zyBi$FV!b(HtJR?+lc39>mul88>A$W zZKYT(d4%|CI~wlh0~CeZO48Gm(pRWWyw_-10vpe>7vF;%?aI-5p9~7>zCWV5X@|VL z?jNxi`4hffE$W?zl8FjgJ-_ZBKD@@Yli(spJPiLDB}yR-g6uN6-RgWqvukCX>=qUMc`_J=#E&;AEhMXHB_xOIk< zyxo;-uTG1rZ;21AZ9ZGK+3Q*h%DaiBNMkw84ndhwPsxJ2sCggveZc+k!=jv^l?s4q zBVMVSd%HF!i;yCC-fu;vL(1ihhVX;%_o#}+0yR)l@bq=do?r<5WY5Q3d9FCAuIO2D zfr{^sDs&kBHTMl)4gX?1v^`Xl=|eVh(6jr#zdSU}3@o}ZfEQlO?Az(9byojmwUNZ( z+juuz1v(UCH|jyjLeT(dJfQkLKju$XU14&QT|`O5Mh`pAc#yATwaI2FrE$=KNU>5* zVe;JFR2`@l*G}ah?>h_m_`@LHNly*x$qC6h z*HX-&^$Ntcw(4j`O6PnkSIe6>N}T@ZADm=s&krjc<^6HqLti}C2K%RjxYZJ#rQ82y zklx%Q15A^wQnWBg<%;Mxna&8sK6UqMZ%0$Zrv((P8WL{``2*eBzx z?L*IYbDmSbcQlO&7&KlySzV+L{-B9GOtQpl3LCUKq!0r}biGgjN#x6(35MV^q)Dll z^G+lR8Y%ba(_QZ7+7lFxy?$T44f+a{`ub4+WKh|}@tyfRjrw5Hy1Kd_T2J*PgXqu9 z=K^KxVm1bxWBNV|LgXNL{Qwu-kO8@8KEX6EQy=(n`=s^!u=@R1aOopcyD2Pw=cT_Q zTd@Td-`Vb`OvX`L96MzM-O!tU{cOCNY!WU+N2oOh2z6+9L4AB`fhg;7pRH(QlHAFj z$u?m;k`EY;b%mr+(K}ZoQKb!=nLgA-y{Zn!M*h1CNjcMR}Ko_F`tw$K~uEDD`zXS?$)cVhp%av3gnZ;k{Kh z!_U{wlzCnBYIb51+?#F^5K|ihJj`{KU%!6Y8T4&RRs1-aL&^u%$V*$i5eIJaYh>VJg5|zIFbnjyb8jUu; zC;OS?q&r)@sJ&(6>>G5ko>=^iNs_b5Lfco;u8z!;TiNV=>@Yad3>Q{nntVOgKNpv; z*ag`vj)i|yA4dfVzx-n_vH0yRc|hTVxIih@`y|{lmX@k(kp*l1w@;7u+FX9eK@ZFw zo9eUDU83MHFIijAFQ2k7@g-R=MX-K=o)KT$ef?UOrv2MFY8H2>-bdw!!1kJ%nK41Q z4FQF>8!1spd!h`WV?=~%{NTO7Dej%R=`j}&lkmEo3xyp#BY_)c7m$f~C%v-#Q&-!*JMstgUR{x)m=@*s3s)?AtDKIdkO3)23rgzl0`BwOeMTURWkeM5 zhG~oR(w^u7C`sPRiV&B+;9B5lT!&|>ka-`y#VB3OygR5nAWn# zt_v^ca(T-bc}QsL`+lzGTT+kHua}!j#GP*ZS0C}U!{hRe(i?VTS86W(NhTY#`MGd7 z_Z4VlB`N!ogskB?xY~M0^N`yO89*o-aFuGz9mw>ziQRE7_uF^Sjwe z(P#N8=o%gGPHG4kvNl=u>=TGC|E{DVA(%&GyM66es0l27166Jk&$F6uHiVA$@$Min9ve~`0HCue1;Dw$m+R^TH0{Z)qJY4L z7Xw2>ZN%yyk=Io!P|Pjy;AEz$rJk4$UbW-7&;!7$wQd@DBx`FLWcGD2UvR}H zPp+0fefIV&0ET3o37!>qf{GP!27_V504e=UuvG#n$4Otl3`RrIFV>PAEzHTPn!&J@ zAS!@xm7T2!oEHTJ1@eFg`goITU7J^^f(C|%bAcM{Xhp``Ad`RWFQAi<&o?GH-QBE6 zXdp+CbxF0;C?tQICJ?9rY^_qek|TRslk{0rHkM*28*WFp!cHkd4Y03xLY@8O;=Y_q z@(|4cFrertuLF5%ZyC|7r#)pouZY*G{FBSo_LfBYNVE#ktfFwtfJSl z77vtf)Uh;DOT27|7`C}^Dq)c9-M4^#k)^3l23{+cdk6L`69I)RZw0TOUGF;eQQ6Fk z4F)BzV`SbqAXu9QrhMFbIfItdk|kXPT&zGP?Q1hp@Asyz$@D8;h11dap>L8fn=FEAP0j<%Ad?%EriA; zF%K#ER`upJ&zPzxo(aY;f)6)kdtG6f%znx9M&93O>)CXdEdJY9&HX;810hbRwy(>6 zNca27^&0bOmKRVLyRc4ty}$7CZ>~)vPG2KST3_Wy=wBc6SsGW*s<^^`o}EEKym2%x zcyE9)VcK*e?zQjI4h!x>{M|o2q;(7u4-Vyrw>O(4?Ec^H>k(Dku30^)&k&GeMzLQGV@A|?wL ziz@!4-UaPP-3FIJKCxW~i8m3n6ezO#`Iz;PyI8urx}*wI=9tdDS^ zb6!khbMS%@Wd}IMIN^od+4JUvAqNk5WUcs%jM6+Jr1M%^>GSgt15=lNt;m#Zg96}*mN-S;B7URv zr$Ow6O1Qg*8C25GhM@2a09Jg?r>axRe0ktBr>m>RJNdz+Gt>>O{owFlxVsE+3y4>DRifAQuFJMVljXc4%hn&i-$lB}6`ipAL^Nu5C7${2 zn^g1m8m+AB*HHvybci4DtOevq1VRUZvCQ=EQpjgl2{ZsXybktc{9&BW`u>e1_<@$e z&R^>=@!OezmX+`?WW5MG>vBl|ZZ1`EmxmB}K| zP%_rxN*$Z)tbP-N@yt0XZY2lX*n*T}?~-t^nBr#2Va{L3rsdXVZ*M>6BbztL1WGCK z;z%Qe*g!oXC-C5_vCo{d&)#IwoH(*m=Ecnp8C&Y@G0sxC1yD%=vO>iIw|A$uZr+*A zP1$`}@|&`Wkoz`f)T9UC_1RZDB&theeLoC7zUtf9#!bT`1ZGa!e`+lAxJ$ZHb~D98 znAsC3dbi|$*A}6D^KWcW^TWy&AVPAB3}=_j?al)2r3mTS4ep*leySyimUFfrFZhKi zD7Yr!+Pmp#*TXyRh~N8;Jjy;>|uuN8M(}cbgmv z*%|*pjvw+K`?r%|Xi_yPnPI+ z-MBHA@t15n8Ij@l3&oeqHDtbq5-Jl$V$TF4Utd7MffAud^35Sv`jCf!9|d^I43^UY zp|SG-lfW9le`8`|089*lJl>80j=06U59Tt-(^P~y=sxydz>n-A_RNtamClV%io@jw6(n# zb8G&a!;U{{Exm;h`=K?pGMMhIQq-^;nw*Nd+fhVBvH$v~kxunm_p-9}FM+Z{e+x;t zKkm_F&MdocuWu0T(5IIAZh#rsYH>D^_Lg6Ij!Sz(+< z*SPua8Mydq^Y;{UQlEf^#=SEIQ&6Ja(@;Hc{%aX&&%^lgQCBOUR~}9hLt1 zGU8MovWGjfT)6Zk)w-Vc1)nJ6&5``CiYZ?og-+H!A(-`4*GtU4W#@@?LE^+l<7TN3 zLkD3`vn27|N{3WD?~@(Ky-^}qc45Yej z7+p`t^c~zE<+H%XH$l3q;_7qDbqvcIsA8E}qz4APB&I+4lv{6d$HdZSncPxrr6ROi<<#Uxqa1Y9$rlw{Gv$Wao3SZtk zeGU{H_cZGH)xe+AUw=-&MlPzf!Ufq*GanE~5`Z1NxY`5m6V@>?N%;rt)zukiTZtB& zW-K6%kFpI?0N8@@=m9luN&$7FTUW^Qa&wh|SQ`8G9mWGN*g#oRTbwnVN_sa%9)Oll zt|%22Ux41cwY)@0;D5#flVE0M{^ODSj|UAE^Q_H$*Hk>Ma8wL-0=NJ`EI#VCH7wj= zz6rS?ciM~WwYL(onRe4bv*JBZemW*vKAT3_3x8hor%AzhbWAk8pKNWVmN~-2XY-6! zd^vXwXK~sR03@k^mOuQlsGe50TOj&k)=7LbIzY=|8G&IMZ`BOulP zF6Em~KmfG1&KZDTbhq2nboJq;o1~l}V=JCkS`s1UJbjKMo5)PdpJDH5Wbr~VRR6~%=~k4wCLeYjWLrrW7n@Jw>HZRLa0*qDv&WwyOE4> zJxwt^vcWNt0dpAatteq@D$&*R&4d_gxz16-t9R`|9FPh7@;BcCt(zRbg0m~5IwQ2@yXlfbsl{e0 z8{Qv(01@M)$Z(8@#PeNAml;Q>YsV+p#iEg~chb3j3k+S?180W{f7SaOMd5^>=u)G3KXFhd$s-nE+B>b8JVLf&PA&E^H%gP^>X@amXeV8DC$npi-l`)u(rvi-%kK~1LT90)l`Q$BTgtI)fRvnqs&n zFH_0w{-Txz$`^~hS*ieoC_67N?-zrS3!JFvQ7uM2=Ln0-fTNA@ z%OaF$k$&kwZ|x;7tWeSRV1&lFhWi-Acsx{IKbK)yZVJ@s3I#HAdU|@%b2hfNws*Xf zPV}<%|Eo%x`<`kDbqUY##e7|x-&Q8pt1!b-97R_&Zm%fGbuvB41t_n%_RMjW;3)o> z0EsEFoY3UhUv4v0Lm$^Xh%f|f5|GiJ2mj0Ke6^*z`p#5OrqM-U^KG)XRNr(2hS9R! zv9A)WI=Ef81r))O-ptpLtKmjAQMg9lB<;F8n6A;@=LgNPud@@E?SaM2lQVO}` z0nhh#b$T19;*HZhAb4%*YDo{D9e-8Ng`KzqY?jzftNJvbjRRX#jb0Ep>=4KRfj7$r zYQ1(pus_k#D!|}y8UhAo58L?kl%raMh*dCGbRM0yfk9M{=l1qC05{xKi#{QxG8OFY z>Y=vXixxYwO!Cq=3+s*_xok8ZyDsRE71)TK2MCwl>>s4JWqw7EvMhVH%oAu(*_9gyoA?*qJ)8Jc2ws2>~G~L20?>#tD(u^r39D7 z#l=bO5JruL~ ztyx@%;dQ*&&u*u`<0yZbITgeb`r#?#en?+V(dsj4i#e>F7UASN^Dw;vNAc<#(O za@oxGvq5t)eCZ@zjDXNab|IOB@5)IPRwoK}sV9K;kQ%4_S5K>;rXJHuo5&xeJ+$R< z;jtQb-r)rjs^|bgk~3MvxPI_FHLg8;nv6VO(2#MY(3c- zP?>!FmxK36CPV1_-Mb}PRuARfkOP}t{6a1~%3L?)yEP!orUC#Q08o7|cz0z0pa75{ zv+j9T)ScLS-|&KsjO~&J5i~+iD^0a!I7=d8>@*u8<7jmSYL;%DR5)vQ8`CS2CpDj*ehL)Jbb zu#O1ACy=QD6hNg2vfLl-0wgGX$WgTC$>{?vHk&nX6`*dj-Qb-~Z3Fapww>;u@9e>>x$xk{&4 zJo!8VaNH#4`x#LmL>DHx0MyBv9C}_;`94YGYS~&fFIwJR!CT-z3b=3hT*hwwU}T-) zC8*+;&)GNSk=JM|yR$e#%H+FW{a;b<$oTvLk;T!{*-reL>m`r;A{$;8Cgp2(01suA z)RFaO&bh1^arMwn>IX!#Pp~)7tZkTeG_}92CX{B~`jhVnyuapDq4&RG+}huSfp>{b zE}g76^%dGan`KSuU|CmD1z_g^Q8n;Ym4A~5U*&RIXqIi#HPFpOD;5A!85#VVhlDOa zhAd)69zKEAZGW7hXJWs7$psBumbl%D@C?KS$ z3#`6-MX(D`wX`x45|~9qMCMFyqc9$T{d+HSb7!PjbDI6@GFzu%(p-s z#A}z$%tEK0`Y<_mg6|^fg9~YN63WrWpRRG}BxpXQk)xrNTY4^cPCN2OF3qPKY!9^~ zjpd6}lpkEU$XTmqe%E;dQYVD7Y-#7d=WMQyv_a_ewT~QntbBdO>AbS(;im85!OL5t zH?Aup{zXeyccgvh^ZS73Jf&ke+{?OIKV_&Hg|HO|di89C+yYffKJx9#Tre}iD=DKEcoYL>v{Ie{# z8d_T0+O+iacI!3Mk;oOenSzhcG5&oB_4`O_z^PnU5B5HKstdjX29Fih)JOrHgLxjx zydl1d;=5y&v`uEZ({r8#7YS7l4-a7K_+2be0&Q(=?H?M# zJ8Wd6r_aE%nxbyVMQNzRyuVTGzn)%ScZPfl@Va>Glnd}LTU#~^qM~0IuQbeVN47qa zHe9V)`0FyXDeb%xgQb@|uiBF2yXxm!L0(XJ1ugV zfMLtChccgW&w7t#5{XP;-yI9Q{9v0v*A}na2eX~AM!^xcrnFz-KQx6=3VUlVzk_bx zlextwV`Rj?I@F{ZNgc-t?j)Kt*~6^?t%~+-jV&Ia>q*DOnOL7SEH!T5e^XWlrrR8~L+q|wrm#+NRoe|4 ze@9EweDAx$ukb!@#$)H_u%jk6U~A3`=Or8TUisa7<9@6tQ*SpGT({b^N~}A`9=fgU zOJZ`|sem=y@USq~xzV|hoV0t@c&78sT!iiR7NN;it^YiH5qJ5kkX=;X9V^%sgdBnp8hA_svOXdwVwE zWb|HHOXP2FAGAwTQ_=Wmseh^{Lso}bNNqTeYU5xWKr3t^=m4xT< zT_FA5qB!C0bt?-v|H5|Q3en2STHT)+4lC`$eZjQpl_M^OVkTFjR>y?7sion5yLqGW zB@fb`JnIbw!}Id+W8J%PTVPfBKDO*r8Of!v#3VRoIJeN!g|b~2s_nZUWF*0l_xStm z!@vO_i_Q|I_oJRK4={OLHkC{P?Y2G~v6- zrvFhqWPhM=Z2RZ~>TlJ{CjN^74>V0o8hb*_H%dcyn*-ny!qs?dgwghsdfh6_rxBfz z!=KY0<+gnvl5hfZN|HlUq|Iaro^?vEOiW@`B7ZLtw*nnl#O7f$;f?D!IunZ!A!usZz-?0``l zm}FdvG+i)Lq!aABMX44-+$6h6HnIAIRoLvHl;b2bB{E5@UIy#)H%v-$pdZYG-~ZVEyp7dET^tOV7KA#XCX!{5AA z7oQpIZ%>Tv+x?s%E&4fW&L`(h>r%dvH{N$l2BjB%c<^_B!NE<#%q%**Gn>*z^GuX* z-MpnWXYa74{65iVEjN9Ysc#n0qizkJW@9PG9elBv+aZ&ftAK+?ezu_N6$U~}r>z;y z@JU#w!HY?8s2wo%z~2H)ds}^qj3A30x{i7aw$tM7w8FHDDaNZe>o#EKQaddE-fO^Q z88#i9-(?_g`DVrDjMG_ zv^1GWzAY)~uu(0wJ1N3an*;oRA+~D<*+cLyFF(p*bAO0wQCEA1N|3vC{{hArnnv0@%8UKABjXoIj!P@M%>11pU%hPFTL8D_l1v`0bZF=huXIxgEq@WH=cl_Qz zP9EosHrF<@cU1_a!Y27p8;J#hOC1NFm1-2jS;|sd&BphBfMo=r@Al-0g)wwa4mjnL zfar2>rnH$^%XeIi$8J&;Q_Z6YhDU=qsQb2ao`DqCO}2^J9xqXYoVz)!<9AH%?`0ot zcgh>yhGKK`dAsV!kY5NRwczQmt=33O(*5pe@8{VpeGXIOjaZTp?h&gx1#W&l^{S&Y1<}7r=J1`bXQ}F zXKfN{R%@+7`y6EZCdW*kwkH{)9%(-^{)W>mS<7lkH5G`f@NO5VahK)s6PViL#gE=!`iT5@Kfb zTm@OR@V!uEO>e}r4arpJ8I*;r-2^*tPR*8A9jqi7@IViRpFba}5%U@8dI@tk@Ht=D zk6@yc8#O&k?7;F4!Lm&PUO{q6TF`x5%sm7vSm*7je&5TQ-DAA~@fqo3;Lz~a!=ru1 zYyw}TWL?^TY)H66Tc&0f@ZiNr!2`kqd=)>h4HkMkMquw^kM-}ro=hIG^zY0=2>j`} z$@pj0y|XiRl&T|llv)KNsPiivE%<@e^C`?r*9XuDE9(8c0@cA`EA#BZ#H9RuGl&u? zn&cdT{SNB3{v8(o(GYjwWb6rhl%LOAvTvc=f(t5)gB@2hNE%c-O+p?1jyB;1@U?Xo z(K|_-*mFEv`Zw#3XJrIFQJ|^*bt5ZTHi;ZEe~oc>!d0S#t&hj42miERV!$BcC)GXn zOTg(=%K`u7k(z|I|6`_~h52B#kzt?rtTm(yepM%F(nu@Xq6x<3ue&ngc_uBG)sLwB z-Rja?M|!0j2VA9pJMV2qt1_66HKO_jarLD#6JLx|Z0z+vsqMta!0U&FUgf|I_kWQ8 zA|BA7ER-W&3Tg}H*AWA>W69526$u%f&lqO z&C)(2{!6yysW0&#pzBI!h#?T@6YIZqf}S}2Qz+2?`yt*?0xxu`uRU2Oso3GMhJu;L zpm8N!!fj&~$SJzt!2E!Z(VyayQxY<$zWp!u-Yc%Dt!p2Ry49^Hh$yHu6-A1IfPi!? zfJz5x(iEgfi}YT$ibzN4H3$MyBVB4NbO-?{p+|ubdV~NWq@5XXzu))2J?G~9&Ux33 zC2P$!=N$bRV~%w}e=0ST^}AetO-&rS{c6`7?Cd*7sKU*_9WN2Dy8zna)?rM@xot(d zDb1R>PB6IMV`%x)%FozFFXYFwXT^TLkf(KppKUh8T)YgJZY+{v@&&xWK7=gbMLW`{ zq8%N_3@Rs`)mc(w=Y6MPLCtehy-{rX?Vhy+);wC zsEuu`Y3B(fq+3RJ{Bu|-*~lUz4MCy)yqNduvIK)}RYy*rwkb59_|4{5fHKaoXp-9- z2whc3aGQ8iJKNbVO}|T8`$sFY%e~#1PlATLUq`9cu5r6nu;Xq2d&2Pp}m`4UqCNFQ%SKN_!v8mN|x%4jPo7KZBo`}mU? zJlsMz5qkSiI{WJE?tB`x^0Jh7B}W~-$q1KsNzRm z8Z3M%ziLgdpT3cKr*9va#taTIDZxQ)R2!b6SdKm;yNtRlxfGf_>`|NS=*R) zg*Q;nfLo~IyU6#7fmO#-a_o>VN8gu~DIO>ade;esqURODxM_MZGM>`BhVM21h|_P@ zboeHjvPem+#3m_lnwbh*DlXa5;YZ2|XUZB?-cpN`Vsjh zZ%p^p;gVuXHu66M!6t2tYerq~GRtqb=9M+9$Hu$QT$6CaZjx*D#O>w(2rKM)>qn}D z$I4LU+!*j7r8SV>LO1WftFOPE6=bWmMWMLY?VuzG-(KnK>HaFU9pm})`cHS^2=QyU zEZ1Nf8DCrR(a#k`p5j)SK{7M`<93LbXkjmTvqo&8_APwLu^vLq5mT(Z!cFAa&oPd4d45*IIB0bz|gKhGa0_U{TY2F0auKe zPx!@Imc@xzkT)>EBK@dy!!-kYJ9s=z3C^F+On2s2q~6UU6DYQ#O7EVQ4lNSC;5nX7 z@<46v;V@jZ5eE3dH?FXq-(6r|OcMwuoa*PG?qj!@+%|9yrr505X5+WH!9N6RX-jXM z5Ce;)Zm4{{klp*0dihxmyBgvVqlHqVwTr-DiV9=B zrW8)@q04li=~pGSzrI+h-OpjrA;c@Mrbf{&!^69*$-!fXDA+CZQb;`b$p!0nw9W6h zEE3Yj-zLmF?6e#|r0<26>`skG>Y7KdeB<^2FYgwON zTpoB$t`~7NTefGAs#g~V%a{4!O4Qq$TJrveHKR6}X1>&YDi4l8sy>7=IaEGC69`?K z1pWR)EOjGWuSDu-%`+8iwl5>OThE>cYwY9ENV_Qqo7`SEqmO5iXoU)jxJ7i`VrR26IchtBit3fE;K#^OVXZN5TXs!;6%!{*!%d7L z|EMEQEBX%_2yu$$ zSDw2|&g{|#U^eC))jS-30QXH2BTVj3=j z`_8Uo;XEm!-56ggz0x-u=yyEabexA?>tLO_L37~hmdx_( z+2}{~4JOIDEqvs9Hzv3&G=3kXG!FoUDvEl!_u0{x6AezQAhY*4`=^}J#09D$XBssY z);xGWPL6Jnd7xRAj~+0c^3Z@(&I@^<;_FKmQl1kLP$%+mN2I;4_~?BYV&9&RK%7S? z;(sy1wbZRCipPRp;AWaI%=A%~$t+JxxoPPKh>IC_wpKF? zjLLexE#Bq{%;!(0*;wceDTr#^Y#rr==)9=+ScxMIG5x64ABWzyMTx4zr!phc-k0du zYiF{8R))V{O5jm=5uY2DausUKV+E#%w%{F6>(s==E`i`{`1JQ^!1bppVp9v21$X7X^~|anZ?kO&SHF4Qqe^v z!YQC9elVt|{bb^$4Czanm6}OWfn{-rDE>@Ru!5(PuDj0}0Wj3Wjm129a>r8L=Hfr< zSC!t)CRqE=eF`jg`^l60NQ~j|<}EWFE=_LWaVGOtG;AUgN9l2!d%WIvsvz^Z9W7uj zM75N<72YJi(|H7R9I<680FK&Yl~4WoFU5l%s5m%8Wolyp2Pw`Pdfxuw!_ ziGfmm^ViIUP8(U)EK6C!LBxkl`MXc9lc>YJ7@C2>@)`Aw#qITtMYIG6xUP96+@KYB z1GjO4A!660RzbWd=R6>TY4Ewt1Wq@H*wjA12~YjlP3zA3fDyhg(T7m-4-=w%jk(uG~v@4+|i+%bk)_J;|^?(Ne)vIUXxxRR~4T z1+%13CXQMi;FuXp*##4LP4bpVzH?<{0+O0PJIut6eNEt)`{c|&SI-1hr+4w<7M0}n zms7qJ7+c@PlvK1mAhokOLz|zhS5?SM*H|;l`Q-vlZUtP??EcsAA<9n9;T-sLbr$2%B^q37S8h#-J#qqsnPXN<2I4!dDuSoZA#iD& zb8|oW)N0HGfHVA}Ns(OORI?LhMtfPLoxsaGTx(>q+K_XHzwx(2GqE(d#zHw;ch~|R z>@{vjrOd|ya2Oj5Xemzku?umO=Tc%BYkA8EGtv8&W;qbBp^ux;m|`RWK5T=hqFsJH z1qR{MxJ$rgd~~p!62)(Z_b8#((g3?2$C*V-?nKcMEe5;_o)Q9dTto&_Sp_z?=F9d?uew^X2nr*R4-|Ai2Rh1j7XZ< z_3_iP?}SCjZ|>Ze!ICT8wotYo{Q9rJ!ZwNib9TAr{8&mPv8&hrnCR^X5Xkn&(aItT zySa%HiIN5AJDx^06-ETWe(&H_xTo})IAOTb`G(9Nmn(7AK}YmJTaQ{fT%2|7Gl|2n z;1q@@pJtzE;BWhFS;D>TKJn?wN*3}<5Z1(3$Ho>_h)P+j9`)!pSl>v$!oXWvV~#=~ z_unO3rlf5S8`q$2dw+Z&YdB;#HIe4AH09OH38A5a4#Sg41c!=A^lFC!!Xhq_EdA?e z7gk3(fC-sYZKTGtNN(2;pd=~V`z@dY;1A?ewD7)!x69xjc&|hf{xKbKe z&|sPnu%075XNMLh-A9SuyOQ8=`h1@%sM>2=7=WvLQNCf;$pgieOYEN4{1DPpBB)z9 zkKRH%dQ)K-!8em1rb)JK>C{Ma|JYr({kyi)P?m$`fAHG@JpG|Le~)3K3~EmG&V zp=zWB8>Wkb9yq(8LPDd6x!lvCA@b}RM;c9Q-ar~{1F|%Z|2$MyXY5#K3K7-ux&EyQ z4wUrI5V<9`GV{^<@W`v(qVT1-JIe){>JhP+Z6K?k)LR*T{n12X9#KwG?K1!67C`_f~vXmkozfY9YS2 zv*VZNsMk|-Rc1JZ8b8u0=a6p+aYuBcVmZ;(>;>O3h@%! z&ES-)@Kd_EP{r1wjfq*ZJkjBTG$mJr;2?{QmF7xW@jmxx`6HzJ-&K4(jOR@@g$77M zo40}htXcWBO&A*)RtkHYeoV;gMhG^4FE)WZ(AvW*z}#*~|0j&w^H~1ycdm{^!iM5)cS^b@=q+L<&z=*l)I!<+1WE#|u{3Y1tPnoV+YPHcRjdqBb8m_uhxHOw=bT*xAWY0SxG-Cd%8DhE~nx0^{$RtV(Z?S z4dwB*RXKOJsXCU~sc}q4Nh*`RiNV`VDXtX#-U)txJi@Dd=2mX%-o6X$D=r!1vu-z# z_M^sYBfC}8nQ0xwUd5GWryCnN#}-H~G~e#HDF2|$#*L9Q($*0J(hw2faj4iL<(WQC z+S|jP6(FMTb(Z(ytgA2#ZM|Qf{8OTCHfM;lI;fc2qH9Q+_pN4)vCMrpO0rAmwoyBF z4slFVMP;;LwGJCIDnniNCUnh0^Pvb4WD@tI7r^F$3v9!W1z4v7JtN-8!gS>47-I5< z0(XNK-ICN0^UCvRBYff<*xg?_udVHGj-&;6J}&e~!3Rq^-T&1P z0JHRsOyjGEmq+Hw0W+^?r0*))RfEt2X(~3ms2s4U0X1V@LmC#(4a@45M>E`~B!KG` z01REl)awK8bJ|C_Ek}t1g=hLOzt~&h4LbpG(8~F|3 z;=j|vfHeWv|i z$DjW~@pK+kB0;;3dY-+REzZQwE^g!CT!VSGNui|$R;8&q}0n?|jUI`jONl%>C6Ta1OA zb(Z;+8C7_EGOwvblMufRfLiS~2BPJDH#hA9p%`jg8MKrx&vbLxE0fymE`4v9uRs6a;mL=-Ulo+&8 zw)7y|Y1keeA!BuQ?hZdH)l_oP-uOpvfmibAy6)N^P(C}8vs??&NO|O$i$+L3(KR$} z@@C=}Qv9Q|tK1pMAXL-m>ynb8htOJCdg-B(r_bK}XexY3nCCw?0m&qd6`Ia{kl>g6 zyfx2;>D3NyG8O(HR0eSJzUSP#JPE1t9e3FdD{0utG4r8y!F)=+TrXJ423gf_a%Lc= zeC=6(REzu>G9hjTu|WiZgSyN-Q&Yu?p?Rf`>jnA_zH!2fxSZj!W4E4bx%z1NP3i4D zZiZa8ZQBSXjl*Cl{a8eNSJ%1|VRXo??-%C>_v9igHAl%mU{m(&%{}!E5s>*;$s!j> zb{OPKA|f$-#x74E*Tu-odrevU>};%35Pv3;J z04oAD(8E=$U5HMZ0*`JEMRe|cGVm8oWoT9AZav}Y)jHyk2u-k&0Y&A|-VR(Xg1^cC z^m-z^HCc}TsHc8kH z+sxXv&o+(W^8ny_@W(zKC$Q~5*`@+ks7`ggmr32#oVLm4J3-T%3j>aoOCs7>;VaIW z1E{I8zmM#LoHwa%N3G*cUqAi*pxdiw1td{=rC=CYOKMvZGUHfC&6i4HNQm}``*^WC z)lx0U0a%MbvLUv-y%xk+8;{$X#hMZU(y1)IIq6$i^wD$pB(}b%CB!dPcY~P^$T=UMK$*EnZN*uc3 z3w<9~(!9p$>)ExiFb-E|`fwn7L}PdA)uv$?{2eadXRwZ19F1XLv` z_fsgf{&Pi+b~Y2+Y5aHvYy+MV{0b>S9x$>&+pqKym72f+ca%s@zn}0L_vaP7ZQ<){ zu{ANXApcv(lgDT4^Tm9?cPi*|YZaOo`u*r;$XcqbvuiHVd^>ExcPDS1vK33NdMpcx zKmvR>OmAJkF$HceuW~EeAd?+i6yHLE@W1=*6A&l$UIv{qPJ( z1NpTxvT|7#5+}VDlWrXl($_cb=!ReG`j~EqqaDU!)9swo@tL*ygL)BPJnj@c|w>%Z8tB1Q~C(ldk5z(E7b%ytgUov&$f63RR2Zfia1Y0vH}#Y08Ogk3AcmeL7&N zrGc;=Y|*PwTbkb0RdEQ7%F<6pt?uY)$vC!W_>38r#+}Hn`g42eB!J9hmS)G-H~9GU zho2MIl$bb%?Itxg`M?6!K5Y_0Uk+=U=qnB%fh06?mIaEL zI*r++cEw&A^;+U7?06+l>}eRaAGn3gV9xengc>3IDdN5^TcZo8RB3mw7@0=zn$Ze% zSroI%Lt=bZF7murq)s7n{d*^K2Dq+2fn}S$i9#o zdz}Kp`r`cYfpTk-xTW>C78RN8`EcJLiXbxOSa#JlG7Lc9pZ1%898QCitBnh}yNH3O zKK&WeCGUm*G!aOc2W4p_Lyf;7RR)pl*DT6_q1f3h?uuGqN*84P5^)PiIwbn}x>zl) zSZ%W_pVQOjxwDCh+qk76Qm}oB=Kva_Y+_=PM1=np$-$v#vQR1?lK;DaAH=)aIs&u# zx}w-9IMHz<>z@Ncm78;!ph5y(^;jH|tuQ}YY;D_P)@X)4Lp1aR?v|0n<^9HD48mvc zgEz@vb3C>JYGf<;SI9s9X>uF*nEZ&56|h*YBLAN7MMYuj+m1^kV1dn_UH;dDAa?FL zcSr7qFXoM;tnEY!*1z%q#Gc;lJ1j*)w&FzywA&ZzR^fPD3L7}C@eq=?8w4DmA1u7c zRJ@el2=~(sl=Uof`sXg_e8&h{B<$~D%>1cUHe>YfgsEPT9!}3{l9hB95BV`y09vlv zf2rp@)}am;aaeCw%QB7wf-<%rG{xMSn(6zFgLy)1SB9jXVGPi{J^hxGA42u^L00Z#g3Q-r)esp9TfUcxQ_{t{ z{tSL0jR``rYerfcHhHyckhCsX1_-?V233Y-q{V0PoK3VOIot9FA7g}gQi)U}>wHH{u&e1L@T@ztpZ3t*)TD$h~edBL|SBqW|I8-T{p z9m}JhsarwL!@M%rm9|MDqtA$v5!`Iq=DY08wp@-JGP&vgNQAukv!wpPkeY>QKWkxZ!)@VKeK`q}L7(j5ypr{rd8{V6$z`(g|c0@t;l2zrpP zTJT!_v9reM5;6EBXDNJKS43=Cs(7g)dZOyQQPiV2D)Z?1WEzPn|8^R~M`K)RqoW0r z$+||0ZyiM!GmoQPwx4K(-d=CAL?WH(LbGob4InR7`esrzuSwZQFC+AvazwhDJ(!?)LTFDhpZ|_b1JfFS$Qo|kI{M))WdYuacG!boKiU;p0~5?F>l=e`;g+--NZAH_Oq0Q zbvw5mSMzl2BLf4QQ7BQXZt-0~8rDzv-_nPx1=1FQN-qy56{zDXY#Zi`m{;E^S<2Lp zmeuCyhV1Ur7dO9oC8$jUQtrl*B-*@E+}Z**Rf0BqyJt!uk7c3*tyPE3ntV}6=T8|r+|~8&#i6JFRy919DFp?KQ>l9BWppWAyQ@1LVQj+s zpFy4LkVU=$9?q2(?(2i~$BYY2!QWK=Ks6!Qs@CD+**c@NT1Xu!YjL@WE{pU-p8l7z zN%}T6zBLoJLla(>o|Wc=iY4~hSqa4fC$wq*pErQr*l zyL^&Sb)4jA`A&2AQ3?~vnR2OPKH1T|FTB!iO2vOp*mAt&AY0iPhT9C$c?TjFg**OK zd2dT1-fSzL*>|bjKzyy!V7xq=JGBY3i*J0!~ z+wHzCr-~q(L!0o9Zz`dUiY~5MLGPuwWj(vj;#^?h<4P4HuIdpC!4G*?NsD75P~(d$ za50&jW(`A%_&FmZu9QjQx&EV_kZk8|GRC6U*KR6_K5;$!Yc-2Poj?KQqb#)1+Yf*e z=0HXKAn1$l6n3VruQqxtK1>A@>Si}(xeseTPR|U@FWy6+?X_5FOQjz8&)5A|M?T}6 zElJ%$q%I?TmoOgips{NJd5Jjt8Y8)SwPdAcKIJQQZnn8$s>cOpSs5CiSO!u6FQW~+ z4sn(~Tow>Mwp-YwqgS@Q5>MJmZU6x6j-!FiR+Mk5oSiPnq=wX3ZPeXd)u=R|-os7TM9Y8s{PQ){II3QDIOhQBl$2`lCvE7x;M4 zmFBpKEQStCJwtsy5?ML+X$ruFkg=qpFk)xQkx0-PBM>5^9jc=ahoAUX2na~(gnM-#u|wJqj@en3bUH#4ZQzX56G_~EwWYwbaDu}>;sL6|d-9CAx$MXfTa-lb=|b(FqMbYG&X zRe|C(#l0EyddV>(v1snNYg>NO$rN7~2S+78`z1$f$4cBUeZukxkMGaXnaG5bkcg!+ zI#1?8^~(xmkUn9%Qj*u#xwmnLGMghaitT$=M{4F{obLg*CYhUnvdcVRv#vf zwT3=4G{An!Rhuh7OkLxaGhmmyc$ICJqQb9aDmiR)J)QkF7cz>9BCOi?g-AX7^ z@u8^e`%8QJ|HN@KyLS2i-EkZxczM!0!2mn@`xjXwPaPgH`R3g6$mw#9Q<6z7_j1I- z%UjNMJ4S{dVv}r3N-@qAOET8ARDUDZ7E%8GO|~xU3D!9AV;TxL@^=s$H4m zwd4bKcsopqCoO~^=daYssto7>RLAV!=Rwmr&50q&X z?;p!I2_MvE%GGF`sU4~+zAZUBZww601+^628_tlvYd%o82p%}4!jBXF2c&qn7v2)v z&1)OEa9sMQ$#}i91_pHE7$?+jCfR7Hy+v?njfe|6QC!+z>hY3cJ6IX-KQaPMM%>M} zbu*(EZ@ujdAh}v+xkT`0n)6y?Zpsdu6{xKpV(7Vxm4`w3h%hnTQl6DbF@;MyYG-kq zm9?BOeA;y;bj5094$W?NlQDl*?+{RHYjylMvcGoc#Thz+JNHflypR{>*5m70{!44T z4b?l<9KtB^Q(pLd02Bb6Zdgd;u-=Y2-F-^w;>BKt8ribX^9%bm83zOMuI!HHjgeAh z9&K<-MJ-M8v1uMZuG^6P9-_ZHhCu?r+#yMr1}G|A(#WJ4U$wDf!p^H6rMlrkg#unvT!eVqS*v0%^q%6)z%ZSKY z-{z{ayTc{!_S}p@R>-~6UZfXm?y;Y-bv3IyO*7T^^>c&qHgw0y4VKD&s4{N923V!? zg~qL}s56QisB+RFR&C6rgx{tB{hL^me^PsPwa`oh**mH&-;A=Qjc@776p0cp8^6M= zV3m7P!(4U?xN`Qb&HgQ_t}~O--2qcA-WC0o+PIHpTY+Z);f8;L6BCi|(z+=}Lao#80pA?xhpcS`*W zRF4?0vPeh2IS^xdYBbO3JbI%43{$QtV{@Jy23z_#6q!|hy}1(QycRp|FFIt-Yl;1b z)4x5iw)q4Rqi{icpxSA7=V~!um)ifqV8m<4TFyOb@#HRR(dM!XwC8Fj^0aR(kvA9# zPT}dFO)k*{?Ui!}$nb5xD2dcJ4e*82YCLY7Te2-Soi!el!NbQg zpHeGnWL|f1>zpAs2X#HXv2;|=#;wk5C-pFZ4(uJe+F&BQoYLlGD~%w37tr`!4ehdG zJul+eB53E#fiZ>~6*9^T9}99fqD#xi`75Whe{rwZul9^0%U5b`+pEST*6Ur=`2gdC zOPOh~l9IeO$41Sm5RWHTOHW$+QK+HT);}H03C&*W|H-|4>&ejNG;er%^du0X*DjMH zG}8R|L6e5O6Uw^-WrzAY{#Z74A3BZMrgS?s1{pL`zHPiH#hhep47mEf1>Er0^}s*+ z9Q)hfOEhv+!jY*aNd0`s?yt&B1I>XdgF_rHOn4Q~I(u~UbMKU@zW{+4SJm|cMoZ`L zTFxRPJMmL45!L7wlTVwb`}cu`g6mPr5PFdZujwc>vP1W)5%C&%w)ua&IU(83s#>zX z^|SOjuqY|cwXv4A5vT4%#tJWn?2e(#t-#(jSG_r4tJZ#nPwMnP!nX7Yyddrz0o*0;<8O{Lnj z6~wgTclncXW7TsqbAw<=u({-&N3)a)68G(PUFthk^XXhgRBC_)IZ5P$fM6> z9?r7|q>Ysh;l&kb5@k;cQRy-bGFviMw(=Awa>{k;tQ4El#fd)=X=$4TJxG*UX})*f z*o5N>*Qkuw`1?Q)dl;!l42fj5wk(Y8hQq^g77kHNB9oFqKFe_@HO*xIC5$*qkz`>e zyIANm%?nj?*LU|=Fk`n#eUmn3c0)=fz&*Fwb>qHi+dpAJm4mrSQ4k>G;3_q?ww9Vh z6-PQrab(IFsWoh!&f_UmVX#uj?5rCrlfz=Ji>`ixQGyCiWJuTK8Pi>WvZy~j4>ZIP zl!D}Cnh$BjXZdYyj;%$Y$8t*e))1?vCa=<=^WrvZ$mpFmVo=q6uJxwlxkW{dyApPA zmKo&Uvke+(Ec9^qpe^D&MuJm~=OK54v+3DM!>)i|pWE`^aI{OeMtcvn-_gF&_U7eq zBshY_liBbv`LP3dwh!nWFoGW;+C(g%J>6?X404g zXIbIM75F3RUH~ookDyrTo*=Hk_FXH+I!4%0#so{md z`||E;$@6Ic1tQs)oy=pvMvj`epe1iT{-Ol9E~jF5M>NqHIN`Y2C{R}C0Pxh22i+d4 z;RVf{c+~1FC-G`xrW8VodBjC4z#Fsp!rc0axyUfa+CpRJcLGRm-}zbwlgw39SW0&l=yw=^vO9c7kot8MGNGU>`r(kS?lw>xBeOAN2b~m*xk7}0pC&62K@+y=dHk z5v@o1Y=Sq2aNJaoR&$zDSGeJ4b&OlDkue07T0AqiWFfQ&`Z|PAPAY>kQW1SjIxls{ z5Q{B0NOu|(v*4AsZsoXmpJjrex?FATdY~g)vU>&*Z_BZn27xFC9XStyTunYZz;PGR zOd{#jn>SQ^EOzYbe)Pd^B9ga7^`%gRA5w!q$2v@7um>)>2%6`GP#FG?F*usZiX7F` zzGVvP!kssklfq1+lXQuR;$r^8-*PNDz^8{;7;=NHSpSk}wKzx#kZaD*myz`rMFu|sdm+jY&?I$ybLMoejAs8}g6Xg7EFXs;r{n*F+GyQ7*p*#4`*JJCz*cCoaOh`BXlD{=wLI+<3A4JXE~S z%%zog>=?2b+=Qubtve5#cFjPj1()mZ%(ZpGfYlOmto6{6q3YchN9c{V0eWF% zv=r|NG=^4c?ECY<<*ZYN42AyXs3Qn6oTaw!lvF!Nl{LE|KNj@_VAr6uS`lVSZ_5ZS zJ9;{&xP_&8N?Ub`lPb*Lx`uHy`t67;?ri1fn`;L`!W4835@OYWeVsg0pmc_tBXjZ^ z^SLS4@b(GUU}ws5vitP<(pLB#7R<*Ew%as@M=^^uxuSFqL0_p{n}iZ0_*n34j-~w~ z;&epljT^JmbvVcA+GGSTyxD>mJ>{poT#k~><4!T0$sJ{~&a~iY{~%_bo74CSExVX8 zHu8LA*mbNsTgRzL6VMYjNHP%{s;CF@^_yTT7bB@QP@EA=zS6=r2>8Fx* zVqF~qa`bTaVX3ynWO=sWre9c)2eNo7Ue|%W2#UL{fAa^oiKCPjqL~q#l}}0qf^7 zT~<)YAIf4~k$cGQbGt)n*PL|Oy1(sws#wSNmtjjbExBz$?M8c0!)&lboXTe1i2Zis zXS$`*8)OYv9C33Wbw+pv}neU3JTSgBbXWb7Q)s`vn|wKjG_ zl>$C`ego=aUR4}n6T{2O3mYg~oRQ3~W@v{HLz`0Q#v61&<_V4|9dD>^YicfAqmC?p1y<9 zSLs@RZyv7$pQf#k9(aGb97Ly(z9J;aUN^&cn$MMtoUxje?6SsW7F(rj3Rz*BZTic0 zW~d54RRAY5ZTf3F=S;cXIqQ{MO*7xRyng3ghjEI5(r4R0H_7 z&Xv1(EI%|@)ZGV(aL64Jjm6M&gbuMhszDr%PVYOR1{*jbiXaU9hq&Ohtjk6w+ces4 zf-`nv%r3Qed}Ul>x=NSN3I;vCOE^ZP2d;Y)ikNe!Y`E(|;pFhuO&Oy}V>a-wNZzVP zt9y6YA6Q&Uv!W)7M&n~XM(M{at|zuz1Z+~ayPKlLf)>MdC(Cl~vE2^(;{|6Q|L9`G z%9an~vcBRKjU;C9G;NPn?=@8)xLo9W_#dDzT2!QHe*+U1We!$Hqc-ktnd+%3~nQ7O5W_D4>dwxp0m%{bF*YaiL?w_S%|h z%QM`n&f?m=1UY2}VITr2^d_iP$<&H;d0R-D54HN5)mXyH47G5)9fTB7;i64E#hz48 z4VV;S(E44rMsJhq?sKQU2#W@tXgF5KpA~3(@7NigrWR`+pXY{@jaSk$lXV5EAPMvK z$|ajWoN%z*1%YWBG6Id>oU4Br@em1wsTk6x!gLWQ@!F54RR?+g0TvxheX2>))hog7 z96~DS?%fQMQgOSpbhPldhgFyVjO0s1ArRaRt3Lt@V@gYU?!qk+xAtFv|6#rLRbY>D z?NCK|ip}b{h>zxd#$Uqi9slzy=S#oV?KP&Poo!+PS`8MIdGsc$bMzi_Do?F6wx@~N z_Nb|QF3aJsMieb}fxZ*0p~<^{b&<>S9Sr*XI@YIQqLP|Nli&(T$tl!%&3 z@!eRrJf2!t)3mH$5KKe2%+eD+Upx_~9?Mcj9}(5%S_0 zF!zCBlc%6s+vkIPWW z7*5*u?I?d&(5Bp|W$U|PB%bawz#z0FQ)&fqmx60?gl-XXi6Sj zw5VIvz`*x^|LFPiJtnHVEP$?VNgwd!ZOP&rzBYYVNB&=B{SYwyA+NgYWuKo8jrhl| z!hBaO=~=vCJc@!-nf{MF7Ae@+&KJWE{^<6Rjc1Z#9s^1$@YTAJU<{A01&`RyKe5v* zok+2{I^LGFr4512H##TwcvqS8H$J$TGgfii_Gx-$IXHUX`e_o_gnK$V|0>LkKQgRb z&pvpgg^xuef&&(;ly)xNx(T`!J{bmQ3*7M(+O&sU>fOUUW+z{yy*}gng?nw*8ruHJ zd8{?=xNvUHMK-vmQ&bq;fP;E?>y7EE!pPJC$f-TJK-mI(wI^!Cb-;1jPHFXwl1$0W z$ynccn5XN8iTeyOn1}Unp!f5)SHK75_pqpr^jKTbsA_+6E^muT1u0Im&BXTJwD{=K zt<1AT%8Y;ckk^688y6tX42PT{!^@4Wp5^o{N!O8m+)0buMi~33m$Aj+f|3OsKH`wE zvtM>?AvGGi1U@hNn)kZEs-JzoILsUM z-Lsth+w9!{FaPimB0kbxinPx zCj_>lp{Qn`AbH6$b9tqOk?G@ymD7Line+9<{05eY=vvIpW-$*{Gk;U(!9f~^2<1HI zzV;=he#8ULV*Nl9b4G40<)qe8<*q$|O8J%sh)6R07gK!fH(EZz9V0aECL|`e8jc^2 zau=NtlsYS(J;=8|?)t8B3VG3uRh+uiRB}~+Q5Ry*_aCM5M_&GG#^bpD>*Abe@b-V* zzyAuue}!Q;N&H`706XyC0Pnw+;ZM}`|6gFBAZHLHMgW%LCMk`}DSs~rvRV}tZ@P*i z1Vm8@epeyekM=zO^6dNzSpk$upN+55Gj#>|EwkQpE#Jo41iEK)Dz0*X1fY{hj#zrQ zlL#BPtYI7Y+IHl%8k5Ujla4DRUh@w9Am%BgpMm@i*APkWK23O`(#&-^sdHPE;dWL% zjK`#M8qrrrKU3#i%k633MyfC`&d5G@aT?>Ox_W&jL$Y-%ML=+ zD>U}q-N-)G!a$si#ppiUr8lR4HdsARW|=X%g9*3bJ{Re=lFB4J6U<|&(1yfwqcK6s zpv?V|N`n-{c^rM{ME}dAyT?E*8^k^; zsbyz8fX~JMr<|^diD88a#GbSHMo579wsAlD*?6897Cc`c@@44yZ)`D2us8^+g-?3sFHN&TOfVzpbS zhnv|mi_+8;dXpdZ>F|7~*WBXzJ+m@HQTMvGc@uJJJ{}CJQ-0H9)~yajX{_=Nc*A?O z^T%J2t>xBh!JrK&jO6P(48os~!Awg0;hD~HSd@SB=A(q_7r{by?yTg=x?4{EziV7O zdAEcZ1Ms6DJ$`?t)5tT^k)kn2*!Wu}>fF_@^E(@$%gn9&vTwO|2^O^c2935E zd$4^HmnF;316s$5?R-H$Q0NjL$3Zz;c+^%;;i$Gaz1aQAx5dGN!~H{^R*rVqR=VPw zh;3gF^O{AB{*-V*P`A#AS%J_dG0;t|0~dZC3|XZjZBDQ%~@1%ncc}NJ%@NibZ%lbo%rJrWboadA}lo z>pcqUHZ?K9#dbyOYUktMzTnTOxw$#*Rh};KO(S^CXY)en|H+6Q^K6P%gojFqdd0vi$=58TgBO1Wd?z^w;6Zv*a>aNh!P$ zh}+h!2tktN_#*w8-!E6MZVEsy{fvjKlUNd!sMq}M1=%r~r`B4D%LU#3`vG7p@4c43cF0Ya)p7nL%LTEx_E{cDzCZdV#bxBN&}3D#rk`^xVc=Sz1Ho zn#~u*jxK)V#>5Q7_-A#w zbc(%8Bb%}ARy}u~Db6v4d?SD3IS->%YxX^Rmb77C183s>#!#DrGQ>eK*D*t9>zBU= zYSI|&n9q2{gT%lc4t2u43j)<}KbRi|tRt?1L|B|DMccI)9+*q^OUM~<_(Jhn+B_>3 zY!O(fwlDj1kul{?GjHG!_(0B0+V+g~{G39LBW^v#bbu>XNlC6(4&T^let;ceCjp?d zD-5kfM^81iV}0nskl@KM@%y)}we;Q3Nw`VfX^m37VQtME$gOs_r{lxjxtnelz4=@< zsvY7raHlpYRT)X~!W7Fl4+K4VgMv4j;H%_SMTy!53sn0|kcTB2=N`C9^fZUH^SC#` zQ8)rVa?Fhe0(0a$8e{J zIdgISp#HK@Kz#Tlt5fQFdPCOrjJd*&qGr!sS@K7{!dLe$oun-a@m<`#Ds0B3v%XI! zr4IjJMO_6{6yMukNX=s3N5kkyI z9P&Mo$c4^0j`qGjxey|{?oho;v9bz|(EffksHD$SrmCf7?!XCf3t4)#`5_&|pQbf) zpIp(P0ZGqg0Mi$ZUCj^bGP~KmjdQ)Nia@MHTYGRC1OI1J|5*#Lt0pclch!fCDK&iM5czG<}(oUDUAY?{%Paimz3P+R}3t- zc?%kQsz^FM>?}k)Ed!*Xtwtwu`q-D=p*#67VW65;$gXX(Co$dgl>64EVO`=I3ewH! z4CWiLbsCE5&)moD2NcF~mhl61eugAIy)G|F^Ee{>;zn6K0JzQrV0FGB=m zJbMKn`|iq`ul?l~XzySn*vU*56ZHPNIyjDWQ(adV1&pp4^0Q>(LmNy`d#xvNnn~EZ zrc=U!B<7oC3|b?uzG_kN>-mMiZ)*{AmL5g;ZRF|9dAyz??Fy` zFSlXaI(k-UuWdb*Gjv_%Wx+K>#0c&^1hoL)_4~c)FDxpWfwU1asCA}vm>8B#xv2e# zc9YTR2?PH)-W+vWY9}p;!U9$^nTJJU`5})tOeV|i#u|JZTI|&BOG-*II4$q&MAC`6 z;aQB2kF%7SC|)nc{!ijbXMAOioIXX{g~%%5eKU5lyXItqcE2H)-n9`dkDq>xXdb#x z)}Q`bV5%zSt>2FX)VMynfRl?0Yqgj8XK`r2jNk$hy;K}K(b(y>%7x<*Yk?l^+t&|&<`L0E ze@#1lI3(A@F!Jy+?$OlrG@nmT1vRqaR(9PW1w+86v@`AG*A$?~_Vr*weQyF)Rn?M! z;pHBo*+69$xUuo)Z#)tbu>1G#=W6AFLDPfk7|eqLG$KaYdXA2c3G4Bta*<-&prmhiCacm8Z$I3Oufdf z1w2_0R;#f4X9R+h=uSTSXC&X+G7 zNy*9cTU!J=Iyzw!YEfNDR^Nn815tmP?RZ}5V1KcFi?W|f!KW}y$sC%m@<&kf7c(u` z*H&vA^AW@$;f)C;Sv&#mYg1UD2QX`5T0SDrlO2x1-s*>41Aq`gKkCj;)u+ex*fiPW zbgR86UU)%3(Yggf@fmGbVQFy1>?_}#9I9Y1VYPcIR8-Rf`@-6Vp-D+lUClaiHE z;gK}rn1%Xf*q{f%t3`Umutf5b`_9hJ`{M;9F2{Sp?hQZ3>P|(|3gD}-kM#BAa0ysM z$}Z850kgIse(zDW58515^WwYDWpAYF3P?4}f?c$JCPMw1=7pQ`hKS3K`bviB8j`k# z>Q3ValeN9#wVh*_+xFX^1>=YP!x_ZcDyb1biF*)wH!SaRwEs6`BV(oi%vC9y5^X-A zjF@znlB#=Jso5Y=y9rqH?Ql4me}h9#7q5|nHi8`_OOPxZz8f!T3MMO zQOMzjrx~M<*4Ku=P>mEBej!x?j^7B`>&y`<>P8S99Ss@npPi*=RZVH0`xy`&6B95~ z=V>-u?=9?&ejpo8?GIE@Gi?c__$cg@?ihaG)$cvdj;5yO{OW4R(2y2FRK)wRRwV-;&*YG+5Ag(Zchr37a_yim;?90tpg z2PVE-{!JbkGOqyn?%iolaNnIjo$Xu5NXy{c9vsirJdOMHz1wrF+zikXF-Xa3ciUoH z*7YS`;zPnK41xaDI^sEcUaXQA@%08XRhpjj=jC)Y{hM?>RO81jwxL;FI*UgRzQ!vr zHT(0-L<@AQh+bZEKDm2&a;_InCjfSHbJML`;V@}Pv&k(?jEPY=4^PesP4hIdq5&m| zrUokVXoJCuE6thq(;F7L6-b)aD6ZG7`6+9BE_D&JVFJ{mNbIDfq;LGD;?I5S@R28b z&3T#)i$m*@ptS~`>=PsSs!eWGB3#~27k&4)hW`o)rG*rCVuJ?FD;U=gp7pvwM0=UO z+n7-$?I3skTg)6Cr{@z;SU}sRwMNc($;-uo3^@pWUa5Iz2f)$OwAlGPPi#5$%L#Ca zpg&G$eZN+44QoAX%^v12n^AKs@-^>nv&5w(mEHL*W;V{4sOp5E*Mi#sf~UE*GmwcZt9 z6oiR)Her=ji~u|z7v$)acYn*XOv+m;PebOVJ|V5(<1Kgfv#mi8;PvrA?VU)!%VH;L z0c7BSF5nXwVmgXNkph4aeq8KjNsk{{UEw8*-l<6!%y{zYDa1m*+$X|H^ODq8_?Bjl za&vZ%MNYBEi5X^Z(xZ@KV4NeywOD<{Be)%0rLTQvK2oj`gU*(h9Hd|8L~ie?sH(bb zj1d9)iGS{D*u>GHv%kOR)X2)(_MOxj-Al&n#ly*^IbJRf$+(aZ6lJla6D@~l$l9OT zUo%uz*N1*i$WpiuADvvQTN{FjdwP5}3n>TrMK^_*es+)qJ$7^JXeTf{ZArSaS@U|b zo{{|y6P;7fzl`BLIT1&yf7F1+siHRbr5wE8CAz&a+*EX4x1XAR<*~csOX~TB)@`OZ z@gPi2aomleB{ zMX9*-%Mk#CEG#TIZVcT|tF@afAFF*`(khOB`}Qx(MW7ZqWD+i3;0)uVoLArv>IbC{7f|i-VBo zVw#vQ=Vh%Str5ooU0vLj@dp*-c0hQ1ap|7_Ew{uy^|@|?$sN$#s*wr<$0kN_1T`+G z(tQ^u0TF?Cx;t@{f{t@&oZ?W~n=?(pEnD{5pQ>(#7_LO#_jq18Ywjhl=e z|M}_g`hN)VxWn`SD5qsPTNE+QX9X-Lz(b1>00(p{UOZyg@lnW_>OU4VVEJ{%5shMq zkDa22_qq10H~3v0J{*yI!t6a!u|&K*=Ess^ni*;kV#j`rzMWBZ16xHvla9+*R!8aKy!%Nr|uqEtR#Tu1tT5aIzD|D%UI}Bu5Z()FWnn57LJCl9T`e^~|(~97fPqe*BHC$L|?#YZ8*{ zs^nT~Sr1TeMlmrct&lz9bZ5HQdYJuacXoEoDP984_iT>=V4FO)6_x{y>26w3D0FUl zISAlqCi9I!x|NO$BVUc8R3&~R+o|I+Gnp!@tF4(L zXS`1h#e6Qt3Pk!EBk3$c*qE7^?s9T=7XX=(QqdE};D7WCh2rFMJCe5@FDC=+AjA7y zQ263fJ>tNB_uSZb%S6n_0E8RTiI+%si#}C?8a;q3P4^ZN&hsJYp7{*byRPNjbq%t4 zlULzaZYuWNja1xi=|K$d6tk#BUobT`=mtOB6l@$AAU#}-Q^}LuEXmWYeSle26{S`e zEKsk@tHY+x>p%n`d~|AR6uWl*T_%rgH9-L&>su9o>v822RVK{&PhB5SziPmM@Ad51 zIXdPR2wf!zWT)rmQY*#Fe6}9W|0rSip10*aLv_*o;4k--+gZ|!5J{VLnu>SvDgO4; zGyIRT^R?-YpBoJ`F5xaNIPr4BK#nUF*YTw<=aBkHo}mO!qtf&L2>DGxI7~n3G(RBl zHQ)|0;FeQYC%qxY750WPki^n-?ujlLA0=b5)n6DEe*EA%daI~tNn_Ibp9Y>tv zf5GGRa@PldO!>FB%LBDSsc*P=j!N<#ko~`@tqs@7$*FPQ#Kfer9Sc5&a9ozuOCHbcFf!`gU-vGmb2IW(Z4FP$t-EQs zLG@$Og&K{ZEp;&AAe8cf(*ojRzl|Q4x#Psd!nz4)n%mm$0bvj@GL2D^SE$BD>E!JQ z$iv$0!fF)=Z}S#(hb1_v{8aS_I_stQ)FRrBHC;Ow28v>q&X z6}xUe1@PmB^Z5H`aZI+gw3zJ8{RAkhl#9y)``P-4w`8mfKm4(flj1IGB*0WfAOM70 zQ&nU@R+q+S_g02pLwb9AA(I>UQ8@`Gooe*Uc*K9FOW30_HTafplQJ!Y3Q@!wFuc)X z7knO#Dp&yU3y8HHws||bo*Q+oLopa*I@AmdY)A0k0kb0v=_Xv}HG*uKD_#OvCPb`v z-6GoRXd`o@Dg1tPl(?2kFFye!=H>0Zzc&vLI0l@(f~IMntREm4DfYMxC`Nky^UyQ| zUJTPefhbMo^Ry6SsWj!i@195#bFWg(T=Sme%9JRzy-g0hCGZg;BO{|YyfC1c1?Ep6 zaITu#!bX*p2&9{ynt51%mjyTfesL>(D$(p!Gdr*quIQYlk2^j1^4oTFyA(&K1iJTIo96=Q^rj5Xz{p6O&W9796{d&< zuol7K^ZF=YR!ZwtUWjruxV@`Q$;zG2Yhty%w^!EIc1sgiIdjJr*`Hm~v)Y81P&8aG2JVPY z70}(fnMW($Xa9Q+0%2}P2zd&BnkH@@8v1b3UztG~_zrnc@M2pHg=%kId*ZiOh(xL< z3<^aITS&70)eHS!#Y$L7)!N0f{z=u#fsuv~T~Pu?#_v+lo4K?<&HP>~uFH?eFbW&K zJvu6*pJ#qVe>(#>rd{%9!C9mwfvt)Xq)c|NR+9W!CMDv>xBplLEC+ zM|3%vmxQIspRU|mr^9H(#;Ze(@%%fVF-9KYQQ<(=e6ei0t(Fq@vB6-^ewO8({28Yo z3e}wx4VrJV_|BYtqEmDz^|x2c9TygLBu?4&WlbL3jJ-o`!0z8MVN2FD&Xd%2bI#Yj zV>1w@G)z@?o-3jR_E3KJk1%jqO-$jG8GQ)|ba`nLa`07A-d%QkbmOztVJP235DJwd z&Va#4`N2zDoPaW{<()i}<*&@Qu8jA7{mN7z17;zUy|sfnfKj?>`FJA^^nP>LLN+1$ zUvH~8Hleq%{`P}6*~Tvy#ukQPR8D-bUUdtR*_Wvh6G#f%P$2dePNw}sUP$9~>_moS zV%+Re^#)xNX%`&nJfqUUuH|4_(O>Ok`2z*a4!s=Yx97hqvjhNepv=+~eNXP&iynwU zjT>QARn$A238E80lzXCYd=v?wm*#1*C|3JpuH)1q!e9IXoS}*!uq;YU0+1 literal 104337 zcmYgYbwJbI_nr!ZNcjq)f`kInC?VYvBLqf_M!F=V8w7E$gy3ipkcJJIfOIM<%_PR8 zyGwyF7_r}Y-*T8E=ln>|xWtw^&%YNOru59PDmcP$#JBE6m{ngR#&R?JJ({?$Nuzzt(aTIxC62&2| za$maZR!_yPPm#uK{l1HisT^)~50|YbvR<>-AJ^PJA!!8GS15r0xXnOdrbtUrgZkw24~Y zm(g?c;KS<&#P2da+vuSjO(*4}52xfmF(La4Vns##+4E7WW=nUcXMDnfkAK4}3K_!rO!GW-7y^Ew$^QGzc3qEO(KmdnnYFn~LpKZfdaqD1^l91| zZ`aT8pfA>PYsOTL@<=}RrTuZ9=yBCUZEmNapdfc%v&gNjt>g%*hzoZtPprw}Fi;vz z%g&)oYOya%*JDl%QxKQEn23O;O9c=e91H;=o)>%Up8gTWGwf;rDb5s zqMeCfY>#tG4q8Hc$$qi{fWoeE7b?B~on$v=I_yUKnz(W|5%@G?+w|V6WFC1=$n52Z z2G`4`^uskDkPsa{N$wjYck*cIie0QaH-8olUCeaZ@W;kB@Z=K1{-R#aPvM*sudJgH zukp#|vc!kltNV46g+V(Frr0pFUzvA>5r@{c0QSSorrmDvsfJwF8iqLcCZxp|H0~n% z>6u+@h9;*_b>Z%%nCo}_P~FdrQ^u#WS9e`Z8<$)x>-Mb&+JY72PPeh^o7V*grd9@| z+=j_QmrffoBm5d!dtX=DN^W+FiQJ{9VB3#K@L?q<8qY);v=;Fh9sFD_c>B8LkXGjp zjg>22yz=Yb#hJThy9QZdM-kJ12FPj}0s`hj9W4EIcl=i(aa%KiFG^|Ixx@YpZ%5vLt$CUZ!Qg27Vm$x?`?(eh6H7rP2x1-F`OUYhC@%KB9b=F90{M&$mWRsjcOf>;b{e(aoA(aP5e_B;WKTqRq6>Fl zS-5unWYDv;HBQmc4hY*V)uw#I0$nx?_z*IuEORvS&{x{8UUs-|gAD)nkeZL)a!@gNWI8L+!j2bHbE>D( z$g?iFR4w`J!>pM^_K=CXFzk?vk?+;NL8xrrL(q}@*h-8crZ>hl$HaN2!7$!V123(=5u(I9*2VQ`$~wzqVIwTvuRUj`(jbz`J+KNAjVT zyen5`Fj@GxK216NG`7q&EAE-Bj-Z2;tWJvEx?2g2BMWdM@ok00)F>QWu}XzMl$&}< z6;srJCrowoG<62&8o9%txZAv6htF}7^wnJWqn4kS5X9^Ok}C++sT}wjagpsjj5d8@ zJDNwqd%LgDc!xRxpK0vryx^7w`7S!lFVsy|XQpjux-;iagatVC^91a=nA6w z2^?d&EDk?g&o9l_NJm( z?24_$cw&P?)*;3-jvj~Uf3KaLqEC6J19u2uFPbGiN^lIJJjQi z%b}F6nFD0&&Itz1J1e0@*g)Nt5<7?RZ@&gO(o<=?cV@(d<%^1o&=VPtawP|anCtPf zA)9aGH=?`*2b%rPmaa#3PQE;L4V*nYCIsZLyQV8jb!rCQS|51W9ooPBzi?to^6}%n z%L6T$c#gs@VsYsjR1z}^e*6I;8Qo-!*qxBUw<7c+Wu74{C+){R^WWa4Z(-W^DsDb} zwi?Oej|Z)20rko&e9z`rlG`>(w>}ZK7(Fhz652O0+JD72k!CY>E%;;T)J(B?iMD$} z5%nWr>9|i63}UK1mDeeUOWUqLt&KXKIyd+vKYndgua3{py1F^#Nlv?PX|K~IW!~5 zEKR*+2TF1*e|uJch)ScH#^(r=$bgLt^kIzon+G_8<6Dy>-v!`YN(6aICMsOGD4pUh z-O0a7UqnghL_8pmif%~1OSkULcn~2O4jIp z*I2VH>lVwNeL<^fmhX~yBWk5x(*F!=mzJ91%~`uuIP&x|5VFGT-*RhsvvJ*}MAhE^ z_{YA}_&$4KLE3!oTYqa9;VCd?C1;UdDL$?U^-8b!Wb#R@{nu1!kOE)cGnSK znizE5H@7WQ>=N^s-ejI=-7Oqpd;uNW$Kl#O9j^LB4$5hzK&;>p#hgwjO4 zfR5EX+glTBToSM|e!`Ga(2@9CL=YBk|M95h?}Vk=6$>ZzQ@bL3a*p?bAm?KnptHT3h#<9D^0H<>d-q%9yiKDoF6zpE4)7S^ za}G(K$*JrA+;FtsTJG`?T=Bxmk-A!|hmM6O==<4X}Iru!jQs)~rX7qn!#VEnx z#osnL;I@dQB4^1WnEoLK8n!BQbml62abI!x|XNV!osIz%Cf*` zH2WbcbL7st8|2UUe=`8YK1ZgTXYJ(FK^B8n-8kz$TI;VSYouZd1>5p~5`!psAt+Wo zg$~|Bsn=tknR05BIB8ajdm+{h?N<8fxX7cJYb`SLXQ6ZPmM7)U$(5bjZy7CUOHFey zW-^e2#fR4Oc3wo_J>fQyOdjLXZ?~6ZW!4LVDyv6t#L`v}ZJ>?}Q2GkV0b`N;WK{N? zetKLKalN3IW~(qwATVDS#HR(Uq>yJ<=1zmJiHklAciPDTqnNUH&YFOnsbq;wa4wa* z3<~-8yOa`|L^qtP!w;(0_llBWfN$)Dl4EQ7s`~DuuR5$8xAYMY!sth@D~-ogTaXJe zsceRk6N9H6HX0xpDn`$0AF!?3%HS^K1-wbm<|xgq;iR$5csEWp+D^Z0ySVdqGU$V| zUX6!Of2+NKA6T6m{DCC3Ta=EZ|`HJM@x8s+%c~W$Fpm|Vh z%`Gc#L$4+XT)q*-(%@uhIymQc)EY(~5es|%ZHi9uY)uclbt-KYQmohYf|T!LQg7OPnBHpte!EZy^2DdQLINf>?u2=Ayv!7IO^qB(TsK_2 z%T3dD1J*Z1ua~YGk+uY2XYYpc(N%$Voexzti|FmY@WU zAdAxJN}`+0WPNJD{wQQ8WYr>guq7?jDyF~hRGiZFQxQ55*1ap5IbN5^)GzqlSeoV{ zyKi(mqgcF<_qoZ~3iG5JB7i)FNqM#k*|5iqgY^7{=IKTDel#CyTK#g!GFIZ;1RA=f z-LG?|lSa{cVj#dTEp@fZXnk+XB4_5mfjq@knHp&z|(+( zzxlus^-DV6`0GZi8hu7T%;vQ|v>Zu&j2Oz#9AbJ$_w6cLM0&;Mc}teB5uD^E$({e4 z8J=GxrIg=)b-a%iLdRLnmC9ShrI+3I9+bq<%dOPI29$A;{$Uh{_>|6CAm!NN>XLkg zCO{^(g~BppZdG89T~8F7Z(`Hx>YlY%8@(3n@aX;6LJ0n04(@gK(PGXhB5JkQ&@bw%n1<|@T1R)G>)my}QkJn7@=wADbpR{^28sU6f9 zgT;p?WR~A#5zR@@vCl@SX^P~^-ipQ0j~{A`j1S_13v?E9x!6d$LBiKswF<{wcHS_L z0$<~-x=!R`TlB+qWQdz*WNYqK&(MG1W{GX$NAbhg%UBCx(MrI_zCy2smRDfYh&Sn} zl^@h4%K~J~F5T}gQoJopN~0A%zrE`mMzhrthGqI#A4Kh3B=ib*g87^<-M%*`Xj`jk z_kK^%@~71F(d^gXO3;DU-+AZdiw^-(X=M3Lo8a0?IIhA|SqQs+ixnwDrLkh|BS_Y%Hcxj2MX) zrw|mCoTsRoU))~BSYaarc>2-Q6PQc#-8VV7HLSDO-Y)3a&COy|yY09|V@pbyzqMLr zL;7tN+xCdXzY_xhIvX>h2wu)c{=&eiM9r*69k$s`LIIfZDf(zdwzP=Mh$cl3dgY%b zuUc~J@Wve#UC3d#Gy#e(6;9MD9-JhVrCdI=w!n&MA7EKEFko9Hc@2j+-D? zj@Pv0IH_okAV*>2P`>0RX76l$8Yys%K%$o2M(*i&ZB;^{yWo2%&^eoTs@GJOeGvMt|DANVldiG{JS(}V82ETw0 zMovw^KXn9RNBNg@3S5|JWO@)HuNo zqaIG#4_cg@-rrNw^Ct-;B2K7$>)!O_Ens#j!NmdHQJ`) zR|=?ZYxWXK;d6|gGVSNrS+g z@WP~n4>pe$nf@EuBZ;3Gm0*9+>m}|vr0e%VXo>cI8v2@A4MOzT^xnI^5F_EIEs~|S zDaiEkP@V07pcee5DCGya@o zKd;8j5^qG0w7%)OXTof16U@CCvo?|?j^jq$G@97;u$XMIFRBLDhNukJ_j<>XIn;7R zaJfcwmB-aCi^;(CTQX;ZoxWux4GRYo`-iG5!{x|TU4 zf$7*M5EZC&;hfQ>-c&+mcr8ozlymBMxyf(vz*()1!nS7F@agUUCJWCW=(}~MdOEzb zf<9_!;{EZ9Mgas{_I%iIJn4lP3WbMcWz2R+UD9kx`QGVkVcAfXOt?-eAM^YuNFuO( zJUp-uPhC@Qx>{zf_9XL%EM!@>c~l;62|LKaZ91Qb+-0~MrI_1QD8xpRUig8+;ELho z`eLa}XrrJ}#`v^W0?rrPYl?n+VT{YYdk|mAPMsSH_iXnMD(6l!L!@?09paOG!|rJ{ z@h&y}@d1F`)3Pyx@H4dzFHL(Mc{l&0D5B@yeRMPE+&!*iQxgndEns%dRcJwOZf*yx zAf62!)rBCOg6xK)NMlSbQ5k@O8QgjxDzvoM(73Nx${wj8M2sYHldGnd+*HjoGz#lM zt5fJLBuuElFSC`!cLdpFo>3Nbww{ygrX^L|3bSCCq7ruM!+5lXJ>TpUn(O3Y>u$Wa z=s>J!+{~1W<%Jh)24siXy82|ZDB`m0<1}Y}5^m2p(tMt)9q$G@eH>oXO(pW{Ej{Aa zpl9QobZFD;@qF7Nsr9u&;fH)0F%ybAzfq(G3ZqzyN)5rnTd)xcH-$?|SURuB`0vRq z!_CKET5|7uy>K-*KRgQ^U#o6X>c@&aDiWI|VvF#68!j>`9zKpNb_CkaG5074arPYHP4}Fix#KDoxC13%IA=@fV4OmOM zrh1F#AL!Y-u;BXqcdc}e?_YXir-KihqbR6}Q=~kR`<=$}x~GmET_qTwZV5XyJ*^Sci7<_i^T0=5X$dpkh=Ivwm`m-@P)!-xuC|^$!%n1LlPi$8q_z_QQ()f~@Jl2^JBolj66t~5 zoQ1dP_4H$b%3PkJe|x^w^!uh3GGKrBcKnuU10q$!{>ZD(Zd*t!u5U3n0pd)xy(MAz zB9a()0NhnxDM>>32VLoW0xA4#Lp$V>RFnCb!Rer7ZI2GanAMy=Ch__s@Pj@hbTU#A zs-8@toU5;rY{+AhOPepP|4OZgM&s`0%~8`NO`-0MFAv?SY@tn)i4mkxvmj_h(`2Nr z>+TIj$F`F|m;1ED^YZ+c$4Y@+X?Wsw z3DjhwXP%-$wq~I+Hwg#F_cVPfyiRQ8HSwzkm)DzmjXhWnWK&&Xo1nRV{;;hNg*X(8L& zJR6@BfeH$4x`{~>`rHJsD#!P)fqE_}s{@~4sFqT|Sys!a#|;<*MteGYA?)NCPinM? z(oYBUSSFfcnp+Hg zc&PSJJNu`jG}JQk`uKPwEGG4dX!_H1Li)jB$xojA zIEnySyzq+yt~aB{edeEHh~R8i%`_w}V7PnDL_bJBr#kbulKO759{&D@D>p}BnkSrF zxS`=0(~Qx?JlJRVTjk{CUe9BAczNIc!_8Bj<>GWP$pv@8Xz0cn$y z4YanuLxb0)4|e}}4O9kel%0L~zRx(7_$|pch0aEwFMpn`>!vlxB1Sn%hw4Sno!3JG zpQ#mmah?aBPWtbOix{=ba{Xi|1%_U|`VQeeAi6>xRBHX_%gw?AA9bKb|AgA(?ZEdN zAjB6LgsWq}`P7+h5I$0ZK0e`Fo&>-s>vApTR?T7`Y9+acOyO20*;6izu2^2Wla>eek&6b z_x1^Z1P4=2G1b!*{HSHMn~=DceuuzkA!~?xnyEekmdpKWws0^#ea!fpGP_7`EpIJkrSIlNS_rIdy0ifY zM{dTWMqLR-J`idxY9?KH^7rE>@j&DC^@FDfi-x?3ncwlLl7EJg(r{IlW36*IdTSed zz!Iz@w>wL-HXXEWvEIC5fis=*exbB5sHRNriCxx><9jb6HDj|Kd($V>M~YIP1?TC< z2>l-ynNrDObML@+z$GLs$j@b~ki^w43YKFaPn&2Rs}aVQD&V>f4%_MoJk0gms^96L zY0+Q_TWY8003w&vf+|bzL|fFQjQ5wtlHpM_Yx`?WzLPtIKldNVohWJK)H#iyOii2YooXy6 z_eFgsT==JN5+mxg&JwSC8fgErOp4MNDbdeI#yTu4I=<3CYN*%$m!Is~o&$32?aWcV zfZ5>(=Hs}T%@%CF+*v~C=0oOn*P#8%_|>mb|9<1Vx3of2f_@HzfvnxLRo!bLzJIQ3 zqAUKF>>@w6dT{XjZ`#eEQ0T>}%+o2JgxfY@UG_lV6KSMiI+gTtO^3-TgF5R4J{3QfFtNgSJ}Hx1Oe+rJudS&`&bS3eA*=Y{ zmsSI&f1tKp&08b~T};8=E3WRp{#+3-A0Ij2akA|;_fpdHZm9Q;jNisG$K`}-!PbHW z#!eAthP&}9o^|VUghsM}2iNB9yP?y%t)t6Df!0k{OR8xZMH-F!8nI`UR z_{JBE|4h(yM$56aubYaSa560Cu|Vp{WH8|XocwIs&sCLeUT8fJlk=$I_pty*SGEF$VR^%s=ZhVX zavvtJN6+=H?XKFe4Ccp&JOx#p_;*UNj1c&vB0}FjsL%^7ET2)sPc9eO>BDQDa`suo zFXcjVfgZ1ElnXJ6Ot3@SogXids9N)>M7pMaimu%qAD^o7E%?nA-z8YUaZjzizhi0&%bELUP#oWw7}h!h*quonk-k#z(5;S4Pt= zW)ElQaoJz}NJI71(*E$MkMaJ6=7fovOy*N?n_L(II~=neBT4>P`1|clGsHB48`fGB5(xj2n55E@t{Bir{K~f41Q~_E(J`nKEmRWfvS}rmPgh(FcA=f4j zql&U>BAaeXluH~)Tf{`r3^&4S>c{#T8_S!E3Ujx-ZoZG?zehYO&+kC^{l)o$Ehb8u z3EjaoW7OH&xS&UdaUH!us3zoY6Zf(40ZqY~0C9A2K5_;7BX4-g!Ez|${cpGJ+#vJU zMTFDqgwkgQttXAnb)*O zK{G6f+5?AZDvE?Qzx1C`MzNd>5^by?n?zPzPH@9??$f^9a~@TJ@&R*>zcSF+7eWUt z4Ov8R3?VrTEeHeVr>eUgC;xi@v%5wL=F=kDg26wcM_xVrG7(g_45xw?M zi-!8r6=bO4zpXN}L}iQS`qH)&ID^mHF5EM9a^q{VZ%DNZOU05AlgZD~bM4mo%foxJ zi@%bBd*)#08@bTNRni97*M7QYoyR;F8U``Ucfr$0&ZVbdM2h-j9%E1$uW%Bbo|&xn zqwfA>TPSprU4xTGA^$y`JSuuntuvlQ@Av&qX8Zo0i4^m!Cl)Q>dtNiYtloN^$rr7} z{W~FH%3t16@>5*VZiHQ$pLkmG3^J*e%OxV9@%?44>z+Mr!2j!fJ-fRcQtIlVQ}~xb z6TevZ;_h<_Hb;@WF8cK<$_WrwKNmgT4G2qsUmv~Dh4qBZ@KB)ifi>xWw7+yFH~kE?<<0;KNQD=e#7 zq5H^{X+r0QVojTvl}cN1vBl18=YGl%V)EC7U?$H662Z)?TvLob(?DKQ9Jb)OzO4?V z_+s#*gf`;I51Rl&$(IBI>4RcRDY)4SjYz3GENumY)p{Ol7!bNzyJq8TG!^d~CS}06 zuh$)f$qHmF2gI*N{2ir)WWYz1o)I0#q^v4RUW$O<4F8;~stNQ=e2BaRVK)Z-{y3}K zomj?Ia9gzUZI2@bcXxBv@q1`*f%NsK4TT1l(}Vnrvw76lH9Z@k>63XXxjMfk0WS%p zJ%_4W{}R+#@6`~siuP3eog`i{!;@v=bmEHd)Mtf6_lCS}tuZ6Bq>gK^DUUw4_}n+N+jkb82IT3HXBSyPzk)D*Ewqd%m&1b2j=oO&M5W!}uVpd5tqpMcEBlgRCVa`1wMuebB-}fe&18YO*eL%0jG-Z23NRV z>izZW_J+%oR&`6dqdKksSA*-ag%ka-{NE-hmwTJe_abC6Ka&V?Q$7@tNIEi9ddlUu~a^7SX; zoZ*a-uCA^erCIR75N4YZTOnP7qL5IJ_kt_d-?{srw(>1b*GYdY#vgXy!%AVt+6J{4 z&r582MIBu_Pi%Vb>adlnpM_crGQmI*>hpofWCF@&KHM@Iex+9PvR~{VM=t0YGDqei zu*Eq+dA+b;#1OtY(&#LCVnn8RLFG{k?igyRWt3j-p3oAqbUFKTGUkOV^=tE6TG;i3 zi8|GKa_k7V{Z(*$=5`~L=m3xU1`)>4k-p}!TQ>T!8|jxo5Ehn`Wb8(qAE7xT`Evdn zsB_up^DBsPTceF6iLuy4tpK2IqUVJ;> z-CojP?671dtRTr&=!p4iWX)?9=%i**W6uLJmMKE8<+5tjG0$(mCw&%Ojgl-Fu9mK6?Y9}>@9yH9yZ&WOQZKK=*}?TwM~eXyE7`$Dd#~|KI3X3MXIR9|RPNb+ixTlOtJl zoxuzGoG--0DogyOqBj0d;)d}{QIZ0w>rbIQRr6^HcWg~E~<}u*#H?Dn?{^XE%d(o%sEu7K&;fD zE4b>K*WKMGtZEQVXpwtKl(~vT79u>qqwssRP#@fb4VY3u&`=$_wDt55`27UYd^G|- zeA04|+iugwD@U$N+yil@;AzH&h_80b{Vv>u8>UzC_^U?XQnCg?q>Q$Gk7)J;;*t2E zXPJmrPQUIJi$rkzQY0jo_Vp|=>cjI3)20Z(4&j6Rec~M~$2FJI^9lZJ;ndhvI5gBNWg)%n-|3`Qc6yE* z0^R{(fG?A_-Ryqp>T!y>vl4*rYBfdrvJ$6A18~A;*SZwMg|Hc*iqyPbR(sE2c{{qa z?}0*}zCJ&!hs)U0*qBO=M&a=iZNXiqiXoBKL^pc_vm18XyRf_LhiYte zo{14;^lXa_EI^^m@<#D49?IotqV*pB`j@)$7_kP0Z<^GV13XC+_0_ZU`mP6*@yMM6 zw#)HP_SLw%i@&}qFxz4)&G^p7Z7>Hht&o4I_ena8{dEFdSu^VZ90QZS1-U`_lz60P zS9xyL#0VK1GSY3B=vCphtgiSwg1%IEa{*rb#ky{t3$%b za>-~s;fgnUcZ{bbU7r1{33Lb8ihKhl8I2P2XPYZQvcM+#-=PT zuCn!HDeNcv51x&`J!!PWh1(bn+rHXyvF1|!kDBg%ex#yz4GN``np23D3_bZJYC8G( z=0i7V;V-wp1LAtG-afwPsYw$^^aKHe5EwIc?&aS~x*(XnyV_&*g+GTTh)P|$C<6BC zzA^$AEpqO^{w8mSE|m5{yyD?aVAux8Kn`31D*@_IC}(2#m$It)ZPZ=QC5Z987v4Fl zS`PQ@kL8Mq=?1{WoDJt}j6{0Hl)8O?I`tPX0eL~Wdc}u#VWHUs;04>TuD!5IjG2Xk zym4aE{PB+yqo3C6CU4dI11BeX-W{O_sVa~u=pw+w^>|5=Qn*}? z5IAJ9&aa}(|7=qNIK)UGsPShrGI=bge<0rLBmC!r@P9bDt({<oW&XLz?J2ngv zy5BiLyZGw3O-Wk@a}7AOHte@{(#zo6^1S*aK3y!CcS_U`VRt4${*-8vcuxk~>hPWj zdv_oGg6;P4-bwpJt9J3TsejhEKSj`S5Y$UE`-?2WWdZnqo{RVraBs^C`{=i9M<4Nw z)W0V{n<5QZ^0hRqIA)q>=`+$IBY*>!$!M9GIwV@(68K0QY#V_~@@Si`| z+YWor={O*iIc(k!Z27V}so=H^zWmuzXR|Z?%mg60^KmN!}Sc&qkngwFzKCgV4`tYh4J)_^9Hv9oRId+7fpm-U(+^O{5#KQWVoKQHl>F zNM*DjtPZjmr;z0%ug1>}r4SYzQ09+RTir;&`W=FV>y|kYlmqJj>=U@KIlN zIGYx>F0!ztQ{n>)t4n(f-h{^^I0l}(a@iCmjleZa(GybE&l!nZE8b|f4%SRd@2Pr$ z{Umwt$!C!TdX-0k(3rA3t)bbNgG|@#eM!MrE(aK<*a^0mBHoT(XmKa~13QG)FRl7~ ze>!3Be9HFqeD#F$j9x3B+4Ge-Aw0K5fWj^3r#nSfmScm;ZKopO?6LkU;^ZC=J`tXT z(c(o#q^J~Uc6ez2U!|0d%uIe? zm&v|Cc|(qpO>Ld>1u{N2cLnPE;_XFg{I1A?R85Y=N$K_N{62>X;5`!I!~iLL{`h!M zTMU4h_QM&q2_V)WLWG`v8^3{;Bd95 zzaNYZ(cNo47^f$+y-&AXrOK>&KYx{^MDY{9{#=HzD^L6ShJW*zsS%z9@UlFd7d3y5 z?#($4G8T^h2CJ#LW!~BBy7BaHBKB;bdsKY6VARlXG4ojWT=`FsNDlEL%!X`*#;~O7 z|Gc$4L&b~-V?-M?wlP%dDY|IIg(`g}27~ACu>ucufx5Rm z?NoTm#ZqlL0Z$D)Ks6IW9L63|U+EQp`ZwqP;d0a`2_W~ZbJm*fmL5m0Q!CA^Nf7-; z&`ukMr!6(G5CEa3y?|4mt}fTRP9gK;qc1m`I6}qH0e8xj#E|zG<>6O~xWNTrNr^e_Vzd*29QT{Ls(I2UWG~eT#F5>O7yI#58lG?`DiY$R4|J5iz-EK zLMEMb2{{|`R1G@z0`*3 zdVd1Vst%N;r)FPrrU9b(sDY&va+98<(U}oTM-SLuoAFz(e{M6;U#b+3ea7I_8K5G6Mv^rc z-hYGPP7ka5$Sk3y9EqVXa=P62GWbJz9x`-~Ndf=2{RhS_7~^xc!Vq}>+@Nd@{T zRVUAiw+ynoA4`+8$b?N<_cmwXt)SdXzd72v_GG2I^+`EUcfGQ$vi69f5Y9M8&_tM+ z|9_Qwgmo;m2_#ZjA`NJ9)=CDwdte=Vmq5KBbKv4hyAB1;rh8*T>F~QhEU2Uqd1DNVcyBg#gP&*Rb`hu)hV7bEdZr}eK;Ag+h3;fGNM`PN=;_sfdi56e zJ3mmDK5g;NgNm$8zb=J@%Ya{kh}M1R*|rVK@R8i%74wtcHvP$Qka(!s+~J=S{Di4# zMl%k^zE*^8v#{LTnyJ8_kcH`3VvzWwO9(<6n(&%^{%dp;#lDn@#q_H8^i9*=8pZ$p8&z@{>J%0ZGp^+HRhg#;?lNA#~^soIiZ=; z&xJ>&xs==qXm4QOw`gH+A=VDob+Op($6#m@G+ z8B(J()V~p(H2D|YEq`en3c^&MesCifYI&oK@QWl|2A{w$T{Ms_8|Jvo_~56Au;U5u z6(xM+yO1gL_O{u?1TM2P=cj}0A-r*o$`TQFFc`nS9JZ@H+HC!gE5kb+cmQv;=+)GL zKw#xfvx4no7_SQK(^H9`Y5_K~0fPH!)K?`}wrV=6oRRtl-XlJ6tTgH=gLtH-6R z-}zI9r)3VW^y!%~zi1Hl;foUNPy?l*4V#ITsah}zD#VuX=}SQ%N78(kP6AE` z(IHtDSj%Q0_GBmQGhzaaIZw9KfRFJ!g?XLjZA8E!3jDa6=H>$WN0CFB^7VZaRs zP3LV1h5%=NBk&l};}`!1flDshXtIn#c7C(n69}Rg7}-MbA(@cJ?A+-qwBJEDMbr9s z1TB!buH!q9}w(?QqS60(8zZ7c~1 z@`~4ltA)GqE6E$;t}`wlgGNwg*@K+A4kHeKfll6DBAT8?zE<#v{dq&)#F}NU$=42?*revp&UoRdIFroQ2G1 zP}+@0Y|MYXA(3Py#cLior6$L^ICRS_b=u|>`)OYT-Hi*5cR>IeM)$-b|GEnBka^RQ zJI0}2g8Q9HKUNJXH3sD&oh(j&I5z}0C^CvX621PfKdWu^!p$tc%z20p#k|wlsZ?v6 zgq#FDY7_`No5$i)dJDUK%=jM1?kkN5W?!@J{;WLO7NT0@*^x&H$#L*^KUfLV2?qc? zA<5=VJ#9ueQ2rY})%j}B0oPvz^!NttDQj!nKL<~w{w4g|`88&8)_cCTL#+y%H887*yQ2EBCnKprP+^0ZeL1z229b{pukgNlyk?srh3|$yGAZR}0+|u~#lS!F` z?C%c|mjTa<7W9hOzmAqS6rCg#{0#Kb-<~6@X#@*a=l>hB;>sz!@&y_brp7|<4w#(- zLu$yvJd9>xmm*;wYkR1v0+vlRxc1U16Q+SMxA^n&&(1LN@R1PWAR%_&wW?r);7h|x zUnyt-;kRd8Tzn-|ca|IASX@&m# z2G3}PYXzSid+FIK@^gi|Wwp(}E19g)Q6Hq(gBD4^KvY`sl;A`xOIre%pL<&gAk_!$&y<9K}fRJR~ z<1oFRQLEnpOr#qvcsuqVyX)B(xRitC+;@9+JX+k_(*50@XjQ0b`IqbL~6-HM^c8Wn@I;L2okSoyJHF zhalU~vVCC%A%UBfW`F$9rlg)rM@%Zq31UtMk-z@lDr23~nWa;W;KLWK(O zd#$*E7MAMq>E|+6@cZ$-dws*j_g_*ooT*YBZ7K26Ndp!eFU+ix{gMO1ck520_usf= zhcGh})cYeo+JzZEOCD(G>L8Cvr6)p@HrQiFv zQe^EM!Y1}K*Nk8^682Xp&1*Oee+aSf#h;yap9KFv+Dh(pbiumnLyulAwb){q0f5Q1 zzC2|LmtXChx5dizbMULbUtc3GzpE0S89`aab622zyz9j5&Hcq_A@&7ia!$i~4JEoO z5JkpIkb-8fePanL@n3mo-&t=Jl_6@dA5H(i5j08F4DA#Tkapt2PkU;+>UX`s=7O2? z-|FYJ#8S6#$V-6PXM??|yv;zHYMaSNI}r-%aq+24)Wo1%>@pxkPV#NAtl#(J3NtFt zqa#XQDWO|T#wWIQ>WiSi%M3%zlDT`8hN{B|C)6)S&RgxQP(9<`Leb&tC>{x(p3VRG z014>QEu%38<}n5~6+;c#B#bYZ@M)+}X%Jx$tm6#;NXI>3Q?NKYBdmkFHHw1!Xy1t# zzl(qOTUT~HsuB>0eL)eoIUQCS(RG5uM8EA@d26bP~o*bp>i(~{hhuR3Vi8V#fH-1;W z#UcXl`$%ZUEOMVT{F`Q_^>K(i`=jrtq64G#`@x2$AiI`3h6h!F_?o)zo~$JT**I2d zR4ydFDgS5Wmr(!%pX0@3-Jcm$Q=%eY#-XbYU;MzD{~uRZ0Txx)twF^g4MG|bq(SKp z>CT};X@>3|P^6_xx@+j}P(Zp%x@+iW$a@CA@4x@O`*~ns=IpcgUVE)~l6_#g{Kq!C@Rczhx!)Us0z1^6d}(YlMcsRkIX>D5JEq8Pc+p!|Nh` zwQ<#18S?=ZF#{WVIp3GDNSG150s|xDU23O3{FN9xir!K6653bgQ^q~xbd1GZZMB!4 zHQWGFt39(G{-{W&7Eiq5H)Wu2h=zJp>ofCrEXM9Lt&pU`0UNQvPZQcET?~MwP$z%5 zH|MxK$c11llUPQzbXfU+QvH(|U6esDeR-}v zKKZZfL)KY1sr4oT^z&21RdtHg!a8m6^4jGw*EJDRxVs9x#zq4Z127TUlA@rS)~E_fcCH4ErR}WxxMXPw`mSI@#IIoI0jSEN7t@GLrV7 zgO^v8R-H(*FB$^TjtN*5D+EmFYUPOkBLRQdYFg_lddEq`{8H)X6Gu}M<0BGRt9b#; z&7Tf>RL1RTvU zAA2A-Tc?%T9aROp7n7a|H9h4ro_dA9d2Mgrr63%#E%}8Zf9uo6Fha+b0y-;RtOB5y zvF1!}7=0+~_|59Wd*w>6ljHa>RVl8*#Heh32s8dK`_yT&FWAgp-~uI!M|bPR)`-;z z%CTOr;U()-s6L^({^W#BNg_}TIv2=OrBnUSxNWgF(tcJBloG!`E~%>dt`;V}x1OQv z!3H{4O*LxRlfPXfCddfjX^4+}L&>cftXZQBtO7@c?L1lX?}mjdPf`nJ^>+LU@#;(q8utk#8`R>XD{Fy(Nx#CPH^lF?lW^=f$ zsNyf>wHXpw1j{`N%%f&mk9)CzNqDpTG0?9pHI~J(9M!Cv_ncv1kspZ9t$LWE5VbW5 z+6m>EW&WF1ZB4eyK$5%*Fpr!qO|o=e3o8Hm;1SXyz29e3$1oD^7PHKR+oQ|}J<(46 zNtLXYF2(@^#kvImCAwN<@Z2Iz7_9>Du7U=ViY%4I%$B70-9h-tj~khm(DnEYS{fV9w04BlDnNM z)zosrV@mR-#=&O0-c;BPCf1=PCSf7t#bNy8g{UA$yCr=`UK_zG{;R&gz`vBRqY7?Y zdSA|y#rq`Ae#9{;suQ&KBpVf}mH2xl>nd+~ z)t>93fb#X701bd>%2{}1kvvk*&(p4vkXE0FX(oJ+#^xfzbcJ7ZE$>=7QQTkUt^HOR z*)A{__f0V)74=`b0UsQoYmj{13)DMt*Ehbu4*0c5P`#sD3xrw_*`Ki_a{osIT z3YRQyb%MM-+4m6w#{agIwR)5;N_=Ugik{~zK~H=BEhR?c9mK#R!>_AAPxt=!S|koS zaTEzLHC*f(&4AU|UvFzx|M#Q)ShR3D#lKEG;@t|3e#~$}#pQpmSe&93EEfC+FOZPD zH!_jBy^sElID0q#+%oZYArJb`_(!oGEf2o^*9BC1cx2I}|K4s@7H)?||6i9^d(`}& z%b6Amk>lo!}$A6X$58G7|`t;hbTQMnk`9G7mrt?IR(53lE&Hrz|R*=>w zBl_pO+34vf|GtNWuXBtZKHE(D?LR${4A=ZHg$ALfHqJC3r~dLIaJkhO1`e5qEpXE8 zzuprKMGG%f(Ej&s-m|S>r+@!JLNdt&-0XjvYp8NfD}wp#5^Mh$S}wS0HdKpmjdgPZ z_VvNXTc}D^DR_(#8b0*ESo~gz)OvT=OmwdSJp>tTFFt+eC#jQZxj70`QYNO=qtsrb z^QUW+@TSMznw=6M{zF{E$CD9l?3`zR-b29M=nEaE|A#NVqZGV>n~)9uX?iOaHg}$Q zw$GP)m6}&Vat>0n`LVzz5cS-8a%aJ5vte+O_I<0G-tCZZNMf9WvOdra$-CfhcX^k~ zh^>U9V*!F&MV_i%%?~&5u{;(j^*R~JM2;@VQLW+Yava8t2W+semMP04#uxFo^QUy7 zu&UhkJV@r#8{VcG3--{y`|XhzMMh8}%xTG^JYkZk0PGmN6{1LNR3;$?)iDwGf^Hrf z7_kwd7AOn<9Eau!Mtm$+rPxoq838J#vMNLvk5Zi2Nloi)mh?SO9V> zF3paiFm?3#-NGBh%*m*z1%a2vvVo)^wcYa6t$a0WWPyvm_dk;>A~ z<|77&-3M(Xgt-q}u5;R2WYzv;%I9^_SxZK$UOOr<@$xErSrerZR0Y>x|4si6{4@XP zq-bc6DF4V%jaI&JSP!$3l0&J9I8L~ZbywDd8M?U|#Vz2odkzseNf}KLqBUH4> zSVyXp_BrK~!H74sBrjGocTd_TQ+dd>yi&PeT~F(2A|BIl zH?LK{cjy{ixl+LdvRa~bjiWE}WjWuh;D|Ln-%6L0x_2^dp2#@@+~eH|Uv9&Rj1#>{ z1(V_Xoh{6(<6NHAuK`xSltZmfm7cre)eKwITSisO22~Xw-0YLSOqQhZdx2kMEJSdv zx45L76v(zEBB8;^`|DRv$CD*~REEu>9(jJ)7?*fX|Hv13uZq>Y9X_UT5pBq@Uz0pt zxk{<>2CxbwByArYGT`Na+8SLeP4~u}hWd}%Veeh6=eAoe!dogA$Ah~{Z$Mr%1&?R^ zEU7WXxerLYJXiGwy0vCvS2q>aX+7x@Xw`BjoK%=odqP(Wri|;83gyo=x_Jye+Itn5 zHPZu0Z^QHJ7HI9HJO;V}=4Bgz;Ydg>-?M`;p&sKl@Fy;GX1(vG3NhniNF!GXaiK#5 zAV&zyP*SOZhia`zqbZVaz|lQtduvDWYb2XRnv2_oEcu1A=!ar#-i>Z_uNz(ix+ytS;Q=i?MahOX=mQoQzC~Aa?75$d}4<%y@_{ z;r7^Mz{|l?rv_p6L{Pbe*|6f#Gn&onsawjRUdTln1r0@?yh-NES@!#UT{z1>*PlhJ zOf@!9NQPdxxWeHLmemZ@3T7LF(vjEKO)<|?m#e1`xA#s;|GU`-N98?BHWHEa^YhF~ zyH<(25@o%xZMv<680z_Jb5_K)t4`N(h%tD-hLyxAMUGNP>V9653aneKo|4R!>s96b z80qllon-oFh*jeK<1@SP|L(@4;Es$35O&IUe~d7ms%YAkfA>=RR;&3dFzSd#M>P`L z`HjY#^!sTeh0iE@14FbLj6t=uXV_DsDd4I_#m6(wbsok?Q>GdZ9~d2;j^`Vc(Q31{ zuCd&UPE9Ca=pZ4Htju4TgMYX0MrM`XhHWioQw z?%%MTPNuq30*~NvqXX|g&Zc}<=dixCU_yP}{U$Q2d%<$TJD0G|;V+YL{lg>=d^|w8 z5LD%ttas4xQZ4@Y#R!k*B?{}vlVyeNSF;HB)DPCZ5NZ!ZyFxr~w zaRgHHJb>v-DlOsN$(u}A57#lwB=J)nuF~w@nUza19R<^(6 zDk2mF_i2#XFT8CE$!x0rA-~Vo)LfTIqsE*&PDLaqU&((%s0vzIaBu3=^1IFIkF5so z5Q8Jh3;ku)?VUu5{pTb#GZ^9jtkB_uFr$-^=l+CRIDICmCFv2%B|a!fk$E8D*< zX7XG1T@`-H^OhV439s6`hD{!tcpiwF#4wPqxAWZ3sWzeGJ$l;?LS6;szLQqSSvQp{ zM8%z{{rsdi6-F|#G(WedHzYr<=OT6+L20$g-95Zfxe`?tG+!p3-JDwZplX|jVLZKg z*Gp-V1axvHPOR-gb${o-YS&x*YAG?q?KV(@fG0Z+I?3=(l3TziL#~BId!BzjXmdnJ zG=U>l?=Yj>&0RY3`xqh3}$!@B{fFkGxS4l)hI`1mIeAR_7MY(>?mkXnLwPTBt27@r zB2U(((N0Ed5>>K9!lxbb(|$8Z=d08`M|lMAA*XpWUu@t%Xg+uJ_R@Sp7hyqIH8G}~ zzR;lkv!iuSM^5B>ope;Vt0iy#+nT3xwd5gp>3-6(zOvzKzw3vMAgD}0LKS@xk2?r- z^ZSLd_We6~al9$@GUC*m#NLqT+phv)aQ3DkZeYGHU_t6r>nRdEaC^O|D;_!d=hPURygwVl@TXV zxr=Kz?sKvQa#3vc{K$_4tO`Id0Y|%`x{#mWxbvO@xrn8#N@}sEjI~0P9k103AER4k zxnEAI{`|DC4Pj*HA6hs*+d4j1-8{IpCxAo5p$n(V3=cV;Q~ z!=J}&j!PS*x_tb}W}e__j-ZZ>Gy+##r8E=LZ<`?FBOOmp=YQ~w<=79X*%I+N=rW=I z$X4z&IPLuPL?zv>_Epq_)}p|f3h@~|PY_j(9LOeln)b@Z3upU}Zgp!bksiy|swDA^ zWdf$$g(8i~Aao~69(qJq(gk?HRPXL-aGr*s0e*wCNWN@aiKBCirkm^Pu3D3o0AcnI zxVZe%6#70ji26#FcAmgws=KnLRVdTJzI5i1vZqQk| zzSj_Av*-=>x^51tHs4P9>6h+l&}r7$a0lv!+^C%QG8vUk&9dCDiHxgjjrx)QqLOin!!y1O4*lZ?36xBHk+wSCEG(`EqTN3 zfwc3P{xm?;46u~N5XzT#I$rq@s&s8|(_EVh9cyf4>rMF*M(eai&IUL8`jr;cxV6o# zq*MtRVhNgRmaf8Oh+|+?8R=;Avo7J1V`>==Y8ytb)jo=6xomK?M~VKflDXd;F+SP3 zBM~HEqd>Q}S2XlncFd&*yJ7_~s$lg!L@cUSS~KguZP|>@zy33Q=rpxFkbg6c!$m7V z(G6S4^jq-A?-@iNsfXc2dt8)KbnBOyPDegrT|JEFcDra)-a|$zw_7i1VQmn32J$$v zWrMF>X)8h`lmw@k!7Y%O#v2bd9%iL(lYt+^_oYDPB7jOfP$zAwPEVuyq6lB#lZ zwJKd!`RvQ<&K*t-=*{pIl-nY2T||u5X@>pp0$V`{F(aYj;*#A**UM5|aF+Ml>uRv> zrQ_0duUZ-Cw{&`pmN8(rG#>=)ApizaY6<|>;Yx29kTjGd|JD*E?t+cgID z>qy;hSg|EvSKv+*BX~c7_+GG>m(YRWg}B?UFP!^TOd1Ej6_cbCzncgl;h54!vXONN2163>Ym>Xp;c56pBDluMw-FWlJ+*f5J5NzQP26|avk}+PhA~MPw%#7RoC3kmAc*C>MV@G z7KQ6$dAaYXG63GDkgS=!mWnbyQ|#yN&}PRIytT1gmnqsE6(?pdiD7s@w8P1cZAYhFX_Eaew>Z_73^#%@i zPb6lMHdiGYR>qQ_{2qfP8L1?fG?eqsam=+7H*RqLWHz{51zOy-p&LzcbKNgyIb$QW za6K}*R)M^#^Xv&0Sl1U7+yKtMmX2ZNkqae`XBFj{zf(vKBVqd+)4ZQYx$T^7$gOGi zdfy+0hPiZRoR6SpyV{`Gr%K2IiGaE82y-bs+vP6saUblSnSsj9(Qb8bBtorxUK)4G zpN|QTf~uu{?2#(SM>;IV;Nh%pWcLhWIl*_@SEx>$b9u&X_CHH1?Z6GI3fWaVU+LPy zEs$I%ca}Rq$8#@eA>vdOnX~2ngIG~~A2dR8Wj@@`%-dtY7>G7_Z- z%UgJLdfG?GFj5m*AB*+@VffZu+LI_11IqONI|3H?G&Tk)x2l|HHY0>E=E5(gar>qU z0te^fZaKj{CD0Eh^;*VPG1QFN(=l$0n$<(^QBba=A_1L`{dzT_LL6z;l90qz#8<1T z>(!b+#rW-}XMf3p2vv@(@*xRdUns(aAtMEBBX3@dpF2%%7XmH$ZgUxzuD6~+)Wk`* znwl1ckxu(6NAq*#sr(FWR&i>d(mbSMmA=r9uWHqQNA<%V;=`I4LHv{nZ=9Z?p`ETv zdu`1~HjNeAqm1rtpLBEL1XEK>GLMWzJMoL51mQT&Tpzp(arg{p_H}Ghj#NpPdb4}6 zQAxla;-K{y$+Zn0Lg?txgY7tf6E>xo1f7Zw)Et8*?|l!J7GSvtgV~Tf0${>j@6k^i zw$+Ms9935CYQ=F1a3U!>N_2`w4Fo2AMbV5-%W3oUT~So2OT5WN4G*hnP7gj%((C0Z zH#pHPZQ8=40~FL#uRs^+$iPxF%399GQg#*H$_G{0EMDf5=FHOtcPvl1OG{PuPEO`X z8z{>WIh(`ZNTy@Jwtrn#ZJ|hX&@N3kt)Qbk^-ioV7sq0IeHXL3?iE|F37{CQrx&Ru z5vRgwGyL}sCjvQ-XaIAn%RqmC5^8qJG~Q^5-#>T#gMtR;1r()r)vW3j2J{Hr1_a%l zV@y4`E^#la^?c%RaFtqFBxeL4FD{5A4N>X<$FMpd8@Rb|egp+ysL<75s7U0c7Fg5i zcr@zVeu={}sR4Fr;g|0myI$nAv>2@KE9F)g8XnqMe$=5=KT_*4F&u6J_w$F^^v?8! zF27`(hbUJ_si~Ysyj|1E3YfA*%yd;)wE|#_qzz#25W|G=O-i&0SQPv*lCG?hGNbHI z$(g9gg^oAk2knfn`1N2(qSEWBvdt3}5Ad)<^;1)(-NgxsUGhqRfGWmaX%UHgaRgM< z13F5zqU~W4$2EekQ55H;JS`y`(=pTJ*$l*M{pM0`|Eybrz|giLd?c6VetEuZH$4wy zC-gWV7eb;%;Z zxE1{J#ashzhP&GC^`f$6zPi#Hl`Low(!WZ&nThDOr!2e%*ylHBbNAjZRd$X*HOiA- z$nDqO4ddvSo^tb_m$t%~+9~MDMTBaMkrt=qWKxU0M<{XB(;KH0wV~Iq9WEfbre9_XI8HTw1r_AoBxDC&?mSE;xXIrmRhN%g`^dVpHN}|d8aNJ)0OAENUopm# z=?V!+NlV4PZHrYY#;x-3MP+YkG`TCbG*KyfcQx~{_Ct5BJl$c}3tu)XQzz`2Jl0h+ z;@5oBf77r>ZvbvTuyJ=z9{*-bcrtufZ>H7|OFMUi34+{e#0^%VJj&}|IL2nXWJ$i- zRr5S)u}XMv<#V>jy?r$02*aEF%@(KT`G^f%$l}H12-im72e#K@+I4}hHnRTfk*!y@ zv>M#)49CbW%{K->UHrnlaiVXaXoB#IpM3J#L!gLHD1oVNozkAwbiJQ9v6|v`@ zq;GVHgEZVWaC}m&XkBhH-6S>q=0K>4uRe-o^R%FM<2F~1K^Fd5`f}x^Jl1fE;vRf= zIkV+1J$z;+M_|5k{WXy0nvE7-=`7e0zUdELQZ>3@tP$URgw(%!KMxH6 zr^8zF4XKgPi2eMNMC)9E+sg_zf(r|SxIvU~jx0(_8hD=>N;HE3KyyI;ggd>i`v0Lh zB7$@9sRTWxAltuN=e&bUqvP4!VMAVc>Cw95}vI zIP-pE$*E6@)7EU8fPAF7L$9wmtGHF(P+gsjE|AP^!VQXh5m#nDq0Pe9O{HWvw!=?Ilt$p3fEJ&kJXXrctXf-Jf*!48oow(!%=0h#H09X|y^E!JWk|D{D<7XIM|UE({Gcim1VW!CJrO4^C!AE`a|FDhkwG^ z|09>%8KO8kk$t*Rnar51R`dB;3_VU^_ktcjTGsE><0{ub1>7yCq`3pkM3@X)W3p=k zgbe%Sc!O5~Tya_ZzY9mNGP$`OalIRNcOofi#|i_dKFGY7s4UBfrT@T#NZWgRd;^?e z-m&)mn$5l6W=Bk_B9Ir9eW7n9p-0R1+^6tP7(@?4wogH(wr6nEef#vyu>%lCr|9Ns z3nHq+i*2ApgN;FqbO zp#I^!CTf+H4he~IR!BoE96-Khr+xPSvvBwi3Q9)3Lj7d!AHv9hE0#WF>}jHgw0zdEE0yuwLPC zon)U(zVm7kjiRy`-Z8@B+9k0$1_CSHlKD~r^0shS7Vl9`qR0-rLn_iE25kudf&S$K zeHI{4wYUz1Epe2{WL238ERcZ$kM1m&4b17w!`C>}L$ZO-oPgLWBsj0cYcJoO`!36W zKcUb%cmA#95$)^3>0q_Zo$msbje`%5o*k&wA&2F;#0>y>$`%-bnWQ9lgI(2G7-30X zOo5925DVC2)ggz8){Ce{D7CpsMhgpTebJs{rgpFPoo9Inu71vm0x?-nmt$1R0}fNb$C|shLjHv_hTv4ih=HF5)t)j@t&K-T1|-TLoR=IN@z6P@s0CyH{H1lrZnl+lL_A>7)XP z@KrXIvH4uk+iBZtE|kac+O?FUhRupVx9v6G%dMFZS`ecOpPSlb?yLHIhdPC+#uCOf zz{Wfo{2i6RX5>GQ-z*`7;&}=Sm>EA`;(nL)q}VtsyL)-f$O(N^y|K|St4tqJ!{>c< zzb0lPzaV@QZ1p$iIArreLU!#P-2}!FOYdj7-TS_g0OQHl7ahIE@T`a-ajpM+X^vdA zowxj_go*z>dUi)gPs9(3;F_AouU`$zjBdo2{Xm^3h70-N(Xy}ABqTebGhOGAQA($) z!lS31tCnsSHU>rf2bI?ki}kXAmE}qHDuGAJqs6|%^5$kTPv#4PSsjMxJvnpGM4!r- zlxZ?q`NYWMV|I4j-RDDFWiOZja1(4su{f&HQ}{wI3Wyh5uqaJ;{t?6CZA#OAo1??x zY_Mj-YAGy^C|mEhwUXvEj_CIe@{+W#M~q4$)k8z{yP`ff{ipOYRip z$$FWad++C(MB+A9Gs*6wqhpqTg%O7gY4OX02cD}EauFRo&bJ1$`eoD~7)6o4tXtsV z5Ge^N5mOP^mW$v9-Nm+%zhM>(7R zEaU?;tjJq_ixR*;inqgp54S=_5mCj2mctJ?Vd!?#j?&Tec{E;gB@2*QXpgACNS21@ z*llQ#Tm!#NCOx}W^ZWx^pbCRuBkAXTlC(IIr-kbwl6F*FoTwzOUiR;fcw$OvzqU6T zMMp>F+IRhoD%Bo&koaLOO#k$bv4*N9ziW zOHBnrfX8c60pEQ5u@$Nd|JF0Dz6ETi#dHsHX_}=j-3kNk4hiX~LS3kOUHFvZh(-}E z5LVQ+wdvK5R$9a*U}Us71i-Jio#&*o%RblxYCv z%M3h@Hv8LKaU2zzyP}UlfP?+AzYvA2daj5g%w6VAlBgd9MgJ#`Mso33E+ir#M zM>Nyr*{iXl(?^t48w)J>i;xa(=ZSn2wEob~K|lJnu%}DY{|~KtRGzARr&PDS!bIS{ z!KkrmQ&DwKG#cQB+m(I0z{Y^x`9o4hJ1f!0!Fc0u2U(RC_Fl>MdSB<-%v1+yHvigr zZ52m=N5w^Sgo(-ikB5A(OMj@%=yG4&$OE-bt2?kN80+<$3Inn@_v_ny0?x|7AZ#>N zwoaB3*2&*homHRvKPcOi-5or`iu)`P?STT!+N=Nr0wH%cssf~EPpBTT+|>x8Kf;b9`Po;9Jj z+#SGF9T#Vw(VnkH{R7T}fBJxAPZ!t1!F$S>yg~!7J{6JkV&l%?Gw0iaaFh9n@t*GG zuK9zFjjjC8b(uif@62@Ua4FTxN)wZ4T2&fDC!*DdIH~S(bllELb)BSaJV9DORw#L) zG9HJl>v-qGhv^1Li<1>sx`AST&^fA#M7kiTSW~?UhNGrln>zIZFm8{CgFnCan|gzU z#D!O5pNq?3l@*#e`6FRvwb3`>xR1w;p5~mmFLai2mir@N7#|&}9#C+cb+xq}GF`nC z4dfwucc{CljD7tJ)*3aAnDEVbd0_%O}omPAB_ z*^9f#w7>XC!%|l&L|#Fv&o#S8`pLrrQ#XC#U3RJMy({qM8i!Vah@nu$3gAGlqTPEU z^sql5Us@4p51Nl`yfr6Lf>uE~?agf*t+T0x)MFPvAo~kjdt=YGR&v!J8Y!uy4<(3! zYv=B^^@o1-&>s{hrE%L@0Kd2T4tQNwa^utBDsapLI#r;CZ4sMhcv$mp(TAJQB$T|~ zNhQC*ojOk&zuWE<_0QPFqh#H3?JKXOtc%g%>5&V?5Dfxo4ujN|SIc}+xPq!Lppj}{ zngDStk|DcG>*@1;=lW8ET$*DJUM`U{V`nAEVm;(`;oaP5NzT-VVx`u>oYIfC+zw=3 z#4;GiDzACfsf_zo!P-f{ykKKreQBS+5Q2ZI4H8)x;qxz-LdHJM}Ao9Lc6@TQ*FW7WD+EY`y-2CHU(Zr<0vfb1S2G3n`5 zslV6j-EWo$%mS3EO8IO($Y0m44EzKdw}d8JqwPD zqiw#(sBVs~Q6sj5Sp9&7kXk#Tx6-IO?iUN|g(}XtDub%`n>cRZ-jNaDvpIE8LrtP4 zWJX@kQ%R$QUqHSDGk*JPCBg^+VxeS%Pl19?w)wjf+?pog&{e~lKHkeK(&^j7*QdOt zZ4AeYaJl3FP}xf%KwyIReT#;LMVuU0R$MN5?>XMY3`A1)diU>?jF2#-H& zR#`s(I((xtO@ok9JlS!p@MfiDG9GC7mqa*1mBHD!n?=lmc>sWl=bfvCrhQH%qpi*j`; zK4qgK=#q_o9X5ZL5f4cy)li1a!zvM9?X*aKAIG7^Ak5Ls6f+YVo#3uoWXjcBu;Hw{ z4K#85w7d_qJF4|S#j(3YUzI(yr8&Ynv7J6;XUoq8b+kF`jAA9*H4WJaB!@`Z^i+8h zf?!{s7@jhuJ-kZ$;tadAIwHZRTyuL_2EPBmU!e^oD_WRpz!JU z+32-eZ(H_rkUev087KG(To8DGhM1U-)Y)!<6OYqoD#yY&>^7{M#D1P;l8?(eeSHE< z-ExF8ZZ>G83R%p_njST*;M&mR+cA;r4d5%mB%Ih>F)*i9aRda2qp0Sk$%%*NnZ{WqEadsJ^WG%A3?=Fxu9Cav5=Tp{8QxPg7(S=O9Bn+TDj_*C z!;x}2Mp>>-&+r=D!`QJrC5vL2ICxNPde0!2`M+S}s-NPO7?YLV+Y8FW2=Y_H#wM<( z+%-ag9OI%0ZrgkG3Sl7I*taw^FV8<*d_Eu5@m{6T+yrNTRtTj46ydC}{xCnJ5=b}m zW&@_bqs26OvQCrgQh!4JI)F@BLJy;?kX*ma?J0b_ld$AsYu};Pm@dElHt*$FhFk19 z20(1?t?L$Lay*AP!$uz~k5uTNLA@cs+ZuCNm%*_b1)_tk42d`-#W@R*H!b?2I{fDS zQG;~1DV=O)?uw#*@a<%I?s^X(K`IDA#PZ=X%Mow6xotD#fI?43iH#>!=;J1M5L_8Vb>}V>qP<@|nZ|X|aw+>0prEcK91LkUOEMF{wLbHmlP6pk)ju4z=Z z+RT&_;T%o-Dns~cFyEr%eMP3WQOB|{%+cBr(C?|{C)*{OQ`y0)=ezqKC?x<~#bvk5 z4{GyMgpdt#vYSN)RhjQryMA^w?=3qP^~F9?24bG~F5NL2A`DRz#3G1Y)3o=oO~|%RXTTG z3%+BUcb8w1O@x)?Fo14$IaJQlZ;i$4yWUqGPHi}@?`OkGolCBJqd)MxSadM6wJk@f zJs+e=9ePgLE<#5}t$;T`Rp-bKu#|2GfEmCshA@E{^~`x4E2r-=&4d+lgILy|ozNF) zI~trPiGc%lfZ=3rn;0s^>ohyYYZ6O8x+BGAi1Acu;}uX78}6(@&y0Q^%1VR@B)jdD zpr{wNw?LlDn+5RpfPHb>3Q23DxWulVGf(&U$-Y5w`9mTsMU)S^v`#k zxBI?jb{YoK7rnjGSIKt!Tr&W~f4T|~*+TD`rW?g43@HtIi4zG8$%8|k#;~8A+XzEQ z*&d0b2hcp1Jo|a>N|C=bD@P(Rbt=<@ly~o7gxN{Kwmsj0+Jw_Vb8Fb(5eN~Gf*!3u zbqonr?Y`Qx?>R-5SE!W6OTKiEpIPTp+L4l#QVnwU-sv_&MH}SXFa$8xg*o_ht-Fab zKx?xbm;r1W{8bewvjIF-t5gB|9!$@Z-!FGLZbZyLw~zi5$qw(>FF=B!@`5NZKZ^{ygok1-;xBgprf z@X6vN_&qg`d*aj@P`ql5=DSgXt4;^AH78&=$+NC<3wMwbt#zPkboIVErj<3du|Y=Q z`$C?;B=62d-JJz*{$1srt2?n~PFJt;XR| zB%+#I(+CJB0ChQS;SAIg$ZNfHjYiTq4J(+wY}Sk=4^aA=G04<@XcZ@cTh21R7O2|6 z3ynNU6k)xjrbE3?Sj`o^Kn0R;1mdIb-8o7F8|H=K3TG$gexBK2eJ2!k2crt^IAy7^ z=FfJYxyeE)AWgp(Oj&tFQXJsE4{C3U_i~>Fk`+Mq>mFk%nMg^yd#q|(tH!Pmge~1q zjo7ZN3Z*x+|1`-z+gPb&sQ!V9$1RE|xLy>wRs-S)@5ggj>Y-bf+2hT7lR-`4J0lv$ z#yi7vmXNW=7_0)_%%^b!5A0qA_rGHj5SV)KfU)=hs7fy`5E)F7l9ic=k1^NgHW{U} z?qa`gAvo<>NO-?S0`vg*&l-_&K$1ECxj6t;VbhlF4V&0laGu;v?&b0PeUQ5WKAiQO zw%gPYjYW03JVi!wm9LnpI8{sL2J<*W8?TdE_-6N*I_c^}G(4}(6G(^@^g!mNmw=hm z8h^Gjo?X?(W0L37OlVWm`n^19bT|6F0~KhGqc) zP)-cz(1gmhz2rD`b(c!WxvmAJhG`eSj6h+7=re(eRsV>Z0W+VA{psTf3o`?swW$GB zU<*g5q5Vk(Ui_EZ0<7018H^X3`ymgL!e0VIr~&pOaDruG|5eRa6UQw8uESslt*mM1 zqAa%%={%S2uSdt{u^sw~nowZ?3(fBKOd0eX6pl@HhSP60#1YBaXQ8AaApNg8nEpUnXdLR}E2u}dO_hbRn9d$FBf&8!o){lU*(B?f zeJrSV0!f5Gq5KvB9%#OE2PR>I8fm+CH!^pRCWi5Bbx!-4_{QM_J&ZDlfEoh4foAm! zQFjo^F(0ls{EK${SPrMTC?6G@hCX;a@;0Tiog#UmPOH;+U^oySTsavqG`4uRS?0W_ zc!zu{BLlE!`2E3H;6~vOhYM7<7He&}n?8MsluHVy0KyQ!5w{&&YtbuF>Ksk27)V~r z^f@#WD1v`Sg#bW31ONif=5bs2y>u8kMG{GKxvPHIo}e+laqA%EBy*SfZdlcmtMCQ| z1kD-}3&GaT4Q;%>?h8c)`spAD2DDX!58IRG=U4mNt9|k1mzUI8P7J@}Uz zG<1Jqz}X9$X^`Jww;J)?N7}k@u3Imy`9a~m;ENrr52XzaI-5IO2Ha)#PW?Z)d5k$|A3Uyp zKubL08tA^iA9ho{|HHc-t~NY z4OrYD=r5xUxz`+~X^TOD0RaI)ei+Zm?^}i)#o?iWi@S?p@5lp2bKZ0lYrPDY;YsV( zJO8>Ndk2vf7Lzn9LyBA}L_aC9JlF%^H6XxT11T0@r~6uffB*@u6t6qJy=pK@oMXYz za$n#}4gsXr3>_^8kL%~SmYU073}+ zt5CazfcvPZTX;WzfoO`18i$8Z4^G-U=NjHf%KLv2#@OUh@mKW)cJwe;Uc!~od$net zY-Cty?Sp}W=b44+j~{upc0Iu|Yd7eX(u+;f2lObNbnaR>wO? z9^q^1{N;>pNmb8>-kn}frR^)M zl>81=2q?U8$$I>Vd~2LgqFrCzY3o5J3fia5<&2@rm=5Pf!7kCcyo)seh2(0I!!`^4H|0 z?!ipO+D`>{ave4aO@9rkqY)602Xt^r1oR4uxv|quPI{N9i+pq_@zBn z|AqVUyXAe?Hw^EePtnjQj86DfClkvMaQL}ioedSMNRAstqQXyhgZlz(SZ^)kv{&4) zNYP}?30Zj|jUu)bFKJ>KY6E2p_S%NKiF`U6(li=qheih*-Xy2QhTs|e7Cs-w8PhpM zD{OG4QJw$RDSzP7<2;nFiXqFS`%OZtfg&v3p*)EwX?$FChKD1~z&vwA^CLtcD6EB4 zI8i)IMe_+D5itVyoTFG*W4q?*!q|*qFU^OJzwuR$kLc6q?6?i>c=V^3L7nlLB{qip z%BH3Pr5-v|Cj<&w-Jn;VjLf_!;*jIcR4Uz!kz-|3y1FOAI><7KtY6JC9}g8M;e*}W z!UH-aurP!h7Yy3n_ynE6v^!!UANwh#T>>1rj`i1N+UM)P7>i?4Q{3KsY5O!?&j2gb z)hWEX<2)gX5>N7TCl&A09zk_`oPaVAM?tlubG4o~l*SLUR>yeysH5k~8kx{bv~|76 zbZr+y*kt2nr*dp=)H~#Od>hSriScaUpgV`Pj~kCuYoqWJP~1mAP}iOkBJf4UDw+T6 zWt3m4Q1BV(U5PKH&NqbQ6UZR3|!SL{S^6IaU|Z?ti{?+q$3Z%nNMyIe2E4b%kGVZB(qKw}Xyy@pe)tU` zqQvp&n+t32=bLZ8@ljo6DuFUzcAhl9`YP!or@#70jb3X;5fk*%b80S;^h3tr2bDtb z_xOd$Z;Spy?`;bo$DJ0W(2wS#9`-@OA zH+Ey0>_2321AbMNjcrnmKFIS8!P^)$m90SeYEIop%${rAn;w*lo2Xd#*ETpUfZN z^S#hnS&{DV32M}S&n8;Xi7XJI;MG3}5Rnq=J6*l~ z!BLI{JyAjLv+KHSUBJ2ZicOn*8Pjr}N2G+I>0TqoL=48^v8r>xO)6Qfns_DW@e_0~ zcNc@alN72|wWIhhPD&oH99K)+LQ|+{s@#)w^SnT~`E;gK$a1ncc~p;$>5RdS_RVu; z6ZW6WF}rKpTa)I?rOGbX6fchj20qTvZKN4l6-PHN|9B02N#&P48XA-V!X4X33So^C~j42 zvHeZ(+%*!?7X|P1C>`6~{ztrSM93x$7y&oY?>fOPa?5>=ip~CL~u74ss4f@?aC5wcV{;)oCAk6;rYSxdNlW~lb;ngmPOO-WNyhsLc8s|Oq z&X(x5pENEdOn9_9W(`+ONBA2~L%sf{iW;Y8aR=I+XP=~3wu<~z=S z9y@-D#`m;X_yJfm)oZS@%Gw^1^*P7TQaO*s!nnb|~#}qZP`^MAiAh?6hdUE0!M7ch?17F%P1e z%d|+X+ZEZ>F2f(qr6@>b@Uai3s78R|7fg2zNrJUjn>h0(^J=^~eBw?dB%*?PrbCcd z>eJhBQV=LB?w)ScwCe&d^k5fy?8NgmyP^Ig#Y^(5pO)&?)&(a7^fNW0Cu_Z~x?0tX z?`E$!e~pN>93UGpx07-`_1|v+j1pgy`D!-ikHXP4RH;G^S=VaGff6~lP$ zeAoQ{79n8K>d$&N}b%Y8;_C`)QB`@nUbFaf+m%@B^_`$cfxG-zY z%;;-JNP_<&pL_VR?=fKzcw#L0X_(B|wb-Lm{p;h}A*v%@4f6 z=C;EHy-&wwy1va+JQT0XTCTq>R);)aHT4m6M|(7_MV6;Z`OV4P=bI%VnWRkDIb`Fp z>IKBiywbc>nk4LCT>a*lSVr^DPKn;Cp>ST#J

tW{cr9P541Z$F4eV1b7CDTt6Q_ zMJ&}!pugTPRkcRV3}bYiy;0R>&xg)! zyx`avYE1qRhxcC-x!-!EJ+aFmKl(oIslcGF!rID&*4v5yXhW{iPgp0|D*>&1$KvVO zI7l^2P=`3Ouu$6oFoX3ET;j+(rQ9!&a5Pz?)XYS4ER6ySYdL*W!jy5Jjg4Ileh0K! z^j|lQwqjX-^u?>>$0lmyg|`M*HG%o|E^C5yf?k)^hsUZ6(VG4_ zz{9bly4QMl_kX8~how7y(wf=~w$E%y{kB>5aH(FOhMUj*kw5;z$H8WTZ+C8iOd})T z6m?8E8T5jRg{&1az2qO&IEel#**^YWXOYOG%FyH!z1sIuK-#RvsEFh8d;Zm62?}|H zlpcRCMP!R=+I8?`(I-}Owd{Z|hT%E6LUXNxq2oBou`xzlJWoW(kPMkYY7tD5ZrtCd zr=g5K|D~n-xDT(;9QL--V9aUx*^jk&+U(pfm}C0#Gnt0X^F{?)1_A^9{K{TDB99m` z|6p4X#>rIjvO_|0pnd-;_4D-Cbrkt%$rmGaDCprK1B0p9Thez@K95^(cF_#=_;ntr@Y#d+OB(cjbKXzVXS?!)<((Cv~y zG&m|2l}(4(HBQZt8^$*-J$8lb_!Ibq4;Vwc> z@kT|JNLy2&bsAQ2m$7KgRakxf`v0f!Uyg){2M|AGu0v@Aa|6k5Ap1&?quyd#Zeig*8(3-aIcn>JIh4oU} zI0btf%+Ht#>d5VN%R zE-M`+H#(H~m-pI-E>^I$L@semPs4U(nNRivw0bY?eH%MTZGTBe|NLnP{=o{%&PF;$ z|JH&_9DtTxRs|}${qnAD5(-7WyGY8m$dCoT0Gj>xw_#W&H|E0x{I&n~k^aJ7e1#d! zm_e?hzV_y|buOC+vdBeFo>Ud}!=!>T(eq=Hkx);W{}tKvoT!|I=I=<_oIlCmChM!^ zfo)&BISmYR#8%c3??ije>d99i2X^(NiGld9iJ|&hzzP%e#kb^6&qt0Og}GiZ)73&N zm+L7+b9bxTIKFBFIlQ{&^B;C9R%S7m_^T!+u(zdN$<>2V=wJK$E8z=fb1fGBjs_;a z;QPDMq$nfjzAE(<75d9%&|939zu9%0{MlcKB}N#&nI~j0JX$@|fympgqS^~|O7X*s zr6vY*5$maYxb5IAa88O@NKN^2z_GEDj*Y86>aQP?l1^4A_JglrmY-E;hWXy8&l&H~ zP?Df%&d<|YZUL2;!eifmarY~0N;%Ft#ye*ihK7QI-Es$E$;7KPhSVnvAu^gaQ^X$z z`9;S2Jn!Hjv!|sbr-r{9b7(7n`UxHIa$!8b;r|Mptk>D~sv7ObMS12I8vuQc$RHPN z*qiv$TdC(54f_S`0N0G{F5yTG?NdNb9M<%eMLS&3L~o)9byKHA;SATO)X1)u7_>?xJ2zO=*x3Fpihb|Orc@Bx&48j z`D}L}H5Y|?!>CKjtx}F&Zn20EZnemn~ z#TDSimLzn#kESCO9Uh3}Y71NISw9puTKLS>7<*ein+%5D(XQti;(YE^D_Q8Yyn~>q zY3Pe+|0=TyX*;bUBKbEW)pupYhUQU!YL5YaW;Yg5&pJ6@x3A@Yp>$hkd@7}y*~~-n zdXW4&O4rzJ-6n7SGd&KLyb<&|t>%cSCn^?*)kVhoQdOU#?YW@8G!N8(N1g5lC9Hb<|HD(GlH z@AuCH@?cFOQ^gmC>r*-$o;gOB7bcdZ2oY8Ok`!W)@EsGWX1+57 z97H8xi0yaU3H#3OZl^6!B0BuaSuEu1+=f(bn-?+EUt%g0N?47KQYAeuYbhwPBE{&% zPY9V7k?`_wR)Q5uYEc>0k%HIrr)yS~PoFy=cRJ`rG{b=lO-tK2gE^mB}s-7o)a%E{;eJ$}|{K zMN(nD&}ujH`Y~mJxe3%)FYU^j6MEQLb}_io5)1H9-tFm{g-6|mWp6NICT-#Fc|wN? z!fIz|FgabZQC?TL^!+mh@V8FXVM(SZ4)u9y)el5?fT3nlm*EvsrBLSaL?&T+CvDwy z+nVCS=a+-8>dt`cjoYktJC4QE)BoD-l<8+Z%a6mMWV37jEJs93xa{k;4lCRyHwP@q z+t^~3P1MK?j)Hqyd;4g59a0~yTOS+cH9 z>SrDaS`Chf?3lKpJX?50_=(XcSFi}N9Q(>dCLUHX{8 zF}h8uRpN`QeZ3!e#jUZR0w;nX_FiBFdlPCJh`@rBeQN&oV#Z09iz@6PjY!DCMY)!9op6;I@DEli9y4-$X)+G8=U%hN9SugTU;NOikq5# z?#yn9pC9Vgx%EX?5ezIxm(rD-b;ld5bZ+?l`(2d|B)kq+oBHPbWA_VniDmajId(33 zfAd-`fBbqogG=WQr>%X5u_xbcY)`{DevWDSeGBn>gOM{d!TTxhmf=ifdfiCR_C*>O zV*E|+x)uTQ6LRozr#IyilAH#TE>U#DbWZb31GIx8rtik9?|}RB#%{c^ne%(+v?DrD z0f7F89^i6%X?t7g+zJ)2yD>J0KT2zr)k8gbFg&y%Hdej7+*h|+Q{u#?Kx9p!W2U~3 zr6LZqGzK_l2~ft&HM>*t`JiN;J7-Wapg118gkSIM&t$Ys+N|&`s5`mQ(yFMgG-?&} zG=lTjIEP~!L0SnyfwY#n3e|sSZx4y-0dT_~2k-5Z+(3rhe(To1z~g~RJ`VruPgr9f zE0J@)Fo~jnTcyL?^8Q<7{hD*k;;uTq4aK$fj`phK%dOcJC$r5g3??+PsvDy_Guw1; zdV-^!@)FU4R=sdce5x48kBc3eGi017j#wh$)oQDETymf{osRs^1!u6_8;8zh1%`ho z`MB4DdBKE9bRVnVoK!UjW|UZ!txrOw;^p#9fR!+Nl1@+8U0#`f3*JEzbR=SOB@#Ea zePp9-y)Ow*!@klB&)%QH*Qb^nrBu^J%X$(WZP*m-ib0SLNohe6%dLIw`l50w%MAF* z{8-2BK+DmXX5Ymfyb&T!EcEBSZ39BJhp3b=iXHCBjU)n=ZfB-l1ZyY1YQ0o z%*VA}4-QjMR*hpH`mm+sD!0CMgDGJP0 z`t@1?&yqGDJYk!Z!|%tYiy704r*4)-f;YWD;~`pG91F|uhet>bV=9_+CCx-c}Pg$xHMy1YY58sE5Jz;HmHcf85&=lhjA9h=(ARtS`1d62xC*7a@rY?kY zV{DD~w7l1MdIFu*szbwkzEhRV+=s^^dwKa%@BMIQFWXe#98s{Z0 zIuv8$aj310CTHM#*=>t}R6a+kXv)#HiQn-e6~i-oep#Mi8Zm-7Tu0Q5mtkA#LMOAX zK-;~_x+VvEZ;w7cRW;mCiKC3T)mzm%mv|OHGF#~I$XrN>B@i0_n`h=C(y8}XuT%$F zRbpH?Z}46B&DCWIHfte4-`bL7LAyXjF&8IB)sn^89-i%3S>^1qioiFpFYV=m!vcz} zVK#!0S}8s7=`L-uFp|GhZ>4tle&}>L_#)VGqt=De$^+8}zp|Zz&m$m|d?;sYqo=sd zSUTJw5lRA?uP=QQx@P1GIave0&-%G)va$B3^vMTKnZ|`_V!f2TSz{<9AS?Hg+l&qV z1Eqtp-=@q?Tfy(wpFgq`tHR6DJ z3@#?U062y;-^W7VuRhmU6Z;Hens%S?GWcL;OvWOde9f`2;vr%=x^nCrk$DCQLfz}A ziaYECZcfTD>2&{`^15BlDCScY=Is7OXSSXe8^`>Jy_m%RqcRBA?lG=AJEGEA41HQSmspoDZlj(6y`OK@x0XMkZZcuOgP3+2q49ME+Tt9lT|*M zK~I!G@b|fG-v<*CH^LB!&FBvGh9)gl#?|lG+me_dX-9ZRDm3ANbB}>y=P+DJr!re= zbjVz&>k~m)X$4*KSPiPo&n>f5MDTS!}uVYYvwXDhZv8v9pmdIy7C64`HoLQ3!! zn16Cqd%#fO0InliBX5F~pBsL`dr(M1&7Lm*jl+2sx4*y0a5Lnksb%EC-R~l&L&5Tl zUOA1c^P|8+O21r-Y-^2rj!m|8HvFBZZ!bZn4mbw!a2KlQP(6rWzp(UptW~U}Fq`EkXUC$@#e^0(Y z`Ve>IPX7-b`~@(RQx&&9W)>y-t7~V~WtuNc>fYzUTWwSO8_E-46644r9s+ul=)ad! zja_T3dSnq&4kBtk~_PxA<(2= z=boNb7K}`vKkNun{W^1el~TYgiDN`Z8X&?2rWxPb<+1-g0TH zc7A~gDZod=UgCm)kQ*|n|HTpdrgw?R_mNYcc>YI?EXA$AT=xBptS&Q&I>)LPx^_{y zT8-ad2UH1MzAx+?^!EV($7c=gk!wC0pP?e8OkiH3k^FpWOtA6_ahtZ7`+m@BXQ|7w zej3F(UAMW98DZ%8a`_;P6B1+J!*t9`bEBR9LP2fZ+v9+^S78&%p>zH5ZoXQub<%N1 zmT4QE&?I+AoY_i9YdX4N3bg#tAhN?QN3K0GUe=!h1m*BU*wd}Tq?_bI;Gud1~c+{-k zJ0eb;nra~l_=CC~TIQ2@_p=R*0h!WNWgY(>qj|JPrD`c-7K~yE0=8U7PiBSBMJIMd zx)m&7Z#mEJdVNI&Mx->P;1)+@Y&NQ>dDJaAmP|w1%LFAN%3^Rw%eI64+_ICN%}P0E zzr$f9_LkLth)IBwq0W|D=V;X3naaj?8RwfC8ts!`9H^joSshSJTzyD{!iq5rKhk?K zLBemp{cm}8_k+-Uo@l|q;ToAr=h$Y4m);GUE!LBzHZ_Vu!t<;ADrIBEy|~g~Yq#<4 zuN#UBL-^*eo(@h3+@4Wt74?KzK2_d8Sh|!}+^U=lw!0&VN}Lw+b4Lcm5739m{Bg=I zRDEhRlm0p`7TLP2&`?N&WqU}mFbDOmy^qE4L4#g%iU@E*`ljZ8TdMr@uN+fGT5WwI z8pU1<$a2Lg8#PiQn38u;Wtd#%U2iu9NU_ST(eJF7MNTCtV zih)LbVL?qpz7t|FjWif~a^3~EQa=m6HW(Jw0)WU;UdRRyw&?g zf^3#r-0SWdQwoxo*MVH0Koo0mj!ZDKk53RfS{YG_%l19j^M#8@GXWS!wfaW zqoBlezf0WR11o<2C|2-TP6YsxWP)59-Q?IV&U-9Jj za$&GKrG;S93Me%c&mC-<$+0m?woPvi?R2Zzpf)Nj%)9$tH(6=&{+9qK;h5dTbYz}$ zO0={5Kl}&y6gU63_P|bDSES!GDe5g9mS^y+xS7rt@Xk31fD|q;wNfs}P+YGAX}tzr zzw1&h85uABSkprj>uA}gKXTGm-#CvcRs!Hy|9xmt{{fdH$<;q7nwM+`>kiIIFyI_? zJXaPmlNeI7$G3t9A~GRSs!S%EmLahZK+i#yH*Eu z4`;`HGiB$`j4MR`sm_0-f9BDD1=t;c|FOU6{>*n5E#%S&K~>1ZT#@||FeD3D^C?Wp z7^w)qh8y7ETIRW1@*?2sAfK+DlA^(?yuyfyfxPi(9TjOT*zLutF|$sI>u}O3H*$tF z7Q)oj;JUr?K{37N>D%Ol;$Ej2&WdrW{F3>I8@mMmow1~*1=dLv-zATYN#*5(wC~n- z`T5k^bBy*?|MSD<=E0@ejR5_^L%8UK{jCg$oHkMXM8@vWK%H%k+qknAjEvB;&E3K0 zS=d|rzd%LO(ftgdGxqmS5-&CHxGzLOIY7EoZ*2v);I1hV6Dy5NARhpTe!E>SkirR@ zpcu`!FhLKHLt9-@syG125~4~J8JmO&saO`;5A*+49{FH#en;-3z7p30J>^P(i3E@hvM?4nqhd0l=;?KVDp@FDQF8ahg0 z_lp;8mfqt~D$9QC>5bruaw_1X2=4bhSPjP-J9zNx?Wl7_vPqtd)>`<*<`yKMDYzEg z_KA?1?T(^Xt`kjw_Bb$aP7?w5JV1~*Cdu;}9E8VXwtKtUHoK5U1amvl?fEES#SsPd z^;F3TkB4n7Ft2TeB;zFJ=~%7L`1MGH9Z=IYcf#}V-v*OVfo-ET<^&`Xh1~KKZj}DZ zxeouO+$c#Y3{kajuXTx_Uv*u-PgPckIB2?@`2m)?hiAFiPS$=NOiQ6>&ITxt=wCKz z+t*}7*7fD!CYs!Ipsg17{R^ENw@xnA-~heru2NB<=f&vJo@CYv{Foep|Cct7fruHi zbw;yev+uQg8hrP$y)}UoyV^7#kx=37zmP?qOQ!hUrXb5xo;FySJ|s1>Qp6#Z!zRcm zE3{?M3V=JY;>&+{6^u3aP}{H5LAdIE3rYz#c*ETwQNKQCbDM51h68wHozQ0!Z7W+yaI89TP;jxvY452gBN>Iv&(fkblK0eFz?5PnDJ_q{X(+_C41U1KnMnoJ=>-E#+Y{u>BuGQH2*E-HQiD`q{vAx&Ofp15NWAi#8J;c`(2Y0Rs7F&?`(?f4p!R7|Mf{w`vaL)7RO0D zA|VwZUr3ghhDWPW*XN!I5Y5(@Vq8#{a-h1oVZUzKKE?(rjqA>~s2SG~?5E5dHKxm2 zSJxFzPLYdyrJR&hKU$)*;_JSq;@eY<#YQuP!?Gf`nKFDL^;D9BHuK@HlAn~Vq%FNq z1g4M)(@q}SLB++C#XOt%dne->NRSZxG(JCa&{%kV#{BDh5}=-b{dZmM!-vEoy8lVQ zje`;!hz!US1@YBBvx%5!6R^q3?q*)k5HjJooFrME7=8x>D!*ZVHS?(sVARs18T$sI zb7klESIO>U($_fL3#10@SD3WEX8|piYtCgK@3&TJc0_=)>s`o!qYsG{o0~iCN-hFS z%jxhm3|91;{{H6L7f%whT;CSwQ~nUP2LJvsm9rX#rN+U8b00s;gq({zIRCcLzz=T( zKCk#{AHwoPRGwD6;qfFAUg>ztmHawhvhj2!$?*eA&hINFj+Hf@oPxRTmTg{V53SZ0 z?a-bQO7%zTw~>z9<5_{&=33g3%qpS*1UXVl z4yj(d?PV)cv)dg5P@5?io05`^NXsbGvIXe%=KH_klaLV-4%gOgo*2ZK#^&u1eF(3^ z4!ZtxI?*G}djD88vr3kzwH%OLf<8IEPgEL1s8j9*76-$aHs531Kuy##D_r_M!?aenrRExi>z1qj z7&d|*E>=2B9^a`6XeGH>rY39al_kA$3aS3c%wEz^$&z0Fi$!nI|9PU($xo=owgIMv zWbCZ{RI1j{L7aSfy{ZtPARZsJb^WL1Fo?c4doHAp7W9t`;yp#5PZBw^o$b zMea2R=j3$+PpGwww%_1%9<;arZCj%)NlzPgdMXbpH&5~M$XzD<8ZD6$)Yjl~`%jtK zMl~cB-spESbujqo4;a}$#f-+{Z+Tz8ev#d|OLeI<111C>-VYOFT8hRG#%GRcj`#`Lnb!Vg+UymMN!ydPvYUHrBNir^2bJ*k6__!I)3VuqVl=DvgwCwD_74Gt z?8?q)DW>#EcgLh=M2^$)$*r1uBaE#Eii5D(F9*|IRD0!?(90v@@=EXPuHS)VT%%xq z(SjauPNmZw>UxPISOMyDWu?ccH*INNCTygJNHfuniKYjz^vFHt#aiE3=wv?ZBJ3@i z?qgJ81SL)~j5O~^|CO~$d%Ly4qR-)lV&!|q+})1Hm*yT4x7v8ln;v-Z z7D2&SUg&0Z{d{Oju#NwD&CWqi&m2w}3g zkq)Tbs^E!NW@UDbaBt7d@2@qwTwCl2eMN0K4$cYMW5|GB1CqIEUbM--q54)vFZ~8T zxH?%`-JD^llA)8<18mN|Tm>{MiV)TF+<(Qe2r^WtZv@Tdwcx)jUTPdeH~#ccj#$r0d*3-(w?dWq)dr-Frkr zJN9u*9Xv$cTc>C0-re9FE+Jo9^(52?XRsT(iPy-h4I`Oa>ldL*>R$-3raiwCrnjcW zM1@I8va;^r@ji6xC*R`w`7PAgxopA#sR>XI@cnNMggS`yx_^lbJ>D<>vJbt6W*;gO z|4P@111K&@dp#z-aA@$*ytUKkNmt9{4 z^eAMqvc$=g8@L_D*dHz#nYKQ_!A|GCg2RMD>S>GC+QED7TYGiWsh~@(FNVmGCs|nh z7qQ*{DanfwQtw2SU`V?|-mQWmK~&T#{rlef+?bs(&YTYYzv7d4EBnP?Tb8L$= zq)Ng>3vK_9JedFOJt!d;gYmjV)ZH`lnp2{37lS>Du}=a3UgYSfFZ)5E!bx#RqD4G# zRYN`_6#Xwg#ogQtODZ7?3`Bb}yQ4rEjDnsO6Fubd`*!y!2tX#R?W~(s*R@v$9Q7~( zFsPZM*55ZnA7-T%k-Nm)A^h28%mb(K*w0u{aB#wscZ8DaBb-nD`q|Nh0jviCq}j=r z4PX|!do_{4CFVw*$Ew|>+2G)WUkU^-4F=%ypO8ZfOK9q?%SmTvg;YhzrbYWmfQ_DS z64cJ>3UE8kh`>_$T!OC_8_d-lxvpueSe!Q4Y52#>-SNnOKiCeJ^uZX}EOTJfsd|`w0?Z0D zfkA@VA{{$m>*sx4{J;42kzr_SCpRcwI@gImnv}MMnjfIdY_kEG{!n6Mq(JjYK^+kX zw5g)x3~bisq5kAYxsLaE@@o5Mkt0R`mcbdfp4V_J_pk;(&`90^K(Ql^m8~t@vtwiM zmhWxjrzuv zv>*w5DXIlkL;^4_AThD&K1h%QP$g>$LXxUS@u`*nk~2e2Ny>fJW37Sux#5G0Io-iQ zDIFg$bGyo1+jo8-IE!oSZ9n&oZYf8r%zM$44~u-;WusDpn2p~9B^L~D`yJE!md9&Q z#&5T9ebR7*j-ZPTVi3}by4V89#y|?(eCI+FKHvI*k_GB71cI()y~vxKW8*EYT&6#A zE&Z`;on#+qltK;w`&;SUqgei0hlBugI@g02tULq>UBbNb&Ori!wa2~aM31V#CpIuz zH#D0qC-c#rLA}La`c(6DC95Qjh^#BuoBMZR!>R!ZUbVjOhdtv!1SWn)hz9z5|FP** z^WJAHxm$sCtg`a2VH19d8N&XK6y_!J3kyn$U;L69*lWqi;nVW~7!ZKjC{@Hps1knL zeP2K?e;$C(>G@i`XBLqvhXo`ca0sw=AN0ryd~cKsS}ZJ8k7OY5M5Qfd|LJH(bVHAH zwKb^O5^^or`3z*11Q(aZ<}0GklvNoTZk5BA)3}2r2Vy=J9BE$f?yQ(`yYxrGQdt7% z9FI4|qS#owN&U)D>$AUt4snXIgS8E$lynr)H-_Z)<$eKj#n(3a02OjVCRg z;|P>B7RA9a7p4LaFjNF?SjGw1>nEdS!&NE81y~j+9QG+p&7}z2_Kygoa0zQvdu8{N z7$_S1BeHDt=caiN4mSPHeXKz7dHW28TD|rdR2kY439Z>rc&0<2{pd6Ryp;-xHyGMg zl*K3=KIEH2u)gon zQB${uAP{7`UgpI6uP98a6%rYazpgSq7tiRw)K;S7aa0ulOqFzZvA!H=w`Iz+r{k5$ zT0n@AgREMC^S}=sqdVIk%mP(^kZxnW-SR0O(r->4$j;m#tkvZYWfMRGq?W8re&VZ7 zlQzq+cn!O4Ix1Gmc!SRTAwPEhIz(%wG9=qWwsAaf{YsRTU$x{l_?F@4p9lVDxjvvX z4_r)Bb2#cT$W2eMf29?WjddH$$EqJ2hj?-dZ1rZu6)P=>%*Dn@8@a(1Msr7MsjcV9 z#vWbZ>;*;4!RemfHz5PFDJJWVD;+pNK>t)@Bf$xf9iN&FKGG>I(nmV|q=$SSoSXGb z%4VSeD`Pn^7@K5W_Whjrl>{xZqAFgx?V%aLO4FG*^o~zhBmig5 zBDpt54pRN^fvBixP`((802JlM?KKVneD*cOAp*vPq2tL@+UiuG#kbERmMRkUUa8RO zNVKGpvyH9?#C6(&!r^P*t-imJc8jje>)iaQ=R=i!9SX}WP90A9ThiY~#X|?%atcZN zL)JaI|FoNRt;eGeJowyj_lxCkrA{mYSHITRBNJa(EwPE|wL;{zj#r;7A`LocWb0eN zNg5A_MTh`Xbz%VHIvd+FdHNYfyv{d3UQK|m0g6M=Puf)?R})dGrT-ZZq9d{o=%_D& zF*K-{(#W%0hwS@JmVWK}jsWgii#gHkB=9?8q>%MMW-s0%Tr7IavZHCi>(hs8 zuKIf#@iD6)#y|^9-WVCGzQc|Qd%HYhDxYPT(Rr7jhKU~q00r{D=#h!_r#ZlTnb>e4 zywlF1K~bG(;*rz-YSK~rmMAdQ8P4?$;H$EJ}3@WmAitHD`rSr&s@t#E@3t_OlqpXLZ&0dj@BB<>(hO@~rNSR>X4 zMEsC2r6PIHHF{;dSz<8#9#iR$Inio&e6XhTfSy@g=5*G)e&ZAE!)RKLkmQbHm2g9E zYk(=Mv5aJrBlZlBJx3=^lmcWZB#9&0WksM(gN-=+Q<$qBydv@=NK&wHVG^O@ZSqy_ zUu1Nqx2hO69UMqT$Dx8mVA$B?)BAKBY75kPpQ!}eBL)!HYpQE$)_rY1!1_e0kA0jn z^=Rbvo4uhw;pYbtp)CJ%aS7M6xaRx)J^bxpzU-xfIeYr_E#v#kL!Sx&SKD>j_YE{DY{-E-05hMQX%})O<;Bw&WBs3Ko6L}wa}~x-oL9fTbS!y zw2wbu6Pc|_`*GxrTw5*!!`?uWAVoU%C&(liuKH{hf6jC~NG_4qpMo7CnhT{39w0MiDy~t zYVQdBewCp$ZZ;~5U0oq3Z40E);Q>OQg5-5xs|4XSG*HYegq3Gt@rYit&(_ev#(JxK zZd-4NEKS$@vj9`Jzm|gY!u#jh^#45jSECKDLQN`5lC8a(#ai(NhLdGGbefB2_W1^n z)R?UDkNzM8E|n!eiJY11jD(|i3}M62ywi?lxGD*%#I1H~Ot$E+5Lb^^{QL~~vL{U> ztcIDr$D{*}jmv&h>uh2G@HNmXcsUK}l`H_;%As1F#eutLttBi=eeVvrRcsbSBp9A; z-IlGE2Zfix1!}FO<^Gci`;b_0t27Y&s7ed6j4?wBx1-A}})96H@wo{_ZqgriBcQCJaYK2N$NK zh#bQT+QWq~XzeZo!*N5%eF|N|o4WG~hm9AZWyQLq<%?sn-J9TXk4N08Succ7?4|p> z-+`ZL#L5~rqpg$>9SM)jXSUFGkf|%TU8|OVhQKz)4A=xmk z=veLY7m@z&bb-vZs1`>+XB^{_?mbiO<7JoC^PR|0s4ME*HZn{G?ePDm%JkqVH>7?R<0cvRfT7 z>20xsdTdhBBP2FXh%^SjPdK!b+WZaJBID|V%*%%~ z&lJTGq9gvQ`q_nEur|m(yx0O;+aIJjF*cDPoQL46C+U5LfEUzn=$o?|yv=+`zdw~q zhH5eKj+Hq>MN*+eKAcMyk+HSfk5|#gYp8xMIHL9s?;QCD{fey1wbkr?CvMPo(?wf- zYU`UG1R2HBL*;=(1<7`dO>K5Og}k~pA||3h>v2Ao(>|Y5qr|P%?G!s`54KzO&K|aJ zs_GDOrbfrXNqX7RElqZ@h3_4vL6qia@;Md{`>d$odD-hQhy9hp%zY1sC<;F`ozr%t zK~)1X1~0g^EUDDUx<(nUsj7(7UHI_)Qc`L-pd~mHPBD%ZB8DKmoLb+k))HMzahJWc zw81tS$})+xLoXEV6atr}4wdm)P+}uPy}xeO2!V)8S4#s2`Y9EA(Q+9h?{DW)->0%0yGkjihfkU)fe}%B1G2 zwzd(g&i6>X{cOVrzdg2KiX-vl$J2jQ4a)y84_cNKnHb7Q#_eZz%4bnNkWW|FKk)28 znXvwdKV+}L9M7X}f_spfoN-EWyW(A?6BHQD%q;X*+uvTC?tGTgh%Ii%syYa3=vwg; zQMhS&kD*f)t+Xw#r;@ZWARB*V3mD_9Q)rN0AR7`7q9o&>Ldc0GHVXKtw}L}lA!SX2GwEQd$d>PLEf;0B4li^50Yuj2BN z*HsLT)mB78Z7L@@KfM*F|AF>*+gZSJJ^gd(@)*m^G97UI!{;KE1(scqIIPqpL{hg4 z?Vhj#WvLN&+IIDmYiD>}8Zb`u{NuOV6g}+3tPD2)(|m8d`>#mCne43@)_f;KYLyVMN>Y20K@{><)_gCT;iFD z!N5xk;;=6vh$8p$Qf)&G7NU`xqc;9tlXBGgjRHz;ykD=fJ5?b>;<36m4^~F2tX0DK z^eru{>c?+>*TUrb#+K?Q5BW;e7dw&q#e2)3MC(jJNhRjtN5B|3iP?zLj)_svYn9<- zqw6P^@vJUL!}~%ZZFnN3Ts-9(_WPx<;4+@>fz|SU$DNiI7^hnC{i4{Pnbh0n7&fsu zfk<({VB)iAjG0C6`6YN*f2p@A-SuBb?MDN!(u@|>+)L~j@r|n~Nua%!DQGEnaxgHo zpZ^U@SXpelZ}z8$9Hz^G_{q|j&LO>AD8}d3WuwBYGBy6g0Hy?+|M{&4Y6e`G*cT2# zR$_>)&N_zjG)|Fc-UX>yAYB6kn3H#@f~EIo5kgHzl5LtV_}9d&9v0-~x|(mR6k;RU z1(ZF7tNbj*GizwkRe)pTbxHZGV-An|$)PlBl?t62H z8$!!sidbD|XrrP2VxvoiMm{-ROmIzo-$~ZdGxRM`|O)N z-to;A+IZn?bp6RVn}+StN^n%~LinH}0dPSQL@@^(1vQTO?##=t^3}ro!hJA93+8wU zbnJ~seh=P^Fa$|_P8`wxZxwI4>uI3Eay+~I+gM%I?NC(37iI0wDXhv#vEI2bg3?*lIGzWye3KBjfQ zBw(|Pb>me!Iiq{KhMAIOJnAaQ<5 zkXZk$_AXdp^qY*3dQ*&<{REZTS4pEqU*gwd}Nl?B+c^ zVQV$u_SAADPaWIPf{9)|uIX^J7N$B9OR`|?PQgSRJv8stV5cUXpMJQ-iZQxZL zoj-pOQzvUbQlYyf2-b#*Q%}qig}AM!cr%w8o>MFX{?veQ)nKS2LT+H*m=iVQDH=~v z!F;EGP^2^uv7|F|$#VJbBqG}yI>Op-*2XN@4?GsMUj7^NN5%0^?4eMANt6V$fSk_o z-mE3z_S)XOG8XH5u=F?gtNX*F%9w%|R#> zzMZ=E0kSTir#ZDBPnf~Mivei~M1EZr?f*>fgTVkjq zv9`pUY?#j%Q5$|S1PYI(TFB`&tDahZKet7mGBrCzo0wv55*ttBnuAb$>39aWSbV)i zF3BWv;mIk!WUSZ^I7 zX{g)PY?l*8p)0)SSuH!N=jA z6Iv;BF33DqS%xPzn|EOYoO2z*#}2tb(D3ha;0EkxTN9C>34n*N^Kr#72ey4U+=p&&(uv@4oxk3*f!wIEoCi z2fW;+`IU{q+&3rIaX!}`C40Dd=Hv{Cwz7%?4bFPDUS0M4OYXLVOpZ*#3V+hNjpI_& z15x?kyH~!N+LIg6i+iiMcSRv)u){aCx=PG|clAC0A|{!im0wzNd40}S8uq5hD1`3WsY=;{W0G2p6 z?1mTY#ZA)C@IEo&=m>YQT@Ro9`3Pft^#!a?{IQrGJTZ%p3E2Q~Q_dADd_aiBb$(}m zG+SeMTjeVwpaezWwaST;j%*!&Kwp|yT z?}FA6OL5(#ug?o|o}tD6g-@epK{jf%KT3gma@Zbm>6vHq^0>sV(!4aNpSWn*`fT-JtxFSE*tvovzCK4)REW8JIAl!Ec29(z_|)+@QQ zg~GiBbU$!#db3p-3Mw?v$VxC=`a(#p4y6+3+%Cola3+%P&lZ?63pR$#u_p%{;a9X} zP!sOh+r6cHQ2Aj+XZj%?%?|_SfH7&&d<7?R4hC*$6-1zC~`0v-5x-gL$5erl1#nv@o zqHQNb!3lB0V+@bj(==cIF1E45blx`R>ST=B-B$~Fy=lulwU)rmsChL#-w6AN5Tp{n z}# z){gNs>=NmFeNL>^HFvMli7c+*Rd#6cY=5WhmuT<5`%Wiw;0V*%z@a~Xfo?X}3u^D~ zSZ!wRS+GDc$6Ty|j{7YOR!KX@PlORV|I51oB@Z7g`|6x$EYe3!1Ny=d4g@n+jwx|X zQf&LZ&M5!PjtnVFOReNQ64D%HN3`v_?-rG1xqwfYS`G0caT^L$vI6^0c z5C$hTVlXzyY$}c-%)5jzGtUNSR|-ifa^z+eYvrW!W6 z!4l0^1Rtz=>I=GkZ#h~g;6iZeljts%%W$YrQZ=x)emGePFYAELUY(2dlg$6=d>x-) zZ+Zj4hg(k+eYEubWD)A3)Do6~V_8s2C5>J5563R?t16mCjV%dB6TQpIt0mJ^O@>7b z4kh3Xxyak+7vX?AfQvF1nY8f;ALv|ErBaGMQbLe5V+ za9jw4%7v{>0?%M*qU3Is%B!f#l={48DDjngLvy;|lP6VIoZWD&tQ+g|$j%(L;`jP} zKY#oPGCA1}tiO;HwiwcBhlt)AIM3|xJcLZDx=<1QaDG4=@phOBG^DJo^Ws;_R>{h* z3+}T9EEo_(8!{W1LI^vM)|vB)O5s+cVFH;rT+`* zydNR1go@$B{@UTj*N2LoRoq7^Lh5*=ww7d`W|cC#iE${~c=?D{N=yt>W3t)4`g8^z zig8>-LO9SG-@eFJujhzKXFqfopC`{Vfl!@!m%f(uI+B2ig*j+{6(w6-Hr?q?XgD2m zIL7<6=kmAf`L@TpaPxErQ#+?kDKk(Kx!JD3?Bjm6A1q?YJbmf-Kcc=es*bK{7I*jH z4#5fT9xTBvXb2hz?(Xg+xVyW%+k?Bio#5_r2l9UF@*`QC#eqF@_Vn(quBukC1K?HB z_D67aw=1!2Od17)6>jW2%B;q*B)>C`lo?I7!&&p4ToaM4Ew!D-oEA|QL;r?krT1E- zqY9w2s7NE@?FERnh`n60>Buuv!on2QS{~%EfEs5Q&hLQKCbwX(`@j5OR*x8y1N1^1 z*g#d^Wza>Kl>-JAE@0l%xrjcg)qoHW2m`oU$C8i{?L63RwEeQuZZ~(j2Bc)%Ut@3n z>=333;78v3q~p;);w1Q8S~uCrr&`@qqp@#mrCMM6YnS?z|NYB? z{T&v_(7wLDNFhdv&y}EZ-Tz@UJjXDVf68C533B4^okzSICjzcL22C6xK$OfL4mh?t zp4@pD>e>eY*7~XE&CU4p;FCG?ft7AWbu(&vI&$NDz-}Tu6~5Q^0Z6D-_kc7ngxfg| zbolMAyK^)#n1&?ffXEBEy-QQ=V*#`@Ow52t2rzCpa)=hr^??X_Rw=pv0yUm)p~-BU zAU^jmnNIZLh;@`gcAS*I-ZC(wew&;el>Oo_MHdhmhh1A%`p2=Wv3aMzkL<_dr`Clw zf~NEH33kqxM^lCX2$!LuL3!CAzz>x0bEJ60`8L_d-4n5gyVkpBCx7M#l&`mi?b1n4 zEKm&vqdtnAJ>&yKi`d}_S<-jgDvKvuZ=hxN#XD?-acSO86NO69$*RS0L}5^93LSzB z$(+L1S&)EhH6%RH*yK4^?$hYjDd9TvUR2uhS z!MGzIAkbwK5QuUVepD4s0R&lLN*pnOXz{?rG+}4^<1z=s90$!ic$6>N`LO&yvlTp6 z9DKia+G@b#4RIj7zw}hI=KjrRg_86=x2bAIF3l>T=$j22Uw; zR0{}58>gu+aqJ?N5y`>79+M~1S!xDt+~!w<;-&om+9lHqK)yYwaqqFd=l%uj~CU56L}^>%wK4-j8SY6 z!IoXZWZ2tD^&*QXBK2QGd}NB`#Yr+&8o5C#C5;2?ALi^OG_5NqSc5^3S324oxFk`H z<_$I$6L5xYt~z^l>Cg43xE^kz?6&y!`>#qn3)>w*TMfGnHq5pV?Cf^~7H=CP>)gpu zT-^WI>#8qnwX4yCV{dg_+ws+>w3J`_R0s+osq_~jJyzp$pDCpTzu$6I4OKd4^*9M0 zS01{yc~V>%6S~I?!qha`WSO&**HcPX3V{*{KN>F#I<`o0L6Dl$NvF|?yEYL!M8oH= z;uk&97^94XgT2!h9h<){Bb{BDkv=E*W-aD`4DQuN+x_ieyU}p?u=}Z7Z{M7$3dy4p zh`fV?{b^!?txxuFP4}9>O&}$^rj`Ipb=M6zU53;!Wnu>flRhPt%VUKt4ooJ!uD0{v z`coy$X2&|JTP__V$ljv)olhA{@eg)rlLcf#JRg$#KZ_2~#+H|HR2%#VC6N;Mts(jZ zRWBB}vHJqa&E?9A#HQCX(Fd=3;4HFU#mkO_Oghdi4Aif={()pXXW$o~YO?;$V?GR& zi~cfJ+(yE!Fvg0DnoDhBX)KxkttBq7Dd zueUc2a^l?NlAeLSTvgVD*HpjUuD#>$A6wWi)~GjUV+?{uAj<#!=~w^I># z^|o>q{FOI$=BfSPZV5!}u{@rwD>!NE-VS~@8|ZA4S0hU>ru5*>w!w;pC(`1bUZtOlQESSW zE}nwo`1qm&q}iWL*XyX4OiKGswII)rxo}DSAlf}vC$eiO7%Y&5_!YrhL**notKd?f zFInv!*x%CWs}Cw#9-D6j*g};z958sz?yozRYyB%x*!*3#me*}J>_@EVyaJK*6vV20 z97-4%@5U>2S?rx*R$%ig3}SKHc|fI*i2DN=hIXMUBGHL1Chvc+0=mr@$!hi1_cvNu zIcSPJ0?1xrWrrtQpe~l)_Ah?v?-IBylT3J8@9-;rN*Y5ldJ5EfK$yC?4%sts*V*1& zH8J_VD!ljheHO;nr^&2yPK_nJ@3ZA66Vvl5t`XjB@~jTMtl=qB!A_oNlY9tCNRkfr z6Fk|53D}66V<7km5I>%r*u#0XLALxCTP4n|bwg4{4qUMBhNZ|rwaxNr4u|{AD-1pE zT@j{|YZO-T{hZJXi9j6{(}c?}KR~H0#fVTdZ9p`mS|RwDvln`l=$h{E<2hoodjeZJ&-*Vkj^?=@T7aY_D; zzcF2`=Pmt(6cG7EoFwL{mOZtaC1`y+NL12gyv^o!=4v?`Ltq50?TTMZ6&~9L8t)yC z!S<=Z?4QVgclN#J1wKYqsTYTX%)QzW7W1{YrPA)$rdrn)-OtF`$x1!@q-> z7wZ?*k}Tfxe_JL1eW6xOfWQADgzYMK9#I^3X8Z70=jNaE#rDU#Tfm{susHLnLiT%T7A^7L`kkS0-gcp?#>d-}O|#|tGY@O6#D^|2xW`T0 z);14ZSCku;n;YNq2o5mP!(IAZC;?$0yTjwOM0gAc%i7mz7`%=jY4NXwwc&QzwR8AK z4JQZYlK!&^Cjk<@dzVjxh6urZ-hug081P(U2)k>Q`U-|doo;`l%u13HQp2@+B+2%_ z@~`ZVf94R<3+@egWdl&<^M{?E{!H3PMRmw4H$=X*GP9`Vt1Yuk?l(p{Z=jRvKl1#) z%?;oVx9m@ha>Opamj&eL4=gA{(u)8hJuwk2%z)lz9!QJj4Vat($6c1gBR*)QhMK>X z!9P;(XKH<2z~K%&P?;$2)@?yDZQtM;C_FwwSCV`xRI$tPTKC)FK~%6C&tS2f&zfK@ z8safMs)b=@YY!+-5Bx;_PqnH@_I|zDGW#c^2^#fxbYp4Z-T`soOAkC*s*;j37wkdO z*hIm-*|&RuT3J&DrJICm&%Kvczh@kH%<0N%| zkjpJDWOnU2u$WJNF>=t&;E(A1xt_V(ggH^uz&wqgG&$Kg)6PaXZ}EB7GJxxsnx_}E zw9U7LTCHnjqW32<`@hgP_9uBUJ7-yYM4#Q0VxJ1GK|Yu0zOLoOOza;Qfut|suhTIa z4LdO8Js7O_Dfx+l4bZtt#0hx_Nii|przerk9ZX^z>)lT3emTqAZG7VmyW3Pqlv_8pxre?MTDJyt3lsn%=n4Opt%WU)sxlS|2+ zsT-g936+6t{(UJoMrlqK;5s@D$ceWFCyHi_r`f}lmjlZ#Xi_?O+t5IB$?L746Bo}Y z1(|#VEuL@ze8kOpomIureuZ6*X(c;Wj~yGRb+-s1dDPEo4{CH3-xdciFKx+*-BT>rb!TF<_(BWa!}!wrrBR;cQA^Br#6RG)9|F*BlWy0&)z6Dkk!PSk06>y?%^ z+xreYEl#j7xcMFCme4G%Ho<(w#H6Bzx&T0zauGIm_v`wJ{WUduv?Lay2N+G6viAyH zT>LGrqfgS9THksE!+C{0?*{_>b}17mesw{J zKV2Y(^9yY7Te6R6vinIXRk!F&^-!SQY%A?hQfK!KQP71r11+ato*FPc)Tbn2oZ0)} zU+$YfEqT zs}o~V&kVTztm0G@YNXW+N3@@2gvh*owuZJ6^&~S9I8tzOJ(&}%-Hc^rwc;J0^zln; z+xHz^L|#s{=z{~%^o*#LJE&X%cuCt0NJIVz-}nf|Tx#k<)=aJ=SY!q1a*)8|8Sfc- z>YSzP>Ed2oLv)6Y_i22sy7aMpk|?#R}}V*3ZWD@Czvu( z`}G=O5nw6-LKZ-w;hs8AdbMjPMfoF(!eh$*=;*tJ3GAUDFu&(_8|TJjU)sio{>|FL z)19-aR$>W57y!p#Y;Pla7+YpV-En=OD|s$*X>wvd@p$1mg1HLN(?ILhr0U?4pp5CP z_Rs>Hp~H^Ufy|B6Y1bu z>E>k_{66OPIz-IcR-toou{AZr_GAtgRRfDrap+*gkXL_qM!FQO9BP1iQ66QXK( zxRE$WTQ;@(OK4wO9B0l*WKPe%_{xXDq~qhY%4_|4PQ(2*DLXg!eFLf}p3T1DaSw&Z zYdHSPT)N+{tpxldmB`uJ&7ngA@etbuneG3`NN8z=rlxkMpaE!j=#zWgtlG}LS7lf1 zZ)GqGi}v3tlmQR`l1fH5D3LO}KfL;M$5j(Qx=CP9pje{*hI`0py-gbdkT95kPkzod zCo7_!hYc3&n3wh~%`c%9R08$Y&(;$JSve~Bv!%#q)SPV-Cipn%u+V z)e|OGKc*E&mxO@}g$DkhVx2D0j85GbszX_Ohe_%Uq&3~9@Sxw+MY;V0a!l%^WK5W3 zs9V;DONc8i*9eL+(u4nvVDjR>g+9fYyXLp#(xdj_;iUg5?-&U9>LA)Y^0?3{eJ|## zzl{X)Tlw%r1xkg-79kUv+_fj5yEV2PW5#GS>kqCOsH)P({@%kZW^>sSCRrjjg~vM1 zcK+U4ZLVFNMZ7Efqe?DiI0GnKqL=k7S7+WmgE4d!>XWO$GE(MO`kQ{o0Di)OHrPZe z9P@sW=`e=Swz<^%q^wMsKq}DaruqF0&I;*ah2Q}uSyb{}tK=H=en36YrU_w(^!73! zJ#}k=XpN>C^8^UZ)%qT=xmX=#D6+QQFEne*BB9q)2mC8iT5m^wow4v|@WY_cnR)ZC zx8dHBa*EP*RAi!9kd7T+c57e|_5L|S z#fSn@ej;Dso5EV{k%S*TK5J)p!5xOOG9#jw$%kkeLb&8H6F&tlfObdaz9faA~y>%EFGV zZqC!;4v(D6N^*JQd)*xNQu*jDtHlv~?S)-;ugmCgYt6}4h!jHx0T`E)-I3rF34o3N zNqz6e6z<&7Fuo!0fY3J6t%}=?A3_~6o#M%cTq(9XCWG0F>oXm8Pp1MRN+h-E%m_-m zj?P475hK7$gP?xBN)tf$p)+Lad z(6iY?G^YbB23`jxHxGy5AtrCV%j3bpv4M^KS!g_wd8R%hA9u4_Kuibkah)alPxX!3bJuVJcFKpE zW%2r=$+HMuXkLSHes4z_7mD~T>mpRU9%+cHJZtPC1A5e^UKg{r)f3WHPR@5vAr9!( zn4Z+3%R1Rh_~AIxm2qUPlPxUa{g}`4q$?A93(8j=cLl(1~ffc#;P;bnm(*zuMgwr-&8mWyxJnbdxXZq#)S;8 z{(ROr-{#0NaKFe^V(tH87TmY4O?%Z;-v+sYLikx&OD{LjKfX!MOo|p_>7o0$b5k^h z1g!Ed1rd*}hz#I>Iybv=qz**k@WK>(y?h{7FT>ysl<94glSDj?&}i!@`0wq<_k@{S zos$BkDWXbR-z%lb4x6{lr>Y4A--(=KCg(eqo~T1U5g_d{s>4Enjvs6B_t5gIv;cbT z$H)2Ani;(6!$u2k#w@>%BK#w>*_)bx8`_2e4{Zm4#zVh{b_(;KA>~%^!L?wwMF(=% zn*tE4?}i!d7_zgo z8JR#!qY(9v^aTi()}<2aNP}`8)x}!LZR<1wZE8}ob+{5fjgEU@1RkZR$J|mPRsS&z zu4T{CH$b(>fSD*-hx;M$EV_UFvl-K_-72ChLj&_2i zl|H=N&tKY-ZK#2*0%UWD=zb$6v&9@SZpWKont z;-VN6OvHnSE{EgH=Sgc%LDD&v!>ip=AD~||yP8BHzwyl(qnsaaRCY>s zGxQZWY4-SU(mycRW96lA-6I`50FS78D;gjlyn4mtarwlsu6flr!ZV(YR%0p{D^C;z zc<+asHHi%ThX58$L=ZM3sXr($9Uxu6RGHF(wlr&w)wDLl94Vru>}&D(NPAr4E<>(f zDr^iAYaCCZvd04J49G9DY5ofVB|*F4WtBT&^B*HW1A3V|=jJa^BF3p%jEUjK^}={G zE+JII2j%a}1(H<>(*;2GybvXO&Ur@0kWk_088mj9{@k=pW|{64sH`58u%GjO-Er?z zpj3+PI9E|T3>X>Kb*~cA4=VNlekEMFM-v&R7L`;N196iCNYpT8gCT@xEQ*6@Wt?8b zp(0O^``Wi510t1vvR|%v!;BuY*eRA^M2x##;(v=0jlq3H0L%PoguJSGGErNqmVFOk zx}C@Ltc?%WUy|6o4t)E=ee@l)7LZHv5{&c!%=%$^PyeJ@e8!%mulhPIEJMZTji>mM zbC_ADH^k&P-t3NE(T*3KtW48wGZU;dKOF2DxJ=P6th5X}J7?i_d&wlIWwZ07;5=8w zaQ&||%Oe{xuK+@jOtu0okb*%1aTx9K6LQjrCZGuJ?p7k$+Q|>e10U7FU%O zcxr6_-C6X?Y3xb?`unr9rN08sgC`(?ETJ=vfcdO%2bF~Jiq-D6x)XI>8;kdIo-L0l zJAQMSn3|d(AQsX)a{fAOMrG;vQ~^Cbwz+nl(1^`h{^gQBY^A{}OL1Nqgm-F+Paqbb z97?s^l9@ALjC41GcufEtLnU9*13M(X*vo{ZkQBjs4lD<(XU`V(Oq84`Vm{q}rpDJUkmTm? zWY&!vYrC*$g1E8QY6^y|t=Z9mNSUY!A|qoG1L4JmYA|%C(QHrF&B`HxDhc?aZqy&D zoPpd2Z_Yvp>59W&7s zwiWX4=L(toERgpI;&YYvW`+#7I`ch+&f9#@XsDp+j?Le;UC=n2Z5RA zBW%B_{fwG?dR$(;CO$p}K=+wdi+UNa^432)+(RH)R^_f1Qu%pEyh!r)4e(m10eH`! z`jdh$(<4YtR_h2v+i9)2lu}=c!NB+r)x|j6#Ew?)g*Q};?2a}l?1?sXkGQ{GX!Sr}cvW?E9 z<4g@)A0u;vuth?@5HTm5lNs-ZNQ$vp5$sbNg$Ppxw^fHaHQRoj@I+0>Ld{1s#+AA4 zs~8$1-9zAC)6IHfH%@4B(4zQA>bz)(w2%dirKOY?29tfb6Tk`c4~#f&(erw=BN$2X zlA6@!$OnBkN&7Jgpzv^Yd!5wT*p4YFaCkh;UhIN05 zU~vR7YK(@!X*li9>njQr#-9dxj?{KeLY~EY?h6yV8w=#_5k;Elq!?Ho0b~&9>3Kcp z=*ZpBXirRD5Azyd)1Z@u`N^}Axz^#&<9f+|y@S)3f6-$^2f)DIkcgS7gHx32jw^!A z0OS%ty}MTqK}Fwon2?^M3$IHmb!Umgk29k56DK8o6|H*1jg$%mc3($n;Fw%);g4g z{FU*V@cN3iitFLSOIJ?TYlv>L*0dpfEY_ueqzFl-0&R3$QdDWFJD7KQISdf$X6osS zs=4(_Z~*oZl7T#`h@Jm)Bh-)*Wa4Pzb4CVDztIop0*~M?sbmV(Q|6j(knOrtIFTGe z?)JIl%((IbN1M1fg%|w#Ld;^-`S8?)4LvcJVv0RQq5qk`g^nn439QB9C5Q`|=fP9dbdJNi;a)*SPGG5=O@5LA_AdI$z4=fGm53 zN1-c3oE-Gmyn93&)p*Yp=rkE#ib1CWNYGt{c|fGke#>o_;X=ac^U91U>X0-~^w5kw zdpZW--_|ps(K5*TZJsGh#?RGk$Y8#LYbxpmo&wW?vSU~btg82bH!C?) zJ&1@NNWOtNTZJFdNr54x#-a!#jMuYj@Ag=9ByR{(p{NG`0Eq=JPgh=iQYH`3D)ZDm z4f;tDiI|+@KqINmOG0HD7&^E*4I$qHoGD^d<*?#84zQBIEm1`xN5?1T^*@9Rgh03^ ziurTTj}PovztK4Xvyvi|wd>L|TH11u$Paj|Pf4y2-~ekMfNBDYlG2yV{_W!T*)#9} zzVy8>O8tB_6lGUe_JiKq-Ho*bKtUvi9Y}C1tDc&Q7hP9Cw5ec&8dg9L=_7A!OxoIP zn-`T-EY9s^2o@(-DJrJ0$I3?N0Va&998aRo!+Pe&yH+0&YX6-=9s5gWNV+By*O)Sl$ z1EWukl3$INjiKf)dy(11R;oGs-u|JXHVeqRWO`ml-LW+c3Lw88 zkb-x(05yYlmu#!gX6sqdL^eDm@kIj< z;Zx0b9wTaoj%1~SBdX2m1sJY!@f=B^&34jIw=|!#fso)x8DPXP^~HtZ#9Vy$h$t#Y zYH{b#ELOg8v)L%Sb0e2=xDa#zM8-%;58vE+&u*t8(9bWn27n+9DtzAuXmy)9buad3 z15|O05G8ZNHs_GxG`G&3lD~x)yNwv5($2p_%;sQZMzdrzH8E72*t>Evxo0lwY3;*3 zmm{6o9Do7gaw;zAJC7p4ahlu1@YkxkZ|av|y7xwjl)|^9`(U>;aP`}%)#n)Z6Qpz` zB5%O{uWMoXux)<{2gf=?2$o5idQ+x=X)q!ru;*4N&eh*h=Sl zt>L&SB*dA;0LRzqmk8tQVKg4yt;P2QP2&ZJ^Kzwm200Z&3`fi6sE(VUEu$}VZ=e>S z<6KbV5>-{!F*TJz%Sa4)yw#(iru#5X@jE6t7LsPZ7{u4e8R)498?RRUtfU~T6^dg) zcs8H@{R;o-{4^P^857aKz+!<150NOKQ1s%gT6iikuM%M)bUOWd(t5yHrRX&0PhH0G z9dg$CGuYwR4v`L>0pON}5Bp1FTS!ro%o{)awbS}O9ZR5b?}Lj{%ikJ(&VXONqAgWh ztCGCCc(aa{Sr~NgP*PO;PA*1&OX(>Ky)P9_Cr0X3>=0ttw$3x#P2HY90boNYVadCM z6w*j0lVhst|wOJ1vI|g|~ zHPN;zo*lhMYvfn;C07#i-$PaUyNnE4?${VbaBVPd-;dkVfxQ3Yq}3}gw4jmja}>~GQJ5~xD4_N0iT*yJq=ClgB^k=0TCL13XOMRuPeIgS!;&|Ir!7u-xu(QiybY-)^ zo&0@pke4d`vQS-pq24OsKo5!eJaxom9DQO87g-O>tE!2C4YPr$IBPXR7O)%omVKSU z@QQ790^4)n8G~U$C)b^Vgmhes8l_vb7t9ED2b}Bi49($=I;pHix^^1NabCEx&ZZD= zP4LX+Dvj1`igrA8d3fpd`T7?eq`N7C)yI|+Lk|aM=TnY;)Ca_O;60$Q8!%-L$oY$* z9s1O4~m}PDRU%*PCINBgU*(^aakbs%tjSGuHZnlilIRO zowMmkD9D9nNxYYrPG4I$Y`Fp29ME{t+GK_tjQxF9s?TVT&<+`+!g2Z^^thJ)I*Pb~ z#0zp<>AyDaDo`9>ESMJbPK~OxZ3AW8Cp=bSQ zKgErg49eLHpW+}Mn<lvg?Od;R1Bo{4(}J;U0!{6cE#>g$%ULF}hwT;I_X9Lrh$7&|_f|HOC6IBQ zGk(fWC!^nk?tOq^0Zl=wevS+ZO!G*x<&To;?gbA5#C19!NMzBN_GDSzT-;_JJ5PrF zPmM)r1o0iz8C6}6!v|@#kEUQlj~gaTf)55zxT7|Psy$=VKY0x6>+7)&#--A zz?fr@+=g_M(V;h92XAfmgdHQO$Kg3KuA@6cZbuA}+m!ToADl)`i8-S~cND6ib*S%d z4VCU$Xop3=`qG3u75U)-cPuTmw_nIL;o&5%y3yt%K4uVcSL4SBmeYZH8J))xbjg_C zG(B4!B$O0(9QVZVk*wX*jE{(~)ky6O zhyz#xM2rTKv?`maS_L>VA8ar?`+sQ$_7y^`Hzk31+(*wX1%fzPsM`}uCTzeob9jri z?$=~~^Me3Qy@)`I^>mpM`tjj`rhZ176;CWqevRx}hc_xzaOj22>WU=LOiwKx;RhYW zKgkvWm?NH>TYOP`m5GI6fB>EC7ZKY}xy{XamO$nU&^U7M^=OsryMY8$RCPK#%Kl>n zK%c(jF8gfeN(@09p(qPLg!m1$0}+MrjXSS|X~`BrpY+=99L&{I1#lt(iaf2AB8T&b zv``~Nrnjm~RFdq0_Kv+aFs=?3u$n|XWb-c4gw&yv*AvB4cvvqIUis zD~l$&$FD2!WO6D?P1IN+W=CO)ntub!QJN&Z{+r zPmte@Nxdu_mpMyozHWw9l!z$U&TdyzFEs--D}HOu8`Tpl%9!yNeXCr5kUP7rc2twB z$A7a=Qhat8%tAl?IyH@hlRn`%JMV}jwSn(x*@ij9tO++ z^KO4Jfp@kV34&NBkVnm|yv4H<%SeeMN-KX^s9#yusAsjv{xNdC6~nvuCU$jjntwto zt{NIqMiyUs;5+_Er0#NT)t}z8F^=C^qRJRIuNGgo?3SepIA#CrAmLdIcy%q;w}9N2 zBnxi$#C;KXpm+q_su85};J(!n&-2}O_m`$?;Mrhs)_+Ejd5^&=f~{|a$C+Y}-^Ut_ z`D_OXm%hJj962G(mb26WUyQnwD-x)%4|-j-T2UASQhh&G8dxPN=E*))WY}+0>sl^{ zHPeg@@i%ZkFCF#xVEQR^WIZJW$>s^SC6}GIf@Nn`8fqwUSrZZ zQ{v7iu?8z7w$L0Q)ntdtxjy1IT3XEvt6K-6_9f}vcHQW;ou!RxVq@AED{J6(G5FIx zr&9YjBP~#vt}o`2{~=ULHwTtb!qr$%?dYf|*7Xo)T@~fgb~gfD3&tv|d+dJI=wE6r^Dk3o?dHjjAKA$>1eBFjh%<(y7u9kq5}#aRbxe zHJ}|qK$?%Pc>P|06wQX8w-@THLx>H;zka#i7vSx30SPalKHpXmQ4K}Nch=1vPkd@W zq9{(UJr~{XL;OBh?b0+4>+L2c*=0IHnRul*l2;W`Hb*M)MC32}Z4B7U?(Q# z0wW_h*dvh0J~D{wDt)^6t(>Xv zSoW*D9xT{RS4Ja=>g>Os*gY3B)%tTverjH}oV7Q9`JL5XJjp<4rPXJijV5P1?QnPO z4>o#8N}Hg>cA>xR_{Y(b0_i);B?*3{H0oRY7EYmV!28p>yJLq4{bLa7)-hMjMw0_1 zgU8aa&f%#NiC}jRE2g5|3%Q1eU|p|`(#MH43&a~@0{@$|R4gR|u)WddV739huGm;+nn@Gwq-aIiu6+|I7S&D&_I1Qd@XeI@Ec3!bi|_SbZtL-*^_luGU#4-5!) zq1M-%P%71)#ZyO%4{(rhYi z^mt{h$5q$DLK+DZQty;ACG59iTB__5+lAu1Ep|HPNc>OT|3VCclLe5E%kR267n^!* zVtpZ2PF6`Yf%C|%C*HQ=)l5MMZ!s}vvzla>kbZ2q2b(M;_}^dj9oGn>Xj$ zP2#7PJnc(1wu{a0tq?C{$_hQ=1q-b3hn^z;MKYRt4dH5Xn5j^nbOhVkZmj2!gu8l$ zYOW_djk6pXefoUE?b~?dg5cq2Gd?Hm&bErm7lkT%h=LNTrSVyxS(&Buu;R}Bvz`0x zG>zG?NbWD`kZ+A{my8f6eWY~cL?mnbBD7E=3|E_bmOk-oj;3o%a+?VW6?!hXVf#8g zPUd_$vg^$V-!3Q9G~D?%`9DWm`R*RJd^8*_?mzuP>#6IG*(CyR?Z_c^S$|_~^#eLZ z^D}@m`D-wUxSBC#i%z52GvkQd{s8~T^5d6*dtD|Y1H<*~Gsas04+eXuL&d!XnX3J( z@7%MjaX;4{&DGI9{a`Ue2BFSdwfkCrP3cI-HZs~CZGVRQcFy*z;||8rZhtuSFj0cY z+3{SsX7rG3VuIH3OMi*N3K2V!nw}?O$xngWSr};VOwif8`@NLna$f}pbbN(Ej zP|2M^YwYbwcgyVXdB`g^TpiZq&|e{GDvTA-3MNNjr0?ia>?w4T&@=hbuZT+fuj&DF zs4g+##1^;N7Bn;r>r;^AF=j&D&zHAcm0sqgk-B(3H$>PCJpqN)fXQahc$n4J)nvlN z z22$fagM)(uE7*c(bVl={KSeXB^zT;=2Z7hg*0W4kM)HrOXH&(=C9D-7o+{e=x4pT0 z+ed}f)WF%<{aM)N14>$;muj8-8=@#i7_VlC-kC(8e{($QmRlbLPgWxP4|Lj$(&@3o z&|A!)F`O(U6Jmt zm-%Ffj(4HNK0&m45r!A)xJ9F*Lnr9K>MxZ0jc~}=o-EMc5qX5zy%_8yzf#i?S>XTb zd!Fy(GPF$>6p^YJ16`bP0^$iejJhwtv!Z=|5jdSL#$u-RgsugB{{!F&N^0Nm2ap&* zg6YX$_q-5^+@0*p;eE<~avB{xJh-u3=tI0rU^jE*0<*%hCqVJb);nFtO_SnV^o(wY$kJq1bKQN*NG zC11b%wXfgrA5jqhxcb-snkxaXBkle>GlUG^DpI*RjW)e_5M=kCBWrF4id%1z)^#_o zy7n7ytbMgF0Uf-)Nh4vDY@;%jIGcFn15DYgFt-Q zVJJ*QSzL6gR2zAZ(&ly(q({))fG;)?cD<#e8aOo)H;NBdqq7qOJBI{<)}wsVhkL2; z@!p`@`)HXwU`lCVTm<-+FAmuM0H$C%+;=!t2`!AOu&4!T|0F7)EmDn@Z!$H#P;kWK$Y&40Wtj+2^ z;NxqE)|(@zkVkkl>Hzk0wH4kNiATWi1R-UcYN3;_O?DLcx0Y>vCHvA+Uj{|hj0J&9 z6(@gdAnO}hcsE~%#oAi)B9~SlU zr*tp+^Z4EZ2nKDxXL_o1n1N}+j+SI|Cx3G;mS|7}dzv#&He}AkAEzqx!>!SZ8=4}~@tE9>?I&KzxT~(a}$hcM00-JLa7;FO>s^8u# zP4eRRF@At*VDGo|SqEMKm0d+q?phw3ej@)7rQGU=2z+HmFE;w&waA0Q91`>2dCRy857= z1LuGWX12w3du9^X86z?CV(I~2(vk-}i5%k!{6g%S6Y_^lWK7=G_#ZRn_cgaPZ;fh?C{O;h6rVy=pIHPA!VB+108 zIj%2pe~*wM0)quz{iCRw$nEyTv^nlg8lL|e}(h zuaTQVh_1SKzfNZq?S@VQxK$u8kK1eP@T3EHfoEG?ai+Mf>r`f&^(CkxKCYhTDn9=9 zTNBgmZMZC{;FJ#fn{m&#CL8%fqiG=@FyTb;C(i52 z2Qf*G?g`x>Ky4P1N6_4r6H>Qwm`7=}J-{<>z59zBpS`ZXT-gsRvEIGDtT}4+khuHx zoYI+HX(f&Dbo%o9uWaR`n(SJ3(Aj$x+xr_>|SJ7SlR z_BFT3qH`2>EB!F6a|mblN`I&0Q8-t$f*tjo)Ede7u{xHIzUojpq~kw^`Qz5%WH@J+x%0 zdvS>e7U*9dJc5>unLi2c^mOIH9L%sue&sU&9hzqYVZtfoTQJgB2}3D5N(^}S=Em={ zd+D!@<_6p8?Rd{FY~dg`D9165N<#zng(U)dekVs`@c6N|K>GI0g~}E#7_T{nO%89N zNaWu#VP4cT(~^pgD7B+;O3f?1E-q*XSRJy^V7W>k{Y8BcFwrO1kC&d{a;UlJ=NC)_ zczX;sA!d$NOI8lKH0q&HKSxSjb>Cax>HkdHUUstSZc--0W6u_8GJhv!p+ASb!I8zb z+6Re0X5)!9>hfR_5PE}=WFfzh(+8JA0kLgm`$SJW86W036=oJ&6%eZd#k(CZo9$j6N2ZtFM zZdN?YG#!CnOF+9{+tfkAn*@oy%tFRJJxLKvEGO1WS3Fm{!K$@OUaL8Qhv|6=+El8~ znvhLq4_~*XVY^jXXXe3}SR5vAy<^72+9UPp82YVk0en&ZJCJ3jr!cb8gQyN%G}KJf z6fskN%=G3rZV-g#A(m5I8GUNy)jkD$_TTfkA}w!#Dkn8o@)i?+8`7MGsG{!>Igb3J!QK7pp!I5XY@ z8Jn6sTL>E`R56;FsqW`f0jLjg($Hm*k2{oNX2yRyQ89SE5yx?ziPqs)O?>xk4r52KQj{!hgH7mSj!ZFIsdkTX-~H&<41 z_{T+%v2)D24LKh=qBMHZzz7IBJkGN{_kWG~fR9on4&kHV!7~j(+?8b!gpmQe8r9>i zO8gdcykr0uhbD=|h-F`=(@X=^s?T{qOY#EXvlHI#pYRl6p`E$DNm0njW8bqA@m*33 zczq)SF#43K@e*~KjIl9|mMyt+RA>mix0aI=ke5%1fenCXQYus=|V0QCNdfb%KS zO;Wm~7~GeUXy?D7p~~Pzs1VT^zhQIgk7Wt%9?tBpNR;#fih@C>KnWcat9|1^pc$_= zC@)v8P*xf&WxCAwhewY5J|}B}pHlr(;nAVIKZ&za^STb_bazAmHWKDhuH3>jA{impxv#7m|Mxt>PJf|^ z;3~x>j+>gC5*pACF*%H?#D@jHNGmJcD0mJ^5Sz(%-r_P}9sQ89!V6MX)5uxpt*?z}5 zEZMdm9Wx=G+@qB;-h77S4Zf58sz7dr;;Pzw2E*Ql9C0WJN`MPl$s;f~A-?%HDzG7G zjumH)>1X+mHtg?fGF&FctsJ{SZ+*6$eQ>&UDnWvq;yn%TNJ@ChTjA!JBw?EOO= z=a%Xym;@m?X3)Tb0ON2uTkDq#buZOY2ThD0 zpWcfd7#*f{zOgmZo1cnhDdg3G@&s5Bi=&lVelHX2(v`s>jE=?>HZ1k)@d1xDmFMia z6Y|XJSP?FaR!=H;@H0;4gnanrHqYjrP?xR-<7%*uT>UnmL@avnjAA^w#po;^VAmg{ zzW;P_?COyayXu4k^xh{<`mZ=Ri?FDiK)$tr^ahWb!b!-mj_037Bldo6wdxF9VEt3{ zci(LLn_h% zV$F6BT;=6KiFE!FFO+X5>vw0T96@FVJ@3;J@}US2oV=PLTi-POH8q9_1hLxb65XBV z_^iMr9dYl~sCBq_!N+Rh?eC zbjI&joEW7YNbdg0*1(!EoqSkNFAHOh)96Q@AtI>{B(sr`vZ2WTH5HTY^94W<@XmjC z?n{3!%19faMb1(QhCIWn)GPhm=?QesQ18$h*3FZ{_~uq#NBBbHy!x`gKYwH*itk={ zL2Krd2cJ1P2lBLWS?f+ePJT}t$TxhYn0;+|ngM^|+@rflKFm#~kSr3m#pq~deng;A znz0XA&=$nO>1p^}KR*Ax|Gjfa{9=&XV>-!X@)(JI+Sgd_Y&^gGhDp~a`yZQEoqmk3 z)yX@&(TUf;5t?RDbYYktl@tp?fUdMqW*f8|4u`=-0=a?Zvg?+^Cr^TM=Iz#BL7MWzOF9;7~FBZ!C6aT~rlSO=3 zy9iK&EzwEE&)$|)af~p(kt!E8NVnxE;`!hy`|sZdprTnCW{^a4k`^AQ9`)us?AFnF z1#xT%H2dJ<9YsBGL)OQP*gc>j!j|mi%}uEUIA4~RM8A5SlO2%#BJJuA0KNWhKYlFM zw#b)2Du|_!+1}}3;Xg;P+EODN{BVtm7F+*BO}F8Z%&+5?Ake?FWbY=QT*(u;I7e9O zET_~?)~=sD*Zi-SdZi5AZMNvLA945@ZqJS&*jml)?XxP`cSzv zsT^;2U)N#!g;UX|gFk{C{l<`5HhnV~VIZc5_k_~OKOZ{8^bau)vBs%ZH7iONe6T9p z9O%xTZVRG+HSDi1pA(VgYyGaRtzorz#Cw+f@$j>4F0(y8i}}b`S0ZtNTXWl7J_EXA z{QViETF%>kD!mDIYi?JJ#6tDgUlL_0e`Z9)%xod;Qu*VTaMC%zrb;gz*SA9^wp}|V z`i1NR9=~;5ul;2XB-6GA2}Jht*yaa&`_>VMg_oQkNG4y{SbBHmMfGG&Hehk6mJtCJ zXi44s@`YkEOx3b+wj9+sG~~UNby$k^ufNwYkJa)cu+)?G49Z=X za+6z-@2|;G{KUmEjg4a68!3Cu7YF?Q?wM8*ZJ5^Dfl~C~O5Y4c9OMY({a~Fw^aez4 zh-bswI;naY-6WWwCth8?PCRhKO${P4Cs{o6HC~?_e|E#p7d!j z0QtyKQ_`yn@a~0M1ou=&4nYzv}{6IBeJZOQNc7MxLrP?R71)MrEa{z`>?) zQe1#JF)^d{?2}Lxdd0Jg5-*Lgz~1Ti>;{--vdND=P0_>gqp+TQ2|P~3bZ*BzImBt% zEvU^Z=E#Q1pE)?SkE2adb2A`aHf3$3#WTp)5G2vDk-_lSnG%~JwNXgMiL}Cz1+)-( z5FzH1PWAwl3IRsDe?%!dK3l0^iR@Myl;0Wjvd`t>RTcoU{TufI%kEk8&*%~jy=@lR z_4U~6Jb0PbVQ|aAU3NL8*X^+|*ud`7S9i0D<|yvotyx~bpJSULZ+xNTSF9Z!^B68O z3l5xP^j2AYmeZ^!v@gSC+_hiM%uE|R=E5|4Hm}y(N6oKT?--~5-6h5AzZG<}ykUm^VX}=aYpXxZGc9YGi_6LS zQA;1i+Rqq=n(xEgYLZbw8#D>sK}_FRHDJ8#KwS2>*E-{ z`w$fT=0Ex=^kZXEn-qL;pz4QDo+@+ZSqlA$>vWh52-Xz|njzU+eiTvk7F<-?25Qvz z9O2KrPCI^1jmgd0?oDU?t#Q7jQ-Ld8c|IXQ%X|0nM-0uN&H0n8LO94S8cAUjPBR}% zVY~Z)s|x#4YMviW*zW^2cHlD&WTtRnKIK1ao=5S7%7feaeMjl7AI`;TyKlWY9PP2a zuJy{M@}-|2 z=m5?CLTS5%kW5=!?BMVgHk_Hcd_dGrp-K>$9FHYGinJC0C3+h*K|}i!%^uzBpt=m~ z0)eN%64|_#pF<_<>l4xO;0~GDqB8U})g!%=kRYM1`QnKHbu1u&rs(I79>l)Lx(qi} zFR&t>gc5lW5?~xDc53+LQFYdM8fm#wbM!7iyxFc63z}zYxk-2~s-hizPUXn7k3rJGYnf>XDJrk0ohP z{6>*2-_!q*Eo2H`T+8V{92e`@^@m@qqBU^+z%AD8dslAk+on507eluHhm|{(1?Lxj zwhf;xPJ)pU(>VT{vEU%GwmXm(&+F!?e_K}l0 z2X`Kn=J$n+X>+Cx!!&L1IIwRWCq>x8i?!lKL##t8yP=(|)zp82gFh8pN@tDPq%flY z-D0D5=nZ_FC};oY2!PjO{hv}mM1;)ufAGjmw(=>XnH}@wD+!AGW@8YU)_dubW1*P$ zyW!)?0a&dA*F&z{&|xBVS>kRjw_iQ06XnMdJ%{7IR>M8sR z<3OfE;d*uM;NPeZsk+B#0kXKbej|u?BumdnW|f1ttyv04(I3e5XXA@%Jlf{!y~KIYDkSGU`0?Q=yXnw#`ls!r z7Ju%VQ)bYWbXJu;(=| z9d1eM@IZE>kl*G%wi%)nGeYtxEwsLMVJVGu)mg?J9&{LX^E1e0hZ1Ba^9844kQgM4 z=NS`eaT8>JeH4@IpGNwHsa#2+;J8a)tib`VzZou2d@kE`hHuIs_}A;qB}hNE?~(|> z6A|oWh|#f>g^&syoCTU~hT)_XnRl_|ydWix?7?6>w#fg6dHWWjXc+&mDrqKZ^O2r= zvbUdNN2Ns$+uQIvIaElPJ@|avp?q@%bqG?Zq%p%7$b0=HLvBi_X0P$y_9 z@=2M^^>3OU^$8jIh=Rv?*nz=aKJd!%GfTMQ_9T8_>*Yt=B?;`gCRYs5Yk4;iDaIr+ z(sm(;JEcZ$46lGN9`kONS1ThACQder1_;qJL>8_m#D63nrrPztsU8xQ80xS^4UDg5 zSAg>Ph)1>OQ@zIg-W!w=$l*rVTzz?`9dz{Ov83*4oaPro6h_B2G$QSqC&40MBd1|{ zg1?HBwF}}q`zYahy;VAxL1*Xm5HX3KUtyuQ&Mdtd7e6q8zzqbX75vCIy$|e%CX3n5Q8CCg!BKCDlNPvOr(LZunZod@oN8Zcn#9R`q^NhYg--o?= z3yUEQ)nz+20|S`pxnk$1AC&H~d0s5EC0Wb4Z&JjJRT6MxI(xjRAYmj^&Da5oV$-!?+`Rny?z1L-5_LwX!MOOM5d5i*mL{& zbF(g%SA1;u+?<>q_L72zh?w^wL3c1?y^Vc9If{2=esZtnOj7=|_e>LPgs0{fH95xh z{n#BkFDc3T@a7KLAYVH;)Pq{B-}JKBcK3|ts_yW?uc&4fjlTRBZ+M>yxf8Y5J5Q=r zWHV2BEZ!HlqCZF{i`aE05H>YMCPkWXy%p$~yep_Z+q^n%$JpL;ckWwl3xV(Hhd1sA zt|sO|Hp^FxZ)?BhZyDaO@$-MFt&oTPwbJ=T%Mu~cX##^`zA${@# zA^UOZvy%YyGczwu$3||Xw0el_Cma}vEdk7dN%gx-y@UCt!Jw4r^Rc3gnimQiB)!k^ zoV+1tubsTF^5)WoT`EmTr&9Pbc3;DvGREb0H+h&{r zcbluU)~XBr4uYLL|!rK~-Cn;yM$~bjS9MFF(`GbTrw+9%OCiwWjyw+cwX*GX# zYU+q^U52F8)W6_bAJo-%aA2`no-!U7!Ab)r@*fY58%gn>poICWxE#}}XLGE=P+#mi zbUE{Ml3$F^zrW72z%9t3Txsb^Ka#92NW52|LTb`(;n;B&@O6boZ_fM0I}s6x&*?_( zH|9wUBJL`^DO@_+joq5?i;03kl<=R-2aFefg@T84=7SfVx7N8Px*JoPKJjRfaQLih zj*(fsC;3f#WxQnCc9QbLkwv6A?2-mQ8A-=1-nn^v%OM#*y6ba+VoNUDz|%5pucqCv)D9ho20i`9Hq8mC(U`guOU8HnFjAHCegdw3T!~j zNznfUcdj^5zP^g;$sznx#M6Xau5^tekUl2O;2B<}lDCd?g_*6BVkk@fN|8a<0nID$ z*LT$WL=$Ty{a#ZuM0o0V5r+M*n;L6W1pn@vUX6)Gb-DDOLoF}$V1QF&N0NHLM4ne~ zL8R^N<5#thgZTmE{46q!+SK#!ZQ`(ah`6tXbM@=iSzn=2)gc0+#*?MpN_Mr zv@KUJc`<`{cXf4jM6)yY_*w_+f@uJ~_DX`6o(a5ol6D+{!pOudDAwNxcd1(Id2a!> z9YVS2Ani9XygLecO8L8(HyU7qfUaZZdk`b*Fi2M`-%WnMG<&;Px67MC(MavBmBX$t zPRY`XAy9~_AeNrMc5TvNVgkQQyE*@%dc*SvIWp<9e&uG}nB2z1OpA&Oo`V?p_$1Ed z8E?Boc>WHz6Q*dg=Vs1jbTNM|$-;Eek?LQY;G_!^kR_k~G)3X&^pl+4;{A~TNB z7T;t6>TX22=64hfyU1#cWPXSg)c%u88?JXJ?89w%c=yc)@37W8inJQ?#k%W!oEPR! zV0nCuPV6f_zRNVOecUP?_@YJDy#5b&HD~Q;6Hi6R7_pFVWK_m9T+L zLS3M#jBRMJkd#MNcW1^oHa<_n95*xjZ<#6q%Y$&=&H+pa=HV)jzlR;BHFJ})DGq`t zWa|4F$~Q!DoarIOeu#NNroLKBMo#Y17{ae&M1Q44@Zw^;^(#)0Bw;EJ=6yIl&%Q<1 zLl!g-N>y-n;KcI5@3_P1KdjZ9rdv>qJpRv#v+f1UGGD*rm18+y(AG7%wyugkusR}o zG+ts<&;ZD!VU%qHGh<874uNmEJB6{nH`Vv4XU|Yhxe;49$db9BK!okpfW3u=J%%WK z_*eJPhH-fpSZb|UvlCuj6)VDmo?2bSG&UwDr+pM(BAB+ceLDb(+gjl+Tf3FSeMH#Q z+~_l3RBBfuKl_y2raWY=-?rM_d404@ zc=)k-nr3&^FLNA2EK#U9GWR1yIU6hSYYP-oSWwA~~Q8{M)ynD?WxSK3*V)07U)+`*%TRv zRZ3dxpLke1cAUp`4k&E{2@0^u%`k;L4wXLKTuw2EW`6|(hZPr2jx8KTZ$Um^mElZIiTp_B0u_vo z<1Pn=vH$Y%UF32gD-O%=BdaY321ZLrN`4Loc{Lg1GH1=-9-$Td*%vwcO5gmU2h?u# z>J<2%cIyzG=>1&Ur@9O!^RDsYpF6>(n_>I7-6wM{b#^>^@W+^%?&RE!Bqgg#h^_qY z<6Xz(+J=7 z2^Z92-4G?yor)2yGZt`e)*0=}$?BVg`O~hYelBHdG(c}L3UANkq_20)2~b#(m>(In z_R9G*3xe}KvFlFrf?ERdzVR(RS(VxUq(rUk)*A&n5;!JHe>)XIEu0?I+&B)z1`12y zqT2sc9mrW;uznmrfZLV3rkD5c#BQ+MK&8H}wmVopjzyy($7omLTFXHVQ`R@v;UB+j zs&Iaiz&Ta+XBtuX;EXGI*fyH~JB58BQUF9UE<~X`pW9(vg|B~dXUJ~(B6=+MOkb{^ ztt>tL4{bz6nI~{?TUdx?=PkMU-Iog!*Pzrb)1AugkRLX}uMj6}KC1F(65eq^LUBk(CmRIfpGMWjF zD_8y!eDEQCeradx6l6iZvyvgLs9*tkC#YPg`foWCTUz8KXWs-xFNRdH)$u&`5mRlH z=J`){DFMOx*R&qJOL$&@V)2F*^BevVon-l$|1Sc!?ay8I7m>HktBw`SZ!qUFWb6x& zUrBuBCB;HnFq+%vI|Zx(shZ?0_g%ga7U7#{Iy39Ed-^sskYVElrlnDR^i9JFF<c(4(g$Ibi-IN~mx z7x~bc(N_CCbQbqb})|@aN2h={(%8 z3DKW)`yUBB?N4~9jx;25DQ>nA06MVP8yms#+%QUWFBP-o4qcB=AvF{(S~dB5l~9nt z3l2$%H2>V4_)!r4YaCh9@*+xZ_NKIVV6Mm1Y*XkJhI$Q`0Y&DA(qH3oU)m7&WeUvE zpe40W?9Mh8CeKsT4Of%*ps7b5heRIokk3D$DVF@RMbBeusmAHW4;iasXfByQ96@5v zU+|xS6N?9@ifhDmr+YGwL{51>5(uPb=sh)$ z8AEU%2&W+ejfgwy?cTm*7hYrZ3Td+z!=XD9N89(Lg<2KXu#Jq!{$2^cvziWSs5k{V zZ4U}X!sO)_z0p9fgPt}9IpYUT!er@@SVU`xz8;QD6KrOi+K zn_-Az(eFl){U?!kS__}v9__e5ZVfWOz3(B#WeY6|Lr8! zwGSuEY=qkZMs${=L|IaJ(8GaWuHL;jna#c;lRjScUkdYMNGoodHeEv9~zR)>OwIYHJ-V~|9E8d*&JIo9!tl)XJqGZr!jk$Ie39{&5M5O%#;3b z&LU)TVUZI|=L@W;B<<>sG7SqWrnIvUj=t$Zn9qC@7efpHuH31AFf%a58_=Uib7UAjUX6Bpn%yFqP4K>kc$!@L6u*r+xn=ujiAYj-6a~q?@4-+5 zkB)Eo@@Kn(;{_n6rz9F=MIx}~|5&QGX0)3BtQ$LiE#8~+{u|LSDpIVkHh;;?&K#m$ zbqq|XH^-P&1;P4*yx!gavxxX?l|O?QoSFK|pL0LjH}0n)#lmdTV>XjXeRa%pQa zI3@ESs6mgA3E9Ey%Ct1#$f7yy19`i($N<UHgI)w5`?pqwjr|cA_ zeoq&!dqvY+uURk<3+hRD9o|?UR#s3q4Y}$wSlktO`r>C+jrkX$PgONIR30@ki*#cH zi@S1K!Oy6$oyTAJVm_geVA?k@+C4@6Dk#nr882n$no?;buxfQan_RA9)aQOWc^eY~ z@gY;x(1;{HtnS7A)IL&Y4V5hJM9oQ!G1WIG`QFn*;|`5$D`}`2gXQNxJa;p3#o3w7 zn=`uwS%?#Y+=f8pK3C1VPR_V@yI1b2j+H9noNvt^_TV(<#c}GuV7{i+gYBl(Cv}y( zmwyh0$`+{)$0dm%kgJ3H{16D_%K)#p+RJKPxKr}Q$%Jupg|>ADclkyvm6Gyktv@>k z57SaWs8niqalRtloWX+?m9R=9c?}gjTl(hNZgf*`q$MPoOcvHTk9Ch`(1zV$O|A~L zF$&i|eKd}fIn5kWu8)oI;Fhkj?%Q3Qy}Ii1F~+ISqj#Kjie+H8ApFR2GOt~x?r~gx z&e@!4UNbe$>}Q2{+E4F(!*!mbTjITNiQRdHL6A}%#!VT1Z5HD&x8_6Z*wN^ia(U6M zBil?AClf{a(vcVi;-gy?2}(|zY?FbP%k>7m+GZ1zBXZ{W7?bO(5{gRw=N*LnkN9Yw zWr$?AKJ3ncm33#T=Y-`w=i^-=@k+9ucOmzSHfTb@==&&2oETYFHkn|3PQ13VBM^|? zab;<2P6&Z`)!umlMi<_WY;OJ*KyvYRe5O&qF+`Qs_CtH~xf`X&o)>i!j7@r~LcF^z zPHZ|xMO-~c=9sA?Ypvm%FEqTf_jE^zVd)lRubTpL3j%p<7wpLU3U{_bT17|Sx1Byq zV@03R_*j^s4|l~|DzT~;zaBhwRj=>n%g$Hkaof#Hvw8UmmwfQ5{wn9yoD`OI@@+fF>c=rj#vOT+_JY*TmR1$(Z3Xbe+ep6C^|{8iPKjuxTwW|s z1s@o#=ZW%lSK>Ct2Bb`umr8=fA+cyyCon}w51wpOlXq+a6uL3gDD5=m?$=IlTvx4o zNsYQ=XRSkW=50DRQ<4XPj9~Do1E#zZWU8A7WqRv(}s)nhWZATs;cyMj3 zdM%IrM7Bhji_M7x0>O>|YsPq*`VkcZ;cvv_vyxEJUW~LjNNhXIDQ7dQ;M~3FsOQ+p z^R5cCf4fzRzo!o0s^WpD%b}>7d^Pb5gMKu*s>g8ny`Q)qYJO3cLQz2^Ds!| zgwY-B;s&7cK_DiKPCkGHSHB*^jXa#@E~-2@D!7fc%hboFeyBF~zu9YzIA0RLFdo?p zsy%O-H*8a0Ejb0Rwa|fF4hnG{x7}dEGAIfjtKA25UZ>venvMh0x%9%mrDypMUAKK@ z?XEZajkc?!4#$Jpy3y-tRl}d5Kw5ep@Po&m1^JSM{=s|26OXz}{M8R<<7<(#8ntKj zc5)jIG%33`p{GJu*^pG|UU(NXoH+UtdiDa^crHDrVf{DB=0Zf>e%5bofeQ?D>pu9a ze6KHYez{n4u2&z!GqRr-FF9Y3)N-0tcG{_TxI#TjNkz%^r3Mm+K__1-R#7Wh<=hVFktX(qhgPexL#9bR=rbnxFGn;6kSm?&acX?%hyhvSGyUy?SH3^_q!#ISQAJN0}i=+P}%LIGk9`osqU8F+E+aF$Vf5vh9EaqU^Y&lb$Su2sUzMUito zPrgyF4%M=sKB1zcGaWbwGyQfM!-f!K*l`i$lt$+%xXX*a{u z+?%6W7^F+ky?aGTLQM8Jz}LUkPu>DEY;-+tOPjRVF}I)5y)-%`inWNw*KxNJ3!6K< z)^fi@->6<13RM78gM`W=-l*~HwE3Pbi>mA6A}9fkhd=t$r#YXXnKDCn$S_k}+ASWpTV#J4?7mXHHS=w?H_@Ql zQ`KTS67e>z+dvn*ukv8CaZuT?x3%)Hh&$SzEiLUn4?1|GST?&kzEUje+*?O*VzzCE z_`xT{wi;14G*rgfagdRDYrRxhtJh!mSV1|a3)&Db&cGd&hcYMImWw4$YC4o>pTJP- zpix|Fl>j$eiH;t%JUsXwE@}+zweD?+=*ZO1iFGW%0+x$w7}(xEoR_n))!9O)D(B5n zV|kAA;tYJLgKJ4CUDnMJPLd2U#aqS6=-u?mtJ=+6dHT%LztP@qEXy?4EAOEiuX4|X-r zR~H(G8(fEJJ%8D5G!5Qk-DE#F$348p^X~l}kuePWRWM{%S!u=!6_}n+)^^h6^?v&y zRO1*d)B8Du;{7gzW9IHeU#DMBTV=3@e~M>2G#G!jz@xrW7CdBFRCgC^zUkaaXBPgQ zMbrF~10VDN|CEM=nM1S0LAojBD2K&bzPiH{a0w&ywdFPtWZzD;oaQ9ejk1VYG58+( zJ=z&(rwhR7GO}(|Slc5P=Pa%fWOF?}uV6@yW$q2r+Lme$6MOv?w!7P4ZBgr)|`#<~T!#_)L-_ z2%|ElvwJ}3@=N1uh-)ufwd{9kHU^qp z=^OPD3!6>^kJa8l1~8F(Ya+Vqnfmu*byvFufzc{Dsl?d+SoPNg%|}uR&Uxno8;qZE@Y{DE`@*7OVY^vXQc=AwBV;yeX=@+%91w_xM}g5Q6l> z?3VpNkhyU^Pi&(8VHiH|8&peY)eEaKHTv47dBQ|oNG={1Kd|3R<5CDBW5zXpOgTMG zb>k-TuKY!a#uu5HDIVnjt=DUx_m-`+#8pqX=Y_e95avGg@ppo2lNcO27I$ZzTJVX2 zH`1%n*`k|r73X4&e75!KJzWET7*BCQAFD`f7tgYOg!fBf<#zhL2O2#c?*pf93qF75T zEASycsR+wPj$FS(N@k0#*KEWIbY{)ms@r0*5#}4W9gSgLX-r7o8PxyjbiR04`dAAK z@_6MquDNHfxsisQuhzWo#AJ42Wm(o6?x^8t603bVJ2sI8fz00wOCBIA)YCuVJ<#$DrWLi?85xu+U4Dy;Y!g&guOmY zKS@jC%}u?Qa;~KxcN_8!p{yQ<5;1dFPO+C%Y3pr{M6(r4%0&3fjb%GNTBFw$-b5XV8Hf{{pAMc6mb~fKu@LG+mukN4B;f}$WCm942ZDB}3=mY$Cwjyfj z?gXXjVmbAQNXpS_^VeC@iCK)68kIYL5@L-uqc@$uKp35CcMryyT{R4yW}JaPVd$Sw z{kj`Z)hfc$OB)ui1mSO`Hb=@;c7#Au%u!L9F3v18efTUCmsUwSIWiJ|n?Ig2i>X)h z%=YBQ{(dt8k8 z5^ZM>s4R!8rkv)(5~7P|S5wy7QREsG!(6#FublE6wuka%Uu;-}d1R%tW!e zY-kpx>YNs~Vqnd_=I1Fgdkw7NT`v!xA8acs3}w03C7p~{Xt~2UdmV@T5)C?7OZt5S zN+Kd7IUnDG^iU#fEY_h)%`FeEG9zOnmW>gPsDN;>U@L8cn*7xKZ;Yg-W3*I7*WxAf zkLZ9wIE`S}T#T3)<=U%{afhAmm*aWf=e^^GBc>fWrz9t`sTgxoro-8M=EGKbFPY&u zi7(fZVg^f^fPc+FHt&?kcQ|XKDxp!4JL*BiRo#<7aQw$`t?}EZFs*VKRuo8i2Oh$h z5Cfhmlj(C7;-bby)7JTM_&8H~ z(+*mNs_j~CIz<tE}G#fQOQqM7pXmpY-@2i|< zWul=;fmeID3&1nwK6&479Dl*9g1G3+ zj<)gTw&YWby*ix<(^Cho%a73`3v$yxQJSTJBpoUeO}tlv=5w)s(JfRyLwz`!FMDpu zZWKh0UNp{`P-UKoura}QD_4Qx=oAX^Uc7(TICdMNgfz#Cl3dzFY7dfd%}1(6{Rwhh z=X(!^h%edHcuL^&SXAnE=M}Rj)vRXT!f;&sqo6JD0c50kFoQBne=U~Pif;wxJY*E1 z1JvBAr{R+(dVD0m|4FxF_jHN3Hnb8r)|5Bq$LtT)_OOH`Fz+Jy%VOiC#0P%a zuE#!~wi;ur!+3c!0?;MHC5ypl50-LP{a)QOOyw(700Rs#W=rLXsSktr*SDk8jv>#b zQ2fl4Fd7)OBCkt{il^Jj?zeD0!pRrM5D4=tqz!oOHfY4Ll-prG<8@82+jAC)7L}^duqVy2iBa_zIKLNM^(JuL1ni z4cm=l(<)f8tAXF>!MSwxnCouZ=}cTeoHmF0+IT#?z21BVTEOtn>eHVP zmJqNrsm!M`RXp?CJrc8txLD+b#ZAkNx<>L?t>zmH)q&GH_8#$)NP@~(H9?&@{`z=l z$>qAHqF-K-HtM*rqmW!V6YE&5JZiYwR0=7%ep(t6MQJ#24DZaKDUP_sJ{Rkk>hdxf zou^9Wn7DBbR(s^{MOAu^@;*gjDic_?%9WdnL+OUpucWQMe`%VB4Q3X$?=+*?&V0P( z!%?&f*8u2Ccwx<-t4X~zL;FqA@a2kN_5#~xO6@u$U(H>~HdWo#ZnTTF4CQfY_3qV; zn#GbKuZ^ss2KVad=xBq3KrAZwLaWDRyJkF_m6nEemGWx+S}Ds;tyqzH>n6d4lJ*#?(9Oz=;##)G$XvoBp$N2sn`c4|p$w=SIRPW9_Y>lh%RCBofhzz(j5 zWUg=$7)(UTvWxLN1HCc(Y2*h5rcjnRg14~5TE#R6u^Fy2zAVT+ULt*cY1lySD?%4 z#4+r7+%~aYxoTk}T0kW?pJ@Wrt57o?^>Bp?9qV*2Bw9;e zHewViry?xVG8%`1Qw@lZI>NkSoW7u)eA(Y<{~mpIV~+c9-8fWR=3WC2ZM}tyqE(}J z4gkW^k)xX)&eKL1o1a4^RA>>MjjrRj%WA{+@*MVetSU$>&W zkX)oys^E6YDf$bU8CkU?VnkiJB@IW84HsgiwNnSm7osU$~;ggFFY z_lVHdf!EdD#3`m{kLM5tlyC|}=EWVzWq{7B`>Z`YQd6h`(X~;J5LsbWM1_x^w?4OM3 z!(lbn?;s|RUit|N!8soSGjlXEXxMH*=XB+#J714ZKygAchT0qHM7F%RQZzro-R2dT zmeUEEy6fm&yI#xbEc4STPikBr*N#BFr)66GhllH^s36dimQJP%y-H+BR7;6rsAnv4 zr`P%<ut*^y)ahx4iQMD_;nX zkL!5smUgORl@_h$c8yZgfRJ)?r}Wjty+ zuX@zD)>JX&670aUmL6S^3%j-ICs?-sB+j^HTr^v9T*WaT7xIkt%1&suw;1iidOYg)gE@;fqSkV@D$EdeA$C9YjA4lhHM$O9G5J#jA8+=5}LfOv; zbJcOxGeIbAe{W{qr>|rr)4o=ijk0LhRf2#Xr*RA`PA4b9kp%Q5XHI6OQ@se}HT~s| zo$SM23A@g&t+Dy<%F5#6UCz44?|X8^C!H#{4pu%d4Fdt=hW8Yb%Yy`$8T)f{bN>ih z_Vo!nTgLH9I-73W8JR$Pt-8}hi{cy6)oMY+!$-GbsGS}HuJ74@{z%x5XVk9_%+E!E z-AquQlv=ypgIm^eW$8x(VZ_A*I{*SXjIJDq#Bc6`ff8gnb=GOD11XeX-Rk}+T0Ath( z>-XN*P3azm>HfLYC62g@YsJ^Gh6*u4K&=239`57z9zJTeIoz%pdt3{TJzeWeA`g)6 zByMhcNgfc^FWMR=u}1IY1!^A!`;{~udLj; zV%+$(zSx}$SLZNsyY94P(-RnYUdX_rPx`?^BgyJl&t2JYzp0f0#j)NY8mH8qH?M%% zLBQa~>Z}EG@~XbH-;KeaB|Bh#(pTCAWQoa=dl_qL{1lBUxHZ^ys;20Zaz4k z@mk_Kw^&$r*qovcrkmv8ad(!ABeonWGaOb@QZd|K7eBY#oA5aKoBIflg%U)`vYR{S2DoMI& z)?kLom%W-Uzn?*Rx{(tBQyHW}qJv;okj+G3MduJ7weazP+I=?D>yxV|7j zRmAnbU;4jD0)q1%ISAwhMEsqA(*F|n{~}@kmze(_C8ps`z!ke5SOSRXtf3*PbV78d zX*ne#EVf++B+X59c5{$jH?+I;)H_;~_>983@md)Xwi6_!GS^5LqI^lE^bA02$_lR$ zaUXRjKjKM)Zr;fci7$uD2g5?Od4Ys`O@;jsAb1E3vudd8%|Q7?6} zH#~*-EFv&{5MOfJ$x7q!fTJExwhT_%jT@Fv%1CBe2H-dnTOa&3J@4n^>*FhNf3*YR zp&W4*5zSsmha*Ovz~cC8;%V7xORa;>W!?uBAL$2 z{QY+Wz;ibf#eWVWHy6cjj#G~2@%nu*$AsvZzQOa7vu=CWt;sak#nE{#S|Z5zdq~wF z7kWC67yDSXiQ1j8QiE;MHV+`m#~}ZJLzFjy>$+0XtI-uIQh)+^uk!*)2X&Xf@joZc zU<7uXqnZX?x{lV{c1#xQHH4K*jkRY}^UKxsbmJ2%K+9JmAHew3y6HmsqS(o?uhue= zcEo+xbzA8iq#1Z?&PLE&ms%nSt{;a2VN^v#R3R;oJPt=|Xv-H|Ibi-pg;l11uoYMUW~WU67(6A|N2WgHl2bAXQ3;ih@$5OO5mnLg+0b zz1PqoQUiqE5=i@w@B7}n?)QteSV_)#X6BjMGkc%&3_#`vv8!KfCVJWNrTWEy_NL?I zKln|s=eK)a%+*xQ)Er_o zT4fS>7Rdx0nF@Xz(2_yO2Xr%yY}~-0#9(rY4>9e3nCA6c6j{@JP=tZ6+zhvGKAuRi zYm8Pn<3?vd9Xq2rV52;m2VFL_ePVqN61bW67Q1A22^!*l2P;)B(_*UZL9Y^xv$UHd zbWBVV#0SsJ7J~52UK^t_P=#Zh*X{y1ahdH1s%qE&{b1vemT&}bI#{}OTxogy2DIzF z(yb%2gVWPfa5YafZqn9zL@EG&bjhB$TaW!HOzM*W*9_*Q5}Adh_p#FZU-1XDaEMNH&K^=_I2y(SCQx@09GQXEmJr#B$$-P?ejPX=gB37AWRhv^(qUtQLxti~!- zSO`8+6aJSn(;$aS!+=L3zQfBJ);b9w%s?^C6X7OY7^~0v2NVCo`v=F9Z64i=U2A2t zZZBffyn2~r$h-D-tyJitZ=6we*wdvpPnG^gW|`O*ZO1xZcdwfAJfPjeLEjC z0iD{rA+tiJ?FOZuls8*)6Lm!baW!U&;k#89iHdlUW7Dps zQ1*B$;_AxF%~~yhwLumPWvG^B6pQ#t0;I`=vk*mp%bT_k^snHkZdr_525P6u*AlWl zuu)#x(D_{LATD*Wai_(~wUL+si}dVKf%c7R2*q$SiF(+|`m8@BR{MZwL0eN5YOx0g z2VU#LK_S)Sb`f19B5bQ^j8-ky3OoO>ardl|IT9Pp;@Tt`uv?9ZV6?y386`9%+LfN> zJ%N%-b*r{jo~4pGD^S+eJsUGSft%u!O}rx`gHDcvO-jMu z7*f*MP|si^Q2_(4Q*o`|E@Sm26q?u*2Rx=?y6k7F9K9P{<5qqVv4a~>1x`CV@_e~y zv1DQ7^uoENJjr86!%01$n`A8kP&h8vZ*PGP{wIrVG*>m1xf<3)jxw>u42+`5q~W{A z4}K0z00URf-R(+8(*?3p^>(V1bL?@=R{B*u;#;|`@<=@v zMz_`;r#+NSKHFJ4xX+jo7fdJ5<6K%lb97>#?x!y6yZNZC;vyY;Y+IC^f=yS{0Mf`( zf{2I8?R?qt{gvrBou$H~nUUsP-eQ|~Jnj?mrcHHaHOZEyyh~>%6lO6a6iK^@nIWw1*w>$ON)(B=v|9?CZgK@3955?nEOl)H; zWi~$9j20R6nMBFMB~Q^1I=kfDq+aWA5*cZi5OWzlxwB}mp94> zoWR9aSR>Ds8`S8gtHOPLXseW9(oZ+jDu)=TJi*xV-F||sMXk8_U)Pwb@G4Yj+jszi zQ3{%kh+D9J;m}gk?3yvsTa}pvL)(p8QO?6D{yPnNYgUllm-5Y^L&DCF1dkCJWaxd0 zeiQs|tr4xPJ1S6g1z_}~6|z;KkBQYtLo*q*(cC^LhhN>E($zd~%!D{=vHj5JgP}&Z zUQt!H*l^(%>oaV5{YfY5+o`91xXeb6sZ40Mff4Fq8_Ao=W^3v|UtfQ1BDGu#6*(~k z)84hp-j7{rz_<-A1nlU}-z2ts4k5l*PngRirkxI1-{PLC#oEIH9M3Stnnv~=3`yjk6n(7k{<0*Kq?6YU5gk133!Arpr0wmj$W>fg<8j-}C1wt? zdwv7yyhzxe;>trv6<3$~%o|zVhe(?$7MC{Y#@a^D`waTbx&S3a9ORN-Hp^7#s_B$H zL(x6}S_747135?m5QGSwS7c7eHQLkx&;I_jpX{?gZL-WU+5e$8mSN~I?`J3qR@4eJ zoUQT1PB@O1sQpXKUwfY-d$hOgF<~{NfgVgB&2>(ajnvW6i2=%(?HNoO<+6N@6*qmP z2z~fx*`*n|#?Q~MhA6G=#&ZN3yV-c{%<<2H8@+*tFyY9=RM4;Y(asVJsvMBm{bk;l zsHd-3;Qn`BZeXLIo$YhQfj}F%iQPid7Lvqb2;K)CSdI!5e}IMs7`h^kXG$7+)i)Nv zo#>Cp8_mWI-rKRGqoXc}?Fm2hJT@P&3nH9s5eL*M&g|!rgJq4oNo+xl_Rk~k#GtmD zhK^3e&G06LB_;hFWG~asXxKOSkle9-Xx)$#*q&(GqfMI4QFByJ4aEA2!trpV1(&$) ze9Cy|%k$sP8Vcv8?A388zAc*=fMB2~D8=ub-4!gYeHA&QC6CuOAq)rWPUL~2dsD#o z@0(3zR@2{ZDTUVtacZgofm@8^V~hNyG^O5{$Av1Id3+b zY6HXGzY)69*w)CnQSBbt*|-y8R*B7!RKzb+V@jHzXFwMd)&Ke37su^fUhQ8^ z1XZ~L@2$f66C-Qa6txxNxa(JI9>X`T(aLDY66xgRI3RKl)eertMF=Z8n((tm97=N9 zC$;oo_`L5**<;sk3*WhKWfqNVCuZg8q_h5sAj3h#US-qqN#nHFa-^8kNFBB^L z9XT`MJr8}AgzX!hJ)hi&lmI;+ViJPpQ^}!GhTcCDJ?P`w5B0JJMg5$J5W}xzLw+6P5rxrI# zAf}CZ9u(T=RaT0nH+l_jV}JD%nDo%5eR zIurw~04I9(jTep`OnMG#&(?tdrcQ0>)@Vt;!#oHC+C3gtrtRj>&q&Y^LGTDZK)BS* z1&%S5Ex+wzO@!lNu!DoQ8&ieKgM>ac4@oAf3>1((l~EyhA#>EcMPZ^6nDo3o9lFD(YnW{SW+IWGaZxJVpY4EH$AMrec^ zYT8eiEoG#Rou=DY0)?$VvzLTfzAD^fZxy8pw;`E>XVVSqg|mya4)E70JQMi!@@!E= z+8#}5%jv1y{=*Wxf%yA?a4u+WCm#|-I&YBq>iF;+VXlLm(wZy1%rR^q7&);Lda9K9 zClmnOuk-RWi+igI8IU0yJ-+9&?%hFXWW;)HcGx|iUi=Lm*y_diRG$#Z ziSh9-=|o#laEaz^GJA`7u_zTM&?b@3Ji4d6HYXaMgNrW)eWw*H1C%%e#)oAVx?+CT zV&3YbC8rN&g~uChE;dP zy9k)5O=o|_(rZImuk~+si6%T<>;ZuPJo+|J<-(V4d<0;!;zxZqhJ2J~t}*Pu>#SEDXp0I2y| zogHJ6&@iYauGJg>{i1%PQ}kH56=Kd81yQVbwa=|V&jT0h08dRWk7f4t(^(UrzG;_s z9LertEpS*f6&V%$%o$t+{>$qJ5?AYFUflp@#Tedm-Q!PcF zuKDpgC$K;Ff&soe&yHr0++BAd0iLXjj(3_Uw7FtaOm?>hLPz`!Vf^1;a`vY<7=tUQ z>+%6wWCo^(ubA6xQs2`S znxEr2=`^c(M_O|Gan<+p41iRpSsm){S+~;2(#@Y!^eUk@?5zInT&8kp)9G4j{mw^J zzSS;9?_H+z6%jAZA)Q&f@)oXx35+)SXB%yCQax_9s06puAhgm*A#%Fgl@7Z7@scVq z{y1fHfsM5B{uMttV_%X$Q-A%?Nk@>#m1iujneQ&|vTywihHb=zg$_6i#{3m0N3%qt>PJGP{|Q>kTo{JKD~EtscB^Fm>g}mY;j4^O9Q0u ziUaqoKY0497oVAeXtW^LnE;A9AYB#Gix&N%3e1 zkAZ3RsVE*|1yX|ymDFN)$$B~_2KnMP~8 zdFB$^=oIBbIfCAmqCq>8_C0osBq}%wHH}#8~R}XqZcMWE1{<^w1HaA}a|?q*Ay=1_L#oFdCnjm;*pLrpHdYGrq1eeKmHEcjL6nA1NLJ7GN#fK`1nD zro@90X4Tuk<6X&*f}CUx4lRMvoP|j&Y=?j&y+7EcRVtr%|R~kCXy;*>0#%F|hCfe?L-Y-iqhRtmT%t^@loVZf7^T&tfN5Fn}|& zg@YqwZhmm5e`jz_^l+g`{7ZHy-GwTv&%M~u<6MQN+1k`0kCYJj?q)+&ku4RLo}N`l z;j+&q&QI5sE^$_dyZAAh8FJ)Kb1?)aic2~?_dx9A5R)RRU*H&=*w#}zN375{DmRr8 zcG&GlDhYVkM#|Egz!yK&)yObDt<7&9?e4vkb0JN5-Td1{PD6Bn9`fd%A{jN~t1hop z?S!N(g4=FX2A&KMSjo?|2%WFaUH@yl_1ypT{$(^4Z;q{oE-jLZ8;_*P% zlNYV;gE=Vn8*BBdzLN`Q2fd8KAetbiH{~|X;7MLhF1um$!{F}?U!Rl`zrxo5Sqlx$+ZdFjkGMof zXFr%G!-{O{*d>o5Gp0=bncwk%zXE%yQM9(r=IiYH5GcEu;( zoD{vq9U$-^nd;s@_x{NpdGw+23mMIwl9yf7LN@%_G#uBSXYi=eQ~Glejx08}s{Z(p zV?R!jiyIW0dElJ5g$@_t=s_D^{_8e#e1Fuq5v?ic&o6e0eGxgiv;;vTG5OLf@FWY$ zA6_pm8HC3#_lSXJjC=1~%cih9JNM9M%Q%FVP2Izza`Bc->H%!Aa(dc@>D=xuX2Uzf z(^aH$^T`1CA^n^?@j<}Dc8>HC6V{ZxH)3`|*Vg&}yg3s8H(J^wwG9|jYK4cau3|^3 z=I4X@s3BsJQ}zwRP8eDG^Wm{pQPpg)HrdyA=r8S?`Rty=#Xm6kVitBLBKUXRZ?p9n z=BOjLi|^mjh9dK|Iiy17`nG~io_@+^^h#uh@2`dE>t2z+miG|RrL&XqtLVsx|0Y{k z=0P;vV^#fk8}QJ=W@(4U!?!ac@#XH(hwvSF>H~rx9C-!E>=kH?7=4xvF*F~R45W~KX1uaH?Xyf<6fCtYy zp`zg-nr31iOVX|z&CF6@l_OQX?+?LJfL1L&MAK7v23;JnJY}#`-1_(TNZ}?;3%-{Y zRl+U?2Ay`W55vo`i_HC=+Mn;Aqy5)h&$N^koLZyfq*(-1FW0~~ zeoBa5$oB+M;l{kF|C1}m9G~Pg$bW| zWxbVk=zERoLVFGF;Z{RMm%tJO&&e4U9y!Qf&HA}Z!q=6erBOD>1C=Jlb#Gl= z(sFWHxlC=XKkjWxwbKxtc-|iA$E1wMJ4NEfXl_1n#*z-}Rnn$66L$YK59B7zlepV- z`@>vp$;U*A5ZbNQG#F^lJv9Go;E&S7y63&$2X3d-y!+x9rz++@MR6r0WTe6qD<@B$ z8x_ZwW|L(nDtb0iFSeBbE??==A`*gh<$W;TJ2>z)q}L4J)K|YZ`*nL<(rV_`DNo*a=qfrLW#=rb$?YTk`PHgy)W|fMCg^Pu#mil3*C&Nmj2T0& zXM0$E;+5{*?Q2>`fx51$Qaqa!59U}8=?rVrNL-ydyUJeMY~1>?!};C!Zk!0HzS-&)JOXAvL*{+E z@o{<_d|hqZU(;ctNd6E6?VF|_+Nd6cDN^IK3+<}RUFjd(2}3fscX~rTq*fJM@J?Bt zsYOLqKtQ$-Jt)cT;0u3}I9is*zjA*R&sQ!k>g_M*eLS1TCqSooAYr4(`po*b4uuv> zo$}8}l*Lz*mS3-!DB^nBw{{ULfXji?YDrOyRuI8Io)VQcs&_Ha_wqHF*^MRG%!b^m zO1GryC;uj(>kFD^4f24l<7ynEf?Yx2a2G5_tV%@ip4o`Q&XDop-M9~l8CqN77Ba;b zZm>Ra`lA+1w#9unlTMrNNsQ?%mt*4kDdA-h~sQzsoto6xGyt@5qC0Vx(P^bm%vc zr7DP)W&G0Chl{t;ri8Y9~s!c~EH#fE0q)q+sI+C=u(%MA=qCYs-EZlDiyqb1c=$A*hb^d6|LbQ3s)kH)BPGeA1qFEarUOc+z{=JHobAw$78q;EIv8eHh*) zM%25+SXq1IfpFAH#I-zL_FUzP*$s;`!F$O0^?b(6_`u`>KW6b7?v+Qbz-~kqAteIu zwJmI~o{&aAm;89?@6W6V!OF~AalH7w&qb)W{<^qqNt3Ug{(3gi`wSrm>j6G)zKN6G^GrYZ?l@^nuQ7kG&vg*J63V!^jqPecX7j0o8u)DN zShdpo&!onuw?nEmVX(|ElCytvHHYJLT?+@!zpPw`t?L-JL!+Nm=xMau*@>^rC^ zIT4+#Y9Bei_hQ!!pe6 zd#`9VCl{yfGrU?vESroo*va7{h)hT$b$YN{J=3pLB1R5Pf!-LiH)ir&o$z3L=)jk+ zl@0=8LrqiDZVRV<`nuhrGy3$QHl_#jVdnH|;!i&f)@^pzkUyIPE^YpmFTZ?v^h|zpbHEF2CFSj)f=QU3TvbC*Mr() zZ&`(Hd zr@R_#<1oCbb%nm_&P*3!3jW}onmL^t~H_8ld9P- zMD*kTz!J0LrAV5t7NIeaMEGmFg*^M)zhP#s{7TQ-A@3n+znun7o4D_%zwREUn{Kg@ zzOON-g{bw{X*BevFzh6BwD-W`;=Mjz@lCSdYb5eRjb!d(SY{9dR$Hvyp8XFtrn4V& zMBM2(J5Ie!Bh>9&-t+?RL$_97rbACM-sgp&-lgyD{q9e$z5C+?31kUFq13lq#+3LI zjvOFj{4fKPI`kd(vur2ZkAKat?&btF&wL8Goul;mfUrv-r_Ji=4vM+7J6KPGb6#aW zZ14$6iPDx|D{1tDcW%u>zcC}Z9tE7R7EiVxbXB4*U8y{1*R$ZiuKV6C9|~G;z!eEL ze){xmMt&|NMY6aaLfXw}ZbCvIW~&DMDl#aR-@)t+)GF#`wSxm69}`!yGeexZ0OgI4{rXYD67Uw4wi#j*duP<{5$?UZNHT^Mo%3xHgI()XU8Mc z`jd{8c=`-z1$6+H?FVF5stH-k8<4 zJDOwe4L#f85AC+4 z{&W`H(qe}31H+6Rf*2f%i~aF~Qo?beGhne_|8@Q4hvqn#JSBr6pL4J0{;bBuK-O@i zde5lcG(6xjf`F48Q(#kx1D#00WFWERbVb#UUaU-?V3<{BA%0V7g{z zw@}BUlA+7X z%lPbTvan z4m0VN1w~j&6j+7Qg+yCpcjRSyk;P_LQwKWT4jFCWj{WJ4-);}2-f`vlRirq1fV0{5 z`=O#2lpz_KAX-eUna|Y3-2NL>Qgn)19=KJakJJo@N1)_eb2VId9hrdL!evx5ee};SjjfE9-+oCq;*1YA`#}4Z^zuSlA zqLN`)dFjCP@R*>LzGDw7g8bEm4BtunUq-~1nbqwnqbwLMfX8MM`~z6_c&T2Ts0}aN z@z4-4Il5l$Q5{4Cu?JM8H>bnV%$q|QoBNY%Tj07;;w%eR@(F7=_l1WK)6&vj+S+oD zjErn;&Zid4zwLh^x9N)rP7=Num(o6|ooKTYWovx`<64cSd0!?OcHpod_biIV9{0?H zmV_DfRxquFe5|U{Hxy3Q{yoy>g&BdBrcU^qQ?JZT(?7`v&3Cr%E@-JAFtveSs42Ad z-1_RZHJ5&h7+g8Ind?Z#d4^zp`Amu)Kv1XOM0g-Cfnqye$kFpPXZbzkHS{#L-fN2> zCS`W=ISowo|hazX~+e1|Lt(;p8di<|H_Y9#S@0JExTW-Q&1{A>(QBs@d1OBy3zngrB4 zc^a1ST*xdnz&Cd^41#29Vu)sY+3btC8t5H~JxvP3@~^AE zKZjpq5uK^m2L74G@5e0d^dxmcNNgyVueG%m_;C0B^2zv$P$kuqKnq5w_h~HT`pxcr zAuyL*#A2U(x zPL3KiHnHK=k8VMSY=h5Ez?!KNwu@PIgld1bY9~XipHQS_@spX2ulfFjYMB6*vd<)% z*MsaUuP6pqXZN3T^YV@XU8X;F2h4|Cbl)3QX_%{y^tT(*6)WMi7mmMsniUz3qj~n+ z=dR53q0(wbL>ew~Hb4`;Z>mon#(+qlpi>-dA5k8bh)kcYt+dDbWUP-zmghwbzD@H) z>wZ`8e!!No_0qwC^Xz!*rN60Zlt;#T!(b9DDo0PBZh`oklA5kv9G%b9G>Qkeq0hOm zKaoR_aFXd+mRu4g5An;s`?(rsN&T?Td5&^p#|FQzeD(xB0?cpjN*>2f+LRfeuoM<1 zz57YjoAWnQ8-!`RA*LkslaKN5dslM#g~Lx}bS*S5zy6>&v{hI(?n0cDq`4ioR2!i2 z=h?r_l&Jlw=bUfXyW0>%aHy=o08(_kQ6Ou<&P6EZ3E0&8J1pPjKIzkbwbG|! z^}7oK3VlbL;_r#nwEMcXW%P~JcLL0B*QLw7rSD5Dz3V!wc#ZhSM!=A7$Y_j*sc6C@}1_gtI;N&2(fgDzb(*pg*WI+$VH`@yJl;bnZ z76w;6GCp87TJHGWmU|1i7>Fbzk9Iwfi1KHO`^PWOnEj6?yWodjr4cW*wW;rNwSfwn z%BAex+7fn9mb0sACzc^l{ zCF?|yqdLt=??mD61EW-M`Inr;Up5LIR~3O=u_S9!Jb(cEmO!RtWE}`*55r%cZmu zs+X??f71p+hA78&61%tyE*!WvGiB2+MyPRgF||HdK=8g0to^Je+qeJf4Y&M z(sH~d>y{#&7Jq$Eme~ZqLI^`kEuDvq5RO+h5=pJTs6efldy6u?6Xiy!vG-lk@07B- z#vd-spnn3{=#cTj8|OI`#drbxn}ThMiV7Cvs&`EDjVduQF|8khL+kN7jpj3kp_0y% zo`3#u#@^I^co;ezL3o%l+jMPCVK|HFd?MZAdc_4xe^L8hQLD-O!wu%gkY#U#T_py9 zQD-#oqFa?i#UHuGni1SzO!1x5;2 z%KJ@3UWx?KBu|K59jUqrw>!8|qBi1~z|j%KV%Lv;z`mSC}T+J{Sm;u>g(T zk0UnUi%nL~A{$uc1AjrEb|^DH;ClSe01w!ljGRl1_m__RFgJ%9 z4n6z!@a^yprP)w37FU?^u@m-iSsSs3Ke!{SaC|35lZDCY@vq_aTK)i4CI!N~Yh0?p zOfC0H;C1ISuB@3dW~l;=7cb7~>gjprAP#&jC`CvQ+GE+Y zQG}F1wMS}dJTOEceEc5!1YvJk4cU@w{q+!*UUE$&o3$x34)Q#6NhHncfo^0BsRYLLP8dk5;SaVnqwmpGy{1ti7~Am z8cB88`j^|NQxzbx)F~78>#b>5we5_iY(Z`Vv4lE#L6mXDw}3*96ZzF%KT8@*bJRVj z@l}8?&2p$n^OJ$d_~R%PhX@~W^DT^M*}w-MC|g^N2SEC9VMRp+MIS#d1=5^YxynxQ zD)5^eKCR4eilsOH7Xx1kJ@SeKNhE3 zq*wo5eGNSt{@{mD=+-&P=bxsY1|@{M82ij+}6RyvQKdq6_s60seITln1!Y-@lcntELZ2 zYOgT#KBnfZ-JMdY{(`4uw`Keghrj1)`{8K!N&NuDh$LI8=fxMYj3T)gCC*>CDILD0Ad0!D*Wk$6aYqXU%!6sL4LjT26pb|C#1_$$-?jY z3>|hCzhu?*Z@!{WKKI|;y*r^A%D%Kwqv)<(db8>F{C7$!p;N;oA?0O^4(3ZT;}BY$ zBezYj-Yml6?<$u-D{1GJj2|z0P($*yVYI(mMHKAkM$W&~e)Kz2KOp1hmye&<_13hC zc+)w>#9~)gY}W?U15A!DFMiGD=qsW7XQ0XX%+h%{=RxQY?MgPMXw!9>xK6qxbp1j# zzdrXAdGMk|!}r#bLNk*`o{x3rojnLkcl$wfeebUP^X2k1@h1`%=h-AIc)8?*z097M zf!;rg7c`1mUv~gb7vMLmdGOkb8*+BEF?jdub-y0b^X=ARHZ|XM7^vu9F&Kc}|L3d& z75|1v?GR!IE_%}4x$xnPZ*#Q2Q12TWDLhJs#Vn*V5vh6#?nG_Pz70cL7503KHoeY# zJDyI6@o%`+?fcQZw{?&bHg9^Cpw1uzCCwpS^RFv>4hg9^M9F`mztmZh!cFm?k?WQw zNPb_`vTaUndK5k?_s{7a`s|cieDp{N(><#BNYCfcYO6aUk*>iwD&u)T8M-|5(?;*! zV=10*9&7h#QsQ$}QT|n~X8TUCsJ~^d-CM+r;+g7LYvLO&d9L8ANx~yLnbgxYLOV{i zdY53pTPH=KBi2eEgDbudeDCMcr+P(y`G1yOR+sbXup~;Rd-Hp+3o7y1?+VW}#iZxY zLulgE?&tjYeDi)=9eQC&!oh<&G8NUsw)(r=2mbl*RbBbiO-&ohFtW0;DFY#SAMzY? za&tX7B@<9<1Ix#gmMt^e^uP1fU|P9EuITGG=|3Tzo*EeFGw8=%rlL~O`CnuFTd1XP z)G~~xT~*Dtr@e!za-9!Ri_5=xLnr;`&!5GkFF55cU%kq8FH1I#M?2RWBgGfijM}uM zWTw42^=Av7N!lUQL)iFchLk5Mv<5ppu&%J4~q?Z zvr$o5j12=*Og4)l*@8UG`;Q+Xsm*yM+YQcd-s*W=Ra!TJZ6tFP2+y*KOVd-)8+cz_ z?=NDCQ|oY%x?z6z`!~v`#sh}^w{P(vKV?~KLq0FP{IF^m-B0oFF!A3M_Jt*pNsRi_ zammxyDmt$WsNg*j$gE6f=CIfgS)kXW{SGNKn()kG0f7@Ht|+&8jOm(o(%nmsy6WaB zIZamE2kxpq;WTsUzd?9Kk8kHzF%YYrC69^q6%}1JkjyM-Xa+>w#zMFIdBlr~9^rr1 z{tC%IdGYf8czFihP^kjP9Vqy!kTjbx1X?_o^cDq;NpWPt zQppg6Hg+lSUvl%mA^lP(Xz(nrnd{t*f+EV4uso*%DXO@ltYQK65E=u6VF?C#ad09; z{`#;aP1mQJljlI%=V(>^9~g--t#qztQojSV@`%%d=lL^`W-mK%7P8zwGyqIoprBt|bTm_MdogolV|((UD$X->ZZDl4$X5FU__bYpcWa!wD`Q zuIsJ+sWvMT#Oj;H9&Ylity2!(4bC_olcY(+n6f9UjQ9WgA}^E(q63Z%r;DBbJP(4} k(goo(p#Q()&ahCBUR-Fs`~68k21B8yqV=py>Gj9|2Qk~yxIt1<{;q!gp^;^HY*8TUEvsN^mGiT1so?V{(>^TW~p(Jzt8qGBb1ae(YR!S8D zxhw&J;4fXd49@s_aQlJ(@ElZSo6Rf7Mu?o$6E)YQ)hVxVT^BdjBSg}mD6<8N zHotd7%Pswr%hh$RD(|fF=YRbzmZLKYu#VKZ>34fyL*W+VzJ3v<>{@HfZ1_jY_RdFU zertDJC9O#rKbAU#OfuC*awVEL{G*DLHyYPB5|-umj^edTSQbM}inmy#E-$YyN0{+u z#P{XoT~HXZh?A-(V%#H3nSux6Ap5ZA8xl_R87RYyy`kNhL<3?cOch_<4G@Jjg= zN$eS4eF`E83R>?ZYpv3_7a8pGx36H&b1JLu$+7!i=l)%)TX7?TMb7_*z{T6xOA=Y; z1RYP`KXX|sNzySHHuoXACg_NfEI6Xw=o$TfeSUDTMCr{g{aDuJPrp~)ig7UmPsPqoXZUE^ALEh9R1uZw$tcg@YN-uNQ6omQ$p&4+3FcPw(Zv|}Dx zK5GxkOVJ~1P4dmU7yNSD6WeBXCyGqEztSdy!CS3}MJ|2ZI^{Qw@T&ri9RGDq@e8+b z9r?I#Fq794BvVS0XvZW+{&Mduwbp0tc%S2y{t7MgeTkh;_FOz zX!L++ROSp{^LKpgmG6ocEhn5`8Muf1{D%kdZjqo?kh`=L=YsSt&+Ye0zeZXk`6=qE z_&Rz}JVexE1Lj36LPbg%RpN%yT6JH$Q*vA?4-ZZ~D3LDGB$Ljx5GtAu3fmLSOZ4h4(tHjX?)9^mIH=sW@Ck@pJ*GXpR(%fo8%A{<=MJ|@VAE8>F4j=X z9`h8pyQS>NIBb0j=sYl+{|_HS#T3`glxy;7cGw;ZvEq!qP9C3 z)$9@W>Hmai$2^Fz@OWoXxo;Vgdm)@fPG|}`H5YIbr)f&biMFRwx?7~N?X8r0#YTLY zQ*$zU=vvFA1J3p8eKxPk`jydtC1-Oo@Dz{6(%HXLl6{nUwAkqiIN2Wjv1@JcnxS&v zX?-VGtGq)ot>`b$P5IOzb#4CPk6j z9rVjavUsl@?H4%SkN7dM<|g?EC9=_daxa+a@0#<18^fBjaD|?&nP^jlK4S)Bsdig~7jfYm`cU_Ke~?wDV%EOJ$4;?r zUi;`uY05J2^^vP$eb|vlksGu=%*Or_RuWxEf8vvsq&`3AuvdH3j8kb(D_buzYUmKd_7kz<<8YrYiceR!td$#(%HK@P$D>s0P@`y zfh7yOJUY6)KY1KI<}iaUv732p^zI#ZTU(paXyItf`lz1JP=%%w!40}V_OA5)H&Pk> zfk4__rC{-ZFD_(1m;lk=}g;1tRxq3qJgQ@=mTCKMg2NKMJcnHOgdry8x|9u`{r;Y6L2`eTNY z^%h0agZyfK++F{A2qoM>n_^+ekgtULE)F zS@oFx85bA#xhJvRXw-@$Xew5ZM)RZvmK=-=O1@4k@$vEZyGlQ=Yo;Jn$fU`nNq|;> z&;{(#bt}X`WM`h>21D?E-Tu+o*=B}UQT5U<6xMb03;4?* z;3^(2qk8ag{$V#CK@^^Kg>V`*jWjkgdiTwW_3mA`=tli%W(w;pZmJKw0=}kx_E<;% z{*Vlv+7mx{GwHCQ8Iy4iLXt56!`h`a<#=5@&4|KbM%B@Ci3ZnwxrMfn1cU1=ZO)Du zwlm+FHls&MktW}eD`nyhCt1SAh_E%UBGI>-FY2}o4EQ!0q6%L1DzbN~mzK&k)sG=05#^8*V0o9&T7*gM?toXqqg19oO@M&=e6 zk8neD5O@i8G2kr%^gVJd&lNx0bQuy9I96@!F?l#XL9u!f+fQ%bGzEy528F8UePx#< zg=pUH5Z(8_vp4DDvpTUK8kdyxxum3ItQ^T#0=(VdJq&P#K(yXvq=A26kprp#jGZZE<{Fz^WN-dy z^}1BWVCgUgw%6~rUX@LG0hjZK-wjtK`0!v)78mmxd50G#0CiTI_&QTevqFG9A7fDS z;@%&tiEqP(aWxuNYuJ-b+bh+VG>T>!fyPB<^01oR`C>XAzpui&guM(|IqHQ3#feLa zFc~>JJCBE~~3(n*4~AX^gv)Zm{ap(CB_k^+I{P=BlDj)AqNWT@30#2qP8{lO;OL?@RGIRiiyNRFPb_}=>&DSlN*bfq-Ymwzc&H`#5nP^<0%$(Sz>p=fTsjap%3r5T0DRAwsco`c1sj9ZL2QfH1_c zmmL}{byWa+$L!AIV*JeG`e`&6WX^HMwda>FLF+5VXm+~YXZz_tB*_xUHk#vPXr;_N ze+V$4>P`Zl>hcZoytSgdjRzrXkX-Q`2FINh2sQ6coiJJMD9%xS_d*FtIXaD0-(E^^`tEGhXuv{*O_Z7b5|ZCGiF9K z{VJMiVrI|n!#@R2R;mSP^n5iUCB(QrOj?DEOGt=Dr@}g@C-JdMMS~?T4Hq{z2I{-H zzKAgeYgJZO7J+c<3xhp*BHP%9?mZWP%z$P2?<0Qo8T7gfJcu0ENdTvCgOUTb zm0j5Qd@xekKwcnXfWA{v`hL7KNih_j1)W%5IUV7pOs3}s981b^#$J0CW0wEup4-{}r5T=A?+x!w2- zo;Fr$!4f&1Vc)gkEn;SFu2DF~yLOS$so9_ODG_!wT2LC8_^GS)*gK`9YEwziwZ>C% z`>uzTEws~{{;tSjO&Jw3`@L~Q+nE2ey0d!d=l=fwvAV+{J0JDj3itzH8D=|wk1R`` z1Q?z#d`ufybR#5nVtT~FR<5$wgXz7B%2rzMZF3{{YJ0E zyt9y^4G%R{x@r9xxCAd-65I_-ldFlz6mY}?s!JV95UHVT}Xa%k^Jwzab|F&WL^ zw>QH=9@Q{1F;!S=pE$o7-qYN*DW>`jX!Ce=0jL?3_8 zS~(Hu$Axg;;UblVGL;w-W@cvlX*WbGO#hU0Yazn8q(qRy&b66#{;?10v9bG+mM%(u zBh2TJ!^c%6#9)7Vzx^k^a$8aTnOBL`=pB2cO=?h&4nGDHGl19xOSEmcvp2oJdr*#? zdAyUbdwXg3QMk7f|HA(usT>k%h5~0{{nKsD7XRzCMrMmznR2%*Vp@P_cdJk@wk0{W{$Zgza!V;30HK<1zw$TXQUs}l z=YVqUd8N$+1*r^i`zOjqk?id3dE)g0^w{K^_Lj1Mc|wDOr>oQT!lhT29 z>~oak6U^QjJArs`>Z@pw@GD7qwbMf$yDtjX)>>Ve1 z10#5tndXI+mFb{D`eYH5p@E_1996R|2U{LYO#J&xOZPlh)A^Q;J~Mk;_eTzUu)ih7GP>_N@06HI-Xc}@626=2&7PfdtfT-HyZN&3(6*hv7uhLwaGAx?YMoqzgdMq?OZq@qq% zvB@S9(8cX|8b64UVE@J)8d(E<9uNwT5& zb1t~v7{{7^7%3`rprK7a|!TwmB83z8}q~fku-W} zpZ-(Ei39t9;=P^g5==}W@BDbt!u@0bz_x!yd9amn^@rzOe2smNC!2MRCXyvcBcHrL z!>SsYkmGJ!A47WQ1lxsgxs3{*Y(h4Gc?wEODFZh%hb>zd7EDaEN0y)WAL7QjGf1_V zZh7E_jka(&yx*GN*wK+Up=U9YfDpju{NZ5m=r`rBK%%s0-Dx^2i0%7N-v>Nda&IXS zagU69!N96P?xmotETbI*B0h-Q(kfCaWXZ?*9?14x#&qwbYzx)}&b?4lP zVR+_he|o=HUTsE(W=i|lVP54mAwz)u6E z1L~@n$p29OcCCSr>FOcMgQCvX((*w!c(QgQ;^*f9VI~v0^D)%c#ssxP0Yd$QeYaT@gJ6>HX=Yy`;A(Ds@*8TPi2J_iz zt2#(01mMQndNp%|ED$%B=oB6a_nxzFX1>aNrAeq8%1mb63SN|e@jdON?Y*gqOS!wv$)er1Top242&42JZ zj4<48GCYe&9Cy;6OAS&w78cUk*%_!cy(vj~et%!7qwml%&M!ce%G;h&4hcV`m~bkg z`zhlhDi_Iqh)ZXE2PZz@bp*Mh61|0-8&7}tYG@f780cn+bI3~mI)t2`38Au5#vzcqYa)k*!k|9bHH zD+=LQ9Ng79rdWmK65NoB{QhS4#dT2w#rHU1U3^3Y1O?KhK9uRhH^5;coV?G;ZC_h_ zV2V}Y+3g(3$;o=t!I!_K=ndnN&_7-2ksm=_W7twUfB03Q`%zv>KK$J0biBZm<#Pe# zD`0*AWKy!Y0um!5peX~q$uDthEWr`_`ca;LswSSSb_^HD5qivcp2^5$j9Wi)V^oPT z{qd?GEHlg0n3EBt_~vwTfW6P8%<`@@_ADa))C&YY>ojgcfI2~U-nALNJRA9s)^RJ<4K z|KIHZ`C_c*0`|mjx%jMyl=z%6bBS@0Q0lop(M1v3!9qA{467M%j`=1DzL3NUJ;ktn z(IKth$*AalyJ^vJ+ClS~r;hGk4K$e8dx;s7qzL|0HCDP_zk*xgKrR0p;g|=IkWd;p zKJi=;pQdX(=o)Pcqo2UgbucWys^_JMt$BewM;`qKyHvh`R7RI&>)}RmN+GrDr%z7? zgo{E!M*~-%*w!4z2mqSVdc0K7w(8UigW{6j{@fL!n27j~1Ck_u0_BH{m+d3B9PEzb z4_Xbp#V%HF2SYy+N>J>s;&&ekx4 zlYdrl)}ksAP)q8YPZ6)qN1+xf)BbKr14 z=#i|h%UUfH(|m7jV{ykjO3ic6FLs?sqQ=kv^@jkx+DAdD9;m(+bxi}(<2}(aL7&;# zw1X@ceK7JQ%36+EUM8l!4IdUUSGWv?`exA3e-D=%XMXZcNxiuZ@NuBTSD?XGVLK%> z^b2IKP?srmtLvLH<`O65qJZmW=Rwo)3@s?m93~+##WLwgmMyE%M!RoLFa}W?;F17= znQ1{I7wKr`6NiVBycD}JWWeUdpOUznQV`rJc9YJ4ulo+o1m1iAh?e~uE~xan>%E*j z+6Iz9;jl1RyW(RXqorMIFI?ebhiB*JPSzj#4}glN-6AFyy#*&F#X$0~TJin%oYHf$ zI`kDVdY4yM@ce+A!0iQKcVg{m7k4+tP`O5cjke!xN(0G*&gN-WAr9YYc_>*B$eMy8 zasvUp(gzWP3GD?^IAGaC!(#`4bpW8a9Q?ng+P6{5?`>i#jFXt^9pHK~ja#ubDN&g) zx_F+8^)w%+51(94!|HldO=UWWUpIZRN&z9H263L;UoGvIs0xbb+%?io2#4YKP z=}$=JHF2ht)Ox^tf|4R=0C>6#Y^4mFZ3&IaNcF+pUHiRsKhXh-JCX$i3!!$4gx>hG z+vgh!+^O^MS>|020M2Cnf{8X7U{Ao+yLpV6sxkkP`kbb8wAFvg?AGxrX7s=5zABZs zfs^bJwGalhi-6XGkGic71a;*u`DLj-9uBGBL=zrY7O0^^X(>E-^ZORC8@ zZ?Ons={t*>(krztD7zHk1y`$(ex>o`#pm43Ss z{+t}F*(1+qd-oi>pTul z7s#5EY1uLa707$R^It^I*)%V(bK=Me$ehF?p-?slED_KX){Fh6xL^t7`Oj-15c9Wz10S-UwN#8a)a9^ck==^=JF3tpoMHz^Xb>TX zh`4j(`asnZ79O9S${2yVetR>qI1Ti;Bh-Ftzn9qf|1UbH@>SD=x~0efivlK}MloHv z@v~~Zezg5M)YSk(Sp)`FA*PF@q*^dc90>`=aX$83Vs^C;f0M7E2*84}k@Agvj zWqLHGFdk;-!6&8JzTWjH6i^)E>ov!Oth?P&1=LtkXbFRyX^MjO5yoMHT2!-*1vv?( zCe_wJ&`|Qt{E7%}WxV~bNib1R3Sd%>-X;`=@|&=2WVWqEhq=z$xd+fu>N!5aTudAN zk7M#9!bTj@>kN7E^hIbyQ4nTvn3w=1$hT!TA9e zZx%v(-#Og4ytL@^^QG)>0o-8u~LZC>JE^ zn2I^5gK;`a_G9(YH&EL8eK{4Sf$Nji`VFL{o-h{|^@iIF!F;7%!yQ1q{I4pecFgT1 zEdPSR9T*-kZKE3LVDQ<%9Z@c6V25PGisNf4DE*C>nmTx%WIS$Dd^~dtL*VXsabL$? zHoVUcHveF?3zX!?$HxWWpLzWCJ^QAQ;n|6HK>!;u7S_#gk2Rp{fG{mD%l^ZpimvS( zC!PS9xXmVj5D|nWelQjMZoD8)d|U(&u+_#74-DMe3aUaVH{SBt_ZDRUi692etRF_z z3gLBtO6lZIKdtd-p}hYq<^Ktz`ViGKEn*3<(*xjtX#z&H?(T>c;JZ=t{zxCEpM|g* zW|=UlvhmN)GPpP(LH|V$HY(qwd*{qmark@5Klz*{d^TLedh#&(I-F)W*&0G_aXo%3 z8)+hqA5h9J>@;MB^LXEMI6+x(;%X$~u#|!q1Sgb`_(w+UT@sZbnG)5N9fZgB_Vzxq zlg3x;E40Kpk0nzTIZ(d^OAk_@hnk{Z>V3moxJ&FNz&|9^f?6WL4liH6%;CLg0ip~a zA2|pPx&KAAHcm?Q=DvK4C!vBuVSv5N$jAT$QLIQf*lz~xy}P>`6ZC+lT$RX6zzzuF zt_>i;FIXS|U%;z@r~?`-FE4`|z!H|S1GcDlm!uz6#h~v9)w~VL5nvFY6yIx~knOPO z^Iux0kK=^A|1Wbw!Z;y%``?gY3L_u}3{n`_9`Gy!kOGcE;-CWgkpV6AglW;md#D+N z{(jMY$#WhMD~oGlHIl(A^(%kB5v?38<%~GFhJKtmG}Yh zad&iiuZFt(Yl&PknF#a0%2vhbl)_ z_*lHsj&bI=YXxY5X!k!aHZCmR5MG&heZ5S-(N_|2jy4cQIy=R{@KM~Ywj8=eo~a|%6x$4>8wg!JFkKS^ujHSI$TCiCqYi%kI?P{`8y>Y$~QlAOu{*jcDL{-(`hBGyqs3fam6-P@99B*Y5{F=FwPx7L5__$rc}lz0=ElQ+!F!&)7bp}}=i!Lf}e|G<_6Zo{lyc)WQ^ zkk3iG&u1Qkx3<=zs8vB9*DjQ^$nj8GTnZgbvu>We$ffr2W2s0Ijg^mcuV2-mr>TQ&VwQ#S3>lbOlqxg!^uC6_V@S%^S=l=KD*Q(Pi?KpJGYjM zi`-=mYl|>X`K(#LqRyr#^qpqrXrwZotCXu($b5Z7fmVhV%qURS=v@tYK&ppO8?iWP zk@s%Cjhz~5wXCl#YR2n<{&pz}j@(}hO0;VLtkRs{);!@^j_e={KR=V0TbEB@pU)`@ zNTcrGL%X2Ldi0tKg|szT(5x97;mmox=Oy=LaN+CZJtc3Jrc+Q%F^-X^F^mCMf2#5MlqmW z;z3=HYT0d1{sb@uJ4;D@wwb0eWdW&2!>{P(mA9Z)9LSPL>HV3v%yrdAgif>mP;qPK zY`al9=1z&z1fdapY~*0Cva$Z@aG?@rPf6WDD@V|oBXXmaRctE=lu$|RPtFXeZOpb> zIZjkgS`AL5J&y)c!zSz+MfX<6NqtU-i&84i=-m(I0>GAz%D$`OpoIOIe;$=u%Qk(I z{kRnlwrt2rS&voS?-la!5INawW_yX*W10_w*+>NNB+k7WOmbhiL`CUi_1!H_PR^Va z>(D;vPp*UNb|Ja(&WHq_zG(&mVg}uycbcCtuBTT3bs%vd!eKl?*c&=?xStwGXt4Er z?8okRS9If%rv1U@TpX47-)eKrb=FkRcUjN<)&F5?=X-lT{0QBIyAfms2b%%nbWu@J zn7UVOS?@RlDBY$w*osa}&4(fSH-(1`Fq=+(1#Y9k4Z?$c+Z-J~8yv8~y=7A6;7Nshgm_&Ze>* z%+>|o@c7K@<*gGPufae%Sn#Gi1T;FBu=D2W72Tg4b8m}Jw&J&*Bm=WzQ{n#p090AI zYF@+Z;u#X3(Qd`hoH=^V?0Xpi%BQ#1&bo^lS%dm+>+UX;kU?vlt=@LFWj9UA;Wd8A zp`mZ0;9%XQk(NXF?Boq4*pf$rNcHhPS(`bv;Z0-)YgPX=IyDZF;_;}h!aCWZ@LIPw z{IM9_hWCE0$7OnBor*SxK2evv-yjE?<-HAg?*upxx8n>-X$H)`7|d3sqO+sWtuPl| z(#FF%TI1%96R)9Bc-7bRdrU{&x2b@>CAT-yr=ITQz%{-9X{HAvisYkq4(f}0Lt(J? zHpN6l5-okF(ahQLjPb^F{T5r}cH{nuT~}Ml!<@A}Mfrz)D7aq_is^2)Iily8MWqf{ z=Fc{N$xNxi-ke1K(AMs5g#~HvzfJ?7V%_E+>L4t_AId*Jc(%Of+8?4%ChmR++pn{0 zZsYoisaK(RHEJNUL!hu6?70s8*Of_9y%vzx% z6X@MhxWqhQF;+=TFvhpixzVyaY5=wKgww(YM%ThRml0>M1?TCoXU#tPX;Zc`38H5k zPnqT6V+*b)Z9p|g^<4CTgUMVT#JhmR zWR4=K#{{j;`YqNeEejldGvo}q))kEeGpavYv$y7l@p_#SJ4b=dK@~O=8tJ-P>S1SF-W4b}_#5Wa z=Ek$Bv3d`ey44dDJU%CN#dB1MpE{!lK4re9f&6jYjDCj+4nNFbyXXcGHc-9791K3I zB^?7SG!`_NJ=EA>lYVeEUc1rMu;P9O?{nyNfqk}%H2Wb}Gcd)?7DyDGWvC+IUnOB0 z^5KJi6I(jv5MhUMOAx;HJUQhz${{wUUeIG;lu+t^`)w+s8^+}x98^TA9X3`Irie1n!^K3wvlEn?+g#(pgh6VHliuII z{3VY4@;Ya!_ZLbtYzvvNN9oyp2#H{zRECOb(9Z%NXL-TxWr2vVv9f=~$5_ zqo)mOH6qw8q>j+M>PvWczQiIlHeE$xasi^(Xar);>FsjsxD>A#T@&;G^kvYEcWM$u_Vfo5J`Uv9Nt{pI5h;%pcFi8ae22pJo<;*>+ZN`g!SD|rtt^p zQ=nkcN&f)2aFL zU44UyspDxOx zu;IvZ<*q{d3-*BuZ@x0~KBk*jKEG(iY5Kdbst~Z;E32!SUMRCX%ax!n>ee<>3pJ7i zf7*^c0*QCHomSL-cXi2BjNyN@nfR_>pP>6l+0B&i=i7^erN#2nszCxlKfUwv^WWIo zGAye~-w>dEY-_@q^0mSKmVZgXvDv-ZJBdoSu3Wr7_NTuBuc$pUE6em^zUbTC-QE7b zf1hicUN%(`<+^8&pi8&k%D#l0rnJNx@lohFbgpPsfDaXn4@ zb4BwmZt?^|m%tX;|2eo9KTow^!aWfC)P=7=I{(|zM)&{I{vL$ne;pBAGI)Xi+wocO zn#BKhvq`rKIogkh%i#T#pC`x5q$?d^9f zD=Swn`!Q>0cLa8raI2}Qy=xz}n**;(G?%iAInK30hBW-E5ECxjT?VI-q)GzsnZpD= zM6+qWoBIU)2S}2I4!Ba56(hccz-%k~U2q??*sO;JgWV&NM&i`&k&P9<#t)MEP=~yO zIJkfFmwmu5U3^Nr-ZtpQow1Ry8AMh|Nknk4sFl^Z@xJ?tv8Ph$N3q6hf6GlAE?v|3 z7^(f~*sfNLh>m-U&I`?U<+7(jJohIFM$V_?F#S(Y-_F-jy$tACm@sbE?jMGhlbLx&MMNS zo+XJ>zgEgjk*z-*26p<+Z7q#T;S`B_YNuC2>f#azCiV5nN$O8JYmqsrdJ4g2f$7vt z2Hho&%c^ZKsIs2k6sLx;yOWbsfB(^+pw0jG0`$LM^R+tsxs7+Z%I$NZSTX8j^K0OE zfxBbYD_s59hk)0idg0;CVYB-%v~z8VT16oFjTibeziN5~3JGIO2Zn}PLO2=%UlXl? z_xy>re3VbZJ`qxGgI6Jf0l#C%%oESmVNVzHNbfllvEN>=A58Cl4TJmIHST4)aZUZ# zpd1O_`$Vhd;=EVKX%0lnB<>%|?dbSe?rsza^tz+1oJ5{t(Ec}HwAi!hFEv{Orps|} zCu(b?v|ws@J-Qomzbr;EvGyKC2robXdLxrewZh$IVACav;E61^Ik&ParcV9RDOqULc6ZPOfOqbLilPN7q zhMpa?>pJxCbtmxHA$P;zOW%|0XKNmXP;!`kon>BIbqi_uO!{@!{q^vJSFc{(V`G~L zPzT13If$UZB$_kJ%A&%;ZUpn2&_e}BL)QE&9v!)J^Pe6-(t7k=xvI6f%T_OdLX$S{0M4gBFZvtd42WqG z-jR>t^w_g5ZxxcLDwHqL%5-3qwE2hRDAvjT`Elh+yy<7o(*0vz>tIscK?xdsW}tvaQuewt+36~pDRw~AIvtE0B#4dhnzYfHG|bBx+JJnZx7Eg#jF z7tny2CY&5m5=SWIR3FUCcP_{agrO3S$-Gx{_x7A`3A&_ygcd!hrtowA0(=X%%lf3( zUd_3CZz?ibf#5vUDKQRW0R@3 z**^6?)84ts4ezy-9TW5Cnr?%HG?g;MJ)jzY8|p$C2{MEP?oJFk9hl zi%as8eM5@W(UynRNuJxCz`xmm1BGXUS zV~Igwf016S-3^hPlllawjod2$8;%o$2UdQB_Iqu+qqDBCy!@_R=AZjAXFY0EWbFEl z8}Cp(k3o9zf1<}Or943+<}gTUVPype zIqt#8v5_g>=^jFSvz5a;g4lBwzdJ=V5##7Ln~70P_{5xEM>`P-k(`cVDn?V!7%Q5` z4pulh#88y$HONO8z2kJ5zU^39`2kPtYaMsn=z5hEQVHs7oeqmN@Q%+ftO-6uA&6(B z+QPvy(a_wDSes~x9zA6(C@4sB{%b*p4jX)*Hex!+svC4Hrbms-gf!vOk zbKFk0+7EkO8vCk(x!DJ2!CRAGU);MHYI}xaOIC{NF(X$6`(-d*>{~hrFHl-4sA6z(4s`T9cQW4kt|DZiuHbxnP@Ps%<=gLP{* zb`!6E{$QFn?-__an5R68dZ{c*UNl-e<*MD$UgU$e!esW3YFElKOQm~7j&*y55$u4y z6Tc6ke*N#?KdmoK^w+o^u(4H!UGk*ZpK^gNJ0^H+)KgZu)Ov`c#`^|D98O1K*(v;=^U6tNcMc9@G3!_*2o^=2e-VX z_4Vw$yyqdGJaPeNL9FjceHiKYx~_OC4sTWn09%DYlj1V+X3jT-R!t@8)+=(6Y-21u z(ruanTtxUVJhqsV5R706A63nMJ=@?h{Y@rz)DL^NQmc&cKRcLoHXip3(k?^18#j&J z+H*Zbe5& z@336kVMUQWm;A|5s3^&p`(L{Dj2u9Q;}@Eml;p#^yw5Tmf0PeY+w(-1Pz5L^J@;vQ zZ6kA`-9GoqalEdl7RDRA4nhj2;W)!eW1JEL0kb0U@NG}#(;U=3iDD>Hx zBTMzZ5Xx^zecd(e{cEbRRuMlxze(o_n@O+zDIj%#_XH404pp1;Y+6$(U%BTIB{B>P zGXBDs|Rnv5d z(leaHbM9FK`pgzSW(Pm*Y0WBipjMv>SIz5I#ZY&P~*Lit#y@2O>;7h^j(fFSH7|j8oqrSZpazf z2mPw`8xLrlg|#&X`cAJuG8$GNt5D>m%KT;bl4R59@b|Lv;v1ym%LmcVjDr8uTLp~X zF6ogU^K0%!I!Pd#6j<(5{Aw4@~dsDTfD6lP{N(-gwEl^= zxWi)i++VAr3=3W6!^ocWPaN-B$u(c->o-gxFo@A*#%upd&)Ze1ziB0?oFV$rJH{SW z`#Jl@ahHD@1}X@(LQ`FnFyWe)kI#OID`&Rq5g-Z8dy@oNZe0bW-61OVOaY9+JlSbv zQ)vkjrIgcY;-zq7oyxcA&o8S7nk=dY70p^8MeI$J**x8EOvO;*C!pBCOc7$g%QyN$ zqXNFm%?%JrTjU-2j%;~>hO}hCLc&9ziM0wgGp0qlU^)B$BN;#W{Xw1@s0>te8aiVJ){v*wLWnmTQ87&`cPqcJtVs3GCfhHzrzv6E6B=`^MJq;t3uMA^*nCax~?R$)k6O(-!I5idsd*xqo?rn$k-Gw1$}Jb z21?C`zcm|vwFHs6&Aul%I2vtu_Ptb~k*mrS=t6PX7i~b~$x*au~aA2hh6BWAp*q zdxeIkdd{D=7(+ol2kgbcVCreh^~aM#JE43-ON!0>`EkI(=0S`&|xd#7H>S=EfPFh$`C}=!HVmc19D2^t%~Yn zKq8{St|!I2U<#}VP;p_dU0h#&k>2}s_r;Yk^YG^yb}QzF63X-Ip|UI={w=x)uA^R& z1@l)w4KnJy9mSz?Pf$%$^Cde4*F${W*dDL@z<)6Fxddyg^j$go;Ed&s{-m}1=X zYP0X}Kv*go4pm4Jh{(&MH`q5+)z+3%Hb5pe^l@KT?GylPM0WOF)p4d=>xl3^qm`lD z|AV~0eyeI<_s3ySK}8fqT0&7Nk?vGlr5kAh5ox3wk#3MK0i{H`Q*u&DsdRUD*Y_T4 z?ejVN{Pg?*kJsL7d9mhX%sJk5->({{8yDwHWo9^Q%;A^CZEZQAngMjP=g%K8-mzlC z**{HBH9s`m4UB^^+&e*wz>c8{>|T z+1_-0=I0FIFgad)X-cVm#6L&&zKaDpGG?tS&v*#_rwx!nHq?mjg~Bo1uZ?Ad4=Fmo zq|$fErZ@#eM-whD)AWp&p`)yz>Bd^pyiNR01Miy3^q!OB(Ok??n;6CM@iDL~r_)9U zky6wE&n;{|2+>{sO_w{&{#4N2a)WtLgMfg*K@IgQS*cvgYtKYwdyZ+MOJ0J!<#20e zX?=YjDfY_Bq7M?c1pnr1KsoEe224>}Wo4W~cJoW7+Gd2|$*bLeMNd!fL%ZBd0^5r?`T34inWHurc~mZVzP@6}a`4d)*;3y2P!~ zZ1x83v`kE>iQbn1ljix-ZvqW=uGdgR7KMdkxrakJYz?eS#N)=2EduN>+t?4^e8vM2<^94|eIuhOI)jFUcw@tFAtJdvaE@kL3*A{*- zIzPSw;Db=bR_op8g!f{8>Jnq7TE<4KnN|-lZ#mUMOM>0>IXl}Qsi2Yde&`~I6pmYC z8*VWeHwZ0@9Mm1u#%laxDj<((oqt}lqP6k5H%*M; zRf(VE!$t|AV|f|=BQ5+c+|oUC83?XRc0YHFexd1<-vhl^HW)xN|$Ig z!$*MQHSu2#?@cW#iZIZL4&p1h@sJpM9hcYVjH2#jjZeMKg(q(%qTL`XFK^yN=fVO{ zOh`Oi@*eKwORh0M^_muTiPJpF}*1=C$l)6Yd! z$=mTsSJ8%)5`kjtA03slwcRWDGrx1RX<$mm@QPZgr__y3=Y0Do8FZnV`|T!bWmaed zw%OQXfXMCI*eeQHy+wH%l2*uszb=$yAbb$XRQRQovY)wt{OW*rhhNJ3?s^XiO4m;` zDW^A5PG@O+&CK!2zWS?!=DFXwyp4%H0%r)z+-jJ@)0x7X6zOkoIpVwd)r7RRieq9D zhBIOmYE?`JJZ6@9zoM?hTvEN9w80+^&Gq!o(c3uAqzpQ?#l_BoY`*8}gWcITe$9u8 z;28eth=R!ln8Eu6@)x$!H}lTsHHOK9ps|4cA8I%(?@O>t#8V5VgccRC=H%pDyK?D) zR>nW~wC$M)x?d0}ybwSlHp5|4eu^6dwsiPrSdXqYp{1Z2S6KXg-eu(k^a5Yk#O$-i zy!@8^#XXj`=3}ef62_@$4fCn2^pI(`lxokYwdVlj!8Th|7_G+83KT5Q_M!b{+)ec_ z)0bgWxW%{1+&6@$-T6>w)Gk@FOb*CL3)f2rd#|wC?=I{d#qzwT?u=ogF^W=TwV#l< zDCL)l_8>Qc!sZ=L@tp?Uu=YqA*g;8yo^s?Fq3U%|V=Tnz%+|GswLN{TChjqGtT~Rg z+Cbv9*`n0T8brRlqeoleoz}=#FXoZS)uZ<1=x(sOpTM-0|3^SWB*KBWyZ-Mk?ky#j zxt==(QkPM-OWg)-W~PSYHI5Hh%X`zH$pAyRe2G?ocv#x)A1sZ!#FJIAJPDqr5kHg0 z9G-YVVxZp1*?&%J-3$UH5(4O=;-q{!I*8pJR#h3aYhsU&on(0Sl&IOITUqs{UNUVT z)C)L|hr9Tp9Rn zQs)fMPmhp1Etl2lm&UpNa$1D5?I?FKs&L)Et31D3gq0+u6fnF*GdyN0ek)yZ+&ao! z+}K#Cm^W{X27JoWSicdYsKdUBdsK*ASrF%VMslm)COZdR{&km>AgRHl-aqsaP+@YrK>6`-q|{Qja7+X>rd`32pi&h z!|F<%k6HD@J`B92)G;-}TO7&g89$S2b>30j2xy^#;_soNWm_x(_upS`gv5hB{$>vC zw;R5Q>WT1?laouO2$JX94@}_vOV}7}5a(3~N?3^9x(A#?v+Y#hOC~)S5;71&GN>1Q zM8G*`_hZFm=Y4h1=xh|gehFX~3eby|`JV}u7oJz2H(&KNyKM_cTcYd!5EK^7_UoEy zy^D4;K+h&R{_-6xFvp0|a=MP-UZ*?VMtjSDP8TJFrnNSlh`3yqR91z3n9df0;Vbv| z^$Ek~)Iy{)izp_LsSf(D&qYPnYV$S)j(c?D5o-#pUZ12W8AZN#V4L#Gpod1bq|-PY zNb2ZN0+ov&_(-!;2>&B7W(B8@7FwpHx;lxpv^1~9(^=^vvjnj~LKZo!aNGU$6;xyD zFk9QF_Q>6xH$+gQ$sOuNE3%KDid@&`l4$d1gGv@yR;PZm=;uD5ZO=v>{`iCi2GSs6avdI$r`anc}D~p2U6ajuv#{lz=s2Jb>t)$d-wNK98({nrZ+Sr8u z460j9(~&nFpXiWjoangEL!9@$sqCQGMX(!~(QKsvVZBA;w<+Bc5AonIPzc;{ZZ9+I zTVfwFB}7?mI@Nv@z7MRmWDGTH&QRG;XbdIs`5z{3Qq+q7pq0~m6bE$~6j&z}jfM9k z+Y10sRCq(MZ*GTON74D@w$(9g78!LH|DtEBSFxVXdZ;oGs#n>N*ajG_}{|SF)IFVCwjgdt*&ED#nZxBG~Am`j;9CpUtx7V2uTcG ztJt+Qn{}Qzp*TA`!w(c&ui25I*XMwuT7eed=Ls4eVPLLCeRSURiV(+0Z%S&qke4xW zMMVu~0GZ?*iR2tQb2)<#cU~vA#fRs?wpc=mhgRBwh0>&j1l!P0$a5kMP7LU5zGo;F+P@iAtbT4fIST-N>|c%z@4cKDXR z4f=>xp_G^9kH85N&)d!IB)J;pA#{ov*gK~G?vkyX827Ayuwi=*m@5Tbsjb;PWrK57 zXbK<({%9u2?6-HW`NRsj3j)9bXZp_BhI>lo&aH-potrCnq5xLMzI97sRkl}W*j3iT zh%2E$n>>H>OLh<@kX2(ewgG-^gM`?aAg#d!-HoRwI&gLEZ)OI|Zh9E1LlFu)ZFWu$ z6|Te1f*P4A;NDxJ5ljs*cNywIj@&Ws-}BbTL2=FRR^WE?;v0;yAADnq>ng}1W>D561 z!Q(|~!U?%+MSKLw?8^7OhKh|gygHC8$U@F0;lSM%>m3(R)Ey!!ueI`tUxy?XsZ8OQ z?-Aa_y@7vpZomEpG*M6!KxgGkW_@ko9OYj0Ziot+QaemcOxmayz`aQI&-y(GnaoHq zPs`0U{b=;Bo`BWv?NvXrO@_|KBG42?KFY6YUMnAKjZ)Qa=ac32e%+qRFpaV#CmZ-I zXKhL5^GX^&P-BC9ee<$zYY+(#0hk-QiOCB1DAygcZ&I2$wa@9((KBRI>L_#YVR>-T z<74#>S49I9cjNcKz(!9*pGjO$D8}Kbk&uMFJy*&_=!Ncau48O8QS~R9q{p|PJkI?3 z)%%9v?)`V~XwYt5I4mAkf>{}|zl z)jIMR&zEsgk6zEkGV6U9)`mSMsK7-qbYNuxTols?jR8q_^G%fJJ$3`4BHGbR=R~ps zd-w-Jn`j);Y(xBEG^%a7e2ho01GfImRBW>i^p7XJ5p%v&KQR47qCObV4P+T*D>csa z<}dz>p`3ge*J{tg4Qv6Z0wK1WY_+hw8~?J5l)=oO3a@BwjpN+}A=@lkSi8a7 zjrE0@7|rV$zEak@z9t>Qg6A9FM6nzugm-A9TS_#AqXYAEg2qLY^E|QFYU!q*F+qC( z93cCw{?Bc97G~xjfR8|d{y#FH{oA$G5%T&V9R~zv2FGXX$ZI6Hl2Oyz@kRzuNi|iZ zO#eWC`^W2d#M6G06Z<^V*M9)x1V|aoM9HrTvpdHBL!^gGepJg1mo(VuzIpq$|Av(2 z|7Zbjhr80GP`=YEtr2+s!$|(_@K!viFK=jE3QG}ipk%7u#RIXG9BuQX7|q7!CEvoj z#|_QHv_SHx0wfOEjTm5Go!RbWGCG$>g~?=I_ibttdiGxvhcwzyUPGf3)*bB-<$3|>I`1+@)PR^Ra##kYi_IfylH<&siWbF>kR35tilvsEt?) zE5o<9w{Pbu!OqZ%mp>5bS=?!L`G;-$oV8kXOH@i-^xl~9hdF9hmu-4v(kGuR2*qCP zAB43Hk6I1bH`vn6vhrW73RTQSYtZ6jAqjF#oSB6=<>fJOr59zFlkcesGV@RJh6Odv z%UHfZ3MswDE2Ve;fmleIkP1WzU}lb4%f!@{YqgH>^YF7r_*i=KqjME2Rk~^#zc$}J zOtP1JgB9!ZOhoY!+$H$UAzQJgi!WZAJ9;#&u<#szROH^z&OC(m^aB)+f|`n??_q0( zqVdaOEN&M1dm;RDBK<{+Fr-tcX$%1^g2v9^~Y>`q`%lH@G1UMo)K%HAmopJ z4jm-|=G2Z)CHyAF3q^s%>gJVizILvwA$r&t_v>iC-yH$U0)UdW3t=(QTewi(KzeHA zi?3y6j_lZ8y3CRyB3@PW@Nr^Oqx6xf6+Q;q)2H`5P)}C3;~Q*}fyaph#eFiR>&3`# z?-!zDR}RKb^r^zHN!0Is2T@eL?pT_;+}cm(><*EyQPZk86DXiUWqth=dM46G9e-SxU#eqS`31lGsVw-ZRj9v1Sq66zI288O#U5piQEW#(s0I7P(sfK zA-r_k8EQf%Z7IPN$|Y+kvG?Qc{*~m_paaZLQ)_-1!-sIl#KffhE~V6*F^P~jc)udA zQo4izK6L;K7NH+B-`_MWw1N|b!e#Rr6mg(ggvt)!JXI}Qf(LBOZ2OMG}qFK4-NwwMln z+!#c{b`2J$PA=R;!Pgb}>$Y%Wz@6d7;jbX0w{ zI%eXvIqe>mS5pHIo=4@UMK5P9P;!ugcI|47lIW>J5MH*y2TSgtsbSdALYrZA?N>vY zF3(jLC&?YO!V70f-P_3aC`+sBhx}Ju2rC$U^df$}87gt(*qQ&?G}F6NOhv`Y3#xJC zkE0iB9Cl|+{=KztEv(X-17GE=?J9nm#EAq-J}uK#EGpNU*?D!yPo1GRS#hh*l&C+W z6rd{~GYWmr8SY%2`eaGRM-z1`7hAs-Ww$mj_#5XB%gVWw4bgKIA}-F42i{s(EJz#( z{;2we4?hfYNxVu?5h`>#g=1r5Bd4qk&yv`o5Ih;`#`6~yw|qlIb)pSga!^V`E2)D> zu@RYTp;{0E%eBTCdEK~hIL|BxY2T?ir6fI-A;G_JS1XTxeXToRuA0fvV{{v#7| zZf#?F3*T=Iwa`^`rg?5Mz=sh~Cc;v!&wNRab{N2UH2Lb7sx2rn_d%jZozngOj38#} z;AClWk(f8wEzoC~`R)M29N<2pFvVbN)Ib4QOLMVd0jXzk`L1gwpqeT+Xs0r--BY2K zj&GI_+z!7T8}8S3K2^oI3^Jk9775IRJsNwUF{Ah-Q(H&g4SF5|v& zQaNW*-pg!A@tmevBUH#A8tTn1wr=KluJ-D@m(-D|u)6|n2kSX2In-~pR+P%q>$#&T znb3K=EYH?&jGz?mV2llcNC1SQ8MM1TW;}Pr+)J{owwD|DtyLWw+l+LN3`Rdkk ze{lXZR#n@{u9^j9wIn;@GFM;s;vU)D*2I}p^;X(iK^Hm*hc-0f& zZ@|UX%FW5!mAEh-h&EtP7tAzP`UiKnPrqjqeV|7zo1CdatS5Q}afJgv z#cK|hcP2D5J4fPGt1Rhi)&;fI<{Kr&mzOWJ#F|4R$tTN3%x97|TxfP~@!*e?9T>)) zM6FaI5J<-|Z)2}D)icT?%{SF1Qk`GQ@;pVEyNV1uxp#X+O7DR7eR|7*c90WWpTboARZ61FF56v)TT(`IoTSjk<4y0(4GPv7%ug`D=(f#LGCxs|soyng5h` z`#_+igGLpm6&e80wp!Rt#L9fv#qad9TMbqhKcS~`$sTedpLejC*i34 zBu>*`m{H^*9?6n16lbfq5w$P;If)exJ!8VX7FHPeBY7>01WPEw<>)0BQs>>&sqjB9 zk!Fk};i$HO9U1hC^V!8{%-E8diqIIjL0++Gk}qneWvGZGgJ0!mYiTDa21mRfQnA`8 zD=GDijY$tKOz)l05t5S;@kciR>I7{iAf=9z=O>4I`R+gM>kkCtsij+N8}1giwFD}u zas}$p=d)=o@Aj*swGut2n@Y`0|w~fqCUW5di@qvbA*vXq}4jb$Oii&J_hJkI&I}ZF{ zRXX463q0NQJz#b}cYzuML3$9=4?tIwp|bqHo|KO^0zK7+vr%cZQVTj?O`Be^D_#w^ z6Fp&jN0{<|{-n!DOW!mzGjq1FP>xIKWUBl0_pb_wb{f8yyBJn)fw(vXYLK-+)`M?0 zywdkdo}jT}`=Mq&MMZ4|^O-j>VLBW@~a{$_w{n>ZOq zE&usOLQFh~^rDd|H32@YZ?umF0yXW&Z23l2RaC@5V0cZ50hX1;e|!ny@+fv`*c)gG z6q<8#5SP!EL+w+&>J`la!^V%|Ai?=ycGdkZriJs!2sfBh?T?4k=bjs(teAt=Ci?yi z3;9@9e?%{BogpZ#BCsoc5)L-xWvNsyG z)dtI6rW&w?b+NeqO6`h$Klpb=Yv4Y?#@DnO&9!al&6U_R2ga%+FaHZ;ihIm(*T82} z;*e@B;-3xV^vXW98&J!5mdoH_Ol)xD5#G`zzy~aURG$SB;5E}f24!;-w^wcd*w{~9 zDzV%Qw-uBN#f?r@OETDP9FD#&RL;kn9G+306E*R%mp7bKfIRi)&E+K~>w@PG@emE3 z?w3SK$D2OJ=3MJljB%nu*$zxUfBr;@7`d;=itu^u@=r-Z5(RQ5pk~3pgGsfgyXtUQ z1E3Q2oAMJ7ag0{oz2qUq^(U%Vp1|!#Pebb(Xvc0oW$6F0!b11S)D+cXeG^1qzIFjM z^K~|?zYeP)guKKrC<~@00`LzH4=)<)c+GTs_kAOb~k;E~Wpfc zr9n~Hlg-?1WdjF+th*BvO`;_jY_LGb?(IUTY4p3~2rt~Vn;Dz*?p;KFqeKsThou%# zO1JO8%GlWrqQj;KLUvZx=gLY)DTdR%{rw`Ve(F}P zGxz;i@m9+3&&sj~6)yn~i{X>$e`f zjT>!Agxur*z4;@tx>Wy{@85&Z&(Hgq@G(Y;EP0b)j)26Cr34)dUVo1kOtK>6|9icU z#3X6Gw7~LwQdYXd@a?JcgxOPtwuQx&rN*)V00Ayb_xms_zz2Mgg#Yw^-`4zjacK#v zv_O^_n)D@J8LgJoZ#9u_^u&Zd#^FH+cLMD|BAl3n^$-~u-H1zm|N9vS^+A0Bx;r-W zzGsV7J_FfX<@JIsAPMpprRs|32)w~q6V|c(3QH`|!JSE5u&Knj--p)*`2?Rn4gNbY z$S-TAFflexO><%gc?dn0M!D%cR1Nb`!p=$vRbh4(9roh5`}NDeb0)x24R3z~V1o!* zC9bev_=`9HHCBEC`^PK!Y%^U|?QeJA)TvD@xa$LI9?E{Os|96!ZIh-*z9TDyU@ zj_>1-xYKC&|9fl;C8YXAl}okUEH2AvrPK5^oE=Pb!|^BC>r_tSpJN=GQHk?_K=_)~ zz3~5Y{~lE3>BqNdxo!Mb#w*lzbJ+U>=7Ud$C<@tehw@21!a#1a5Lc2M_^y}z{?C|E z^xBe-6cw1k2A5d%!uoUQ{u%|ZQe_#7ck1> zse@%^7b|1`JM}&u>b4t10Ib30HjPgfFPthjXh>N;B5kC4rN50$zcuK-p8~wmQyA;s z|E{dpJ+K)-#@~mgxeNx);Lf#Y@?eJSYrk^Yb?l1QGick`f2YC%A)fl*B@ge$)B<)4 zItkEWn2w0|vjb3FT3TA6nU{J?7OsK*^uMoxT#eZ3cj~RD|MjI|-o7q)jxPFtfAk>a zzXt~SZYaERR#r}wp)oJN8;WB4eIEwppXHAJ z9J$w9_W|jF*Re~pOE<0A%~*2#@G`(FL>?x|KuIFaPk~~765*I&Kv9IL#<@uEK#ptk z_%Ly@#};NUXgOM!Y;M^eA|v~ZI`V$hi|}>>X6(zIMRLjnF`eE6E01umOTMXMTzud?Yp7DOpTQ9n_C zaG4M;k_AmEM0~?cW%Ute$PDWesmszG`kX!a*X#phf^~WDOJ6x!QDAwr^X;>mh~Qh? z`se)c8-s@bKIxi>mG2J{G_j$d+MM_bgO%uwb8`rLvBT|+JKY4nK~bvP(_7pbhVms! z0ns0Bz6}T#DU~O<`!7N^W$BP5LSYBiA;@R?N~1m-EEA|SH6f%@sxuY#Dk|V}49FTf zgM{H&!~st)0#xyv6bfYY#f*)eHRLH_ymKME)A8hkHqjkwsjy2G$d-Zg&%_^ZDl_9W z9eg_8Csz|id2Ti2X7d;Y;JhJzDemh*Vq)UYz@11nP{qHGpk0jJU%$hNHEA2GRJnaf zMh!s)aEI+CF!`lQOG-W3)KvO!Q6ec zZMvx3PE47%S;#kMoYGt+$@rU)Icmo0xNUIB^M`hTjYF|n0`#S2wwXr~38kvZO<$XeoPw=N zm4g8O$mjQUh%p<9&G0uHp$+(ulasY9;p`40O9pn#CmLl1*|J|B^EjjsL^cu5bP_;U zbN?U&zH75KQcMV@0W2>eakWqlyHkakfIP6z&mH5&Pfoc)u!{mxDSlkDE>UJNAv3Pj zQ#(g27HFDUp`VcEF|pRX_M7=hpwi#Za-%#X8QECc9I`#>5R+J(-$WS>ln0_k)g`8l zziYGL{8z7CpXfceO;S}AFQNkB)x7WH4V@HFB;i4Ub*IUXlt<&mT<<00aVVB?tKK5iupX$-A_ zt&=nG8bG~maL)_(LtULADQ4)imqb^Ap(j7bq?yQy!PpX3XhXd`gU#z@H~N*Z9`R%=!E$R-(_xPds63(Qy}Avhm6IuA$~~D9L{m7Ar7zqZAV z-+F~3LuD!GrtzVx;5!qO>zH0A%+~jtEpG?54EB`-$Bftn)gE%-+6A=`p3l$FyWZEuPZ=OUSQQHO*^!7pQ@t>NoX;u^{i=`m1*?sR~fWPX1HK*=fp z%;b#k^?qqT4wvuQpB}$Sc3P%`S3<*PP^@l#I@B$H_NO9=ckD^<=w^S)>k&>^m$4b` zz*=;H6vyZI_dXxELf~t9RAaXsO^vJ%db8V=$%^;-Use%J$xKc4{C=JCD0FapxhWP; zN>Rw1JzYGQbXOmT3p&5t35vO>eOFbuHFSy`x8ix_-;|!+1vq-7+#*vbZf@@HC5?2k z^Rc^0R)(a$!S)ISv`^F+ym4WTY`CPHr)$yZoDQ69WEY^`tiMgDe814K$_A6;HB*>g z(d&9WVoZ>7bQam=mKHKOab_yeaheT_zPPD4o8CQ5OG^3S z!viW^6bp*12{04;)A5<##$#pvh~>)#NCf@f+nvnTba@r0)u-#fCaj0tFZ_h5+wIRM zF7&~p?y@wUpH^8zEAA73Md#qElwlklKso*be{3h5;v2UsZTv5&B;y2}%et!Yt^#0& z5N=QCy0z)t&`hO|Ep2RYuU&y01?M>)A1_!cM)nh7_(EvOW9HL#rZo6i?Zfz#4N$}{ zhV1Vge0O|>*(D&Tz2fnFDf`HryAv8;Qi#f^99*P&_%KCy&en{r2^;=9jmI}J1r-+g{noEqI?7q2ydMT4d({o zKtKs{*A%}081*U-^nM}yJ+1URdHKkb^lQE(P0U$2In&_mcog+w3qo2}2j{JpYQ_ta zb(!1JnnKe`X`Z(&%zlZKnTEu?M>&R@$KUdqfuD_GJg3J<96X|0Qp5HYp}{}qB2*Oe z0QBDfY0FzOb4rXRsw6f$Q$+&r&jbFQ*?O-y+oe2fwq&0({`7tzCk6>4Q0xt%dT+4U zAl-at&X=HCdt;-Ko`~J)!75wPZgZ1&@20)~rox>yxcPRG^Ex}nbE;KjSwP)cl=rwh z@Td1PAvf8M={hd9u5TQYnFDZV@Gp7d2=U2ZD|82s=NCR>yq~L(@?I9(LF@h@UQ~FU z0FDs9XR!OSn3DK3z*x%L5>55)Wew+DD0kDSop=w zVh9(6=|t0?;0qmS!<59679}nAn)7Lyk^vJaI|f%uiMOCz1e|}}G%Vhli(^i^ zMuxnp#ILn@7u%qn@I_1GGAoX9>evBsx!EE~n*xR9)bEK4*E^OZ4bPPg#AYxIhE-m#RjHVm2) zhAyQ4^x+F@p0R?b0(7L1zPD*UaQTb6>R8^=xpXajj3@!{F~d((d(bfzKxNb8bY>@-O@5$umnGNATdqHJ-R#JsiDt ziQ+2l*A4B?BICv0&B_E=bNkwYib!Smg9?U^0fw*2c7^sEsn>|civqQcN+*|0yUFdt ztegZXs^NCvDlu)p7_gH*QY^4K@sj$sl|IPnuNgisX`OjCDwDL#$~7l=6#yME`JO}y zEU_EXExYj0rhlIi5L0IoE>hYAwcMzAIm2ImDQF?8j@dpoR#UTqR)#R}HkLPS{MUo}a`ADy(fdZ6pzHBC|M&a7LqqKeT7&^<%yk{z z&ur&{zVA-G=j&1OHm#GCaF2hIWJNlHX{VV0ANn`T{fuBbea$G!a*-zHC&zd^Wwtcx z6QdHWCab%eRT-?Q)IV~!^xi#ofs=YL?AP6zA$&tERi?QH6*z@C@tIl*1|}xD|C)_B z>YDi&xJ@t^6L-EE-4XZcj(-xH;rKMy_d&DgLp=YUB!z2N1-f!@*iwgOdB3 z1jV!aq%CKpR;KLzbbXuC5o9$dmH)WuTf(lGbK94hk2%7hRAoM=3w4?#IQvsu^9gj% z4&(Y#DtVcGK_48wGa1!tj_2qtnjuLaHEcqD3py0P%i#t(Ed@~iw3aNf0o(aC+lo9s zgJovYYYVdxKY-f*Em5JGX(sAp)7~ZWidb3Ucl5c!3H7DzKeSow0zXJB_Jyr>n;%6({S}h)l<@tlL+2gcBsp3!(0( z4?3ftq-SRvqd452-U?G4OE!?4gt$EBtZ!O8itWFeh3_5??gW%q9K{_wJ(Uvikmk0RUVPV+Obqu9GQo`3vQl zryAY6@l@+;%A?|UB; zEXJxus%W>>_k6Dh2^F)K7sIB@k+#+k8X=z~P|9cJ26fh*T!6p0b>jeTIs9cl=Ud)% zn78j%^Nnv6u%pmHG{;s2lk3t;saR%DOYRyJ(G2LB;^otqR!yfQxW*+@+Y;e zmvyh*TcxvZF^qu}tL6p41D<&%HObVl%-meEu_+|UVPbCZ^5x5?OS0|}(S%KY11lKC z_T?kk{jYy#$pc65M&c#0mg-W7I9xQHUsDFe$U6(&5>^CeTA+@`^+tb_YY5Z8N>Z*pV-s7(-QZL3IM*H`V4|(U& z|Nismxx$u6$D3l}=nrXG&`tjmx^M~6wj-M61IwX$f*T z>!}#V@g=pY^?TuTmOZ(SqgD%A)%>cAk@Fb|ZZZsn`pYFtuqCiK?Jm07<~VDC5V>&R z&DJid@ID%m%N8EQqHH?w^I=T^bqT_i2oQN}?If5}Dd>0_4|S2w%&o+@L;*Mni1gNx z3-}|7?bcpFChz^cn(Y_SUHq}WI-}y!mA8r-DgJXk8b*lUQ$+un+vTu@NQK( zpJ}nytP-|dUHicoNBG5X~aK*2?ahPxDGzZ zKU9~KoFym{^G;JHMVtNoW1-}Fr73?^Flt5*1`<4d8wV|6K+fms;@xsoKkM6ZIT@LF z1D@7@{td=vXuv@nQg3~6b^t1+it~kf(ZVNn=YPIAEPahR97GAWf=W`HnRpiLpYX`b z_37$~Gse!C&^Jz60(W2OlR0kEYPJwh9PQ(%fffolz}cOnr0K<5y&NJ;lJg zxu72orbB;4B-R56bWTq>;*qk7^I;Q&Gzr8JiU3b29GySxnd)ClSS$WvA08Qor#Lz% z(!w{jv9sHp3uKxHi^2o4TRY&&UMuO&Du|i0A8&*l>B^a3)jem*yEN7n__SH{-(7h^ z1eb*DoPq|v?~E#j0qQqycLU&s6c@;1Krb?u$ME|Z=qCy>be;= zw(Ptd#6tjr{u!%fZW{vMyuOJEP;`>Zr>7rez^A+w&w-<18?JV-EHk1hlLQ?XGJ(Hm zsg+4LFlT?ei)3Iz*_ih3H@CLqmb$j{8i$)xQ*h1x@;eV4)2RpG4;Ji(1C%zFUQCsv ztY~GJoAXxBXzWMYS7K%5c71>Tv_L=m)nktd*f3swjJ_AiDQD9v$Nkj#=6CPKEg4CD z4efTBXFG*Kn+L)ALTspP=G)oATm?NYd7FL;X}u9S_9p>vl9hh_Soz&sVt+?HK4;RN zFKZ97lxu!02wgY^#D^MKtoYG;z-5S*1^&;aXNA(|`@1@aVCC*M1M#oLdQD&zJ*BTS zWy|q^_H4XK9^&po9OGcD!efsiQbsq8{2tEkoz_z37Rz~UfaAe)fH1l(y8BZ|s=Sxc zt;G_AIOcoyq`M%DTT=h_YguBS1{mV!48_|ppg0EIgqoDhf|B>9($l>H;2)80@? zYCNToI7toJ0I9mR?5j+#L6wX=_!(K=`R4-%*AElFP-z@4gB8M19eFVE?EZ+wgc$>g z2$&2$t;-{jXd&w1w|hPWBV{Z>RN0B`r!5kC>YPi7o~W-gTMh*bH@p>!O48CU#dJ#d zmb4K)2}<-_-|y$T_TbUU@o`oHcan+Qss4PIM%#s;<%GT5mF&sR}P_8 zWzN1<1v-5AU!iFN@kYp^)iSA~t2Uh5f>0U5njB3hZkg<5zZuhcJ-V>7OtZmYKhY5i zUJ5lU%8RX~?!Mj{f5evd^<~WKLHd`V>xhJi6v%h&43}U^&#aE~rEu~C+r>=$+}rCF=jbAxS^=)S1!eFsQb1o9KZ@{Gh~~MaMg4_+e5^kN&_L6Utr)GdvcTj zU0mGZ|<|#t%xf>u7Vu$OCaeOxz(^!|7_572!?84 zMsQlx8$8h2zTv zbpz7)Ry@*w`{c@LNR3|FvDfKj z{YApa#ezGc9k=QY(CNk&&}Cz31xg*g%u)oYssK}cYyc6ZE@F{)2DCLP4A zeyloJ7Th_Prp6F`%!C$jsU^)n?NdZ`ebrnHQnl!Z2wm?lvUkcQCWYDwumar*lY&2? zZk2jV+StlQGp)e@s3`{cZ#+opR%CveZ&9{suArujPyPGQak&?jm6fFn=Yzox^^px; zKRcugJ=h;S8!Ya}vPp!w^?>=w*i^A~elIzQis!6OcYeU-5Bf z`;wns3n1B{7&XT+%xImL4u<1F@O&%uPA*AzifZ{}k21eZQk_AF+VWUqgqcV${m(a# zzpL6#0^AF_|Kwr*8Z3)$vu-vB1_S=$7D__)-VGLf@OHqtp7vOK_Is9>K&>YIt4$T9 zbPhd5TJsD$B@Qs@dfizSjQIKHInj#=BXU<`ry2E}4t}MWN~=ZEQaz^o<&AeOY5=;| zGaciOFaPp(?fLCn71xfEKAO^?hkALnM(rGTcEfHG$7Mm`Z{s;owrkn-#RsZ=c0cafScx@5HusQOQAF4ySct$LnThk{u~% z1fi@cHXGqYs;gf-nf~1=&gj)T?NjN6W(kRUy?;{lOuxFvtjYL_8#&*FrG*r#;8J&W z6@dE91p*9b(*hZ%+h$~qoFAfp8unGfNIISMysB1Ya9zJuHr4DT<8~xB>2>g3Lt-CT z;#cowi+wI7ZY4I=4`i-5}K4AFA|=00a@+{!hI!09oI8>8j}8nwlCw?1~rhSQ`X9 z5LUZ|b`k5yRF%hFrEu_I`^D`QUq#1WhO_yL>|6ClT>_}isUsUe3-$Q%KcOHW(q(2_ zZiXje`A3RhRXnPmeJK$~JM!3o z)}GbkD&Chb9+w~&KpU6!d*FtXM2h212>&A#QE%aIOuuFAPC)0&- zjhp4a9oe)t@!T#V1m)*xudI}xYpxt^PfyQ}Xt$_evy+4>iWuJRC48~^yC5b(vJ^j4 zxLeQ@1`_|R&PTyFy_Jol8!r|l>^Z+SQn7yU7{P}p4qLejY=pwkDMn?2_2)wxG6`6I zQi0HpDB0~3-+F}?h($NEWs{!itA2pgq&xX#c-y?!9mu7w*Sa(Cr0?1ztU&W*7));! z8!Z&;%Lh;1`?T9LUYw6S;VU}TYjM?d-BZpzZ1Q5@P5abUVw#{YBbS|>Jq2aQ!YWfD zAMF|B0g~Odi&Xlc@a#cMXZVY+Sr9g{x>GO8YJ#`PefURuzzTxnt){b6Kp+s1A;!Hp z|GhLH!r9*B)t_hD;27wAd>AYq0WB>OfQYZd(d%N3+AtfTChbnk#&UX#%`=iw$ycaf zZ9HVNXVkMw6`v*tdRzRdjR6n}+gY8MmmA&?oBx&62_yZIngF$8jl0P^RFLZFe}_gv zRTTx3pr&8nMvEp+3LXfTd!OYBG)_O3GR>7RD2$BRUEbR-3C#5K-A6Ck4mEED=Y(AiyVMm1k8V&+ zG9wK%&uo}TEVCn~yUxho{`=5G5)}}_tP0saOH|Zp=p%`;k>G7#P%JSso2;5++5+$D zzm`@b!KR&rV~Aop+_j>y-XB_V*lf5u1ZW6sEWF^{t=Vk6k?1h(@3K;V9>_5QuKvOZ zNOZ0r+wPwnuXbw!OCNw2jZ>DEgL=NmuT&(-nQ0$*#quN}SN=s8`63c{Ub*LW=R;-} zB}$%6939Isy)CDlioZC|E5IW`mRzNK(R$-Vb0{j0PQyuo|4`wMW7F%7#d|x{Dy)t+ zVXP@Pd^2=MdJ@_SE7^XnNY|RWpS(A7ZJsQ!vWm-o;8Xj$unl(7p`LHOF|HRMCX)+1 zImUQ>qAr!Ks)~gj5Iz+Vq;Yp$e!gCNpbd^1V1$B5IRX&xU7}TM9Q)owI((p&X`YpL zL`~F3eAg(Ceq}6{-jyN*!3P3FvRU!#Prg6Ru1Nk#blpMd^D%m?ow0`(6v+26eUaWz z;hmTMj9m`xQ~o4W(T`LMe{u!g|%v?55U$d?0LU z_5P&{pg{2IUeF(6LG|`UQYSOYk=Ot@Dq#svPU)K%30A~;tQA6StvT+Gvhx$oI#@d7`S(@Wpu0Wt`{nKXP)m~1NAK>#4J{f zt-IP$q}enjw;K?va(U8FT<9RK7dN+lCNw7P7#Xd>pE@bWY=}WAJNr6-{-C)=fPZ2w zu3$BKRK*LNP{G}+NI4(T{t!{#ez?IHR_0kfWy#&6Y=X-AldUhT77s>;rSzk4p?CF7Jo&3P9KrI51(y213~Js4D3 zgn*Fri!LK#&^BM^=Fw`mwN{XMvcthJV!4iy%0bJklJJzBfeuK&*w9b zYjc0C=xg;?PW?z{WI9$Ag(O``J}i2GzTYnEhWBy@?`4Zs7AIKq0X|0p4Iw}RRAUzsGdiDI64man4vW_NvfO&Xgz}(22!%!Znf7+h=;&}4zFe3U#p!)Ih!s1 zvCMitx?XmcN&c5lf6^n(m<4pcNDw6i(tsM>hW96w!uIUaGt(~_4K*GJDgUs0Dju+jOdil$9|$%L>fyO7|B?)9zHi9k21ENp|?4VP5H7_sP?c z5YSm?vP@zZ2&)H2FxbDSw~v&vakrm6aml5!E2B)J>NiaKAOL%|goO^>^ONxwgBxNu zM7B1YD9`+KCY&CpoQJXjHZ_A#hC7f3Ya(l%Y4>mrod{?~OYSek99N+4o14ONvl|Ol ztG0WRUw?ia66eb3+p2NX1Rf*g)}Rj6gcy;QC}YaPI)FwA5T}D9cuJezBp7|MZimFV zLMS%>@(K;ilKMG~iDSaYD!CBKeX1jBsS7oeL+O>FwASB+hC$o&6~`Tq!AE+!9j(z; zoiq4*v|iu6vuH`SuG&X<+#}hOp}#d)V!*a&sLzzk!(-r??bErslXZQV4P6=z+~3CO zIpTlgJBtR}sN#FO=Ya?#(toDaYQ1vdwK^eW`9Z>Oq1B8y9Fk6X6~abayGOZ0goZ9r zF(&!yGA1UEQ_fb6cp#VyF;PnbTu~2S@Nf#}F}K0?L(|TOaZ-K#{Y@|}4!2e7Ug%&3 zM7OwW?;67M%3mS7!TJ6`CePb*R?d>$^ygGT&@PTIvX9$4b5BnHKALejZl_U$q#HOz zf+z&y>E7d9{;^@z17I0Utrq|;FYK&Y2Z44TdAt;}yEVZb;msrq_eeNi^wqzv@M;Y_ z|Ej>w&Tfe!x3>hqZrh(t@TG}GK%SZphZbh>yRU#Q=R?reD}6$NCD((Y+A<` zxCfbn@{CEVF13zegh{Vi&CAAh6sE-bWYAx6l_9eWS;;@Uj*wXI7k(KoHy`D`TbwTa zS=+^X`Vjxe-0v*x3Wu{OqKa8~-Uf)xD^3m`tIgQ2m9+L>wR+dak^8^MHar@xZ+N() z_F(+w?tB7^^qtIp|A~!-qE03h`x6Ss*>G~MLdKZD<6|cP$X^%5VgFH9b|w>nh109H zb3*hqh^k@x9U>Qp;i7P}KI^7E@ZIE|EQ@-qUZ9IUr<}g@Hbh>Cx9w)VcEf1pd!ExQ zL-xH{%OUmW(>L{R`FcTr*f%gB0X?T!|0Un6V(&fEJk4GwU@#YD1^gUj(T7zIJ=P!7Br|?C!HRLukN*G2 zdh4*Rw(X7AA_N4LZbYP|I|Zb>M5Lra=|)m1C8d!Rkd{V}7Aa{Ekp^jy4yECah3EXv zz0dt)KYQzjZ>%-foFm@xc{xS?$X42neFFvuQu!p*ce_L9JIb~R)QA;p>e_l@$-K_-slr1S7Lj35PhY*eEuGQrab3L?b*rB7Z5)y-6$H|~aXFHtM9 zD@?jh_W)~&Fr0sztB!>n3J+UvN;DWH!J3DYO;d8_gS#{Rs7R4}?fSTA-_BOG6Kpj= zRE|~>c!NYFP=_~|18)|LN+l>3J@yBM5;8o3yfU;c>}rKgI4mC(>2^S4%^1qn0!YK? zq(k#$Wr*N5f5nxI637)$w2-zb;hS-eEhe(1@-5jWxhX!Fnea3CbBQR;84BA z=RkC*)>JL}Zm!t2Vsm7pU&BlZ-SO;jX%{pU0SFl0^R!m_N=XBBFl}*oRPfNzCX(xZ zp@)NG5rx~Y%P(pL>Ce$o-uiZl{2KN`qJPwAr1X-R&j@%5s8;pRL^Hs87imnhGsPdR zdt=CSah|GPC+CVAW3$msPjBimWNg_K1nf_BkMTIQbLcv4w|ee= zmp|;3BxEyg!vduOjP1=ryNEiD5n}S!l20Djzu-1F_)7RKQNaDK#J64*bxunaBYY2K zNl6r#V1@}>kT0w_k#sR;IpQ1>+ zA=!?vyUbYm*Us4xm0xCYgizRg4QoT#C7u_ zgt{{B?)*?*ewrH^9!4%mki5Ap&w2h<72rA0LbO}XlB}&)I`%yi>RQ_UfccjtB)V~~ zKW~URRjngy`al5M#K-_E;7@FFyy{p|+-SlFS4=<>u8>sk%RPR~Ha+;{qu`Cc#*vn| zB0fSg-V}q=-&$^`Vn4a|cMp>4_i}cA#JC@HFZIpz@J^c??kv>peV6YRKElJ31d$T8 zZ24XlxxdRtaV+SNR+gr_TG*UI`kRUeYNH#g#A@D+X(e>>x6q6WPFkY)Gu}*u_fa%g zuoZqkQVh=c~Z1 zLoB+q7bN7RSW1HOUp57QNjq*R!(IlDmd1^*Yt-9KPI^mFfHs199{m&sUV9Lwp$)0_ zngXkOj*{^E=m3fP1R*o|A9Eg$oTfBbk87Y#I#t=yrSQ%dxW^)_E zYm2(*I9hGCU{7@Q2e(wL$Lp*en(1s&4^rPIB>e_P6#lQg>$*o{^20>EWOeOM*- zdq(TJee^?W`v>?Bu$rkNW!}0S`wVj_!ZMw)gDNxdR>7^|YD3t#3JDR>Q!3*q=4EK2 zFPA`ZU!>EMg{(%d=;?RzuKua`Y}Ux}ZN7MkOrAAUU1#6-!!K_8 zi2IrOR{Q0PmuFY5km?-g{{D?LwVVI?+#$nOUtcv`OJHn^XZkD@yO*PQ6zv|GA=|%d zVigdy>f^u^XlU1ROZw*CayLbm-H2H9>z1+)WvCczm7UV#KW_*fuazTsG5>;RudS_5 zB@OettD0A2B`RMQ-5^UB{0dd6(aw|yVJWzYG)5`*WOb9o&V zdQB1lu{qtQnagH<`ZW}#LXuN(eQ+YBWy!_t%>T^3rGt~2L^`%$N9ala+!Oml))2Xlwrdj^o_x3*CHlK5L`1Qz8 zmmQ$1aaxaYwMC>opp6D0EmGj^6k^28(HOw(yS*pyPL*(R=9m(&kL>VcfDeSm78lr- z@T|} zZTs`$hOfJ%yiri-D`NTdC&hKSsjiY=PC{N(y*-BARt@Emi!VS)1EDxfhK+_v!2IiT zK+t!x`&-}JY)))aS_cc<{uV1oDdo7j+b9n5&3sS?4dLxBS`Z5PH_zO0!$0E&6inZB zn_|Cq3NK$UON|1!0~_csVO;OIpx|M<=vfmIsVVU<;Dz%&yWa6I8KM0H>a7$O0^k!t zAR}6TNE;!vgPxcTF0tN`aZ_vIV%N^)zL?IrR7?GEy~qT9Addz&d{a;=BSR3Gs^8z} zGZ*~8tj%D4*!tmnMxjU7k34l?25^$Aq8xiI-p_GFUHP^_xY$ifyFTDLzIUxqq%EAB zsa(|mfRGGZnxPag?EBPIxaBB4wsPM6xQtiUFSWn$lvyx_<`u>|1H28#vE1e=fAehn z@G0JS+3P>j+J^^oP+=XK(A5ubp98p4u;f)u`zu*LC8~9?gPQMLe>n+Lg@Br)rSPOD z-aSRTT30HpB&7GAn(d`TL{gxHRw;AROQ)BFB*ub2_b<5>aJMaQU3(^uYq7@jxDwGIg##-`<}(-iw>3p%Z==^R6RC zfhzPWx{UM#jhoV!BPm4(3JAyRbuT;PU6#Cs??cEi95_csSdS+bgH3odP=u{MXWu1i zaGa%4^vcy{EMc$I;U^zkJ4Z*4Yn7uom)82cQN- z7>`9vOkP1u0@w^bGHi;^$9>2M@z~fCppQS)Uk+7?E>_Xd;F?tKsQ_Wl!@*-zs&?l4 z=Bjx~5Uw-I$;lxm!-`#74TMD8nyu^oL=+TlGj=7-Vp+ zpZ)bjBbS&nG%!t%=pz?S6K}-TR4p0TkU~8^Z0+-DuH1$NislEfs~QuNp2`wxJDwMJSY9>a4}1CJVAV}u!JMn+YGXUn1Y(JQ&KU3Y zg#*h^gE6egjqmI|#zyTiD`F=AZBi$%y29tQ(FpGl5uD7GF?stBn`Wl}Xmvh!zrosY zKn;f_2 z*_L29X7@u?8Yv!^FTZd8n|N=BL{b%+M?wJPI}UVT<@AW zBrFqoC{*ghdee!<3N$^iwb%{Le)GBm6~GN)DRi5Qc8!b>-M!m9vRm+tm{uuC3aWJ4|SO{NE@gt{=&FW4_vM}wd>^A6Uph{4!LMqT;v+L_4=304 z+-`-1k0*KOox*L506yS&ARu+V^8?yPqLqF{Gklto`X|reG^t61WEA`%SQ}3`US|ySrTKlGL}P)EEOTqXut4g&5i4p(kNFlX1_2M{p+H8=*))D%S70B~8|p zE}f>pK|F)tNB`O9=*t?~Gi0ZO^kK3GY+TgA=^VAe@lcsa-b6Ml3Y0$x8yoSTs}C=x z$Dr`JoTm^YBLxF_JvFgok9F(K>TjNx5%^tddKsMG?lx!=BeavmjwINZ$5d!N46 zgPLoI(0)d;;Pd==!Rz)mnU*;V9#WJ;F{~cN_NSr825U4?BZ5R>G-cNad*;Fg&oRC% zZfqxEk&#@RoO47+#=zL^X<$l*9Clp|%`6Z~_(v%#x!V%za65S}(r4Yf1N}-m%UJPl z>*5~6Tbu?|H>sj!u7-P2?DAR1pw`n2@@I4~*I1_KVFae$qllQ>KZdqZHjvZ{b$E6o zBYtM)VZ3`7vp!zs*vXKiaC*Jxwo7da*m63U@e1CJ9yH4Cj!viV6E-g>#K6Enufccu z8@f|EsO11%no<}Q0QXj?^upr_ArCZMTT0yBt>!MVR$ zUF@54W;8T-zk0;*myQgZGe$$k{6^}y2tZl%d|TaOrzJ=Ozs+O)?z#d-9@7`vOAvkh zYHm-F`?2EyI{KMjRzrzZ^ylLqTQye6r8`!L*02oJkukbaSBj%ejPR0rq+m~ut8z-C zayYHAk(!$u(q{0g%NSfgd)g=+-D*=c=TJS;|FeTrhy0olwk|el;%}Oq)lh5eyNTT! z#GwrhrU^akhF2&AMdHbWCIc+BX#}Ow+rOLqIYrCxGiKQE&c2c3b@E4;j5MvjjK<{K zk|ZKDxGe(%h_xz@AHRk|`%-VphcbJ$XO~i{Y>l&wepMRr#ghHO{Ed_QG68huTK4wr zGkW*GG!(mgNBDg@KZbeosBAy%>@Sp0nT5UI&X;Dn0S0gh)>lv@6h zrem}1nGBDhh@e>ACzu=s1Im&>%Qs3^=xVdQDg;Ef!|d_kr87`pA3qfFFpptdy>d(C zSyFh5jrxFdw4G41L{j_mjs2U7;nM?29mGNh4uqs*(z)1&79xwdeCs5Emh5=4_QSjN zPB+>I!nQFD`6uTG{!Cg~k*1es$J|vq!%ED*DQkAPiYe@b-PS=&OZmJ%f!B7*Nras9 zRkkJH)Yh8?e?LZg7gF7$^0ZQuj@xH*qGx{OUhKg2To@5#F0*8m&&PDLGR9Hd#o#|O zW_pw3&@w0xXSyAEhz2F}G;VL3;?n zQD6MjfHdU-w1nnA_$7`^5;n2jUrXdz%Fl#~3Zf$8{!N<-=5)PfPqkVkdP9x1Yu}0b zocXV5tuevg+Y_p#WY!Nv>3RG8@ zHOmMh`Gs%G1aQ1z;oul+qe5$9S^72~x=l(RTEC@MZP0Ci&zvFn_|0Ws%utoGxTECYP zHNM?4tD5!}gl;`K1VF%kf(Z`91W+kABYb0qkMN|c(I}BtOV=JLECJruasAVbD=JRYOR@R*S#8&s+dmRQ54-0nCt2k~MMB6V?_G~h3?Zio znk{}j045Ynn=uV?jn+6bS(m=S6rIWyUKCe{Omos<_?QOh5hgvuwqqFW9Lzoe>Iag+iXlh*OL9=!?m382o8iDVpKlb z@0^0sDC_P=89y#hozu@wWNf^OzLI?T0kxq1Wsc~)d_*0kT_5{NPu;P)C0)$8R7|3I zmVrMNjw}23k(VC6-lrE8O*=X9R2ZZo2?GS=K2}}Dc#2!S`lncvqqH@#(cami1oNBff@HyhTzq1oHS1=z@+cgE8 z_qs3nywqip_WlwyEXZ%2vX}t~P)PDY!iB1)6garK`Re1anaYB^sxID#>}<1FTKtX> zYS?R31_Zef4?1`Tp`yj+J7}F0Kn{0j(@j&de~B8O6mhXKf;EcBgW#X1#p|5!uwWAl zqV!Jq^nCdH#6-8IXf;XWc(0w)CT6krqwzemRidqz%5Nfa}qZYdbMtP`uY^!n{0*F z>&xL+p4Q!esKmQMLPFV4$jF1&8Wekpv%&TJ#6&8mP&7C{cckpP6(bO^@@F0tTZEs^e8)oRQO4!0B%XJ<^92T(7WeRmhu%#Mmk5RH_3wd-%R zCzM*eQ%7<(ABe!sfPOc^z?bVjX3k(MlG?z5{%Lw$T3Q;G{Bn(wrR7S&t_T-F+!80A zEUt2+_qL`c-eQ0!TpRGZ%KiAUW#KPWBW@|0T2gw}JC8nJ;{lTgS(f;_tgJYi>ifD+ zi@FCFyQk%0%)x|N%IABCqPpD(7oKU|!g$g+N&UOQBE!KpgXe#%>YKBTs(^VSNo(Fu z;5aiXAX zy5Qd%!HQk8DMkLdE4Mst6rUK>D<@``0_Y#O&CuEn4G)jvX1>iI7Ly*ysaf(s{l0GE z%VD!$KNJw{9{w&2yAOI{3}!bpq?$P3Zd)a$G^@LIY;0OJIdqsic5coci?0^O~Y2J%gRP z7RmcB&zrd%=!381`z^U*almTnbW}AUpo&@g`YpTP%7r6aZc`@eVMUr9A2Z=gx`d21 z@)t`^(G}_T>#XOLai)<9v?C4Hq(Ir5LHhC2mT{`pBd+g9Xtqp;iC5w!)$_!xK?D>KfLm#R+~+m^)QcU)4+cq8Uyek*QgBk(Fy+{^pI3Sy}dV7?@)zc8_6$CsOzmkzU$keP#Xw(9|7GqqfwwYi?VGLS~RNalVmaB6zrZ zQ<^9#+rhzcNPn6$v20{wwEYgglJ|Cqfy$#tZ95BHmdy7h2f3a+`C0xu8|^bt?GOSz zVp9#X-3=%LpK9HC_uCyZF?ee1!mXq(I^{!ZCM=0KwmJBd~zyjeLQRs&)e*9$Y z@noV`sS32)N4tC#HE);F4(S>j|JouWeK6P$Nb(EZ`_Xc=+Y5QoQWNYd31dkKb~%A= z(Tyj~DXvohED#&yLhgsfSvubuNzji)`~4K38SpwqgUPNDD;~rvcJ*U zuy`ACqHd5GcK}+jRKH%O;G&;{IJZMTC-Tv$$!%>b9#ViHETx^F&}Ca15uqk#uaA1e zn<7;KJgvT^De20q{Tk2GIAaANvw|&gi}L);`Dc;dg?^W?VGA6tej!{en7)}uT8cNi zB9;~=o0$!68nrVi?}F16ArxolLOCCQwz~sIveOGsrIy)z&$HdJv@)>Y5CQK&`ziM& zpn~@4xlXnsTm-~&Z9<vs45Gm*;9B;1>dxI>nc@Tw^2r9 zTAH$!)^KVuTJq12$$z5Yk5CtMFD%qRX|ssPb&}SYN++GrCnNc>m=trUC?_uu_40%| z6ku}!^&!|)yF3p+2X5>gvpg_YKtx~l z^peOFnl!xGr7+>mbOnQnQ8S;B3G&-_pUL~g5GMN~A+E=U$#fc06Lg=#0#~P}(4kmP zHQIPl8MYg)_n<+~9MpbDJOSh?%S3p2q+V9~-tgA=i;Rg~PrU0iM!y)EEL^|sp#3`rP3qUq7M+dP~b7Y?#SD2oKrq}C;J^)Iy=}Q97b`9v#qJbz8KSqjC8KR@nLX0Hq3V(avmH;*4o-Sc#79e4EbbT zNqt(Xzu#P9r@a7|%b$ltM2eA}zv+X;ol7GmR(B8gazua*GSd`9VaEKtIT*)oK$0*$ zpHcL5MVYh6*$4CIqOs7&9^A969fGd{KfqC~Q2)2_$Vo-VV2zYQe2Z zuc&Z(l-7tmy`(*7uFG(<{S)w^-1}E|zQ=@P`RG7z!ljlxsF^)Q9(UFng4A1B;WPFX z1LW+Fr_FbGB+)nNrwg~z9bz+lqoME6T@%MPcn1%|-a<3nT%gRhx@XM#lrM=f*GedA zCb>zT^u;o<>{b$5Rq1EOw3?`ZAm*MX z$`5WziCtB?nX+-V`_=RZ1OL?mggEuSFBI(@qZ=C;A{gZD9#-CF@e%Lr?Buw7a$n+w)#cS+F;_WYQh22kC<>~2K|jw zxJesT5-0jm%45Jr5oA_W#FYB?ZcL#ETqcy4>$0z%oU=Yu2yk;!xbpTo9v13#_hT7G zr5$qqjk>ui)@^Gclec^Ev_Cs#fiK3Q&SxOZ>ek9`cy znBF%#Z-g6V@WtwSMDmge)DUJ_mth=RTPZ+rs%|&?mQ8CAuk`W3jnfeF0xD9aFFG5 zC$htS7$mKTE*u8Fw?Yg~j2e$c5ChMteV+&N@|cLI`Q?L4&{Zp1h0v1&*rSLaifVgG z%PFgi`V21vbFvP8s!f&76YYy~y>G=AL>UA;4B=p@ObF?5Lt4L)u*Frr{%|LyobBWA zSQ`C&HC12U)2ci;TU6B4s3mNta{vpjKQYzgH9k04A0r(8(cW%v_BH^Day%Gtsc*m8 z>a64$%Q!v@XDPT5MLyPwl(rGIrIPUO?&l#gx-=&tM7fUO2avqb&5bCixd|#WJvon3 zTaW${9g5IB$w=z**}4iH8uL_lTHx;qf%goeiTEhAeZOyA;Ts~;$HQYY@i`~M&<8&4 z;Wv9ab{>u|yM4m#;73nHO4tLYIP{18Sb|vlf;Jvh21PW z8xqI`6NfzfCOUw6E`3{Yfc6E5@8CGRz{p*o#G2M!GC|^9?DiL_irAR=AKgibi^S>o zvwG!U$Eax9%a7}Q>2X|uCBw0&m$$pGnsPX+fiphH0F$eCn8&2l@J8oAstjd!#K01f z1;N&gTm)nWa&7EWh;3m_)Qv*JxZ$295H8QxtQO6|s74NS*p0*a1Dml$lS|zKlMSi& z7ZvMvb{xQ9sQNqrn^8gpn}0Ey%rT!lM-QkQa8}pfy^eIfW*!HYy$=e&zd`2Snc+II zADwi>h86ugJClDtH^OLGgBi2!Hn9tK+sf#W6i24|2IuweNFMu(UDs=#{692IO5aHv zI#yQYCr=b#g7zb_$Hs)s22R!KR)^YbyCXGTOhT6AN^S*IP0fLr`n2Ji@0T!x*FBfM zhphbmJqsdr=0$00dXW9eai*=KXD$wjBO^T?vgfRE)Y8309uD{eHW3u;L9nnpN{fSSJuMfI z_nv-hl$Mu!NV6C_C{+-OZ`gnSz!}%lm%%|dtb1wsp^MQ5Yo=!5`?}6Unw}euX>+0tyH{VRi-_#E+HOss zpH2gfz^;dTn5~hSsyv-m7Nm1o-T|J&KY{|~gR$h~x?9hJ@nEk}`#oQ7ih+gFc8wJ)@eM#GrqJ^|LAz zN?1#IJzg=xybjPwLrUuodGx@iAM5ohdTwFyRJ%0X8l(79%&}tUjulXIl_te55Ux`X z|D{*RHVt>Dn*G4F6R3O&$%NlGq=s4-S@(%K5ma#=A|ez~eWS~i3UFgyZ+ z@BJm{lBysXfC9poxi6cQP&R^f4XqRGpsPvQvX?mCK)SY@U!biTCz0}MqNLxtjLHHG zilaJ26Oh%=GTvW=SYBp({1@1}tq%i{J6A5tS*bF2Ww4qljg=A*jvurb@nS9w<6;ER zuJdueG}YGdKhfRx+uYt8R4xb0LYTUHjkRyo67=_k&@R#KBtRoJ2yv)gSzVu5#t-`u zkLI=k2AD7YJVTaA@4?<^Oq@StdxG$c%zwkVpH*6v@Sd~%F3v<3qW=e%dFa4-Ccx<@ zta;aH7Mvxm5`+85GDXu3mDHp^8Wnd$QTsv5Mt1dI{X(#{?Bhxj1^vYm_rFOAUS7zC zau!J+u_niPGwm}K&2*N-cX2v=F;?jL@lmlXE;{hT2BKZ!ObuxhZ;w(WASu`Kn#th%u+qI2RHa=^tb9z3I2OI&9&UlD zruXiEQ|^3P@+GQRIZ%^h9~lz}N{P5}zn(TM<@$h&v8ZZbz#1!bu@kaGKN0y4I4Fo= zb`!+*x8Kl^8>5Z~IqXR)mbK~ltd-`e%nm*#DpRGbm~r8U`kBzLR}sSi*&7=dw1}vl zcBy??idVy~Zx72;jmXYuP$SAR1^(*Y#Oj@x4BtL$x@FfH7mI{ANt)Ew?zTKk>T>FA zSwNwI$=+V8=Ga}5>iq=LMgIH0F|l@pp#Madm7Z{_okpEH>N5SwmA&Qfeh6L zKf}tREfSZwOtKTLp@pXo>?Olv04u{~neF+%dxlPq^B{|{YT z$_lL-WCuZ(aV8M`AXIx3D(3TDjK+8_MMPmtGsMU>PFyP-=42HW!@70C|3@fqF@anhmb->#>x$FG0+U64UH$)# z19+8ghMJ_M{sM|6izYiMWp_Uz^5&Vt|lTsN94 z`fo%J7kR>Spr@{i_geCrR;mSY7FD0{J~Q;s{BT4P+&?*E?fn76>{l!L4ailcefi&q5x#uF9|1u@ zWC9HVmVjOax(5)Z%0OFMw0_b2xvy$Nze#eD|k z0vf&g|9rR}HY`w;$myM4`B}erC5XcNT8-hrKut6qkIwM;&$^)V*YOt98f{xmcK~#?vsU;NKC04s-ot$TOELF zGw2U?Lbm4dZ^@e2@moQ_b4f$-ZlsLDF7d@Dr@C-F}j`|_aI{?fb0%N|4EA)u@wgoPR{w$G^ElR0xn8JYX9GBwC)n! zm92`mRZV`f`$oF@a53qy*R?@Hv&ZxM=yoSgV|$aWx7S@5%2+I;)D6!P__l%?oUw+V zaq+Ee{x9T$k5ryGy-Am(1gtx^-*2Q35r8Oo{E6=dVK=ie3n>Z02bw+^zJa)m7I>fF zzLLC0PoMjUpmADsG6(7AzLtIe`1?Fi%m4fBbiwIuywY~5T}!VOWJUHMMcEgE5VE~D zMexE*3Ob%381$e3!X@q7^?%#oot9+SEWkeDbNyw!g+E2piTO_r4HJuPle)489EmY7 zF>?&FkeiTzaohJbB-_k^K|#o2lA;7vJqVc}P(6ThGj@=1P5ghO3?q_IIE}}~f_YVZ zMT^lTCp}IqS)$FXKHwx}mjR!G*c%#`;@yVG3z|QD>I;2fT?$bO9}%7)TuD_nrxYg+ zDQc3o&0TgdigCXSEd7gBfJQaQ1!0kqiODrQ6vc9Y5d@|-uQ;h`Ys-3jpEZNY5YBu_2@+r6nfKDlNTLJ1G*tgzPBDOR`5_(8VQG@sgF6oLG@j z%A4vk@axZks^yoj`k3fzzhiD@Ag_1zA}V3VPj$9eKGYD(h9wOj=tcH5+QL9 z=`rp&=&}qur3E6lr{$O$ALM|DH5NB!+^oHYi4*Q5o4ug5uKg$@bok@-kF3Gy=dm{+ zF;s?2u;L}=Iw2c@?T_VPHr`HPjpLWnzuRK}1^VV-$k^6Ky+*_{B482KS$`aH&V&CO zlRGZfV*XGUEFVF{PiNnHaU*e+86UKS#&?DF9m|+I!-isbRk3uW)EO649y3r0|4>{U z59hF{Cb#zF15JEnt`_(^{y={h;$Z&o>8?(d)B|(Rpuqx0888!&7zL37xzr-_p+XcI znkgF#y|U2e19scCTyfJ+u{p1G30}kYw@u-9U~s^b5wPI+7)Qx}Q?naKv%Qt`cOUxZu}e$5I!|1~eI}ek>4VAjRJu+xrtvbK!QUFczdw)OG&_!sNfDfAhXKJ>k2kNdiL9)-; zAvAy?SOMx*+k(S(WM)Jg8qZJ1Ww4d5%Z?lDY8CSv;JxGEHUcm+YogT z)|TTPtC7KE3G=k9o?c2_kPi+dD#)Jy=21%O^0ip6x_}w~)=3=)&+k^omu1i|8b!p4 zuqQCVNhidEt2y}KlVKtOc9I1l4WNVA z3L3uuZe{liV8Z}stjvq8%eZzB_ovbIr))Mm@i$~UuMjKATjx~d`T}qL9q%?auq>gj zFEq+?2(FrH{2`6jJ=+XfH$XRT7<;j>n2|k31@d+1WgrYCZD;{Pzzuue)>?U=1B?Y3 zGm;npd<98h5s)T`qC!JM?Zzx~(&>Y-wEpdXvsZtwuV)qHM0iwwSdLIs3c2UoklVCr zAY-SHf?x_^T7iRd-Wos$e$JEpHFwo9ymw?m>!YI$-3Vw)d=@(7h5e_M<54Kv9RyVqr96U2krNJwr&3w z)WIddcZ^KpE{2E6hBBO7(fP>>D|HHYdv>l#?OjEllx>tiFks@+H>@dn=T~WCfePDn zmYq{rrx+Ufo=ERS*k!Z>(Y{$0sDq$_otc@rT!RgMN}x}LQQP@uBtQn3cqbbckh_RU zNQ`IkdH3JYJIl$iaR|u>tpSj>&6+rX*UivoYVoX=M>|zj0Kyc zQkr_a#VYVO;dvH}q8x$GZO5d&eSynkG&m)_(kzHx^6sw$eM9 zyMh9*qhdmpf&Zyl7eI;xYHL1w&Fww%u2Xew`E}TfrN5~Jg57Kn{=sJu$HbLXPj5AE zRyuaxiLKlEkvZYH+k;@hx{43(9O}2HUTRq_v!4})a$rf6fQ#V<%08^h)c*lF6uOPnJRNV;1{zfdkHc{dwS#Ecn|;V*9Zs_B;# ztN9q#jT@z=Pp5xs1z%}rVG5dOL%558iGsP6k6M&h>2Y50txN1~JyC5q3@b+X4j{zp zJ6uXrHnclSJ+;Ue2YUx&W8;Lyv!GBQD2{!4ZfRp9RYe8F+{DGpxOhljY_u5tFHkiK z2c;3PR3Wg*(|C3=8*d72M5P>D7<=^g7NLkRuZd@DL96uGx2Zvus`ii%er)Ez@>Aza zIl1=F{lx=~jFjJY34qD!9pzEDd-twW(BK+{`*H1APFKCoAfDS8&d8+}HY|?O32&e2 z_#USD{=a`?*BmDYuNlV`yj@5f)J}28wICQVuu#8F*G+rWsic#Btasnf4Sfemd3=_B@ zPnH^F%(RSs_~_35@37iLquH{19gej0PWy9}I`d0Q>e||G23L}&aG?nUGa-oMM}uI; z-2Hb9{AP^i_Txu1(m#nl43Z)a@jT-b$1+1eXYdpJK3E@Gh1Zj?M$)VLb66S*6ma7@ z@7=y0hnsokr zU*O2?2X(+x@vOTUk?d119y`iu5h+S|Jd{v&o%?g|C$ogLf-Rhg05r#xa zqnz%En$=pD;^Fpir8$u-5fQi)kdi{}O}!zo14y#t zIKmZxo7hRbHrASUwnqoCo&tEk`2Z5^FUA8NSAYJ^&r(HTS-AZ!*clUedgGh+vnyoV zrzc+c2gzI-^Ny#VcxSfV4%T4uWaEs8+|S+<8zvBOJ-%LS)0Dpd$>hs51X9dkssgL! zzDqdY)b7O9u2*ND<$NZ@-tbCLmqx-&1Lzd!%$vj&E`iJx3~D3R6kuHacXPzB73KF1 z5{9Roz=w0pzWo6@S~+7=)fr~?rXow^wZ89Ng}BJyEPeK}W`euQ!8-3Td|75m<<*i4 zww;3`{>!TCN(z`q($Obpk?VUASu(2x^{Odj1FA4qFtxtYa~-M>b`G0_C-|7b+PaG~ z2Iqgwfzk=moq+N6sU;7=pxKFiHMDkS(cpBM#DN2k;?!qFOf>9cP{EjJMwCE*KhIUq zRof_ZQAhe&xt!lGzc|sdntjB3}A@h#ItQh{uMip-v6m%~d z-8h=F<(ub+2GasxD~s5Llt|M=GX4sak1v%C>T0#5X`K@Stq~#Hy-a8-nnJ%6*dcf} zaS^9vNBvs>2VY>UI7KOQ71ZfKP(qUP8~XUT=1^g(3}^ZIXSCxTF0cP+1%cMvkN?#I zJU#VIiJ_1lt}1ogp1nT4uN$jC3s({f)KKQkK0FFAh9G;?$|JCMX=y3bl2YiSz}rt% zRpnW{Ov6YfhXFzyA})czqwSJ^ky za*rFSo54iDvflUkS{`GnylELlkOK>H{!iL;jvi{)WqHG2%qG3SFFem;>~@hi$z2m`|t9(88}pvfwwlu z0~9b7S_3=Wex)0|*9O6pnuf+hZS8lu2Psr=rc}7PY#XIrovSyfeWB$NI^xS!saN~q zwu$J}K`mw9$YEH4DK}}y@iH#_^0XHEF)}-*& zW=;pbecb!RiwhCAv3fUL6riqb?Pp8r`!RuXcBGAi<#@^!@K1N~FxD;4V|z(jI0=y6 z{2Rly^H*+MBnvQ$$^_?PHq_r#4Pz>XGP?sncXu6D(T%sU>KHEBkF}eN)<1f0xDDW- zWS20B-yy(`8%MGi;B!&sxQ~7xWxtj4FV$y&gv}^eJ5ExF!W{I~5MuKrwQ?ykcLBK; zQYNraYn)cr*H6XD#24@8gYX98z>&xP6~FHl1eT2W;J%fMnN#G#^Z$1Y7^@*si z1uzpkLf;+YDr5>$(0m*rPArq zQv2Tw1P>)u#S$s5+)1aQp}FHcSZU&sGEEus68$m5mEA+kvhwmx1s=}Y&0UecX4-<^ zZ&5@WR3{4`<~SL0XfLEv)kn-3R@IwB+SLPH&cJ~Zl(G@DjSd0`kDu(9nmhVm*4Xdmb zm6bdF5;%szAvrRnwQSXT9%)Q(%B7YJ9nl`|H0p`w?MutX1<(lBL9ub!Nx&Ou=xX}Y zL*oe)5AN9gXgD|Jc&9)cO`bG=>9vAO0*ENV*kjq^{=MoO8aleJf*ezhQPx*5O$2Aq!N8o>2hYvFx2e4c{3&tMS?G9l_^+a2 zKP-Gi88|@UfwaFqF>D9n^v$bD24Q5@1hllY%!yD(PQU04)C zfNW^ro(+DYMEVXP6g>Ns=H@sd>wo)QKQLQp zU~n;_sLFn&480ltFt3z>eQiQkR<@%_Fdzc*-Nej{!nxp=UlY~FmzTvjjU)+eTb`JX z=bMk7=;*jZB^Z=cCrvks%cH}vI^Qgfxw9f%F#twbF7K%gZ-^JD0eY=}#R(qmw{ceU zWelzUUsa!2>sNA*<~?_v`MWuOFtrgfyMMkjO^O!XVM5(Q^Iq*W#D;I9qQw7Ee~zuj zfBp;{U(ZfYzZ}x~6%vLBwe7j9MW>vz-xR+)9LuxLI0^8dpX}yMm}U-+@-i`vQjuwm z@?AU=9o~oY+8XcHZbJ19s(t;x(YKwS@6jnIT>GjrN|9AYendA0;5ic$leej<-gaor z@EN8-(6^55O>_H}_fdP$+xM+^F%VUWVRIn4Gp@h18qn07mAG5A?eRV&$+B7A%tA-M z8Ty*bwL0&aOaH=};H_M>U@TS{YSGEiOKVoEGd@G)UX>j(Tq?3_m= zR?hi~b?+2+Jz&L5i9XacCm>Tb{|T7}*T@S>!fP*+X|87RZ=2jBdHdn|Fvb^Il;#wF|1T3Svii+LC@N=0_ zc=w?~8=g<(W5cD#Mx#_J640NmdvT-#JNo0=)#I)|G)bSjlT}{V)`OQy=zxjIw}UIc zKbCgCG%1f8lwRPdGoYr(34{478d+*l?pOx(klar-?zX2a`8r2`6J)q7iS=T-m(LhJ zBxpc+?S@Wy7)*G2dI~LtQ-rGB*|B%$ytGQ<7xST#-1+ibXqdB=Z7x0Xd(<(Sxtm*% z|NpS})?ZcbUDz)IBA@~y(hbt3Ac!=AgfxPHigXE*(v3)WcMAwgNtZN8gOqfMNK5yb z_ukKQo-@ur@c#0yG4^(hJ=}}My1y~wnx6|HtU&f@3k8pcVBBuq_KFj+>44e1ytk_vCAPCe`l}55D7619h4nZ|9M4XJYnm`0cT@e^ zYaR()jmO6;{t~+TUzmK~a(apK1Fg=6gk-{cF^P21o4PXr%}*ITv>L)CT*U>MjqXI! z&tr?~`xW%tTVp)P-*G0mCF0&l8XgGc?QP8}gMz@J-cNJw`%yQ7 zsp8w?Ub{9!4-+B(>34)KH;b%K6e)Z*aMZ=e?W^^J32Psq79)}=I8`+o-G#=qUDy%e zA%D)I)i_z`6xKsj1gmD^K=F63gHKRQqy9R2Mk3AQ51np}_Tbj%=;pPxah`#9^}Ng z{iU-F31?BB?%F1sPY*g8kpdgNCeeIW*o+}8jzWzRZ)tjOrgjGB=Y<+x$^{z~Ps2n4 z8Sxm1Z&2P&8~k{qkDgPz%aBh9k)DPL9S{rDdjHV!a6~b%yCf*=t<|Wux!cv%1qfe~ z!q2PUR&Qpi2in!3o}F)bto%?_yvxiSu(V_#p_~n8p+}95%PB2o+r}0yD z(8tAL(#={kR>FRL*STKfv%0ghGn8Ii15Hq*{WJaHK6~)sPE?m2y`NJL_>R-?3lTjx zzHMuHguvRS-pxLSi$UhzeA$ED^~K9&V4<~c9nuBTb_;9weM=^|sQhKS>AWKe=BY4| zN6)~3n8PAS1b&piXb)2qNb9VIItLLzj9kLsH~1=LR*v3GcTfYvgMv6~!hy0AVcVb7 zG|HecL8KW8PYx|T$ZY&U;d>+MVFn?56w6^`&u=agLO`;dtHOd*HOJAFZ(^pkz1JNp3+APF3X=dW#V5_AdmSLn2qRN>|5< zsMHJYFq1Zu1V3OFrbI=o)LkdO_D^l<4(j-smxV=t;eg#9`VG?^8GIT^nWaGKlI5}b zmG^SSdAAXvpCMaB5F*6-FtT!%4@->2M9+qp{j(*D?-K`#Cq zQtyL^r=y^VW8wV;v&jhd-`fvfI?jKF5gadsRt(%}?9YSZs&RgK^btBg@B(DbCmYK8 z<395i`rS}yc&ZA=#EoHSG;hO#zq!Q8R|FB4Nmcxvo%@0FXB50Il~aY1pzwA zqhItNLin*>bM@pVy}*<_Y51tj9&V-*9v*IGh5PK^U~Ap@(S5 z+}GQSWELC&ffZb4`}R=1#64Z>Hn{czQp8u&_O7zmZ!LRu-;>6CFTqZu9K__Cpa15Y z-u;0_kIR;aKlRf+I@u?Q$5btW`8e6D&tKso}ztQ#Jxu?5Vf~w zhqNk!uXAL2JRvu#4}ANE8=Q<0dcK6x@N&T1&iae3bB$q0_+BWYcWBoy-O2P6r}3u0 z6)15`vwK*Yt>qpqi-wL1GieD1UI9bpLIBYHEv6>g zVqfv1i&3-4yl+08VHKYF(es_X#MyJULECMyRq!r9KmWD)ynpiUs4g51B`69d#dPs1LJ8nC(Rjj6QL8KDkBaCwE{Ayv_MN-<^CF_aD2N-uPkn6N+oEc^KYB zLcu3ZVnfi)3xL4>J8Kb_)c_Y|qQ~pBjt4APuY{o$jC@yn{>qpBlXS4EE^prI=FXzk zwQY=M$1~X<-!U(g&_iS;3h<#H(4tpD?$Go4bedSKWqZ4w zsbNJ>8-dZ&OYvu>+0%nE4vL=Z252+w>I#%!FO7QCYjF)_SXR#h1YC~k1nuHQG)O4&QgL`R*S^*=EggA(1Zit+Ee-aOpCB-ZpDrh}jEP-MkX1Wc}t*2#eg4pfu1jGy_n85=^U

$aTUbxdBUV)xBgFOZR!*LD38Gjj9PNLJ<)i)BO6 zN<=Ko^7PC3Qb&+M>l+z4xwDz`f2%!F6mM-%Bp6N;U^a-^G6-MLW(OB#^ns)d?^n2# zX!#UkC}Ql_$GuvJ+KT)yyG}8gdhq_iMDo-9p@vERbrWlyE{-;`83+9SbT#GLtjNAT zh5PsKJ8rb)B2*C=T1U9bwvxS zKjHuh2?|oO6FHkzd&WC1&GROnS1_sXS4v&U_8pKLeNZnj>AgIz>dX?iVDIkb>G>wUu#8;AJfx4n|!X_RyM6Z=JSc5y@jrv z-A!Sj`if}nlYq(U44=SvqDV|%aVa%AyA%bfPhC&nD56)2NVxe0u@==N!avSw7I(2~ z9!(+uQAGZ)QS90D_yes!w(w^Y$pUq*k4(NfPiHeSGrd=bbGhw~FjLP=T++TBjxPX~ zn@J*)-fYr2&(wBk1Dl#=kaMIbK9eBTL^|}&E4Dk&N zs1Ruv#X%w*0^NLs-gSR9+E&A$KoW26N5lkrt%LRQ<#`m`2XJo%1OzYykOyjbXWoFjDuvRx4#c*R%BpVQj@bD+7ig8Qz5;cZ&!YL z#M`m-3DbmqVo!4X+r`KaZLF$4p9;p6#>)FEC_ONvm?2?)45d^s+m1HS8Xq-aBo0-H zf6Ktx*82By1jt}ullz259JVEdvdI9Shl*0e(UDLr=j+hvw^9Wo_rcZ!8J59Vj@}*$ zOq@w2nBDfx7EWN2@@Z|Az{q}Rx)Fc}x23z&gM7ki;mH7R(YJvSwjICrFW9)bqc|%Z zic7vE)f`YNFv&5DWG{ig5FPQ2_EM9dFP}XSI9X>E(pKEBkVPo-#kwuT+FF4*^mmjA zCd%IsDT*AEDhllr7?mY}3qh%2T*$BKD~wm92ZB1>NZMd>Ts%Ye3RrGw&HoHO+Y#wG2LV!6j~z>?!hQsbf~1>)O9-RaZ;eH!F=g zNTZm${v^+GYgP47t3W+GZ4@_VDejUG2UR(EU&vpcdt=3#Mm;mXwl-fDrf9DJ`m9$400JUSG1q@}Q@V!SY;)$d62?_V=~YIwC@_>>Jy-4NH{)9FgKCpjt^ zGiw%g1ubpkx{F6^{yR+QS3+dd4aXEVYt}e68!z2c-D{}Mhi;D#>735E5gD}(a>}%Y zjLphZs|KB__cEd!iH_ZAVT(Lqq3bt7wG>~DKmwB>6)Sf=*Pfj;B@V6e0(N0 zwk7aYH2z&Y@6W=Hs?5S`F^3p(BmBt5i~VQVLp`lYJinW9-hx^IaUx6=N`mtzYp6p# zhxI*^g}n%W*OMBpKM44vv%7l{=|~>?-j!B)uPAci4=vX?fvq~Q+;sE$WOTb%fvEb` zD@a7i=ecbS0L0?xQLpN$`oTEL=>3bWdZHYaE`+~YW_wvMn^YsnRL+m&_ej2j5WuFX ziWoUZB&Z2!_`0O`E3maa&flF~jMqP=j!l4Qa&XlSNzxHnM{+VbY-AW@bv@hZ_$O|K z!*n*dYb5};V*dJO!1()2sn;mVR9mT_)SAm9~r)Ar>G}`n$VJBG4eBZv4KVCDC*< z@UsTlh=}j)r^A@e*;%=Mu&WvF#HEubwtcct=N+{_Xh_v8GSX@ghf@nmZ#7l)k+(zY&YD$`-i8a+k@40dRBVH^T|YosZGCsj zkIL;vxyrO4%(0>KFvflZ0jO7kBi-Y@)=*IKUKz@)t49P`ceZpoaV>&3tA z>hqz0x-^V`*4ML}ZY6~$!gbs%5n-I>j#&S~<_((M0HL{Fi3Sq~$FHAnik5oF$cD+w5w~% z)U}DjM2IpUmQ5Ah(O)xLUtii?hY3+o=N~dpWIbz@)$z~lghS?3@Ol2T{R!R&+KL;a zAt2|#FBp-1NG|+|bl?IXz6RahN0`@7ahIIVbY;6SBI4tv9gGDYxsf(0p_j{g4X;Y% z4rizrKptjQg;w8dF~V{ys13hhhib~BJ&El})?m6?yZ1(ywU%=o4bZs**O}%He2c45 zTNC8`Go@h${TQuufFRRTvk0ms*ku!P?v3KYvzy9Tl>mq)VdDc$x zd#AC@{OT}{VBRp^D3C0y{X#QHrs!k&WSOGsFUv2inM|2uEXudC!3Z1Lp4JQRWeUfC zUct|1{QcYRWYz9u@J)0p*$AwIsQCEK@QlaD=C%3`bo(ete`*qVEl2^;xp(_RIgSac}(}Gn6w=*Te}Z7Fh)J`VybaTdyYZ@PuM@ZSQI_O z3}%wfET8Nik8Bd${)UE3X(7#d04bwG3AoE(AzD>|1`o6N?errM2t;IS_-vW*Ky*J3 zcycm!%DZ7~(;xWoj9g_{JkA!WG~si+cHO!9PT&o5x6JR`D1%JCS@-F9AWp)X7M{u5 zc3-joY|r`T(@%bY%_DU&LLxQxlE3P_&pmGn)H0FqhDPcxZu>R6R+Z!*{w%L7vbUSt z@gpAP^kFu>W8EYfm-(!4ee`sAkVa8hTB5RMgc! zh?k^%I>5VpBYY&b=8Yb4k6#u!%w5kEwviB*i)Vamti4_V9^CRK3o@IbA(dl?zc6|co=0!p``~#* zYHA;Nqa1;G^|Ucrj5yfp-M5+(HPU`WRB7426d*)QLmb+xLHdp*IFQ-_z?-)jE%Qq&${}T$&+6QzTwWI>81!QDPb;q_v5G=%!(3@t zWV*-uSTW-n3&|rpCi}y~L$!b>cLguF&QJD{Hgu+u)SbsCF+&5JP@W$U;SSB6)edXZ zg8^}rd!*DH96Ma(8xb%l@_Sgv)s*QX-Tn5wFWh^Yq` zxmeK{be*!K!rDz_7V7WZsqd|Xa)SQT5BGGwp@7Gq7|5I?vlO1-{bujaevTz&NN55r z<5g>xg?F^}vtF|v8CKDfuYY7Jx0&tv(hbfW+R?M@q;Z-lZ@IHU(X;5HwByqy{n)d-`J%Qjjio63pJeI&9>|Da`_mazSyr(#XW$e60JZV^ z^GKsXb)>)Fod&rR?^lNxpr{!5AzM;aosgFdZaL zXLB4wH?X#kn4u%bhpmzJ2g#zjjmp`Nd3pXwhDw0q=-gt4gru;iF;_Ps$W{NWGbwaE?PuVz93)He8&3+jk^QPFsDt$ctLd%s`pofy)vTxUjGQ9%WZwa>S9N9Fsu!N?MLD z>8Lm-lQl7XLkK_Sx4qQS;{MofF8J*xvR;NA9XWz7r>m!D=_~gm{1BxX-`KUv-5WX}3rJs+RC zjSb#72U=|G*r<&x@^lO4O=jgooA$f&?IAx#M}8f?)8ztnYFR8 zQ3^zrRiIp6YQqw1m^WEfr`kq=Kv=>=%9W|ft0+6u(%FwPE4 zwmBH>qZblN0h||Hs*Zc-?0fzGSr3Q3`7KcJiwmR-{3TnUm+GZmWPG$e56LL}EZBX} z-lZ00s>`K+2I&oPX!`Ifo+N^C6UW2D3%3tb&msu@>5E%kU7h^rlcDmlgRvJ%y&+Sh z{7GmB4n0A@(DKPeVJ>>Tbfd%rD9(wPU3NsdpPxj;{%SMG>zF?%sb&{XVgK&_^N(vT zPgG~|jjJ*kSK-}k8gc(^2uh`7?cT1IvwwfpN371paQiu*fW}Al@F*ew%fcxc)wpXi zkpp=I#O1Qkfl)3PfuXK+^?>>U{KbWZ;#S7LZDZ`~f2?lbfQB$NTGk+F)5TD1B12sF zmmeW|>-C8;W=dDoZr%s;d+1P$-ML2hp4RR8yYgDS(>OHhYl>XNpwRKH`XQJZ>B%=x zneD0mSu{8Fm5N)FmF1H@KJ@ZiJ__t! z!}i%~*a41DMAu}G5Y!JJ%}VW>$il%4+@E6yIId&;g>&p^T%HT zKS9t5d(h--|Mz{~B)|13ud|hqN{w2xt02um%7%~q(mZ>~?()+`oKnSiRD6B`@@~-# zC9wPG@w{^P@6rfvbY!GAbdn(_g5f7h=if9i)DR(!?$aa+XCu)oyIU~f@IZ}yQ`k`N zU`9$sW%dH|-6&9f0mXlU`e7N;0l4|0vHNox0Dp&D#K4L& zFg9M?+w6KakRLiTcdfNl^#1LeH>9yj>h&+>2g0(sF@AUU_lpd*9JLLv?ZbHE0(h*+ zn+Le1{(Z{BpY^pmbMJ_TIKX!uU6k1y`igo4U7@#Sc(H%Kdvu?hds#*Q-xNDkOKL0E zCSe`(@9Fv8(P^J_^w>LyX|MUH`)U@6=i_xr4@9Mz{ql8aU?9L&*3t@Wp^&f`yytpk zC49F17&M|f;uBWTDv37G)Yxxhgl&LiJX053UDl6;kN&XYR@V7t-93oj;5b?3h>aq z2KC!@Wu()mHy=mR6J&~-)uo2LZwpSOAA2TvYG8uXMf9zc@Pv8Kqx#u)AI5C|b!#?%?m87s9`E z?j`lchdg>DP)L7BhALV=GGUzbQGt&%#@j1P!6;mu9xt%C<Xb9dqw;Rjse-p15~_gMuY(5ZmHB|&q7>8nx2MyYP7 z1~Vz|dNJkh{6{4wC3n`YW}+M1ZYOr_VN{CLcJdF8{0`UY6I9FBI4lR>D3n&($RdT#_e zCIJ88`f3GDQ?x?=a7j9Hk@u?uu9*Q&Mtldo)DJyNRrdlaHI$A2jaxEZ&0t0k(I?J zNl4(?{IswbCIUugs?VOaMl-7tPc({j^YW_9ZlZppipBK9bsuh7RAVAIHJo*y>_xy7 zaBGIYB7ftWYBHo!t;>!pd_;}ma|OzRz*Mt*TfeXV{YkQaHxaFnSVv^#WjFL)6l`qn zKmKq7MAEg)1lZ^}g88&EI`1&5PQ9+(LXXI!r^d!FpJa^}a^Vfqc1w73=}1>OWp@q! zkNF?meNCHK`Ma+nr=|*r z2?&V^&rSs@=h6;lOBVG)qvp>WK|B81-^N&xiD}L~ir)FpSoU1hjshj_3QtbSYMY^E z-n(L$-1)nCzNhM&DC}cJ!5#EVx5b+rNkT+$Ld)hXR5qTotBs=9bCNrtWL+wQ@7`I6H>URj6}L?CWhwj z$TbU{pV+fQL#X?UgG>nV@y$(h;^lPLZW(2`rpAuLQN4sOd^Cr)2^SV{0ETlFr3xPW zZM^*a&lu;tmDTZb+-+r(@zFX)Iz!RGKY9JFYWdF)L8yCiC{e?KYsd7-_G(izGKNZeaLKiAesF;Z9gT{&x|BN0G)5n@;WN>)PyC9E2RONMmV z=?V>9RLN=|y-eo*5)W%^8!FsB{IcqZ zIK;BQfL8w_$Vibw9Fhkk%imPBPiOEusdHV^jPrb{k3P_%5Lyg^gCARS@!-Hl#kh&^ zP7rBo!Ix@E<%~IB395>oXf|siwTA< zp2oXo)pmqU-w_oTj}#@iihYW^02#Uw*hawj1Bz%PgpeLvcm8CZe|j4FlVJBNW@NdI_{KX7&gER8Sk7w%_3KbO| z9#OmX)vh!z8@4#~%N)Z0kP%u$Kg$v|GWvBT_1!ub@ePfJJDlY|>)pJaGpV^gF(n}W zE^*q<0bueJ$!}Xk4XHkq62&v9@dEcSG6gU2GF3vl2;RJ<40&Su+o~k1O$N#d%8Y3t z>Yu5}12WZFG+>St>JH!(IXJZ}cGu?R!Nqt|lMb~qXC@wXsSB7iiQJuO*hrdlpl2x= z{`uIsjxq!lR8+`-4Bn|A5sqI#SeWs_`UJQ+$GE+sJXrMCz+-_ ze0ETCKm6k3{cpfvP)fCObn)bF)VYK=b#dd?D`jT&H)G2-w=mJ6VF<@62xO0r7Q?y} z22>&qo3d4J=RSw(Sm<>5b`S(CU>JntZ8h)Kp!XORWAbh55Zpt-8xwU7JfN3b4AY9w zhWj1C-~q0E373Fkzd5<)NDRXu@i>@hq<5e||r^ME5 znnG??Z7o@fLI*%f+cPDD5D*@f+uki`q_b()#X}!z9gnhUM>0p{p51RHwolX_@+iEh zC{6AJ=mgqDnc#usxY#x1Bme{%(m|>brYF`Rz8=^yOvJirBn^xDkY?FbShS&^k(-qhWVc&jD3vDEeb! z-?`91_hS^5bmL2ltt>7r4M`lO#NS7SW(y4mM`-2(eqybVhFys@#n!^&BD4ItZV*QE zJk!L)1fnjIOA~f;DEm9@79?@C#Sa%ypkYuwc@jd}2GE-h_?4>+4r175hx&$YhSVqE zz&UkM=FG^bARGfKsWdng0CfMP(fu5mCqx>u34E7nuGPa$*T_g+I+WtGTTOT2LJ+bsKkl$S5J6;ukG4Gs@q3#6VqE%MV6G;BN}9fso~O)fz{LmMz4z-^_-v$&Ac+d zdX+LvKh3DMgANh_@g>jOt1u?y^TS8vcPn}LNCKY$8QQ9@PAE=ipeBauHR~EfMx?h1JuVB4_*-`l z(CzrS^>iQ-V0>%~2I7FBRUw`+XJ1UZp~rCKWsPh$E=`mmjZt;%_ywNNPT zj1xs%ciU1|l&QlJb6072l3w$#gWDnEPrOsng#>qwvY;k!yY{(q0h_txXZ;Q7VEGHG zEvOw5Pn%{npPctr@%?xg@lKqQ+x^nxJ)QFCv+~6~3@ph^*YYf&Y;B4gy>i7u6<@dP zT-BG9=OZ&)1F_`k`c?r21?0)rpm9?WITSZKzrcmYt_M?d1%rU1+sn3JCvTfwV$#Uc z3ZQ(tmY(WE$1Wm51%~(9(|vE2g}ozMp5wg{1s>^nIndqrx>{rYnNWf2&>iz1u^KwG zz82jH)6OlWu8s8K;EB>;$G9EAqlX8+%6-R`D3%)gIQQ{EJp&NcK(Jk5 zKGA%{Y@CjFb&q9<^7b`k)`6o-BCupjRzaD-YJB5gMTN2@F&0*gtPeFNz)WbB1AcMv zF}wZwglQ8NTaPHFe%oCsQR{P2tibjLc<)L(*%wB*Qi9sNVN45bN%B>5ZT_qpm%NL+ zd8z$i)z0khqtCp&%2{LG@)fudaE-xT4H#MkXtn?I$`wht!s$e0IQ8Ayt7!Xfge@M(Z*|T4K2w}v0x+X@3QISSOL`2>G zX<)j_rshVigW*+Q@xjx(f?{EH;+xb#hE|xf7rKQ_p9t3Ey--T{XPE{~_5@^KOaF~K zs)uR8p_zsV6CUx)%!Nzitv)n5)^67@55X7VXJ6f!?Tw~ zmy)(?EEo*N(knP=p4Oh3kt&Fk6_mxlmJf36?H!tH@tbYJ87WFvUkfCnUa zsdCK2n2U&Vndd>1ZpD|pC5OgS3X!vUTx)Va=(8X+^e>GU&V7w@;*>K&Pc9`Q16g%$ z%KujjfXal4L9jqMFf`QsCMuukhN$Nv25IObUQ*YsB&Um^pbpzYVSXuRw-+#k7902O zVp#0my9WSSJ#sx=P3_t4?z^FByXoNbHQMDUr~;*YBnAf4`j3w#B_t#ab_Q-FcXrS1 zIBr+-f34Z}-rxT^N;u3-nEQs!J^k4Sd9T@)Pj_=#X;s09TIuy`MKLiNj=1X`*3!Ad z1V=*AzGw79PT$4dT`Bo?9LZa_wvSzx%pU@c@CY$pY7pwT8V$@5EHx%b>yUgZf3LC5 zSOB6;gq&an6k>rNcdEbsbjATlaWQ+Sc~W#GIpB~%i`qkfyXw`|abAP_rclBIF;)EN zJy`+%gN$E=_XPrG#>YFqZ8J3tVZ>T~%Jnd-xB=t3>tx9vi%Vl{Ikf^#zqv3*^p!bq z1zJ!Etw#1GX1`(p$!){;;1q)ox=d370XVUAtQ4e~JX{J}Uy~x1x|7&&kIB{57Ev=iF(-&pz+ zI9U+{BIl2(UOYEnTB|(2rmEiph-0vyz>FCwcCbq9NF${;){;|8yG~LYDKSP7%Y{4I}A6tFd}nlK+eEHgqSLbC3&^}~@%oRL&eoYg7 zZr-^6d%P?PX~ux}L!a;|Ipszmn$j&ECKi^&6=Rcm_>(q59?ee?^VeU(r*Z6A0CV-a z5RNSz_uTl_sl*5Vr4=y+q1D(UCG1z9NrCPk6a)AHp;6XU7gHJ)j|F4sQk|`DYrC@s zq;TgKzI3Mjz+&@Vv(x|!^!w3!`-Avl+^Kf=lC7e6(>$()PF_{J${W%~nBnR7@uOjo z%~(eSK&1jUHx_C^ILw5jr1hKbH)|6YHJ>i`;Kb915kf3;lwlvMw-nI?2T9UD^7xOb zf>!okRee;et^LiZ(++pDZfquOLbUME1Ucbh$%hgAc5;$eqKTZDIXHy*iQEzq+ockX z;6CQ4`~>~O&_vEQccK;EQ@Fs6U2&JQq57Hy;>emo<IX00*0fa)d$0(fXwbw9mnpC(U?uCUri(nKEB_7Jj=MsnGOon1UqTh-be%t23 zuP}bWF}EGSG+c^xC(ahaJKNKZ%djvoll0QL0u;;39LRnXPww7Opqy43`PQ^0^5k}c zu}9a*>e%i%nL<|MGv<>cfBcpgZCeVjgNw!BaB zgIfK;Mep=6n%~yjRmKk2M@L6LnJ?Hv1g4~kpUoR-L>;Ne6X`5-m=#=GY5n}+F2qMlX zIR;I25d}d?#y47Wz2kE97MZ3=b~8=(-_|~a&q^A41^o#RiuAk=Ds0GvVesImBoi&X zY!zm?B(*;R-p5SbZAr?!dFRI1OWT_uEkWGspsNd96PU|K#GyztpzfFV^@%~E#lwxo z_qR!AjyDfWfE$OjE>ayAu#Ak1m{?gCi!S~YIku3^h;9tUoSlWa1z(t`mHuPzASpop4|O%{Oy_*x!-bk+-|<&v>cnEE|qe0V|KQI81Iu5R;W{D0&O~f z8{JfqIdW}81YwbMUFMkr2%!h4M%5?WV z*gE8_3HTY82~XV4nejGvxYK;>ZCf*2iXZA~za84FLC>E^Mpkv7uQO%xwbsLTnP*`) zuk!Hy;5eapmZ9`p>6o*-6kw^~5p7dFmC;Wf_l9>H6T=4zJm9zS%jpO5t(OjvgmM$H zb4wB;ZX}dz@p`ly`j4Mp{rv7OTv1gwUF`Ee&(o&zk|fIx@ssOcO7AH}{XF?A&igfb z_?eo7X2#*S9gKO2(3zcwiidIlF2)s7SCa|9$$qEMlB2^zr;jC}e3dw~w2ZIEfGwo| zX55#*R_!FlJuPJ=#W};KD)~J8!?bv8Iy{MV4(WAj$^%a&Wjwc!FhduW)KnGeogAY^ zBE_k$ej%@jc`mw73wHzbZaNcr`JdB#Wc9R_z$HYx7M9Xx%(zoS4rQ~N-;8Mz2Ad!; zd{pav{Em-2YkB}{Pz56??g+xY^Dd`v!{b0{**IUED%W>^9L_p=RkQZ1nHZli(JgrK zr!d1=ah0uGuOpP=%skC^!*kLQIsey(wiww%6H!Fs-@PaeNUt@#4g`iA;2GA$)5;3 z{p-XLpUzp4zO)Z3m3Z$=zs;3*3z^TnRks?EcB$@wKPJxX3Dmkz1y z>2NuEOH~z59IT)Aa0Ng1it_Ia-~r6)w{7Ca4d3;hG448Ai#x?N?Y&SP`hhlomz0Xi zSjWoWR2|#}^H%>=NCILto^x_$Sxw5yf`0{um#Zen|dNB-WUg-@|Fa zsh0z!-oln)jT#`a2RmnJAn`kTS9u$D+!RlCB^98^pq|rjYY$2Mk%*>shnFV#HHb?S2Bm_FPr7%)=Y zm*-GoFLMh_2?d>SS^P>YlI$MI3#S1?7@9-wjjyBVXlbu2LDd-8h$cTjy5TbzX`i{B zQ<|_RS=ei9X*EMpqg=o$G~uHRP$maWf{ojE&8fae^wighIAGUdB$2tA7w)R4yp({B zG}w%UO0glIg_bcA6)%FH=iWUr#aZgcO<{fku?pTQlLB@fFrQ$&XhLEm#Ka2Nj@;bb z^fp}lXoEc2e|3K95YIV0j-X<>o}P(vrp*V87SJ@X96f9@pELr}ZdaGg5PwvIX;5l$ zm&OonjBRn)(e+M4(SbKgw{6M_ryf78PD<~WS5u48=KS~J#3LVsFhJt>>c(=3dlFE; zb`NaGwi5}7K+1>4R}rW6X@f*btid0=t4*i0wQ1%_8#O9(4W+G zuI$3Tg27VwzyMiaeCX%wOFmV+y6=pI;R9V*$h-mflhh~{gsjibWOy1jsK9lDp@`pD zNrFOp+;NtrCwe|*q%V1ReyBcw&gW-LhUYZYKb0v#{YlNJFLWxWBN7l3NGiJ+T zKHPs^JtI8TEYb5dQ~Kwfk$3kO#Jx&Q%cvoomSz!48gie&cAU!I-$;9EvTw`lmx|Bw z9gaY6VOV@j%*^~vbpQJ?{O52o@yn2R=$e@Y1_WRM*DPO9f*U7*&7gO}C|R42;N*rZ zn$kMow(}Is3oEOtKBmTt-+GGo-_LoA-vZ*G1V#u)U?qW*L0UiB93Yra&(VFv09nF? zW4}!B|NiBOIEgF&eBS^3i|yf;V@l8e&wuHBsfzN?g89$Cu7{%j??>IbrD+A<%Ku)S z-dQL}SpDA@Avt^t|9h3r!AJYwE8?ou|L=!mi~jfjgg*_Ml>hIKru{$qg&Q|q`|tDX zi0wj%?BGO!0w)t3jbNYcM4153zB9kyio7FXOYA@EptI0bxPNYrdU$yF;Rmvg<(7L! zW1OU+0lF((ycD z|NFZ(I@UfxRvjS``_2EX%>*f^7a3qRtZ$=z z`}@8VKRYW+A4iG-7P5`=ZqMO=mpEYo3=PULC`!J&E!OB~KBLDLiTaHzo#}U0_JH5) zN;`^*X4JS`sKFzTai{M=XYajlhAVOj3CRO{RPbfUKi{0>|2`mq<#lCLuW$65uQZ%i z>^M*zQO|WO+7CXX(5otfM6o8#?eqYE{fK>6+{JPdW^D95lBbI{BtK$^@Y2Yak}9X$ zkf~aTCI0SNOqX| zoHjxSj#Nj%P}4*MIX{C@niPl5NgNKeGfE%vG_j0+-ws2tsbvQDxw<-Xu!oq9qYmoX z+vD*#j*GKietoG3L|fg;iHgTt8s35JBYTSU#cX~`UPNhQLEX#ETsPohU%xmjMvS)@Pe= zZ_h9gFG1d`(A-IMt-~7bK>+aoJr)e*KCOYT0&cLXqE+WNWWD8M zPippz(<=%voD9Y}+%7M2i$PerZ(A5JnoR?-zvsW!zOs~BpEcjk(;MYLgPh{IOmLhB zjRUcMaq+f+P+NRMjXtG*t=rPHFUpcW7OjB&z>go<0atECTy3`|k3owZmVK1+5u9FD zB?3iomd3eLJKX1c7P(??W?2UfR<%8z*8F~bD0wpZV~%S$%#?swSg~i0sLF)r`;Q+4 z0kF_YWtPkrNc<9#AI~IC2i)E!B{+RWaP5ZcTOaVuaB|`YA;ghu!*Rp=DENU4nWori z9hbv`bGFvqy=l1x1wjxsBO}+adW6XD2=gJ$UNDUc zE;^8$WnAH)-Qvjhu!?`iA_<2M7I_9dIZOyWR##1df;nMMI9XwhLjEw`16m3oVL{eQ zcD6(lJYMpS3>c*Al8&BT?;pCIP^-2X5#3wiMsk+Q=FwmtUa?~h!`e*j>?vg(8hJyj zJm5c!5XA&hvju+Gh1k{DD4DvACCG8^|PSsI6$8_!%s%y4&%+r#O-!a436*gMf z{G39vv|!uTsqI(ArPqHA>d@r+#^nx-oWAls)#U1RddkfccN0c2L@hRgUKiWe>^KT8 zQ3S1=4%c}IdNmf~gk5>cnpC}7Xj^rX;?Y|#a!NvV)G2aH-YBdgihHtO5gwXB$uJ*n zgd`GdYTSQ1`eG+DlrLDnNcyP@D@hu0E_k`Z;lNLsnf}WzA%Ft-qVYO6so+j z=Vyo3fIEzwRt%A1tE?zXq-hMm^`wEHjb*@d{x1VLln zRxYA0afPAg&|@LWZ-$0>pEL#Uw!%l12!#N!llH!_u)^?=p?U2gWy8rxkNwY4MfMUIN==)`M~ zh)Drl7AyZ*o(`h5=68=JIu@$**}ZF$!4Hms;JKPYl0i1)=_IY-?iN0jV*4XdcAykX z>&TdAcK`|Bagt>3U-d;SpUPhH>kbn}0FoY5^fPk-T65_ zmb$IDK5qPk>dsG|T1cnwBzV-Vj{IK1dWw1~O@~JSY0TEzp);&seMADC4duS93mo}M zo}JeC_|1Mc{zzn4#(|XlXbI%h7{$>ctl$clbqGQg>yQ#V2{)nC)F-$nDA1vlFE%3eQ zPNs=)eKP_60^Z_l*PxtO7#qJ!$>%uAS&mOQ=TGj?al%Gzd7u$!uxFJH))rIvrxCfY zZY5F`uXl4t)h^xq++nKK+s#20jZ|odR+yOzq-pVPOrDo)F0{H<-ul@U<`~?$=>0Q3 z4v(Gc{0}RlddwX*Jkhv)y}hY)yN^VZkuW~04f&44XQA09z3D~*k_`O~kR7<_AwaK7i&r1^P zJuy;lVH8_28{>m+69T!}qJ@7KN_|{sj2YUp3v*yZ$um4k@N{AIN;Y{gwen#MAtzq>Xvlw zX%Lr`lypqlbYlRVgV;y8(-rGD{t~Z~`lB+5FHLC&ElRh{>4Wc> z{H$EqGd+!FY(?ixw?gP!NEPPw^I`NU9-DWM;KHm-2qzpFIjDp z0|Mn2yEzpGB;U_jW*U<+eMCE(amD3^o2euD0xMkl%Y*$a{fQj_t&WZapm`j#|3yJu z%v~|oXe~e@0O$v_$dDh}|57kq@Jri5Ol<7^NLd)DU|ah?DLe^Q=iwF+7RsIkyu(vA zj&V~C1FSXFGQWj9fyO*}bEZ8OvT(uf<-z(s7ut;8T2}sG|5tW=*zot_UCxZFZ1?mr)X2uw(|#%c5|hk0!?eloBk%o!-80-RM-qPHSN1qO}bMSAw6EU4081;YiWIG3nb^h z!pOL{TbS&bOd;%INP1Cro%Fw)Ok#MM0^ zey`hUhiwsEUO|CVKtQ^Q=flEz`gddUPzswPZn~Ly26Qx}X!SxffA7h>SpiE>O3Hn} zEu&06xmL!6l93T(;Mmakcab!OApH%jZf;8Gr$8YnuODPA>eG(C_L0 zZnqUc!1!D=MV1Q*q2dU1liw&QGmWnDUL3rx3OE7R7gCk%{uDhUDBJJeMMzzg{C_S0 zaLGM!l%czr|NRv@;&3psDP1Q=F}+!sMhF7JaK$xvC$%jg(U31*y-Lf^zk{-8V88im zt_6j>p)^#-*CToe*c$5QVlTt+Auw-w`Cd{hcR03@5WDVw_g;C#G{5F}^GEBQ-H{~- zLWm`448qI$A<+Yd7H-9>j1_0YDRYjC%X9fG`A>u;{lo$C_LlYZPp|=4&(kwuy#X~9 z`O86uap`Av38aDE7)%x|C}nINLouW77#&uGqq~2t#F6=uiQ5_9F^N! zuzOeC#?ni(FGtNj`HW)cCfX{~o_Hp!BXMIPtgmImmJ8=-r{VgU`%vV80q-*={oq}Hv4C^FE!Y5HQ;9{ z4vPExupN#yS=Ylo?&!9Ae3K}kC!^wjy4~_yz=lYfcu>AV5(6^h9o%LWzSTR>Uctr@SV`Eocz}x=%XA` z;q{%h-2Fz${Bx@Eea-N*wxgq?UA_QzHnx~*enad3ID1H<*KB+GhmY|_g zhPX4cSIj^4YCiV7h%;CxneC}E2}sQ1n4bB*FpyAH5NF0KiG{Pr&DATz5=jmE@$$0R z;uAv8?W_vvC3886^As^uZ%#P+uHd2oPPp`YdJM;a^U4B&NA_ z<(Jb+OSoT6`AUp>yR8*BvxSwtHnUKKg%+jue(QCT&;1~?kv*!T1TO1g;qWXQC$*_5 zM&aX2m%vWG5ai zONq$}#G)d?`nrE@(CRn#z@8T{a}fu+Xrwkz!`a4G@8&NUPr~h|15Of z)JJ?}*$k@h_>Od!6n}pc)TQ+}Tey+_;&{$#tT+U;YHXhCt8N?ry-Y@Rkd^R--#Xl> zUcHP&;KUYFSPCbfuUVYIw>;ZKW;;L2efPM> zFSQQ+E^xOb4Fk2gLFEb?xQsnzA!^{j!fKdSO+F#;*}cG>+bxx*BH4J>P8}&bC(!wB z_$>#_W2f(19CtG#u^;H}FIlS*iCrpQ>vM2(+GKEjI2wYo{#Bfvz^%iqJ)!k9djyz`OIzYy?06pF=0ZV4U(96NL@6mYv!i#>Y}^~=dV?scTadf~;LrkNLRari zw*OM_PB1XC8Q2?^JT4;N(0{g!15PEk5atX@9ET%;t%+9%!b?QfH93P4u1A^W!(&c$ zxgod|8M%;ehhN;9@{*eo=J>;!$wVeQ=+JY`5h2^TR;}tGHggaaU41&S=`dzp zVh@g74yQho;&5%AVx(a;T16=+scIk3x}qmC!Cq$$UsYt-`K(uZccw0nh1Ezn59Kt=&G{+~9R`hx7a?17S2qhLevmwEIyPEZ_%#YA831#y8~tgLt7Ea|8%DM zhvh^05J(2v$JnH#%!~{(K3Wm#C6bTYEMbjAf7m|3sCdESIV`H^>9yY&p*THT`Yp8s>t0d}xXQTSIM9sPPESv0A9w;GZkOTO?PRCFR;OBZMw! zAcP&S6TPKV`Dk00CYE}+wB8NlP$F>Zy51{!Tu9B_)T5!=4*i-#zI8PJm~fWZ4&Nth{J*wkv% z-2CxgmRJV}`C5I>P(E9}L2Sles-!m2LEO=rJKH|xZxIKqTWqCo!o1c@65JQHpQyS6 zstteKo1q4(L#0pB6qDLNytumjrRRU+K9cXFP3*vLBfp^FB-rEP<7)z;k_q6Nz%N5p zUIKn)QxYWC`NGsWB+RG$g35g@AGP(m3SJNhGlbAMM7D?AuToTAUw~UDcXnLe znP%DTdCz4>~VssDZH&OJ-C07K)}F z=oYD*MQer>^t7)YiX79zPzR>(U$V-xaQ5XH7`N=fo~qD#jE~Y|jdRkmDR=v|E)cTP zRkHC9uO-|A>{?nxQfb~#&H&x3u!b4FRSVHmVH8L0x#!iSIm1z@8W;Vrpf^JyU32xn z$v?-QDTge3P}7CGeNH``Jz7LVDOtdACXZU-6s!O^fgZ8#kfCV3Fad&6yl;N+qFAMRnPJsQ%F z+K>r_e2pTCfWem zbswsjYy^3og0eE_v1cf9;KDrTX%G=yq4)sVWILSg+j}11UJtmd&eVwpTg};y$p)W| zrR7XrRX{-TX_k3>&%fP1c{+lz0|nQ3p*7OU$?20Laky)M{+`#l`Ik4$U2*%X+pm|* z7Y^Ha`S_l?Thp}N^ujuD;S%JMQFrFe9gX6?(^lw1>py1Jt*iRP%l%VexVL|RKTIfA z&#OPjRt6l@S?**im^goUpne~3hV$ff)V^ZkyQPlboHebepfp=_{E&(Pb=GItYv6tP z^*xV-p10)yl?Jy+={l~QzhD=(xzCs-DbahH^gxh-)k5Lh}VVL8Se&1jb(3o9gP=WZPwzEMA>~= zf2bNPm5fd7GnJfH?)jn)eYeH*bGXTug*}gnYhH!IkH8fa+Q2{N4tpW=F-a|-TXg0- z8eEyu9WASm+q`%*{Flj;Zp(=3bh0G!%A`AfA;tiIT;PzHX%n1G@Te2*%v~Nbz-@!% z>J|KbU41&nmKmY_PL$uh4>{j*6sJ?o@|}V#Rw8-|N=ki%qUD_KDN_y4So~3QMsQLR zcK`0Wms@;1x+83KQjRY&@{mm4b9$E7bHg#&1RUPp_ie3KMFc+gzz7RJiHck!jcNLga~b@1g1bec0(bL9M5}O2W|86R zd;khQG&5%*voAQ2AU6r1*~Z(PI~%t%E3O2jY5uqy>Nk{B_p0NWwzj)0kD)?VUq3(3 zR-ebl%v(&#uT@ov5SI=(AIR3pY%2qc{Ug7;_gwSdarHb75Hp2SC9kApLV^MNp~}ni z&87BT_NL#~scCxSI|IVQF#SM3s}%*LN(xO~d-ToH6I)U;vb5}M%W8HV)5!-BGUO%E z>e%XQW80Y3+ab1FAW7T}I;FaDXcY_5M^xyv?uY7|;5me(Im6aP?6^fqVD)=p=|-|> zqZVyrzoGEu5$@$92sVL-x;9xA4_3IRNb^+*w+k)7>+P8}6GiGEp5!zn+ z`&XJvPTQRVEIg__4nHeAU|^5Keqh$bNLkagVOB&GQd0=g(JOyOEA zPr+LNjLQD@-qSP~emYrjgPzL?3pFfu*MxRw%~6!Jjf1f5ncm&>yzf^qucM26|IThE z_li*LY|@A8;lqwx{e32wlvffc>6ab1;VHn_+mL)dk{sSKrfaX*w#LSXGUAFdvM`9D zsG4b@TrHE2@4G0H$xsP?fP0%BA9mJ7=ou=+inuGh>Vh)Acy-%$lSc(fQ5^TAEIbHh7&qdUsqe( zWVbd#7#&I2Kk!4qOv6-)`VLk}0H}cSL7*af+(O34`qT95&w$mRmr|mKWnDYTu9N6& zz6O^kLlE@4or3EVGg^*e++%5TJZ@12iF3!tUKXmlDlP0FrMBX0vk=|Yj$(V&*uHdh za9I^HW>XOYEAs+VnFddTf@Vf=pzbS853krP_eCrm+Sn?B!E0*%m&wbvTSq^IH}1uE z>?~aFZhlb*xem$M;knq{ErX-~Y~9;*wDVu1QJs!kt7&RFu143qo4GaPDC~I}Z!iP8 zn#F=PHq|RTB35H`mkI7o&$`=I`PpYu48;D$ab!g6w+=e$OB@dOD0JY)DVoPBnro}r zpFKaOj235$e-Pi%IoR)7)-s=jeVt1XzhS*@X*axUDW3&D40yr<6aRgJspcfDtL9Zk zfj});3D0&e=EfY9z^uplnKGvx%-l^Rx(G|Q^+b0pw zYM5uuG`GG~qC&n0qx{i0TW>b);pG|S#e%_wAHb=3<$sy#TSW9rf@V_gBT;%V8cRWR z$jA{bqBtL}@eza9xv*0xXeim0a_MK@0xIlq+jOYsp<_WNkVmqduNcSCWz+np0g9aN zO;A-({++wCRW6wOw}je%+F-IUIb5GkjA~z+}d!hiHDmxe5OuRw-NiS z0hTEi|?R=Hp750>UW^wiadf>d0kUES=!%-T*G*U_tomwV&*Y$WuAf{3xWENy-?RA#W$5tPbw*g zl)XNOq87O9$br>@Q%Q`CW8n5sIMf%_u6TAA(?+lg?&^ckr7(|*HZ!|z(h#i{nd+lP zb`@o1aS?B~TD9pz4x*6H9p+__XHW(jv(V=P&mb^KzO%l7A~Q1+0hAzqt#bc|t=UAm z^R;*4nRN8Wb-3QO{MFmoqPwwOzpTe{hlf>KY+b{y{BjlPDo5MQ_p2{paTx5uAH83L z*{^9|9HH@Qq7%B$Fp$R3S7hM`PlZQm1ZXL1)@yoic>q%g_7diFufjWGOR)mr zUVziw(9i$^gy%P{f%eBs_PkjO1At-g?fxqd=cEpG12Zkq{znJ};sUi42Nqh*l-N{* zn|P*WFR=0%mLEhW3iLDZ**=FW9@;Sd(Gd1xq^OZXEJGjO2H3$fmF>t1fhOD`Ix`b;UKG79OS@+<(i&Fqwl%4|1R zA1$<{r20hFYAmzpM~GVI>{?;hVwTuB<0koXy7h|en(k+qLBoKS)Y^)a8iemy+N+uj zJ1U>)^*I)DqoZ@^@ zdoAkT2M+@=g39Wf9(H@!^^{38>=vpR2mKG_&%n;TuVH3T#T{6{YhK?EvKBIdzy#S;4k5Mmm3 zp9X(Lo9Lzr&H6y=jKHp;0<+h_DGCg18^I$FREuC?g4n0>kK3WKva+7d*Z8z%X6p0t z?HR*Z)58ER9$YXT|6h4XOG`?6`g_QYCy>aZ?vjY}`dSr{$^enFctMRve>H1b1L>2b zH8hC8OjzV_-0=+3l;`Qij&C4g<}t#I7ByGqr$b_&V(Ja`9Be-EpD?aB=k4k1lYoq8 zWagHOVj(?RBM1V+OM%50lOsg9TB0Z#7tBNEGu7=->zF>m$|6+oJ~ZknqD6wK5NT7t zS+CHC_sTqofCG;hZa^RhSZLO9V8H?n`c))4$8&+%V5UHoZue+)Y@~l!cz!>vC7&}$ z64K#sKPJD6_vZTjrxXf(-63xkiVU5)Cd!ElWyPa{9@tjPXls*>2p;#_Zjxc~8XEfM zaI`hvV!n`Zap8+#qAz5Qp}tFX65!w+6{J8m2u{U_mr$KFUha(>k8r{vuVi#=EO6Q7 zT{+n~m?TYR8Q-?T?HxI$1RXeVJ#gn_8z-?EY9FPvQDv}`(03RKPU~G*SKT2>IFn@i zmbVDKNM_DoN!XYqCMF{O?|-o9JFKr(yRVo5`05BAsN5jMhrCA6*#T;+=X8kC+@V2x zMesUU0+;Kha9i2!J)!CnJ0-pVB+9=227UKGc?iZ=vSA4PD9|SL zWO!UK0{@7)MQ{)(7#9l5$jKoSi5t(mG0Th$i|PG73L@%o4jA>oLY*9kenw09=2wtU z-*|-8@Td=41#|caouN~4?p9%t_QeqwvOPjBlr;H8Id7T>=>iPV9>pFTQ4GA|B*OJy8KrU&*$b)W;Nb4kDdUERbNR zNe3dELt48%+20MhMy#?m$(r!u)6Ck7M!0B^JqoHt1^UvzwBx)~wIrG2@`TnXhFF+?6KR-Jd}G z5g=|-P^_C)B>IM(ir|d8Vrn`rw%^Z-U&d~ zn54;9luCvX%SNWj9*5WjHR3CY{EM<|oI0X&C+)m{^+QMdw>%9P(D$#@#8>>ssZll5 zo{CRgumxf2gppsamfINe=Kd}!-hwqk6rBD;k)vtf1iN~XDLdu=#|6029v>r2dnG?c zy)#j>DL=v!F?;x~R}lqN^ndf2CVvUMio|fBA-M~pmH>Ep!u6-Q8P zor`q4(=hKCf$Kht4@gd<%(kB@oKCy9Go^{X$9s$%?10YY<2JSH_YVpVlNVbzw$gI* z{gHP8F`x1?5Q*O(^T(lQ?Q)#sIXT{5FX4oclWMPH_5R;S0ak_!=0c2z+DDsYKGGtT zOQWlK78V{K)VLn_$ot5`<<=3;Kc^&keKmP4&$}k-sR$8$ktIGjd{A(c`J^@0jtAo6 zK9F_n&A#Z;L40ifwTyd()lVh{JH}6Q4eT5Chw_gmPh*~I)E6o}>_kZTVCU2k?iglv zuJZ~>p+qQj#5G45?{%qa*Igpw`L-fBGFB2^|ILP}m||=A(Y;#4j;PXoS70ufySb(1 zepG+=KJMl7r}&IQC)CL345=K2U`oE2?0~~taTcTI*CI(;c~bupdPZ)G&h%U{S%xU% z1kL*oAD(~G-<|m)Pj`bJhx~7%0BiELC>gPVD<;fj@iygwNk2!D+Zpxz@eBG z0n>ZW&?MUZ)0jP8-1ZAY$4bP_8r(?+y#?mBkQ*iAd<^dC|l+4~4^(!RK|e4|NQXQFdk zbq8^(?h?Bc0s8Ln54trX{Ph_IACD}{X2sMK{j8 zByKrdpU+ze+-UlIElq}}<6eW=!g8SC8FVK`a4jLx5kTnt%HyAP;0%j1$G}J$dE)%^V)LgZhb`s2iAuNyiqmPz9Au1XsiqG?CZDRwq}oGVcyCl zwgYdV0uW6jOnBkT3x4j_Cfpm3bT!nyeg56bAH@IHaYVGd&%v^iX88En%pRjIbRGPo z!(t)fda7na%F1$$tamVnhd&X^@jcb~77ALhi_=A&;eqH>_R^(;r35TY{GGM4wazgl zf)K*9co}v0Ix0?@^H)sFBP?lQDGj~dvVu_H-Q*3g;JbXmUmnBE2dCqU;Y$+63Z1)* zB$z)YIkRuZvPI@@9zVE6#4`Q6knL+`Sy=m-EcoGGWjj46IqKU%9XIjUG(wU|my*wk zDxEq-TU6#fLheP!uGz=cUMmlvo`?xRmfsbuDsZ3j~O+=ZI@~I3Kz22yi zA9VHBMNs~c1cw{9lq{rl-qh3#aiyEJ*O6eXtz9oLtox7Bb4whA#)uto+1?jfr-`ps z*`cs)N@KVQ-`Uq}=J!S%0P8B|2DWkGXBi&u-OtJju1Tf8tpASav3?WYAd znO_`A9S9$sD;!o=iz2RQkTBujVGdh(XlP-`L(*oE2{4FAem-3D<;smF(&SC?z=N&Y zOV+y0!@0v#_syz9FlbwXw`>Wb`Q{T7z0@|j3m+sI%XbI@!*)K4>S(EK!0K_|eqC#< z7ZrE*&GI~Ok%b7H7jfR*gNA`$o>~Vb+p)-KXbesdp*Rd%zc7MP6@K88ZWS2^5uD=n zq?y#5n{4s1lhW@2`)%ankYfoSSG9b}9d>b``K#jQlecJQ=^=^t?+OQWCR?sx_ico! zXbVK(D+;`YU>Qi4P$+MB95?ZpC&hkHIU|9q@QugD@q;k23jri)6#QFgzo!?T?T_9U z3v+5PG-RfF8)>Icq$b%p-)fVwau2^@=M0JDymdk*48q zWzCITCXQ_IMOnf@n5wWvEIS?){`M-YxA3&{ImvY~E>>lmnsp+1I{d>)SFwxqh{cVE z)}$EqxR_!!t1b{lR|lhw)awnmm+_c<3Ey-4`&PznS!dIb=<&Dd3#tKBn?a-+C#rWL zmN%`SVCPe1=Ftmqp^P&8_}+fH;*~_mcXTvHvhIwEbCd=z&$? zS0wZuHo(!3+@@nTE*KWv(MkNpm6W=^RR_Hm0Q+Ip&plEdY+`UfVu~z&$)WBY-gPWw zC$LyJp-T-s=kFw3sEscnTlEll`S=0&Hwr>C!HgJH(kFXzY2-#i2@VG?icQ5jpF>d7 z_RxTi@*At@cViFBM=>@khT@@6pM*cC-2KV#KK&L`0IIa$<-4CdN23&KA#IbJ$J^;o zT{)VNiyV$L2=M0T=dZwX>wu%zN)skhU$I%;h7{rah+TIZy@n0(i97mkGw3I$2%rNz z-&vOm0BRu*L3xdtR;;fjZ{s0Zm&p(Dgti50cCX9JUG)WRPa_x3x6+?oU7YgM9!lSf zdo+a2)n}E!!An&kV*z??Q!_JrSOXhhiB42$DIWCZ5iGz2R^qqdY*s@Jf3-Hf(%H&kz7MT%M+|Pk9wygn&7U(XG!s$Q%P>Ovie$-r6?o? z@_Gt~LI~U~nb@LVkxUgeG`uXDEzUkN!L)TQ{rNa_@8)+Fp9m|SrmC0`y>@kkN1>5n|M@Yyp-kdopjIg>Z%i^t4yI>=e&B_t${(+2`W9X_-x7aJ+7?D7?kngr_ zyh!0n?V~sJMAIkO;U`1{P^veS0h6MKn{|%$#%9#_XyA^?f4%>b(rZr{fg}-6L!S-?f#m%*}>Ja>;#UjAMWFC3H zVL9wuGu?u1W2U9&YI@82xw~~*cnbW@PTKi7LP!p*7TEP8F-@g&p$$gds)gHnnMB0E z@L$;rm_u8Sb3(I?!-nw>K-R@bP5l&D)UbQb+)~^8YhwI1z_C*>0OFKC!fO|gkhydV zU);U0OBlzZFB*tP0?NQBD#3H710sCBS}g%^1Qd4D2_0K3LBvv7)L96A z#sNq=Z~*_CLbKhb`zSbDp$|9QywB38b{6Ap9S%k;`UVFvtgU@fG4gbDoylS>L%c+= zM^7Cqj8Tti%&E!y3T8UYHLlnp6;%A$HzONkop=X!x(k-R0ULpyK0q>vNZEPs2DB;< z;-rmubLE*@X-WSs`VlG>LiYpC8?cR`9fAa;5BhUUPzs5Po0{$yK02uGGZ?}iJx$eh zA5b5+JKxtmJ|!lfS`z+V^~+x+iq5qtU6 zcRyAIuWP9?iwbe=o0mr%J%?|vVo9F6pgj<;Qif* zAT9x;m!c(Shar1=ds{%a3Vp48cxhN|_^AQj)H@TM^^c4$j9En9cm%(HXSj^rf1fK9aOMu^H#Ro3GcW0jTFjky4^v-_|i z2hoNyB>r@m1MxQrGMN*BH{}aTsJyC!=N!1>$Cu4CVMu%t(t5$f48ug76`v|lHb5(c z0Dm?m@eoKx0@~9yO`FUHs)fqk&N-OY=UV8K=MhE|yxf_kr7>}FcR?6}_%0zHezDw3 z3{h3pCek{2_WJmsq;9yVrg#Z7GWq5WQ%6)%v05Q>fi?$k07!3%*4zfB)HASAhCfE0CEKxg&vWB^;3x9700V0lc35A3{rZ%ix7A4Vk@Fzi zOg7VL_AOhceCPaptl#g0r(069Bp3vyLX2BNM^l)ThTyS`(Cwirgk-$>d+>cCMfL~* z_paaf|6lbe(`9@4^5us{wCBRO9HMx#Upng&ptc;=595)M+xZ^keI>gs6mK+>>dMOVId7YVQ%eO3M%y zDeWNvlgZgT;F}_@WI=|EaQ;TWpacMIkaJ!T{IKl=+7YY^$+{aa zb1d7=jJMZP*z@zR?y7t7`6ToTy;^X?iW3-xcROPjYD@NE^YP*&x*GCjCpbEhLMr7f za*2bgtjWkjFZ* zoH}aa7clPBy{Jy{Q_cM-u+vO~U_nT-1(I;R?dEy!x1#{qy&3nUO6uCxp(l8CmQ@~Y zuoV{_^bL}wi0~(Z6;=S)D{p~7-*L+8@J<*ie{5YoNhB5mELRcY!}qD4j+$a;oIK8k zl-b`ps6Sila4p;vk?_gN9AgEr&mOUdbtn_~`wjW%8*NGo-Q}2T+|Qkn1t~Nr2);8? zb_|dYF1ubU#M1;1tv(>ZD)2ns@h#2*TTvndT_+6oyop+>%OfcWE~`Uc-mWf`DcAN% z`P4@ zJVlQ8KB7_m(kW(-hS0^e+Mjig{2q&o*JbIhFR8-lTswV2r3*2khLA+WqF3&;Wv{N> z++t_9^!Y)1vRHEC;loEtf2QBn17UhgkX z!rlJ9NkLU(p^d(#`Mtj(c1`!{VpI$Xzs-0+b*DuL*we{-V2F|VzipWLhmJvt!zqO= z35LHBh^&DL24bJO5ll0|6{mfa|L;why zgcxpzp*XQj3@6_fWNpZ*lW1*{ynKs}Hef1f$)pkS_%T`OXi15)!@)QgrT38$NYJ5L zW|Wi=gB7Klh`PuwaJnHaL-ji9iT886WH_0kbA|?pH1yC#_T; zYuR1B8}K_qxO`aF#%4ph$~oXmPL2Qt&dqV<=V%_-?o)c&+k-l``5+3y3%urU1kuSY z&CLk2Ww%Q#Ip|{Qa&CZio&4ebfWLoVlH*{0Oa;`H2%o-Xot6`QZV?E6ZIK&B5TuddGvikY zjm0OFH4%Q#*JQ|9Mws8dr2Vi`=`JA_81lC?dXDRj)K`BD5Y18{}OaU6P6e`E4Ke@*>_aeApn*K^v}IbQ%3j`epwuI^!A=7>4;%9|Wq$|x%0ILbYD ztMZ<%I#u$*-A@#!BXVQta#qz647iy~DoIN6L9dU{w9%h+%?kJSP;#-ir<*m&aBBE$ zC*`48h|8SWc7p{#Dr7|}6m3WQ@a}9Q0^YxgXskZ9)QtN{n@H3H|g9>6(}wzCwY&~tfFP(8kp{vBL)6F$>aZS-~aPX zl#M+0h|KdBI8W~;9`lI8Pf6$OCfD>>-n~6{m2TWI= z&YuOm8(PiiCI0>Ye!;?a#~NSf101^AGEkFG0fx*AZ?6t@_wwMJi6=`B(

EC*5297wbj4nTAD+CsSLgn%gzlX ze)qaY4v+UK#QzGv`}Xl&4in}>;#$rOK2Oo9m~!p< z)qRy^&beO4(_f^9ALsdJI{QF)$RVGl0Q+#FczNUIeWW;8EcyvF!_uJ<6ovmEqZ0qe!Vton& zo3vlQww_gE|C@e{vHo>*IndF44EosZTGUJKyj!PpmrAdg_g$9>)j+&^GP=JJj071! z*kzSnM!m!6RfIO$Sr7t$%{d?Ha)_8Cn<>_kkMG=q0{rA)LvzE&02huOQsY*=?e+~f z&%qJ}X2=%ULkRw-NsnZ{5ug`k->BKRZ{&G4dB`Lbo9XSTj|sOZA?n}P-^2P@BAq(7~km$S0t@>Lqu)*Hg zlq+Rb2-4F7@#%M9`%mJk$Z1=x%k8$Yt!+}$5tfq!kdvK?{1a?{-F$zpKKlShV7XRHHR{zMw z0@#yRK@j1;XJ!(0?cU=L%Iy67PzImH=~#wjL~x1fDedX%e6T7Bk%^$ANG1H}D`P42 zHl_}pShsezF$n4}#5E+s5`EHri2_=35)$$o0fDGFSRy*k_z^qI_n>ZvNxJ{-QrZHC zQGZw_gpO3Ch^;~y0<&J=vQo?VeNFOj3cyX*CHDq3*l$1nMdV_taq4SM&PV8q!u}U3oK2;>}{(<-lM=gOV`A9#dgJkW6w; z=Dgh9-Q{1rn)}go?P9q5r-Vp0cI;aR4*#o7^py`AIgX?Y1Fuwb$k;r;^Y6pPa$Cv^b{kn+g*irm+oAcy1;955R>Qg(Bj7@QsDAD6S zn2aGy)&12W2xzRu<{z&`va`YU2ji1$MhvG326w3bBL$r+0UfPFY~?W)N$&od240aM z^PZ{T;C$b=V!GHK3qv~MSgykT;jRmwKVio+%rTQ#0*YHV$Ysfca>5f6K^3qNLpCq+ z8FFSnwERYkE(#lPW>g8V-*kJP*V_Kyt$(|=hlfEQKgLXv&15T3iBv2m^RBbR=+}Oq ztCj{7q{`l&gU|h4$sW&CSjCgoWb`d1OSg!~31A(6s@?DX*vq*v|P= z2QN1QjI$7>K@O`ShqQ<&#~fT7uv><4)vd}85b&@)2h?{c7`k~bBE>|LFZy3>i2Y{# z(1CTUDVDKS(FD3G6Q){F@Xwe2m``t9!J;_x8XKL>DjvYa8qc_>j+*3PtwJL^a0$9m zXgOUalg@*8ny$>KVBx6B9v}Z2c1Ie8H-cm&`Ge6YaX&?5ex56y-F6dQ&+uL>o3Qz~ zT4y&M-m zq@@25|JNj{s;Qfu9c{yv2&!*Tia*F8rFFu;(eU1efq_IzjUqS4NW%%(ObjdukDiZS za5MeMg6*J;=C4x;3yE(zj|~_U@5Rw}*rW_E&4L_-V%Uw5O_Fmg7N#qt5YQ*RrhE97 z1SdZBnGZXdv_QLu)khc@R&P_%c5n1fRCKh|)2A3Nr!GQgoEIbMJyfSos-NX=wli^X za_VHHr(a9%a{ZujI-;Vl-^mzm&2rj>Ikj!$**r!n_j2pb^J`bp)TsgqsB~Tb%aZ@) zlV`pFo|t&xyBWBgoZaCXuRZfFR*_CV=1t?ywgpuPAEXoC1447}&z^azNm2=_#j{vN zPzj0=8({t$>b6^?k!W+9{^=h%C=HeE@>Z&8YG|8W6AvU9?`;27)_jJLDN?*fuIPmXOPto51udPO zlq(tk+oN`I{Co3~My#6FFV3v*dJ)BRnCmKH9!w`Gd$h z5&9zJ-w0+z77q7z2aTlLowXRuV~V|4SjkE@2PF+`Vj(9B?lfLtl#*@8;T!h@F&GkK zfR^c3?EXaTyKr`v~w{I@%uGc4+wL zGrXVDB_pO|bzo$HfHA%nK zkA-|!nm;NuhxQ{jl-~qmbOl!&Cvti?uwd0HYyIleQf?a7p=LTy!yi&rav)^S?Y|B< zUQ4EcIR>}|+q%wQ^k}+q63=W+`to-_-OrXy8mKj8N4FYr{%w6Q=7 zyQG(WOm-30t`Si`ltV60qDg1%?egm7%haN(h@~8p-@r7U!BB6P#mj2hsq{Txc1E3-}CX=lM>fBgO z_TFty`O{MHG#1jKmJT+Y?*G{WZyHmJIku$n+xNeaREKp~YWV$ZcjC(X9g~odU?jZx z;xf@Q49nzK#^4G4grx=Qo6glOBy5; z0Yy3mq@-I~T18qqjEJYC7v{6JEEl8|P5)h>!Nc(ds?vIPXN zu4+{lApNDV(Fk|0$%NwX!w?ywFBRQ zh#xS%Y2J(!u)1y-N>cXeX=cN~@j{xRxY0;MG_u|%B$d=praK3nDx`vi1@$#eECQ%= z{wL%HfqMA=`4#taii&u}tW?6+nzIJw@ThI$--p?xj9N4$Bud-av0Q7W!dc{(!D>hb zad$v=(o?l!fi|U*J+@G|$(ZHy2tijnl+_Sru>FhK_g z{^xNq;Qj4Dz5Ucg!@sVk*RUFO)SmbcT(EvHkmZ%d6Ja0T4k#XZYL! zuE5+ofBovPv*jrA{m^;Y392I{Da8nk<=-=7VF9Fo*psn%^^3~1KGIqti}sUztU*(JEaZXTmhNy1IcQOlgaBOu0CUi` za?lc$!v)lmBObeYEVys}yM9q1xE4fOD3CdZRQ1hk{@|_8T_k5e-+_Pmn4S`&1T!Z` zzhVSXDX^Z|J7??Sx_{)~(SFdw7fO`_bw{u;tg$e~(4hGWFIY3Rs)D|ro~Mun>TwB= z_6!p73J4CB=F|)A$HLmN+^NdLtTdxdziW)iOG(6W6&OrlZ55S>=i6`m{=|xPUJK=V z+9ji;G;^qZc0Ld}Av_yoo2=8M%hLe69n_?uh5>5as_IOxy#i>E{x)=TAqhc}I{!u~ z@TNiX%nY5~;lKX{K9;wqKihBr{(Hmn*H-=CUi9zd&OQ_V)Bh0$REmE;{hhJkvwQIG zZQx0K`?KxxKVJ3yJ=wW8e{b2pw{IdkTcrQvy;%Mr?!f1GjG33p~eJnsu1O&`8X-N7~Mwq3= z(EObXPD$Jb=D;v*_~}hoArO#2sg5}||8p-dfPu_dH`l2rb@}nRfS3*`nxHNDM$t4g zf-~}vtP%|eo&Xk812ZC$1hQsA;#4`YZ_SOvs{(>w1-w)mu#HpTlq67o7khN{0sxq2 zOj>`}gWa1ms)YV`P|xq3U2Trhc{QZZ`-|nROJqSgCFaH^blE2SgBK7&OAu6SfntP> z5Rmhcn%1uXE)$Y>5dIr*NK9s5|Gj2zWt9$=^GUC`%(q};YSIIu+?)ujcfVOJz+wXT z%3m-2?~;5oc@J5mZ*KHJu;*+;>Pvz5dFediRMBe@2u~k(TC*FlV_&$BMiOH36Gh9X z3I$;vp8P96G?xk-bi4dg_2z_Lc?z5`f76775K0iz7keH+sq0)h#C-$|3cQ#R3F&nq=xJeUX-O1& zHV8m|;BYs)7H1k%#V5CSE|gUXa>-&4oEg`3d*bt}F zfX!5~jgB}(WEB<8Ei3`(jMct}tJQae<-m-pE?X8bUk8Bi>FGa{?K{1FRXzoO zxHNAkIAmhHQ=@n|<`;+AGgeIOWkNPH)h4HOihWRLg%#0NZosd6C1s{9u8W1pRH`$Lp7=?*rpf5(3fv#;z4Z zaEL)X7jpU#T#h;&E(@jJfFMKU;O6V=sbJ5cjw8f>j5-MtPt`L8bB9HBBYa~c58v;z}dN>A^82$P10 za=A`BdX6^G(`@88`+gJy(yvQ}}(7>TDJ3r7v;;7=nNC<+E3j z891(*O1PG{eGx|8)jN!a8W-p`)@ zP(DXAs^&{P> zc)ydkKyU;)(JT5p>6P=-?g^Y$q?#4}Q0 zt>983x~`vp2hcrB!&1cH(ja{H9ch;G62d_nq+b@f{KXf-W2ct}ZN zj>Lb*@ONtRziVk08er_~{_5OX-hH2vb+n+ed+kI6<#@8@KM@fY_En{B1Mi3N{s4RL zPQe#|RO+0!arRaQCa8!oH>Q(Lzav?1;0KC~ezF}QcK*0{@z}$IXRCV^>F4TV+S;(; zh-(mCum}?KfDs$A!a&o_m#;4_E;cX^Wex2yB1&jTa;4?5Xlk5fP2~>znE;N5%aw_$ z-vn;MT;Oicfa=C=`&nY2hYSgSnl3`!gEYc(O!V-ifVKF9{M?hL(O0WUreo@lD6|Xj z08#lIIh&6QPjH7Z;n2IkzNf$o`r^ZT;N<*-!>kCD{d;+|$4`|E%hbYR%3}Y)TE`6PJ;Bw35ezeuKDy z`BS>lC)-IH9w?y^5_mdlz57h()ph^Z1&hGI0WA~g6f7+I^bs!Bc|{CGVNoSq(D8xJ zz+b1<1GmCOYk_e>aG<-xa`ion1;?@2RgG$aCjl6l35{)0bU>EDj`5szR~_9y+S!$u zdq>0O;Qz)^lzJydv`S`j}RItzfFg zQj!Befvm!mMMztl#JJ>J6ZYbJK7-pF)jmQzP3=sDAA!XVX{6(F2FVYKZyU|YZeA-k zACMrj`+h?;|8{Sm(Ji?^Yw(hxj0;q%^g6`vnUNKk5Ur_VoHwBtuBa!e9zuvSNSvv? z{uA0s&xcg*sYr1vm%M#qsH+@_p2l|Gzkx+IJLOA;AIa!7x}r1@`mk^29Fw17L3R=C z9xrdgC*x#lgzQzbg~CG`b!ymD2T?&K^4H1P8y!HfkNnT4eIqAwcHv||TmoyIRhUaj zSBPKD9si7{Y{Cvst}Q1gS#9m$hDrRFQ32-xxXA#8_;iVwo6sLy39kVk-`ewd8)6QhS&BHTzY)j#pwmZ`sOw z#>b_NjAnGV=o`_uem;QALb`x4{&mt*;8YFMCR^su(SG=skQ`%kz!`XIvCYHD+~e&vlIHp%srgMKc@|BY-Bjryx9n zn*93tM;9ae5kQL zp14gul;gPu!gH6=bf5VO-0w)_)u_~z?lE=fx>cSYHA8EbWm2@H_hWUJE>@D3BqX=g z{KL`L2aVwvV%1449C+FIh0lB==N5bX94*-G|45!lv*=rmRVn3bv6Q7xoDy)neWens zSo9%-Qp(I!)@(jSG+bBrT#_i2WOn~4-?0QQC}C9{EaWQ5YZV3&R+BHsiQ56zSZoEI zY6ZYK8~&u{aB|bueTwp<-`ea zb$(a0FQ0yGy8(5Pz2E59Whjj{19imV&vvN?Zd|yuv{6jg!}Z(@?`*WC9YigJrd{2hKO9d-((icniz+?G-S*rM3XXp9KOluyYo0v!YoI&3^s!MhS^Oi!m}$Hv3V=AETWyA`LRLqC*~vcL+L;=S8qdyzo!8XB7I z>)!cNNHh#gOcV;F+-omZ)YQytYZG^^9ZzAzap{uJjvUvnRvw9E<&S|p4rox(*eSGC)(kp$G_Iog*}P+ z@8@;BICy}J@#T{zh+YJEk`*XVZl@(#W_(3g*UC=LDJ%x{(r1th6RmcKQKDVELG}a< z?MpHMl?42rN3t>Ju&RKl?`ZUGmF_~+PaJ8#vYqvuc|P*{N^Af-iE7G)?F%{ z&+1b7ERMnom>Bc}N_TQue=BLUD^naCvX`3&ic^LR4DNi6t3H@1lawO3C1)ipTdS47 zu(BX8tQKo56_*@rDr99f0@cTY!ot4vg*smQo2(#$KhgUN8n0zayxi!T?Ls#^07>QIdn2g1zO)yIn)gSZx!YR~9Y=uy2oM*@X) z2RZsh?~gp|f#seK>^(X5TMGkYWBCwNq^#_Gx_$WqXi9HE+FKQBqt&4sn6}6E!0}G? z(MJ2s?%_7jUY`w@IlVE9drl;pttbw)H1NCsykbOig`BF@nOipDbxR@RCv=(&n6=fw% zwN#*m&znQPGYib_m)>vX{{ z!EnQtP_hPQ=&%7|;u+xn?7yhHU*O`>I=fj+Y*4s+q#a^B5Va^eafsvS?7Rpi!%B;t z-?b0lXQWI~M$L!Rdxl)d~$oE_2&xr7DBMZKELXo7s7o zzTf0l<28^zgfZ=63AN_Zw}~CdTPBOKG;RqV$FbSH0?O0H6k!-DnxHST1iu(rjtuTB zkCcJlKssi${^KNh-!;!in-r}kw{hR@=9J|Ne)X1#pp=p)zj^mnjz4JwGx=14#sVym z=0}PP`zA^KNE04Ypv%z~6rlcOtnePb_e+V5XdCGLEDqwUp#`6RVXldM2CZvxbGRK1v--5xA|k6zvNu7Sg>ms~BHA~#=@?Lgp z1XXTcp5^si!~`(op4m1{=r5qq(a{lLe7w*aO|f>e0pfsKH1yVw-Yvzru<|S#OTWED-;$)X8lwUz6&qsB#1td4~D;||)cQN*kwnn)f&rDcA8kB3bW^=1c zr$)radOTb80o{DU8rk4*)`(5L6wsyApN|j^|4fuOVJpk*s48ltWtplvF4urO&UV5o zqmm6{)-ti(<8Vq}eJ;Hdo>)qW?OGK;=>S<&s?w#6-lPfJy|%admDLhY?QzsWF{X=@ z)O+TqK%^3sWr4war~X|r7yw1(cDiUM%zwQ?kDmCd3FDC6dDclV(}`A?N|({%i9(^OFi5avZA8?aC9k+0rAO2jg^!g}oFo43WLpOpZg@JAhgezJ)Xs48?579vmMp=;&BB7b8iKBhaJETo+bDJUr3#<4ML?$%U%L zfo-k&y{Opa!tyIG?*Fp5l4KeBMJ76MCw6JT@^8WY1nGEXf7B z(7B{HN!-o_Q0~jMfYScD27RzIAX(SgD{nuVsyfUwtuDwHl3JvvQ5N>hzO`Db7DEwOblYIQi9Mg zAczJ#hk7oenJu#I&j6l8b}d!*=){WQK`jY9V=k#CdoC$mvr}1xKD~21t;x;V{N!jq z^*Q4yG~!;K3(S6W2jBLvpp1fi^ZMP$sU=K-i>w^og?_COu_Tupu#yp5^z22{X+eF zJG94h>!(T(1HtS$Kn>P{AeEQUh&m?h>H(-X^sicM)`T9j09Qsy&GaXc9ubxeoOt3X zMcUuOZ|KdCitq2e+ZUfuCn)XcNFL|Lu$^IrhiNkpm3#`+xCGw^;gt2(!as-X6m(FM zZri%J^)r>fAL?UMfRE_7>!V$-K0rO$fJzHtS$0{O64Iy`WS0tC~u%d;Z2j!qd#;w~l%1L?7;?ICC06+f&gh|40u(gmByni0D{6-&i|&p( z`g?+o(n96LaUo`TK25};=<+jP2d?}w3ser>EuzSZ>;*H-2DRn)!=F0qsYI6yV^Wb-@X)vSJTh% zZ&i977v~j&=yZmbm(@~#M!6>v0Enl{n_GA9tW*cZE4%| zxk+hE`FIfMs0r=8)T4=L%`$4fmcPPtFzHXeogu~Ej0HF}al|GJS$9hp`#P+Y8yT|H zElyZ7SId>H7RD{&^~8N&NJH!nLv8zWb+~^p^I1z~=!86{ZZ_w%!uQ!Z#QlO;Qb4$I z;pcezpOur^;SIG6*xt~bPf1=q$FNiOL6|JSNkvO5pMGz5X=BWL#Qz-DmT+H;^y%c_5zEZRImMa zAA7P8Ed$4<=WTzMYlj0a)W*r)?RQRc5y<@TJfKM??qgKYGVS*8VS+Oo#K1L>>nSy8 zz6M?$oe81%?Hchr^fSZ?!A{s^J8>8oysj7>A6{sO0FHhJQOumbg!`@$SIV&L;Y`#F zixSCtF6VSa7i&~2Ug^U`Ih_Y|hiDIJRD{qs4tc=ec5IYCw8FVWuY`LEcS{YT>*M(k zRR(71#jaLA&1h;|OQ2-gy|nrYOpM%r2KsULO=}1rXzz@qTq1oTOS<18%H}>UcCcA> z4XltisvkhOEXT#c?1~DNuxCOhAME@n2L|ZmescF;KA~0O zxQl@V2T#A*=)s(m1vXFh)Gc0k)E}MI@^;~%@e$3umr`8uU4H* zScej66qzc5%1ubFO#hV^QTaiEY``a|8YvL2@m@3sn}@-EfF+fr1d7q9T=84h_zH-c++$qeRzY zFrjA_Xk%q%W{L(+WmQ$FXC}Jk+-B0wi^vG+@ypN8F}E5hHS6=+>w}B-CcN$qUjmt7 zen_Sgq`z9O;ATYa0}nP@(!iP0B5nmh!(u1MW>g#z%f zZcw%>b(^usdCw+OS(A?dM{T4@1E3h5DZyANlym}0@`XWKuo`_mFfh=0qOdi2hRvq&jq=(U8V9>m>@QorJ{Uu7|~?&5%QUQy1IO|v4d{)Q7` zMoqLu8`cKCym+|&m26#ZbJO<^M#>R1W7tf)BS}6RuRW;`K@~vDc%HOSGc8JLY(Zv* zTAPm(9rKvS4)gxSo?3EeHIDC7_v^h;V>~RVv zY!rQLrE|l#5GNkgd;~P&II^np#OF2ZA>*5x1DCs2cf%XL1U>;AE>2D}Ei|@&xnhhq zq&YP{hFY4K7UUIfVrkSOh zEEC^p9-{Z+0o{?iXHGxMzID*XE~9YoG&AP8aL@Z)dY>7Ey|$HQP%ATe!)0^(K8~4< zYLO3kmZA?SB@tZE*|~zgy}z?A5Hj_dAs|9fbs&M7n~BjLEgXCCbubB44yFF8P*s+b z`iMqs!hd=0PU$_Tf$Yg=p1$uhZyNB!$ z0K?&y1-(b=kNMW$%FGFp9)u>o*bw90>J|iF87e{hA;Ag~agXL-$!O*5n2N*U3h}B6 zV@w~^jqg~PfELBZ;c@dv3p77(s}Wkx)tYji4Cy3=)E6}h5Nkl`r`y&eCJQJIgc{V8 z&c~}Sj?J_}ZqCF#nU@z+L!Kj^w~ZIV*)OI~&SEKn{bNtwty)rQ6H*sNk#Q$Qd2Xqzd`>R|1(Yi_ zMMy#@8Zfh}nevr1^uyC0lkR;Y@mwlBH^Pk7YI7T~kzjFtG%Vhc@)^#iL=;J%EV=Id z4)>{Gu1cXYYpf!~Fw#8hLP!bla~@Bl=NMx0j5c&J{0_P|w$z4yewNlbUQmhZnjL`X z2&%;q_l9eKS^-zW(1<(OvN?2$)87&Y?l&hc`kALfOLT1!%6t2FPP}_Dy1WlLgUOo1 zBpX6!SZ3Doi>*W}UlcAmkLez5jx2|>=-!IM540GLtV->{Kx+WOBi2A?PfE`4Vhm9z zM9&6QAD->qT?<&A>UA$F5nBwT2nBoN#I#wJWzHr0>8s^UGVikxv=qvEt*orTaq9<7 zv{aC3_HdrBjpL;JIBps_zXJngral8WL_R@*iV><1H7HbMIg571k9@=~vg1zL(aQ=8 z?@I-_M>J7Uua(r@*0Qb80xiM1CpsHl8`6C0<(4aDAig;L?wJ8Yi1gmt#3B^*_d`GQ zkI>Xah5vZ}7VVWoTnVCa2c`ItL&G=<%)kVSK4vzr;Y*HR!Gv&F#UY|X#|PO|j>AJS zrcyj@Zyv(1urNt-!PCS43K$q=AZg*1l#}z=zg)W7UffmkO9%UL?Rh(zA7KNtA%Wiy z=i_^3t5ORc4BTaIo6@y|KeLT;ow6*K$UQ(UWDo-Q{s~lW=;>NgHr>x)j#44yRr#a+ z`FAGF`vR~NxHj`jki-T^CJ0jKB|Y%en6%xa-a-PtRBW;*@I~Y^M8*XbSo>j_ z6c@9qX%|{@JGMBH-7oypuS6ZzX{KRP|GQPo!o!6jYx%q%J_8Br!(hvM1!o zZ$3UCh86Fa5gCks91BH-B|SDe^VD}P#FdLPz%3LpRE?{$QK33TMdL!?Ear zQz2$6;3qy0qsn;O{#Zhn705GtEbpAk0|MLmc$TQliE6rnyne!~v>E^=Z@DvE`3nWG zhmrdSAXDQlkA=1iQ7!H`i>mFPlqO|zTiUV<3Zwz95v^25YmkC$1ntNOMe`tXpn@Kr z2dseM#H3508#f58c{4!R>Zyv>HinhyTiSTKB~-A{^07sR8NqO!N4$0A%9O&yKYcKBa?oRHL=9V&{=agXZ2v*Kpm91OrER2AhVmRJJ4$_kB;M<+LWa4@K ze2bNV$l;p_oR2?F@E&T^LRBAJMKxs9z%|`^iSyzK;z=2I9EP407YIffR|F^VDty(o zz08jRWB!bR97o>o0BHvHAh3y{f5XhCD*!qn&1Cfxh0n-=u+O^xV%4gR9&H8q`u#sk zm9FG!md)r13uvqP8A^!HT9$2-5A+Tc{#o%{K8!bnLxS{!db&4Co;4mtx5(8W^P`P9 zZ9Pgjr!Y7R5HjyBGQnU=(E!R~^Rd|O=-|&hPU=*FyXH{MCD`kXj0p!B6U1L3Q1&+0 z5gj>vi$pDhCIrmgv;9~3uRP{-NU;SEeaWh0Gw!z=w6T$oI7POP4A(BUP8G*JeAhz? ze~izQhs5^)rhuyK)8pgZvWG^r8lTv|u##SK{3N<$IU+YWUjNl>#x*EA@7@u-@JlkQ ze--i0S6cKqd$Q<3h!0Y@AJv zs#QcS#;0>a^Rs8lLDkA5vJ>9PyXSB23hh&p-BeSn9g%CGbpFyBtqqR#;S?FhK+NMf zUiWeylCEDIkOxJ3gNC>WkgS_(4vCpqjp-`UB6Op7q?$OTZ_Bvfk@v&Q((DN+u7#R` zv@N_a_*#SAwQ?Z@M?=#sZ8t6f3#@44r5wZ?eY28GhxmIaTgvC;D~%X{BxRMCJFQ(s z=6w7N@`R63b#r$g7#+}WMwIBs1=waE1ae5X4r`_=tZMxAjPhvtejI^EbnJGO(qI| z;=LR2_rlf^VVwbZ3I7CA?m_Ng+ihlZ-%yR78wux9&ag}5Ga!_0CR#X~zO$b$o;git z-=f(P{~ZVN(=VTA z4*C9nKj8n|c+LOMZc&ln->rpq5fu9YvdwhhVgRQIaz~1aX&*m+Oku=^TTkXa$r=2x zUl_jq^%MF}FU-%&aV12PL->hU?W2FI$JEk0VX zFUVb}r94-wOKu}O7gUIq%St~Gy|1KoJA7g>Oz&A(s7x82UeH??HcI`R@&|bzlT}W_ z)yvAu0Z+qnRDo+^4m{g|pH($9;tlZ+8c0u)q2Jk4FU=FGF}vA>gPsu2w4g;4ZIakr zLG?;65=w$djToY}R|fiV80b&SDk^Xs_t8XN8nR|9a*@%g<}DP5YP-9}-qyB@?c|;{ zs9JlqxutVD!ApB}6_dOCQC+sior&ZSk1hJ+W3{VW173&xZCj4CH+S0aWcR~t`B!nn z!0<)R7KLVBb+tzDJj%;+^->(4d!40>EY*u&LeT#jVii*;&;|hbU^7Dn zV*P-}oMy_#)vpDc{|oa|B=Y$sA3W6(S~Ob*(ZfS4k6G@CK@cd&ZpBtWHn1%x{YV%& zfHf^ZoC?T#fJnRM|T3n5*nPt)}zxXU@rKw+9|xwNl8 zsV$p|rfioos`ECu){yj~Zx8Pxg#(^M=NY(Mf@2JDTd;2ZmtjZ+HPy$R1=+gvA=$|) zRZ|u^5k_iA5Kf)YPKS?0n;_lJOx_x*hYz#1;Z|FXj@!UF_ZaQhF*J4vpARF4zzRwUc)e(=e-h)iGX>><4~8+U#k$O!_{@Dzv1cYA~RQ zUnXs1M2>y@vt!>|;;!HQLKK}sxd5NwM9t>4Mtv5B${FRM44KMT`DT3?*#KefYf6*! zg<8!HjEv+?1#<_3OA=hAb$_uSi5=h@lUVh7&stbg4sA4pO@|ZovENtifqct^3&hTL@iYjW|p|C%IwfE%0!w zYP1WrJ?$#L@hNz@?o+@HvS^FUre$O#S=c!D`2*B`8QdWkqY&m}@H%mJgT90g?fDh+ z0bVB`SE^6X0aRM(wQNDlu+a*{qvD^Lr>brh;E_7^{f>`fRBfAfD$~1DjClcFaEJn# z95Tt57_dn6A<=;lVmzU{l^F=n9)O}rxyi_MYs7Yt&3HN>BWD?NPl%Cdle#P*r;d5? zJgB=8err1ycrn9lMLoO4Zn}iW4Wt9XG-l?+y;EF`Pb^a*TY8=u%5?TeNb*5zN6ho z7SV3;b;3iED(QL7@QAvSoEn8-@Pn|HZd@$ge$et#@~V>A7mzJ6=^6w%9Sh-V4R+5Z z7o$F!<8|LVY=F-T2Lx;_SJ$OO>f5X}oMPkPi1qmuVV-a!*GQ)$amUQNwMYQPi{;;% z0Bc2)>Gr$q>};{d83RQ{dA?tK>*Lnj%}(ZkF~hWTHQ}M-=R^K$T)jkuVgNfpRc*|n zFKA(T8AAOC@}cs4Ca?W=O#g-|V9v979_`iV6K@2AzRD95uOopOc{`~@9#`rr_#AJ& zGnY{}k{TBi!C-;IRCD58!&gsE6Vpl^BZb6xa3HcuMZZ07YiTuJqXy}n^eA>(x{d7G zGPPwZD?n}Ic#PsUiVbmDf!IZ~=2AaF)m*Lwntff&a7&lYOaXHnXK*TFh-oPrfU9r; z_nN5#cLZ1`PD%(2mN;>(rHQ@Yg@f`S}a@N-{yF}~SU-6pQ8VjV(11Y>i4Hia|8r(PMYS46wi+6al)vChLVt;NH31xlU!VS``#4zyS*yQ~ z|MfS|;uGX%{Qucwrcdp9f`&$7gKz=R{@4G%hs+o9_}>ueENn+^#sBjluPAu?3UTw} z!OZX1S+NYV5Wwf`5h&nu+xxnu?md5Zt?QBhetWUc{o0euJk0NRY7;LD{rl}|^9_u9 zuSqzS$360I`2G8BaR2@D*9CB}*uR|x*zoHwVO+Xs&$E6_9a}fgIc43OdNSgyqXPAf ze;?jHEFaE=2b}l4Q#~=^Ts_5kfy6}ztKlb8|Ig!tCwiCe|GUgzPj(2-vC6(#U$HgV zO)9q{b^7&``IR&GX!kc}tk{f76w9F>dEiAjNX{NaEs1D`$;tZ8-IJW1+7qNJZ*ach zU`^YizZ=tQUSaBE+dViLBWk{X;ol!DHHKd!_T+(M_Mp?bE)`O&G|*3P^8t$+$QUmG z-J%b1xe!WoZ-GU`^?%00mf6p0OsqjbjUjP3CatV2)6(W$54F5n@*`0a;ea9YZIaVtfaoDg4`wISzD$N5u)Z@-$ zCO8s5={1DnUR<(h@WXchhBH!5flcIc{nfwsyvB)cxT`{cn=qit`xvUsj|*h}J$12| z3T$kdvDApP9Z{2O^SXq2Nac}y`A>ySW z4-qPbUhhZY6COTy@fmlBV;!>o&&4xyE#rAFog~J$;TP;AoS0AS;*|3L{VOzG2bSI1 zr$72t@UL8~lCHG=cSY696&G8obxJOC`NhA?Fy>ZVd&>Opqf$fmSMK;fOux?Df6Xc3 z`PjeTleZ2Zcj(G^K-iE2ZjD6-m;@-W(K-IaSU~up2+jzKg#` z;7BCur?<3kpKSHt`*`yP~X~H*}B8=@-XuJ8KBmTor zizL^GTbNclX`p7k{U+drv()NI)lzZ$wZ*-GT$M#&FY|r0Unz%f4G6~{uvIGP!*yfe zXvK5o(5)2FS=oXt0MQ@{M6;f^>;O+x8}-Fn(gVEGvxmzgi-|{06VLd13ELEgdE%^s z!pMComFM>kzIz|S0A%y>j-D;{%Xn_w;spsl_u2~cft&`e9q7l2ka%|7y6lMHHd*;& zQ6ND9_)+svw$%-Eb5}!QL42|Fso52BFg6BcD|G>_!=Nj2D^gc`BXLNV#awksEs+uXcp(Y5TA;O$rtYA`> zlG@g8Zk#%EOZo6YdQBIpu3>JB6UG>&E z$knuOxooZKR4SJk6FYZXy{p^u!VB72er(d0(c!ku)P8Zso&alc@X>@)LlTt}6=lk~b}#ast54F%ba2vu9BtH$TFfu=8X&SMJGe@R zQ&s<{da@-a5>!vpfV#f&CL|&a3`T9{6uBA5dARLO`fpE1$kfeptOfgCy|Z$q0N6vB z(9PSStK5{$P1TC1bGtPX!4|%pPK?+3gYbeEkyp}H7eVq*OZp;$!*guLaq8o1%4XSN zVrt`UOAlPXnq!GxxXVu0QH>XCmK}SGhSHbcO1zz|`nM^2BRQ@4UG$G1zf~Te=yt9X zan9N%*YwP8^Y9e!s=F_H4623jbRDd$sy}$};CY=!=^pmM_A;?7n&IlWX5ER~rTg0p zZXaYmutmv*@c-CmD4eQZ^}5GmM*Hqg$8Od`t`oDByVo03bXIK>+FfjTp*e!l_DK6) zJ@%>o$ty)lDhf1ao2Rq}%{(IS{-8ECyZrHq`4dZ(3J)3F?Y>?uDCZw44su2rDOc-s zz7}ikd%yY3f#6ZyhtbjVJo^Jp?k`5ze!{xGXKYP&futF$T!WBkirQ_TtWESKw=Unt?%GI%NB<*S$d z4%@e}pP005+FlZpUn*0La|y~tvn~DkRf%CW(*jj6;A!d%YQ#Dq1pU3axw_NH*f<=- z)!;ADR@>#C4sA%D@D-NOv#=C>doD5aP}FnrrV2{a9veiuq23=6c!PpSv+m@Vq6sI* zhb6!sl1|_f1|j(no{cxn$4Oo%u8^U5-Kd`;ms&jcJHdIp6{r*qK$3<+J`f~k!CTQ% zBld4VdTpr{>0>lDHX@y5Z;**7F4~KTh}^t=TSQeAADWg8m^U0(<`iQ^vx*4)_n5Zi za+p&gc}FOkIX6D~aP4W`-p1CuDJz?WYrj~&@|w0Z)RdV!`Z|I3Y**KZb_JQ>CS5kS zNM5!Vmr)fp*Sxd%g~N4ZRVNQBOET@me>z{H24cRpiA3p-3Jx}IyKjwVa-21d;Nv^_Gx)l` z9QyZ74RQ~CS|?M9Ej-zvEcNsNS$H%~w=HTtJ#2JZ`Mq$FpY~+Pe5T95K|5YuXa|91%}LLfTLvTXRVsUS8>qsl?fuB?ho5cME>}5JCp?-E zpPIiCF^@a;u1H4mi+&MW-64M{3;IcOay^R<9*K&wiCKzhbC8L!?ImgLp712XiSOKB zmw&qCP+hvF^5XEsw8$sDGQw=<+x>uH9wBG|`(^jawQH2*4M5}4V1!=Q&RRO zKRsXNyeeI&U5n4{L=Po5+9L~N)sJM$^P)F*C*)Umq0yQM)T6mVrx2tO0%FHiKk2?~ zE&+)O5bW#t_0?zSvmF_P&m7=_#!+ zG5Aox-adQGRu5PV+NI4=M^N$!ySU)L6;seMx;oo|mfX;>tT~&(A0auxSD|D|<+1F3 zlrC)l@kDXm_jmm8#N2^L>!QtbiLL;q#7CF0^KDnU3tcTIPAGQAAAPWsk^WWO&a_QE zQT-_9ef6b>PMYXfWJ0cfURtzqlFfBuKwWUTmzeZ8#45?7bFV%q#iN?zM_g?vQ#}_k z{ek6SOrVP?_0y+Mf5e{_FV-L{V{+c^dyr>HMPI+(j(Fw{K)@miXtsP~3TxmfUUc_~FT+-DJ&O`VWtML`5PyimEQDA8lLA zc${F6`QhAWV~ZTJ*Pib3vK9|n(Hg39##O@l`VT-=0*janH?`+k45JqM$qVSUXE|OI8ySfU zxqz0owg(gxzQB;XR1*V|@=XP=$o?&q=Zw4?Yv;f7?p!~7j$^y@(++dA7=5_R;{30; z3ztlv8yNr|GTS5K>3Png_o0jF-u3$3;k~bvb$h=pM6gH+x=Zlzh@ll~(euXKtvQko z*#4_>o&!oM;U}HXPj;qF|1dqn{%qOWi^s#cbmE=()vP^pWX{&!{a|~(En8FY-PVsP zGEA-0g+Ioo(=KpW9)-T#<$n!IY)^dxUIyiO;?!Lj4uP4tPrG0~u2vG<(n3id$WLs! z1}0?3^^kDBhd0j2O5;4U!-fP0EDO60_KW9n8U>qew zY1$+(^*1?9pq8JSo}QeAB@AhX04nYmvGA|kR?og0DlvHoG$P0paKR}d1UiY(?AI}> z!g>q}N<9XqxW%45TQi-iKRqsNwu4O1l`B`WyGemHtCVwotpO)<*J`N3hSXbhjpF)D zvw|Z!Ze3IM&e7k-#y4(+ZFaoh%N$B5iSZZ3N}X)P-e)sO3Z&}}LY}R1m=_QbKu5Z2fY!qEvDBPh z7JRHc^|Cetn*4?SmlKInJvmBr56H;ohs$y;3M1i!FEQ(*ge*k^s7uqDr96LmK>(Nf z#($5n5~JCIRZtLVzmiY-P3Ck=D}{%X^Ua43wFOfim4|QNT+Y-U>&smk#p`P>Q@QYD z;{72H<*WMBu8<#zhYvQ5`4=6tDRhP_tQw+aDsGIWlOz;4qgaTHQQo50B`BtA#1Ny{aL$*S5{LiCx02BmDJX{RrB&@<*fER+`@b!2 z3#&@R`FWI5I_c~W_qTb(-1Df+NBjPpt^6NW+Zf@{9$2<_9zUr6J4JbxKU9Q$L)DZx zqWp@DVyZ|Uf0HQD{uS)g$XSzCqe>`ZyQ~v%Wu!Jf!C$p_*T;!bKbpq zqr1?bjYvE@%=h{NBeSf6+pIS2AJVywriiom!+;Y1T~ zY+cqH@3?ODh-#e+&C8>A+nSraF^y>ZfvhwhtHB58wD#1{FirH=9EkeQfIp^`v+3?~ zyd7X>0Ae6uI@86M6&+t3mcF8Pg}@VaDO)pOD>W%<7>Yj{5QT1`f8- z!o!E}>(}sLwe2-e7lW8G8PkvV;=R)*pztQd7N~39_FcSvXJ*A@wN8`Exo&8R&trwC zglYl&i*u=xdE8q|v+)NuK%EN!6Q!rzcI%_D{ChFM7%N_4dkN@*cBp zp0w318G_M+*eVG4djaRvOF6z=|9y%J3H_;*Pi zH~7Q>cy!Rprm}e-vU$-UQYWvV@HQxD2GnFyJPvn|6LxEPBqlHr3$;x{LsRhMyf^sU zvB(SMuo?p-Q$zJ)e4jY@?_j^o32IlzTG++8*4 zO5{aa#J+z0n%Srg*J*WJ3VgqFbA6dOV0XzF7=n~?m3#6v9{v9P`_0?8dT_32kF1VV zFhP!#5yJf2Q0#XNs#(Y$KaTD1SA^QYTeieDR)>c?D|`oYWI*@)!$rbj`QD-{1Ufpq zUJz+RZT|s}@B#+L4I-kzR>N^=el|KIU%fB!AsSiF|%fn@p>6Wk; zkbnxrXL+@^=Yq(DLGO=;4DvEQ)R{mvb!KrqEP^t~qAkc$NW&mK2uRB!l+D2qsIrI(vO|DG_DWLH zT2Mj)F$58iodjiAWWWF-Ba1;~9kwAr1tm_kBrLJAghj+CXfGq+J2@vgN#6IJd*6Nc zyWjWT`~5Y8pmUIJdvbvTE(~cWOF$WY4`i8ER#*Mw)6Z3Ke^gdcnT?&-T6$|Z7$DXt z8(8{$Vy%;e^A(rhYYeZ2_$_T&Y$nwmaUbHRI!9uQd^zhEx6ct($3CsnsF$DffcY&3 zf1}ANd1+&`JLBEvWAEvWY!(Zud3n(Hx-zFGPb24b6Yym4H=uqV;>pdTe8EwrQe-N9 zXLB0Dfyhjp#jy;Mg(k>sMw$EON+GdWtbto#*Cb11LqTHW3Eo%YhyleW`2_`spr$GS zy|BV})@Qm}WRC++3g5ufdFgKZ_MeEIM(OlE?QBOxcT5xK4WcRnAw57rE-x>eh7qN% z$}3m|I4^t*g*I6FM=$9LT*L@EL_(OU=MjW}y<422P-ep-bp#}v>H`P~YjgBEMq<}d z%2`GIW>)jjXa9T^MKdBC4reiT`*uQZJkmP4Q{%xqL1IM>G3vWUXsaHWV6$ug)AISh zL*??H8&y`Wiq)4s&SKi<|KaR2oiJ%@WM=EI8+#OU-r zKPSnr>YfQteEMNJ;|HQ73Y8c&yQ0U+9^j_VjEtPVu4VJ<6K&`6R`^^ZI23oj7;&?U ze|pmG(>~=gpk}9O{YxfHfj|||UpRy};q&=^Bp$9{=*!z(XmmM^u$l3rsX7P>)%G=y zhINO2H~R1Jvu%JQA-*A_T;XbF51de@dAdfHQmWjLb>g-cR(fy1B9t==8d-0FLTrS>>0? zSq=TCeSBV#@7bwv<&^*fIv&x3Z@}L7@qPpkoCt@7uuwck@FIAo&}hH0y-hF~S}ri< zG-eKgSOKs@F=eB<5(0Tr^U?GfEku>Uq0*r32<}S>2eMMKX_!;ZgS8_$#Rm6VJgvTE zUK^7GKd4)H_@Vn#Lx3#sI?Aq=PG>pDr1c1ZYhP<8WA4k-mSGOjAXNv~gTKM46APsC z0G*b-xX0!9W4Q#a_s_xxE(K_~k2}ARRGJwa6!H1iBs|H2s?OD|yN1yLa#~3V^65$x zm#{u}`FY?@d}b91+mobnycRT%=ub~3NonEMUZso(-f38pI_o)_?Xs&4;$JSD>^eY8fe1jUbgFGG)=W^1DszKsB_W(U6a#vvH z35m?2{y^i7^E6s~A(3S%r71)0$Q8TWPL+K>jNCrxsJD?2S9$Ah*eFW< zSj@b>Xrf*xF?>8P?bTC3S-Qw1@k0XKv(^0iw^P7+EbFa#$Xnes+H)L@jxaut=vJG! z7(-jsl8$Y|DFy*?)u*O5WIg?HaRQE%hon#0Le&ty!vW?=oVf|#n5NzzYQkFg>H{T@ul4-Uv&6wNtXi9-%0pV%PUI3 z`LI;4o42v-)7!8}AhTbc)#U~jU0|rW%G&+j;)by@v57KgI;!k_t4OlQ?_a@yGll~1 zcKFITic9G4S3J3i#iy{BB7Hmde=0k(?D7D;M46)no2mmZQV)fa%;sGipDpPQE`yh= zp~_I}Yy-8`y~JmFQ#h;VJIP|;&3-kQtUvfL>J`reF$ zaZ*CLJ){s7Sg4h|@R83x*k@^(=%F_;87)5YuL3oJ;UxdX6&$l>+wYLsoBr1k)Xpa_ zKIg20qFO9eg2c&o2^gzh@>WAYP0Slq9`?$~mHKl?)=TZwgpFmqp!YgX%s94Bt~$+u z=nhFZ@2Py|O7;j>_wImbzknV2U7^0Tbt^6{M;Q61VarAFyAP7QgXJ5s;>oM=Pp&>n zAKOlt<+Fd2lk3DbocV>FtT5U%Qa@KSF|R;z#yo3`J_WOOn0!=#4jY8Sh-fj1Wr4#^ z#~JckFPQ`;v=uYI|GD?T7eCe7L0V^hjSt+zO$}X-Qo1nN_0UxuA~c&B+;nl~i1bjZ zH>*Q~&ozGGDW0iKC|2D$;Ej-C8H_YQ%`51tXjFJwDR8LBhO9fNy4%nvlxRh!;S?ah z;~UNf*FP?aiKbAgmazh9Qe^6zk4nl_9Urv!&o`FzN7}$8X9VI02Um2heGug@$;z-?$;IfN43}TU!T!173X+$`gY`46;^DF40bfaJdVN`+vWu}e)LlNF**jCUa);_AmEC|=JxdyD zo3?DYyZP%ws;num^LjQx7k)DFy?gxje1EL&Kci+K2;bVHCw@#a+)1vf+yL5#b8 z?ne9)cl|v}2Je~_1=CF`+z-wxR6)4wAen++pFZU$c(`SxmUunH{d?B7avsm3fUV;- z9QYhZiNmDMdteBj;Ae6sd6(j) zStKdgc)hBePfR1jn^+1*j!v&KX!hH}t&kRzEWd9}@X(tvbmo|fOE&39i0(jnAt8>M z!A6p|R=~sMTducaPLve5nLfNP;OmJM-oTf_$$ZwfV!dLASAs>S=%$4;o};r`)%S5A zLFaR6oWQ>$O$r8DDM6BI?S%=$KaO7t*jaxiM4mVPp=kaV&V2EO*?)ac^f;8Wvh1x? zM^wq$&vd5|CZ|S2Pyd-iKKBxxhbo(o55LT;TkZOt%g+p~VsP)V9y;X#8h4N^RkVy` zAR`p42;IH$Nr=G{+4WjCX?&V_c| z6XnN2?Ec%@fhwG;0dMDqXg_tYeIQ-FHC>fsD0zReQa(Ra$$;5=ea8~jxa|#$Q|?PR z+^LFco+kg#RuWCXa~+O*@2*xT>W;QK@9)?`RiT(CcG5&q+>a6|sVh9j8XL{JLtYQ> zd#^rtopJUj>h5JIe=mT)?aMO)kv2Mc!Y`G+{w20aL_*gVPxQN}HTuLo<2*KyKP|{_ zDf&V)Zhz`>WP;YHHCyOqLeYUi3vD-1gpINC)I4vy?S~J_dfQ6&l!C`tIX_ol+SLv` zW=TU~t!SbbKUL&OqaH$ethkRa@R;p=l#DiQutF~Z&S@B#D|X*C7%MH`nmKH|tmsv4 zK6_`Z^IP;@iQhM){$9Utd_AMnYMD>YfaA<$l~q+G$&U?(Kf{lmmSCo1PY;_|R z&KU=IE;q@7GWaj&0c&Xwm3 z-ej7!7J$`)gQ|2)^JRgM#@@S=WB=0^7eA@?>vqj+OX}Xn-}OHW{PQ#2qw+|$zXA=| zcrTAO@@@17r~HMBcF)PI$R${sjIYdv@?w~uCoeaiGgGHUG2CkLmf@k0;4KTi@%RLe z$IpA1oDhc55(g~FMrYVd|4ji5tq~juMkv+SpuBpD!2LTW9Jp{{(p+M@DUYh&@%siN z)NLmUT&0zt9zZizt&qjgg}Vat7jJDWANG;O>_ApA)f~!&k1IdaZ`EmJUi4uO3~K4 z_2<2zVP6J@jFgNrId5Z2 z32Z5FXQbQMBg8}JU$Q|x4vDUSdt#Mgnp2rzysxAzWf4A#fr zjp+J_vM2eh*{r?}To#Z?4S?@*C)##!i8VH31@F50%{*;LcvOUD)DeZG2_qXYb|C&C zejVG5CO+Yr(Q)OL#pF1WSDpHqB)0FpJJ>on)Ud{XAoOzgVywjq9IBMDAE2gafc|R> zG2SM3!8ITF-sX}^>o|ImmE9P(FlC`F-Q!m^TzMRSD~LWH_`X(^!hr(M$VdpbhKsfH z3n{CD6eGBqQ$BF!`*e1_`7t7D(V}$wTGtfSjl~x!7vA|p{Yt#XKZbkT#dLr7`feYn zjNY5*NVfc)%SAND78ozb{h90;(8kX{C-4i*&TZq?zx-!Q*LAVF;%;tYDr$bo`c0+En9n~ZI5=p3f^2O^L3qqX}_pq%< zurW@)k&6YMPIA@WfC?p0JWtUP`#XDkM9ZTngUZxU_N~_ zy1l^GIhE#4UJ*2BjYO$%gKvBQD!P}C6h#$!jJ<1>db6Pke-KFX?C&r#r+zu7T}qY(G& zrcD9GAwE~{p~r@+>{?$A30r;4^`tSGz zkloE+dQ@(O4g!_l|d4xIW#6I3oZ|Z5V9EQtXX%wKgb=7+QH;~ zI~^&|^37IX?siG{T!q{V7qiIu@Qr%99BTAnzT=p%Y?b-*l4%al*JbHJ@0|($)qH8> z`Fi_Pd&5LTy&2D*0#yZL(0g{>xKL>=MI-Xd4_ygn%-@WnVZ^(u(X-It+d|L)PF)%o z1<>|4Dw5Q=VBb6M3nTE`GaEf6KJkx>2qqa^RF7A=R-O zxP|jfEKV}Obc{k3x}_8#T&ggWI7RL}F5Q>{+g>?0*-v2Y{IcIuOxh)xQ_Js`ymQi( z90dm^f`L|2Z0`-uO+n5qx)a5|JmXFp!jwPR6X(G!M35L$`$qzDG|XwkUm$Pgs?2|9 zt!Tc(*)~Py>Ok9`Jq1{%LkWS%=JbBbjSrp&P-}o(7Ka#Yeq|Ri1uLKLi=Guq4)nU< zWsCd1O5&B8bm97wq;ID?C2FVWtPY6hM^B_^tq#4mp^zgn`)Y^I*c&RF))FhW4E`&a z>|a*jO-C}a1bPX>Ql%)km95ktYb&egiw8c)<5Eh}2uqNO^BMDsEMqV>y(6XIJ9tuB z0;UjOz&ttN@v{lbsqc+fMovcCem*X1tb&PYMlOqe{n-0B^YjXT?ys0PUD+;l>NWX_U_&{moT=Xnl^Zh11D@2dL{_U83(nxyUr^I!N0*u+ z5c>crq&3wh8sp&V%8RU!G>h<_>(WfhGmGFMQlEIMpPqiaj1ifs{Z56~TW-^!ZvOV0bb!UyXZYjQ?xwxt-V{FU^?X8;CDWfh;9G7SH_t}#~hG}21 z{Zg&_PZ`3LFT=~yNvMkCaoVdWwxu{M{yp7#m@}1xP6E4Y#el$VS-Euj^wRWucHmQ} z>5?U1M;wLSw5N8ELU|cgyK;-noo}`E4WiSn+rOKADbyw=yi5}-`nK3 zC|9;j`ZsAA=-rlyy8`yp=NZ0kOY0S+hMwbka+hkPWR6Z%KNRN!6H+tDaT;!^oLK&~ z@k|E<4pj&1*CKiwd0wf(ItzJ(f>VPD2q;?-Ovq@|vL>MKfM=VSc^3h$RW}|Msqu4E*JK0IM7>udc-;CVuS-xAB`SLHV>w?+Oo8$$nejpIuXjhkEy(cE zqm(#9EK0uV9~W(njoRaE4nfLuXh!1}Kmi+SSw5D%P_3^@&}UMpl#Zzr%pu_`h7i+3 zci(`+M^8&gH2K~amFLm~=rDyH>G(p2SYM$72)FL&i$0?Hq zDgMU?4^Ip2a-O->SIo`W2_N}s2NXvuRy^(`v_A+Y_z*TqC%IgzdX;F2B-^VFcz(xukkx|=aR4pTC1v~TBrI3ILm1|CRV zWz&$346H9ST@p<{1d*~@-&J$?t3uWb1Hafr(#17^KA-_pK*xfd9) zw7CiXW%^)X?9rl{#jgmSOtZ&%Iz-$V(5FRv`Bhnpw%X}rs0Bxm{lLSaC!2*oq7TlZ zO;=($GFnv0U#7{9uBxsz?-j%0B5Vpwj(k4Teyz&ZmLGNO?smR;DMfR=+o1Hx_a_J@0Cz0;sQ%_;j6>L^%JwtB_U35?zdumtOH*>mfw-W!! zUV7Hnpq9!vM{GbW)V7&3_w<-{mJmywGBsRQPr=3b+V0Ab5DtUFaRcO@NYPi@n;(3h z_y~tT$OQFms$~#?0BxCv^GFQZHJyIh@j)gyF_a8t5Pm=Zqgrl&#NR<~gtx?;JMU5{wkg7m+a(_iP4?= z**p73u(IX;bDYQ++2aRFMqUvM+DBWeYzr`JK6NNgAjIO%-mBXI;FTG9%h#HLt2+ZvQBVe_ahBq*sm9&sOM^#lNot-Fp2Y=-BGoQ24MXkn15b$E`=t=P$LjiZYNMv=>_|&Zn zQGD-}xq;Q#4rWwWyzyu#DQ#s_6YLJ>bgtO6%PGaUk-LrdJ3iE81ToH{oqwhN?!DBw zJi0iOZ1(WP)*@tL5{eL$z)eZacu(aFLzAk?_FM^GzERJ*tNs?h;W*a$8h+8yn1dAa z%lT+%z!cflJ@2Y(2-ZLM68&w9bJ|ONEV21RM#tlPH=QN4wZgq8-<~D&W=op1^<3o35qt&lJf6e zSl_fk!5E-+9d6}$XHGHOHbLJBJh)|qBk)|j&LwEEx+*N+&igwN^ZHi=gAk%#ZW(xnpV=db`Z=$4a}KbIb96$tVM_k}!uAr{?`iBXLio zke2(8ARg9FxG;YZdnXh85+$z7&n%Lt#dw9}mRgq|X*%Orl$Nf(>)2;ySAiJNQ9idK zVg@x0ug{tf*-}A-@f-KvClpksD{nrIhpf=}?3@uaZi^H=r6a49Pyi{$0WFmkxx0IJ zzbD9Ao9D87!k27ngY^wXa*RxQBBW)9MuzOLexKKLmM!$WJ=#0~XLz%vDS#jYTgt%< z4?jm4VawBm`8CdsoYQ5AK$c7a!Sf@VfnE7JiO-Fj#4kCNwAj0*H1~bb1-ZZYcUj|2 z1X;L}T4!ZQKna>&{eDY+zx!z8cOh{L9H|KLh3^l&vZ{=-0@SgY--6`XyfVz6|JLVY znLoH#qBCYT*Ea3Hxt_J0Rxj~+!+3jyvwur(rgwvhbL`YgJE$^AExDYUtq`@=HB|+^ zi^gP|>GI@riD>91A@09w(xFiRpR+BR%MeF!cl9l@b@n1DVN}5pRB6M>2Vm>KtWTl$ z>pwm#WXCZyfQYsxqlZq4i=vkX$1Y%5_bS{Zk~0q*{A0Ie(*6#LoKzG3@N;U>ad#Gt z@gZ?6zt7#4OPymD5g`B}mW2_jKaRDDrh~wLlL3ZG+q5><7UOg;7+q8AdsQTaytx*# z^g>Rz8I-D9aETLMjwr8~9$V+nrYP6+5m4H__mNM#$GcKKJw-U3iOM$SBzit23a5Jd zA;eZD&R0zV1Oa7nC3F`KE6Vaxn@wU0wggK% za|2rpH>Ju=cW+D61sr3>Ua{iXzO32o2Yw=C`V`reVhxegCDnZI#-tI+q6u~SK1Gv2 zO(a0c6Rmz8pc>-xO76ixC=waBu+o{NHSe5^<1vAT#L$zj3alO#QP z_o-c=MBkLyypW>Ms)MMmZBqZC_qZNRkc>%9#VZc!sHkEKy;CSS?RZl1GqcFXFCIMl z%pif|@hR|_X=q$<@MJb2cMSv-2U3n;PVdP}xD}BQXTN^0`w?8PwHNB@vIaFxQBUcb zbUlR{@C=hlWg0AZTEwgx<=`B5Zhg93>DVTq%S!k@EX#_-O@F9dTVSIAD zx8;>H0%4}GE2!=FN(f^HN;P|YQp&D0R@qoIVe0 zc|MPtKsvEjJ2Dd>IO-qE|5ij}2xl_CI6o0^PdSv#8C{x)1%GwT;A`jqvO|^kSWbtX_;);}H$_*lPl2Fwq#$z)@tGVm)(qtL zMb>b&`w1U z@l}q${qqWQ?d@vmh6KZ4;4tj_uQdM_Wqe+qe43guwjVjh1Sdn1`Dzsg4mG zrJ)F9dp|cxb?+SXmjq5I+C?FP#EoOUcs6iIV*}XD0xh`6tFt5&fqi%0afVk+zHPkw z5y?zL+L@=;=f9gTJ$){)d0rpfFK_yI^HRmSsX8kqyITs8owya5YEvo^Q_owNaVxHw zD3k7kq$q8!|K}Y$oYy%2DlR9nKv#Jfy%h9)p)pq4+jXIOxvwhfGX>r6UW-DjUTy(K zqZ{^^e3nwJ-Oe#65fSsQ1a`xUC5^{k#|eusSy-kouPm}mr@dX_OkAB+X&Y#|67mq#9tO#7gsFVk4A5t}0b(eQJ#k-FN z^^ou4%zrne(Q`qMX_e@_p!rOx@d5)!-J99}TAol@eYet3&amOB8gYIyi~b19*~J#z zV^J)|EP)-d%&x@EF>!%$HLiCck}XR^Do!!HmIP76=Ka3jv#JqirNpk zIDud4Ir+`s!-%n5K02S8IsZBqU9z^}6j*;TA(An;w3Kwwe0eDF)dvkRd~~$X#mSC^ z<&)L(c0bwks1rd6#dHCGm7Mk%cQ25mAe!fSh^;^+ew+;3H@2Saw-NbP%0x`TJgwh# z?+>`eD=GTSg~HK2#sP97(_T57$6cADHO-q7n2W<^#tGE+!P6*;e&(frg^a@8K?Tajgv9$ne4-}qe~d7;Y9f4Y?%e+ba~LR z&wq)$EWGE`VADmQ5G{UEJAK|fog>fe?`JVlKP^<}puQPu=B^q)*RjI#c6?2bDVQo0 z$Ce@uT$7^b9@>_ji8w7ax3=Sn-{Hmf?*2CmK&XFD@KUSs1PRwtr{*yqUGjh=_~_~D zkC5^=e2eE)Mc1tv!J03A+&S44yV&@lRJ-NBh59Wtu$nw`Nh~uQn*#J^Roe{Z&vEX97XIzx(y< zkR4lxLVJs2hGft9(ZgDh38!Ym%=2|?OrvL`A>8kGmCt4`01Y)hFACU~57Y!~-vSht zY=CG*L};6~A4E&SDy%a`LNa~6{XU34JoDN+`T23;pMFbyz*Ftu$(^wY+B!#U0aQsa zFU4Y-LTdN+u*;mRn40cgHeAwU0$*?Ai}`Bo+8iA7bt-UYH@Vqh=4gEH#JK73vBbeI z^SZ6+OPQGihnalNOz}Ka3Lj)W)-=dyz!i z<9EQ?pSDk{pN!A4jozNyxo-?*T%ZBx@?T%LYKcrAiTZcka~eS;6Z*WJzseaNJ363! zFOc_^jrPxu$t8AI=Ic&jVzhccWhet*dp2MWuuXoAfwK^puD(VyS7r5Ba%$Jq!lnvw zoUv-=M=Bm|>9 z`OOZ7klTb|o7ADC=?uArSKVrpZ=aH@_a$a9{8mQ$T^a?LU*?%k(=&T_0AmdokW7TO z)$rx<#G%N9MgrOIuCZG$;^wcc~vxi^3gg?~XF ze^#p79!`qe{ml6=Rk`WA>*?pcdwt4L81uC|r}a%8Cr9R_nnAUTB%cqq_vmu!tODK6 zhdiE{2EZ?ma2iprNxtkjX}kn%6qIE)3Jo*ay1EJ>rKBR&FOQ-x3zsu|U*GlFomTG( zuCA$eU;RU1SnK>6aCETs_4J1C_|3Id{IA+N`M%s4k{=%KpD?Xc>8%$RDsD>qBpS|>%;`HWoIsZL(`Ksx7BM+59 za#S2|pPAJ0HzPE|>P!&+>Qc91jR@Q{`SkXxkIzRO~Awl#Rs`jkz+qZ*M} z_Gcc)sP=Dzj{}VbCEgZ;vP^eVQpZpzOp$h@B0K;Cbw3N6uiLC!yW6y52bah{-Sme` z`dnh|_jKqKaP@Ud8kLw!r!kVm3-_$VfVD-zHQlx>C>upz7`X25%N-mOim;xYNN?*L z_Q%cMYmAxu5`PEhCQzHF-g^I#vvvmSlhG*nTGFAP;6ZfM+xI?7QPk;HewpEG+vsYbY&h1e3dvYW?wzpS;Kss zIrpFP-11GP0Q{3}OAKqnjSG$Use^g(wbiNP*gaW}A60QQ)l{pbUkV)Oxz`Miudn48A*#bskkX+ zlXF!Am!cm60lWPyNx7lR0hRu%5NkKL5_kXro18$2r8Zw|a7UP#;rXCm?#qT{s;*OA z+y3nAudR2BzURmF{uxG)=kkxUaao&JAcuwrvYEk zQwn>44k}gvF(>snHP3!y#ZO(BFUbz0JPgOqDXA}cur|FEia&Oi16F~D7b2q$&ez?x zkBb=JZ{d)=v)2xzPl8g8R7+<=qz}gjpkduaB89~0+Q^8cgl<_pJzBB-_z;-?`E&AP)HsJhT_uF^XQbo6jsBI>>YZ=wPV15$ zS{S0sH@IiDZ)R9)-%zMOG57mW>n&{e0GO1!oDpamsKv9|TQSfRR}}f9sOmF?Bnvj= zMhT@+S=b(xeUXK}JPOCvgKH;Y2i7B!7sP@4q!6OdC`%zAf5yaMd_l$#!WE1536m{j z|0xAr9N2tq-j17mcv$CbS=-cA<%x3XrFitl4%Y*DE)H8t(g{sqIju3nPpt|GHUQ6A zkr)-OB%ZV*$Q!q-oZhHWR91m`+6pazWw2f~kn-Cd@fK{4H4dog63>?^j*szy-KXa9 zkzkVWdDZfX(Kkhym!*2$wrYpL8zt!8@#W#`VljK-XxX<+|rriMWh zKZmh+zd2oavX9N^tai&pDgeatI8hU|91(wPg}rHp0e?ug{GtaLH=474wLiQ}Xl0ewi!EjQysL6vp@(skBW1QEjo&H=w;2Q9<$ZMY>R+9LG>nzk z#R`M2@qt=+!V`-z*JFblarU+pF$rm`xta-_+JzB(pa?vS zNA6gN>?*!1Cz32aaOo^UAe2fFO0}@0s8zL4H1-TLrg!+1_blbE0hJX_K`m%8b$3^qZyHsxATZ27k6Y=6{)WO|cG{A_YgkWl-Jib)32*G$z+U+NmcXhWs4kyQo zhy{U0efWPdhsg{<(Nsd2FZObnU~bG$T6um@-lYDQ!S_Vin(pBug{;R(Lu2QS_uTC% zx1z1)Al`;7=64?=qKYwY>uGkQYcz<5Nal(ErR6;4ao%xV&;xCVa7XK1V#!^9oalqT z{_at;NNgkMquM`Mr+f%T-bL^{NVL@8Dj(zDSK)7Vv?SH}Ij(0sQ+`0=zhP&L@`wZ< zDo1*PYni&mP1v);^j5%msB-K;KYL{f{K` zjxkGa3K7jUrMIzo<^d;_69B4^LEMAS={Qcb7ncvYRRy#Yio#DEL6M;5ndbFR#TXxn zyabe))dRZ(w3d$H8(&;h`Hsx}>m_Z$DKScx+|?=3WhqhnK9vaS1`x6GD&$*9Y_={&6VltPyL&oUbZ>{S;?@-u(mFx8 znSRXDcWQ8~u0-_hW^Q9xSJpgmbK`V1UyA#cT?itfFi@pPo^IIpz22$U5;5AK*L7Mevr@;|0V6w*|M_?<0VFM)~M^1Pv z(Gt?v_sFoeGEcwhyvnycMr_)nhWYqY_!6_{NowGru$@Fn35G^mO`Y21@MG4>ys5me zk%GT+vZZt!*Z|jbz$>0kxT`b&PNC{;8|6W!xVxTehUg>U10-w3s1nddr$i9$j`TVz zBYA&acxE)1hNZhPJvcX{7uI@y?-hIWGgNv{C&v471 zHF32OJS$A~u6Wd5NT)4yE0+QwxqFXg7&}C&8;5O;Gz}uWnOeWM+E><@i{tAG|M*XI zO&k)1PziK3=-88yLbgVWx7cun1i=32>E#2s22zg$^~)&GA@Lo-9ImQ_r%jkF2jv)- z3QpjC43h9RPrlJvxoytf2Lfrt3NlYB#3T8HrE%j2cofYaS7$e7b22VtL2+FR^~97~ ze+MYI2&JNVq8a@vLt+}AI3(ekfOyYSu#?z3rhn!g@`fptUTV<O+ z!FzkyU-}JpreO2j)jR_`oTs4Yf5ZkB0_xeJ_2BiY_WI9yS^tx2H?W|VGj+;Dk^Z!qVus5>j*|506))241)VWOWh)_G;wPSwG-*&ht~|kk0Nl5~T!G@d0TvInGLcm5XiGfVf!HLrC zt*ZvS`PlumZkAIOkdtF)hsKc5$g15Ao>XDOM=Te`oOo*Em9L+EWxXDiGYLd!l8ZW> zE5zwaFk2iw2~5rr)-rP=2RkTMjaga;t^X%Zyo1bvNxL}hte3+#6aYLJy-AJ}jtB51X)Jm|%$_QBHZV@<98FX!Zj7BPW!!*=Sg`||zR)ni4y9Kr2*h=z2 z@834%yE%;|4ny>8I3tk38uEUL1cx7#8SKd9Rcq53bp zwG?c0(ojDZa++3BzZ%Gc6f_mn8jHhQOq_M^9{>5Yj4{4gvvFu}Q{Rm9ZRCIl+@)l$ zlcoy3o}!>gHgkywDk|F0`P9}2bJAoL7y;1tmY?mPX*cKpGj5l9YL3usPZ&^D2SSQQ zQ;fWa@F_V`l?9U%s3&u|QtN#rv~QDOP-9m!cLe+kR$$^di=~nzogM-oR&V|**^Tz2q+wLhg`)EyLq_ z4YQoD5EURhfFC=^;Z5vPW2-XVEgqJMbPN&R626w4U%pmQ$|8b=JCD&L1v@6EO&xLG zq^$qHF}Vm}8Oe+8a{K;)7I{zNVG6)_M;H}5FpES)85S^yhGUStBuFp|hh0fYlNQY+ z-!}>=V(I@#x8IDZD;a$gLp7P$`j<9+jx=$(k*e0Kyp#kp&Ej#ZJRQSw$B-%oyy42` zZW&Y`dve#Lr6W33JCO@SoDn!#VBi#ZlRWs^EGeS2@C3;uK#GDQ-Y#u|OAZkv%+%sM z-f=Xc)H#ID)b=x^BNdYp%>2odff3x*u$iQ2*FDB~%^Sgpt~lVPU?MtHy2TYQ&N}uz zkB<5XAr!_+Up=MQ@HY-`<1tF!c~ly93IO0Je zIV3NwBx>P2!joX0?s(pmT+lAHrBSCj`1rQrkQt2^nM`y-oF5;fLN}5*u1J?L4nz}x zEu~P45cKTHOA{mXevaA(3PZciJ?L6qy5Yo30XNgC=ZXi@Fd&!`(|LX3-aPUEk*IBNYlsR&V@{Z32$$yyA?&H{_Sem1nr-imCb zc+pPOh}*Y=&WCOXVQbZ{M_F9l;0lpky1anqKm_U+SA;b8V%5S8G?GE1YKdNEXgQSS z{dIoI$gF}FxA$(8L2=sWYg}$_i%BT}T3qW}6=ra3szr2f1EoH%8~%HGfE%|d;Sq%| z7kxaK-J3KkG89m+`5E!{63X5!_`0&8$hg46w;0`&vVpt#JF=txX7Ir?Pwhy7%icEv z?ub`;SE#EyYV~l4!V4#`@5t}2=}<=I$Z+DmC;N(`c-XNIVK;IBTqgFwAGyWfbCU89 zm+XIU;ziS9v5VocfPEkhxZP!r6yS}nl-!dK%+@G)y>`|f=GeGsHH9q_=A&kO_F#7z zH5}g|vEG}=%AFT`IO0Zd-|*el5x0Ln*iD(8!0Op;j!}SsTw5&ty}fflv^cD$X|aAk z{1SD`XHCCJsd*RL3{w@~?lOE-8=2Q#&Zw*JDzu4DhaEK1vn33+nuc~GT0L8EL^hJS%-lDiXW9;foh1+K)(1K=#)9h9pD0akRulm4i~ zmAP;LC-ABSj~zc;kD|3tx-?%>Syc4x+we^dAis&5z`&!Zup&M=5+?@=y0$$}sS8YF z@m{7}yQ+I#z2kHM>Z{MnTwp=?#rjC!1$J@RH7&c78P|tLos$XSd~DWsOf#sm^|R

v$(NBHH*EX^iqeY|@U~pS8a5 zI;Ig(0!9c#ZQ6nZl%ZN|R5*j3-A<Q79JkB^TjB|mfTscH7eA_ZUz?EkD9i?vIV8`o3%GyGpS?_V6QZq{!y zzSsm z*bN1-{lZo%8#)E5ARH-Y_cx%Mo?BniV?m(dC)B?o|2xL>ba)qihtd!9k6kwT2EJbI z&qT>@U6vqFHo**ekTr*J7R)p0|1cA?3P>&duMM><3JEklYrQaY@Rze6w3s|j)ho}v zN_zHF0VgA&FpU8`2ZHrl`iXSNzw2Ccy2XZXjRPJRmioQlCtZ+(^6 zE5??cX={VYW$1S8EyV>I+Bwl#3QVz`>E9_`gxV#RN?=PNRN+44rE4Ien zeB2kk+T=SUc4^UbS+?Y^m9(f3q%m`+1diigdlE_3Q%Lj;MRTY1nFf^dw&amgbK#Z# zua3>FHXZuE-15V^6INdaM`sE47S6uDeIo-|B>%bLJ8a#yKvdxk5ec?EZV8d17sigp zG)fF&%>Z+f?lg%a0C=DD)Gc+U`7}z)suvPtCq*VztT?d6VhN)gg3$XGVB~$xuecSJ zHv26Z#W(n*WV$&QaiXhgRjL=$M2P+2(3ivj+)cj%B^|WnrXAyogt-C*?+dI}O;(B!gcq?&|Vl$tiQJU5R$_F#^?-VR$^0$BWNa zi<8T&GdG7wYHn^qSXOvyS08nQ+7K`1v+KPRG^sJ_8{->0XzzKM0grk2azSCPCfHUP z-tZ=vC|;Q(RY{S=5tPtt*q8w&4)r;2iei?yUlU_a*|YX^PfMw|EhIAG?-pE?!wc6O zntH|)PFil@U~1(e5}K{n%tv!7OQW-p(<7w`N(ePbja9st+9M!>r%v-lbE8@rc-PYwI1HQNkYCMWe2o0;1_oloekmH{t9{-=Q>tt|| zBR`mQvwQA6G*X=nUl-2Fn+;M{6yVWvr~nl|)~#vL!#d=+@nY7RRa}q7rl1I>7ph3j zjXwa`)PU6h-VsV&@3KVlym<6s%-j!C)5Q^H^n1@_2`EXJ6UDnCq$AXC-Q)66Ws`fT zq*&Gz*2CULt&ei*=|Ff#0gLcjCM~+yJyR90&S<>Ad+SL+2`n(c1e*NqSom;RL}FW=*6m) zRvV4_(qnj$RPZ6SG@A&wm)dRVjMG^5imswh=fyuvVAsTneVmQKwzbf!YU2}N z-U4@bLrh1}?t{AQHlA&|t9Lurc^;Dhm0$-~JZI12Idkrz;c_HNT8@5CjFN@+^w1+CEgxDyqF0=%QF+cR#wE3r8x5!gx1be5*BH8LS2>5m=@l`|rSc zZJJ6i9t4?4zxlW=1C;k4aaCsBA4f(r!L(N6lH6y1^b zqSqYgVDbu0f(MB52YQM>JXm zY!YW3S-bRmE$06g@v?;QY-(EKig?IU&3Ye|?lwfT=W!u~X;>8Vt%AaH6Yj)+T#E|F z?>lAh0@1)0G#W{yEXI0?yO6BM^J~-=Mn_NhQ&=0W#k>9HX3PO2m5@dR#*RBVfJ_G8 zQ$sPIHNG1J;XyqS;%+~Qc!8&md|#AGG2wa%&-e2nNHP!l5wE8teVCcD>%deB49wSdV!@jB3GznVa3kZc!0fh*& z2fTE(+;MU$T{z;<4(NSa)fc1O8nfmTx7ySI zAV%*FORv}Y&UyO+UkrqXIo`0mUEfZnx|?CEQdn%|ztWb8&F&&Rqmxo567o!I{#5xh zr92Buuw%FT)J~9@8O4VeFQUzNZ^omGGWn`HAklqFx_xJ*Rd zG@#QoZE3VBvO&!<;0Kk}b>CObuL8SeQP7B}xZYoXvb!AOHJ_zm#LJ_4N2ZH2{7d?L zj}%A0SotxMT~!{2m-^Or!@f^;q z@$%T52tSxA^iW=anUXf|IZg+HbfQ$r8`j=>_E-NqOTcEPUr@42M=| zB#Zb(t1G8ffL9pVND6~oz&_S3^R;|Z+OY%iWq-`g+QYLxvRe4*cJ99r(h5|rZWrB6 z!%;O^-JzLY?|TCfp5E<#+M(?kIWQN~PWvu0oGHolbstGAhn`LsoiVqILHnx@b1G!& z$rg0w7Rqizf*dezZ^2!yzy&ydsyO01FI5U$_+s#I_3Tmtk!LrJAYE7E=A6B zUbr@%eQ&MoZ2+^%8wH}xopyQdEYpt&N#t99_VRw$aTF0vFVz`|k}#T;`fqB~CLLQu zsDbY8hGnJ;c1#$0PkZU}0lQDVeHJ@Ls~T2yTK5`OKbW_7N71`>aq1a)3+d^qz>esQ z&jp0%&D)RT=dcsFEdOO8CN^SW&)RtgzOw<_mHD`;X6eGA zAn7!=a|h06<5wLnLjOZSkW)KQnZhu0=)`vEK>84uH{c~DHQ-rT-78)-jt;a>o4+-L zJyFw;q#MWA!;pC!WU_tSRhgUS=(^Yy&qg2C`#|fHGKD0+o5Q&AH3j3jL367Q0#in| zwp1ra<Fa=gqIcJOno@|WsNxzgjUJ7lZ+k~C zm|n;_AQC<|c)J3y+ZxpsUCGvEF^cqusXK$_k3VHg&eTv@K3O=1e zAKW`>^=52o9(I-j?u>mGDpIyR|Ee{bo?paOPT>L*Z9HOt&-tDoXA;yX0eur1J^K4L zW42T>^7zaZ<6xV1?+#*OE2BS!EkwN6!&7b2a#9b8EGnbM~hToX-EeMIMZ6`{O<7(&k!^;gF8GDbpJ5 zerACm+kENO@-tRQE-K*c<9inQQ?Dk%Z`Yyx&mM3jtGz5dW36_g@xei6%Bp$vU3Es0 zBQ9sNvL9ssm6;=)iU_n?5}EGIOGIH;j2@&vEeMXe!Wii%tbNThxCGQS$>0JiPuO@HQ-y9wH`oI70<}s@MJLIBK)t8;~QQp08qo41r zF^Qc$zc{<@pQwpi5wL>Z#h9DXC}f%MMx~o~kV!P0&A;|sB;u9F$&!nS;1<>D!p$fI znapdB4=LgvS?_5{^RDHRRF^}@Dx^|E{NkM!Xz%t-I>Fc3fnz@k>2U;lS@v|qqR9v& zKVC-U4X)iW!u=5R;FyHsD5d2|q^?7W73}+SjXi)>)5Q@fllhFgz!~Ge_XXv>$tD;p zlZi2ZA^1LJfS$F(!_2)j_&T8)c6AYYX%%))Xpg}Bpv?6T7k#@l*`vE=*TZjoU?HoZ zFYTq?lFPz4&Ge* zx%7^jAu7Z3;|sU{$KG29RlR=Uqlh9ZC`j}_H$ID?s>b+!#`IL zCgyy@;M=}0!GGSqh-kX_>$$?esT&N!3=`a!B9-?gdhqZScyRe@-+pqpE5D`s=Vnd! z$Orzf2HQXXB{I*7e~XM6pYMEYWK&fBYu35v;WC@81c7b zNbn~NKe6}mY z;8--je>@-6$j*ZjRGr1n{ui_3q$!g6Wo>#mJuoC&C6x}k=|qx@@6ILm?*)lWPCEe{ zl*I1*9L1960&$0875_3bpObj5o9@hB{4BYd;%CAC@qhfd0~?N=ZaCfvk;(TzqnP=& zMQ(>M*1F4X(2jlW-vtOmC|{3$jl*>-1u6P|>t7Y?Txht~m7DTZwDNPb@r?)n$v%@X z9hv_(&P=0Q*ZxQe2Cr5DzW+C8Q&9)lyDqWYf`l^U|GsrT-4(-;`u(2=V<_30SK?@f z+;aGHh33y&qLHHiZfe^vX$UXLz%f7kH_{)~x!3RimvoaE zjJ16yx%J25i(2V8GX77nPVXaYj&OPXBYTRy-NzpN=mKCC6K$e{K=& z{+~m(XoCMciR=Hr;s2ynLTIdEVld%mEOxVn8z)s-Hk2`}b-*k0Gk6s$Y5t zX(#H22L`fdXN|hqOiA-~Q88AjMdjtForT^oJ*o2GTrf+-;9vM>7(g||3G_PY`Ne~bad_bb* z(SME#<62^tyI@(8zUS+hojaXHtMj|q`3GhkR(JQ^dTX7=Ypmih-?hCct8vD~#Vu@U z(M#akFDfkQ_S*W*TNiZV6)*Fp)??Q^P%N8D{SK3EM@I+0`&O1?<42}UgV^~|KCQ&O z{CwKskrBei&w+Nx3?WBBXq`i#++b?$va7O_C5UKhRfX}H0&XV30P z_Tb|N(Y#KPlUX(utJIXUL6y;nUa2q{!L?fzU&6z~3u|j35sWAX{5#K=GSBZbFE)^p zPz;D7pW2O8nRN$02?z+_f14%Vt5F&^y{O7&*v+12OPgcJmRqvU5a$%HKsz+(A*xgV zMsFvRW9AhzGjorrQ<0se%9CWuhvSVUH$4Rw8YBCJPi-kIiTZ#1pc*9V-^nL%O#gUx z;V%`Z^*R>GPH^vplbfGvkj+#(F(~+Et@-y2o*<`Xn~{i}o#g+3#X8DZ2SAhk4Gt!!}LLFN3Wx zoG)MtKS8=cz;A6wG1YFu^I*(kc(g{l{jI5WlMyik-l=oNoWHfTH4S5-DOL7H$2$Mw zN2mGS7vophDLSfN6I1q;v~;jBq*j%=T&|ji1r7-i;Sad? z?iEp$CxjHJG324(7yF)@r{%+$@XhOF9Npu}h$a|h?{cuzxQ4w#}GZH^DK7bm~qlT5Ro^Z^pq`?$~36^L@?Kc%hR z=XIiZ$#27$(evC!;LZ`#y5|PpFbc&;n5NJ72si0@id>&pOPkoECk-gbbY*5Ryb1;s#f$WAu}~Q`)PvY?)7_voTem^!k5R$)s{^k`*x)QCep$F{(kR- ztAq_`^%M1{`CMnGrS9wJjHomt4r)E>WL+_#Y=Zdte&;&*LA0Sn&FjT>qC!SA4=Zzy z=ezL|p4Wjr;XLhgxE%EOP4t{Rr3LBNqsF#}JpBAcZ*v9hb=VA-QwlPNKx+Ww*6J5{BdKOX1QlcH0y`d+is*1DfU;SiNZ&bzyLC;MZ(}c@JC8Sdw2H|C>wS3Ew2Gg7f$%<5aoNt^D^36O zgj^;!U#FZm@;jTp=p(#MiyP&_y=wdqP>XNidg!(;hTu$PVoRtFhUcOb= zTWUqwT_io)J+*CDV&2fCI`f5-(ZTIr^|>bOGSRR{J|vM&>+?++Dbp*iJ3lR;pdD+p zoobuRqrHENKIyyMIsZ~UXFn=W(fe!;w)81%&tmf;Q^tZk<@a7kedSSC3B`V!3O*Rf zV!j6RhX7%pg$&kJpzb*%87_%8u}|_37Jl5uI-kR?(J ztmV=3(5BUjdt|&>5s!J~Yx967QPtC%d{L%7p2)0|zcIza#a)^>&0g?1id?{Tsd=|g zbyb!*HusfQ$|uO(9YMt$@pH5Xh+)JIWhD%Q7St<3YVXG8Rvs1lo=!|NkVdT3!_P~p zm;1BDPktn|=Axeh!}HaQjSq>k)H3lISkZq4ESQH!RftbzS)7ayVRVu^l>c9ZL-x>k)?kWo=VlMc_MbDVm) zeyQk_ti(jZ_0dXk)(IG7JHAwxJ7<2hklRjEW9>&+eqEiqo}M1*V{&yD`3TpGi^G-m z_2CXYk&<9aU-y-U;__DQB>jtf`>vEK^73~#^|3iG-uNP2;(N{K@oqpUO8XD}wmP8a zk#kGe{f>S0yw+>^H_tS>9fZLCsyWI*AcEgAIQfPIbqNzpi;9Y@tqo`wmqP0epy#KD ztFYAz8Q_wDAAp_h^g@)Cm76~)D%0b~A}yXLkg4*jlxadDT2GJ$Y2%yxbu3=HX`m++ z?W^k;6KWG=BD)u>@$UqNYVx5a!tg13a~|&)vF2xB{f7q!i_MDrR7#j~L2ud6_&CFB zZMac@dZ~V~1b+drs%4Str3P^Q0n3^$2vL&V#CWYulJ#m*aaoym8HX23h*2tk{}c1Xf>>r7T;~|Qn*gjvSw!S$R9ml408|> zC1!1GydmFMQ*)VQmo$N-k{Qf;#LmG;$*;iENU08jDeN}b9N?5x_|ugoArYTr3gvp^ z0oeT#%*8L53xjEMfv&|SHN*DhrKSF@uENAp-859}^M^Z(2_cO5cNkY+=>^~G+T^J9 zJwKsRZ+d(8Z$MkQ!Y|2KY(_ko^HUHB@pe~w7T}}Z;#muDOQ`1Z@?$bGH65=e(nKCc ze3mqDw5aBePQIWbDH(_#pOL#0%77(4C*H@g9RF1+*z}b)+*hard8KL6k{Fnxjk*evb6tzO+xIEk zNWf$H1q8TwdFdzWXkI6pJqP9j3Vr=fG^>k%g{5q@$AL^M5%S}m3wz2?Tbn|9)2p%PS*WmomW75xwV(Tjlo`Nyil?1}!R9%TP(FT|kdyYb}e8t_Nf{C{N?{;~ga zuC&bm96tSj)D3ftXgVOvnfl@Fh{#BWbcNnsK@bA%>^OEBzc}_jtNojY_(s{WD_A}% z30A7Jx6TfYYeBrSBL^2`q(<(^vQr~tX3fp`t&V*XQ&UsbKw!8Qd$n_I4@EIR0HL6z zs2FvRoSzzH@RaU;f+^X)X2|Ay}=~&a$ zphSq|yoPqhTo?OY00xPU`>v!$6l#P8a1F1~`T4narFDd>(78^_s$%(%!;AHaJ6KGw ze-xb*dXBp;KjOKpy)v}RX)FT*7e|igGY0T7$o@i=oH&4HTz8e%Jy%e3i++dG@!!oC zU~ghJOZI3U-ga?ufr8Ky1cc~010O#;JzZ|gt+Tds_5Nh1R%1{zh$GLQqGn)_`D?oY z#JYmWI3waaHv>XDjf+Z4A#B7chTc)`w5OQ_P>n|$KTHQ zS49?l)S^X%bl1wg4x&~x?;CivnGAz@5!}P70f<uF~k==6l~uNDU)--%j1l9 z+RyKu$_L=U2Am*J;C#@yXoK3!Om=CtxXH!VFOR{F02N=HY`nQIcs_mbiuYj7FnAtF z{W@`-!J$wwJw08!+B^dI*WZ=eSL^+o;@T}G(=t#8x3-XNzg<&PW62q#K3){N%D7iL z5N&f5U;C*?TRCq%T*XUY%}1{^H7#wiWva8VsYxdok229BFjrJfzrosj%%55#!h8l%n(%E(F)Q< zDRZYm%*^t>{@_b*IUla>JCu_J0R(ZqT5Q!=iN52#_HV+{P;u0E$LX{sZL>K+6ma3~Cx0 z1)-s#R2og34Q0iPnST1WC(6S&zfAjV5Wl23i&)v9RAU(a1aM(SI|C69!lA|jNs(tK zuCEnmicczH_DWqe1M*C9c!h-Q$IMLic(X?}pmCZ};h))4!uk2JO%qV`=7blFALcw& zDS6bS_R^#;RRK@sdH&edk|{xT`mOdgKhu%pZx|_$Q{<$Y+%`ul9zn(hYSn!rEuhG< zL?PZH-N;RQ^kn=y!!T|nV@J-R=^-F-GO%kjAEO=hHK!gRQg%3_zeDXU;qMa*7J8G4 zv$M15xmXFj4%P;eAE}Knh~(|6wpx31KLti7(@lnG237`EjAnu;fhaO#Mk}aUsn*d| z2K{<~cyGNVypP(A@8w4bm1VP+w2HGX%Nm@-PVHtK(yOC#4>B64pZj1g&dtl;go!Hz zvQI7heaGb^Q1OocXP}Z`pu8O*ARGb&n=)NVgR0Lr6Fn02fG7Q#CLl#Q(n3N);|&ha z#Osm%0oZswwPHn~>b?7d`%&ie9@1Y`=JZlmjE#<&RQV<#)2|rp4Jtmp6!y~wkSANo zQrO<8eWKa|>3%dTGO%Tmx`@-uVO;h9)ni z->V{4DCLp-t{yHa{Mx?dEnYg#1D%(8F@|d0;iWx0S&16b&PQ$fLPx6xj1*B|uU>*P zDZD(Ai?_GR%d(ZnY!%wG417#fsM6EMDfe`=^;PqojWuUqrNDxmWXxV|p5d{qkOrYQ|L3*ET)_}-qaw{gy#hndW;eN} zM0Mx5R13u&&JM8F-)wu^Cx9Y8J_UU>D%B)}P%-5eKRch}rrn z&tlijsZylRhEpgrI2E>)>S6RW`5>TSxN7U_R^Fpp74Aqu9^5YEUR$!i{G9^`BH)7K z03t-Y3J;2FA=H`30?NxH1nh9i%cYmO-g5Prh~Y(LIn_fYyP<+j?^T)!Es6PvwIBPPK8~AJ!n+&q(A4!Xch9PjHW8#rUb2 zG|U-%Oks6_)vr<5d#+T*RH&2cCHT+GG4kfGYH_KK?>leLImvn7iaL~w*^n~gR|Eqc z_WQIxVNjMDDzzUK?$@`<*kN6Edue%EC_nRT77tL(AQ~+0^ZUMvj|@~Z&)e_KybQLT zU^yZM$ld$y-^3&V=KUGmrIi(x>Hg%C^+poYH(vRkjxVgHg#iO84=6E(vZna+-#qYv zf4tUe+q>&nQ6LylACcS(MEbmxmzU@FKB~ywuG3&#>2Y4PxK#H#+!!W;AJLR*Rx792 zst;tDrUnLivoZq$95xpzfDUUws37g(!b!~`Py%mUs3s*P?eQ92@yO6cC~IgWU2JS# zD6I0>#?JAcY`}eV>L*>(^bcVuD*$|VeFT!T^Yf)zo|(k%T*rZ%F&Hm6uivFqL&sl> zgFNs9Mb*=Q_N=M>4I9q;nLhFz-9=?F9?}I22{PSWOm>=(@^e2*iSJHaCVhGaxe7pg zMP+3Qo8F58x81LxTG&ls;t^mTMBCSc?pL~`)%8#Y&_-gqGe~c8fZfIX&D&S%`QwaohUj0V31wGz_*
3QIrmg=zwB@+!|&qj z1C7HWj|x4?<_ms3_t`*4Jva5jD+;bntaI?DVI+9Fbw5jzQK~jXqim#>- zMeFSr5V*qm8KX(JX`hq+VBy?+0>=CU$@jwRW5>-PDbuH2uixF?LAta#Se2hpq(8=l za7aA6{#m1C1;W1xA?k|bS>2uBi5*FscFmjeJ|>W%c~pIH7?q#U$H#zkOc1Ia`r*uT zX;HCfR}e&h$VIy>jNYmtfYfH+`RZN9M7@rM-F(zD4h{(j6!uz7it>EJU?WSKd7a}v z60mcPl0oUlt-V&H41 zt??Zug{Z4ro0>}KT?gHFQ3~mEhbh{Fn%M?IC$f1e&s&baCq1W#+P%C=M^#t?f8s=+ zAoDy%M)ra~y}C-q%S{NndA{hkB7{0?{1oGOH_D9qb@Ag*p~vhe-F|1HQ6d)&fRNL_ zJVC9-0-zUgT?+{J$!`?=lY6shIq_=%SYfk4kMaMK_`Q1|BgLIId?D_mQmFkMQau5| zI!`2Jybjy{D&W$`w`hszOe(52xg5H9+h2ed-bAzI%+?bEq06(~DkfPV%AN>;scc2> zUyo#kG57$GEzzt_)cAgH2S|^OhHkrmUXkJK?&G4*o=eix8XzP>BQcMR0)fqDRYvn0 z%Jdl^_q0A%Eqy)bHQ&4CMv35)M+jcV={8H5oXOK#*Y7Jdm-~(|priUL;j1vb$z0Pu zRnI~j^@`-4QO~hNW|@LP&-sGO?E1^@rg_pt-wVG>Fe*LI?^r|tCH3O0i040trwzHm zPxV^n$Ty=&LIJy;jPbX#zFOSE>S|T<2K7az;*lu7Ej!>(rw2DCoA&86^k|NIXd;jz zA?^+>o2(ZqVDf;$1Azn#9DTEQG#9nHDRPOmz;0DrTT4JDVKY%j;j^cVCZ=|Myl70S z{La5&`wX7uCb%q|Oiy0|dZ2cBuzs>^R)S?S*&nGUNTC4?Cky<{(dSGxGZDFnii^6G zLLdI*(vC&61Sq?dBrmN(L8NLQiy*yD?9c9V>D!{XB!HP10GSYwJt4RkynnWfT>T-- z3VCv$R~#~DYCB%@8jw59Dk)F-+T(1FEgI^)mnljut&NY4tx|FMgMN{$%b7z6cZ%!U zrZ;ZRS=s4TE1>k;(p!(e+oKH}L|#7P9;I-J-xoAparbFwf3rrKGe|qhFN5t>brEB*B>^#h%TL2l&**}?m*nH}@1QH!H zF(1(%@I%<9MQzb9)K z?<+s2p`oE;?Jus@5C^19*`&!3G3yOG$7di;MGIMcx2ZEy=unQ_ggA(S%2#NANEMy$ z{ZuPI-dGM&Y)c6`22h^X?Fi4K+2H-4u<1{9I-dD`)pFt%%u&lwI==#tIj)D#$?Wg% zLz|nMiR)oYl2i{;^vh;ivyeaLF82-4BrLG5>GkDsxB<_!a}KxNcrE}ER-02TbJ-zt zJq|)3QHOhT0akD^16PYrNU-8ei@_IOb`rlPYqI=N>YGh6AuR^s`w%pRehhOkrw1 zv~JF-@J_Gn-cp~y<`4)b_5%Hyb)Ja_oP0&W^L6YSCF`esn^KX!3FA!&9ae62$-U8X zzidF8oPS4%lyzJ;VHZp?+P{i-Bm@0AF`cN>6&Mp-_Ep@(HsKdJfY7j9>JI}(ImpyK zBepwNy;M8z<9g5TSDobWJSXi+<3I}EBcqfad!L2Flp@^6C$o5dh4sw~%%Q`jN{Wc7 z*)23O6(psmvZgAf<+`Ur4~n zZbAq4t7WFz$&1dlh(?VQRD zcb=Vm0XWzRDWqXxH=aKYA1V(qDlRE8rr5mVi2MfuUjG)O%R-0X;AD&a(PpVVJdhRX z?N`0(+0z(=UPK`Afy~myq@URDia*WU|ME!D66}0rI-K7~%O&Mv6$J-*y6B7fqGIPl zKRLo;Tm@Ni@c{l)1oZ-va*0HS;bBSQgVd?thg#N_WPTN+Lp5UN$Bta;LCzqhyHb96 z(s2?7Kf(cSb0s^NLWP%XB#=m-H_EMw4g4<|J3Bg`3?%#BsJ&k)`q)Iz1x5qt__#J& z31g%w22S=@U6%8bGTvFg&;WiBlyLwp)m&3aj0c<_R+Uy>%V*{;+}FM~-UJf>^~Klb zRjMgu&_zIkhJXGnnQU_FbwYF;2K7|93hy_d-4{CTzCs}f5)W9VB@7Jz6b^-9U%N%f zY;Q~>$)BD`9Vqq`a5j(LV6&slTQ}yF#>G5?<3NArbWxPgn#swTg-9t5OM@uDmgpfC zL5e{__<6@i{e+pr6zf9V6^`liGIaW^_Ho?`w57#*zWA_)NvBS(r3KkjW9>2^N%WjF z!g|L~hdmCCN%t`R(>s5lHG)_HPb2c3R+egAb`io*Kv=C#U!G4VyrSMqMKw!l82E7E z`O$H5adoo`o{wdor>v~5a-9}`R(&#qI-S1s1w3_cTtUhD@_SUvOAs-$wjO;t*qkme zDq@)QJzYm9mP99bvixB%{{6d@O5@MT{M}{uVjdh{e|mg<4$s?hEZlLd#<((hq(qBjQ~a}!aHibcQHN2}&A4&T4IAf0qSh?R z%Oz>grR?DO!_)n*Jgv%#g4-VeDQl|z4m$U^h-!TQbb5IkL5XTPoGR{X&(%dSYWJ%$ zfV3Hi7*$f@g?B0ydmV(x*B&#v+w!j#w)&*BH`xplCOSSHnB9V zv7et^o{K~rlX40s#!v(Dq_^mqbqPzHSwpN*Pp{eDfrxJy`Z7J2@B5y!ZCOl%{T`23 zTvnya(Fo>Zf7-V&-LAuN?W1}kO|8r7h({A#rPh90`0f`D8J&U)FB;=RtIjG@PNQ~}r+4!ZqzTNNBC8Jem~eYJhm@wXVB^}g^>tmG@_^3qfFc)n zyV<{bl~S@oob?o2I-cK+FvH)`2~EHrZagFb?spm3-P)jEb9luo3?1WewU-Hz{+(`HfeO2T$eevR#?#$FQamWldjs_7K!}KDQ`Ckg8*7inLi1tlQisXr1P$!duR{X1&`(A= zQxz*_?56Z7m9+&NrE+~S)Gm9GP}nD}h)Rg{D)MXI>py@=-IGqz{j|V{qL1l$zEnTYqvvxdaA?yRO2B{lp4{4QvKSaDq)ti@pIekTGg$ z@sUX-=+W8-?2Bm+H)d6YzeK(BNk2mTcQ>8pbo0rfee(l zY!24hO`yG>_2I@O>;ksxd|7`X3E{d+y0ktda@Ij^ZEuen)-Yi1T~wvkhKdK@`##YT z2`7>@HYcR>+PZ}_rm=CKZ--T)~O5gxuoQ0^XBcG)jI?C355WG*!{`exHa zt<$1H%lW#!hSW=%AGfuFiv1U$B_+1{8&*(DYikvdT>vQ-f+)9c?)Q%0qRBc~y8-^m zPl`jz_wG~`L7@XZ39G+-M!p%3T;(^U?*5ac7!uX@N;YIG95(~`*NHFTk7w`!c!YW^ z-0{H10|d3O^)1IwVp38G>SCb0FfHefET}#7;!Led;FZ~O;N*Lj`+$+U$^Mmzi3uRb zcmGLjC32esF&k}kD(D-3Tc>@vF_2$fPao$r&m*L_jj$ia7T&scK0w*>8Z080=YFw4 zsn6-bGFQ1r#FS$vL?+K^MW{v*_^Zr%?M$x?K9@YPP>G&l-RHGyW2N#I_R14k1u+up z*Wh{UHVpeqNWV`P7rvl;ZaHBwy}YW(jDM6U({pjX2j+<7be-S1LOji&4q_LO5rkkb z+V8A=1IbxgRopPbQTVtDBc-4iSz20B!*lDc0>QSLmKM~Kv*)@e297$&Dco~*w(R=r z`D(iML{VXiQlLmNu#Rlyzvw}JPVz2|Uf#Dso7W_+(h!0dwN{Ucr_fSjShmfo&EyV} z!g29(6WWcgIZ|KQV~x6q*i9$uKu*H+2=fHdw4q{VR{Q2`$v`pPCN;nLFPm>Dfqf+Z zDwCPMtuiXvAn1Wg$uXG=t^nz4Q<~RfA9INC5VhM0L{?#D42umb3g%o@=Ms)KIUP^bEkYIiP*n>$iiy$%oQvj&9rUFuofKLDdBL^5n$d5YCU-7-e+vc0$ zIK+GqZ3jr_C++%;H4fe7U+9wAnB3BMEst@OObP*eT*u1NQr7U*!4%(KVBTkPue0l| z^4_6dpuL$P-Qjz_CqkjdL^#N(?~wtxWU&RV9RlKhYpqr=Aw>)ob@lv{aZ)ocY0mqs z-rrtP2@r&kMXY+PJWko@c+;a=%35~!u{$^uI>g z$MO086$XipQT`&wh>vTzzp~H3%F1fIkE6qopki+Tk8SmYBw&F`ve=Z5KgPCS?j%~# ztE;;=c#OE3k_LH?#Jp3>`H^A-%Du2Kr8A#h;TT?!JlEX9?dboeV7Fid&+yoRJ71n3 zt|sc(ClK6XjH_EHdJA}_-QO*GXxJAo(?U;|(O=bS?=F_hYr483bXGNil$UkoW9 zE<1Sn`bX%vV{OY;ye%TdWn;u{BB9rO?^hTre)GY_h!0>vM~*?lN^0{O#)aR(hM;g6 zZ0ho8^&`ir9PQ~i?c`vK}k0Subw17i*N`Tu2;yNMd1O-Qa1%y5ABS z8loY2pY^TsgB#bh#`EpQX{`>vQKxWKXE^!#-N3BH%9c;#_7S1PyD;oy&)k&bclzB7 z4+{wi>B<(n7DBewtk3G&ctb9TQt^DfT-ReE!Fx%Z@>fVsBn`**k7v)<9B*&FkqTO~ z0oFM{K5Z*^@Jla&mp4VZk?N-Wi}KP07z}1rq9h@450pw1sHv?TyT!->w%9P4$=Ytd z{?g~M$mtkz>-7Am`?unPgKZCHU`#0}ytiI{8c0WBACK(wC@~NoAKc}M?p?UJ*aN>U zkTTW221bY;B&RY46}Dgp+t#u74WFAx!DC(x0~Z2HKtb{z$Aeo1KD^hLp-KByJ!sOR z1WiUP?tUMAKMV$&Q(sRs{VIIhG5O=}j@JmOXda#H7lt2GQ)SDqBqSuvHQ7@@Axuzl z`4Ohy*&HR`TsVh2$k)1!BWzN_qoSOC{YAGk8>Ju8zKeQtVMt7rv~<_`>w*VL(SXv$|61kEq; zn!fZVc<PnX& zGuzOQLLnd;2HzEn-*ocd@od)Ybr5x{XSHJI6O@O3pP|3sRG@z^*5Q>cCTQv31Y;5@F0e0j`yC= zHd8=;`_B`-0u<+6`lL|w2G2$CIIfn~gS>~8z5OC6-Fz$!|BYX_M@K)=SAF`J6M}U- z?srZkP2oYk&N%V|Rcq$Qvl=}M+X$BrW4KyT4soDBoVXoXQ0QOZ(|F>LL?I)b4{u54 z`*y*~WEoPZxwz$?%vbDUNy!9YCv#1vES;sS?f?g zH0qA+{LnE=QlN_K~4@tT4%x_W7r1RXnx$K+@@T010+m?n{AxVe3ueLH# zl5Jz#0r~X`9|4eOGB-*Yl{*=%~tU3UEd^3%d3;hQVKtWp?-Y!0NGi zQ$_~GuN)KNY){Ra2FTQNx5qZ`qiAnAC8Xg>L1(- z_Ly8%G@*{^Se%Cz6^$EwPjRVxGbtk&(_Wa2!%FIVM&9xH7Ei2`w;)KDsgm2E=P6<8 z+JEaldH^v=*{!V^*|WqRR85lR)G`E&jz0r*O$HuXRX*sRF?Y?h@*ZL$W5z+He++$*@S1IJK5htw8XOtn z9$W|w30dRn80NMAdo5|=x+|=l=vr6QNpmR3P}wu?qr%Cb*$frzKCFZ!>C#FHXLhXa zKZKT;396dDWeQtws2K`^;>zj2Pts-8!H$(!C+U$prPEjKeY`_bq6_4C)AA0})gEXV4t$c71BwE540``y%Iws1X|{QuF9S#Z z>`h__O8uxZ7(9Erb@t}PUV+Fq;D};Y%bMO;>$EKz86sRMJeQsV+sB~ZVofew{u+1| z5kTEGY;e)Br(#B#sp!nk4kq~~farW1et8P#?URN3VOMD~Nih-TDACXG-lK>L2J``t zY|hTquBYHzj8TDMiCc@Xz>H zc^1;zDxAn_5NS6-79KFK3dILx*^SBp2L_w8;x476QzZXA- zBpSK+0yhqHFi?Wep?HF5kZ-l5`cw&s3^O*$0nY#Rw+h0>(u|0V>WU}y8`o2MWu>v!g+ z3Qh(@V`yaeV+FrQbQ#XB)8F` zz#XJY>V1HF)1ra^%*yNcOv5K4v=H)PFzYub=gAT(+vPzk=8h(B%dP1ha8zzLJyIKW zC@STYO=2?M{?*B$w7vF=_ujT?hPM?@d81XdLIG$cQ?;q!WjQ*(MuvEriJWu6@jeb^ z*nw}19aQ}~=??u$wT~O0)DHbhuNmdx=?YBT7VNekm z{g}W%TU15#X@DNkI!4CE@4?!{f-M-NCkc9IrlqD1`O(joq(slzL4c&lw=$k>u#6&^JeG?XFozydTjdiW(UP;sm^ zDhU(car*WG!S>=sd%k?y(S{qm7mXwft@1TpUHvNN3_ZEt0ktOkxObQKN+q!KfZh1{ z3}Q~^aNoLK-o zIB35+|Cy@s#@HA$({FJLVUmJR`$KnkxZH8dW6@}$Ndb=#T1Xx9YHg<>M^>c_MCFZm89z3}kpraDVQstGG z`_)hEbh67PvJ_-zzq9u~xB2MTe!3inIBv)DZ3E1l^l24@vsOri|1%rzNfT%=ZO2Bt zq7)8`z6PgFeDsUK&jXR zKvpohi>MG<_({$6d7|B0y)%6zPQH!z_FPyaZbCxXfod%n*`Vw{ks4XNAO#))!GoVW z^Yqc+L!}CK)#OR0eG9R&!if6TefbNdSKm{zdrqLzb>{-lJ7h{TNH<%s)~{>xnwuj7 zN3Z90MnCq$-YQqp*#}!54V!)&Mxgmc*Y}t}pcLoVu6D!5{E%U!2_>f;eoTvofq|l* zpNPoGEHkijz%mC~r3#*Hb%5yc?Xp>tGW~|{N%5IPDqy{kxWFV>l599Rz^@E>*UNl0 z1^}sEuD*9AYYI2f+>12Luag!RUisw9zI=nCH-O;QBgNltcSH;wR|-c+@${o4sUMC_ ze;<7Y0;M5U#eq6YK8&ZC-4jzMiRmK;OPibMt>_FR+J%ORhy$mRK-~G+e5%=l0|EQckTZ({4`nx=qm2lCc6a zKWo2F@RBu3cxP*f8|88gg6N)50!H`Y*7T1G?f&7THromghZd}RGaWu3eEyq<2u_hv9j{0q7y=K`QVguYADYcZHILB;g4-_Fkn5E0`@G(Uj3xQUpF&0G>EqEemBFR;GzH=;i z6|jLDPr~m%h|!Y#M~S}i=c)V!@C;Q<7QizwmLQ{#5#(aJB-{S+9>xUuc zfIcf}sVdeK5e|C$V#XRjMQYmK*9`{zx{1~Zt~vxJ*{8s@J% z?pq#m-ugIi9moKFmN5%*xUv2?C(-``95 zx!cs#xZ5W{LPBB$YEOZU#Zp6YD>F?{BaBD$1cBG#(1V49d{YS>1=?}-Gc5;sZY9;} z4_4Zm`R!ltK5hW_d!U-8Izf|>RJPKLtic(T@80w$0k^>+k- zULt+3vu#95y?f`-W$<->Po^~17)E}e(}`vkF01N*Pr7v@K=t%S2SM)O^0{6aaD7z& z1Rhtft+abQSmo;R6YESrti6@uP18DepU9^^iDz&e7SrKIpa&661cA0=`E}57*AnG|fJY9*yaf4KPOL-_Tyg}Rey;pmvC!h} zMV}&9WjDe7o7o!iIa`-uy-M*3vFTgOWHFXrKp~rF$p9%<`%iOXtl|_3meb%ra;Agfh~V3S@0ql!Zp>k=z5^Q|$Mc`|v9E*96%d2qhe_(9I@xeRHo?-$ z3V2SWvj;GSx0L=@XPKbb*`O$nfw{^$4q zoelYa@anmgWz0YCzGogeXE?zfWMr61n-9In2e)HmqF0nPTZtY}J|MmYtBC=aZa`53 zs_p)rK=TGMFrU}Q-WipZFI1rT$KDix)~~xl*q|dDNI+p(*;ha&8v>BSt{2-)4NQw1 zZGhdxD9h+QVt=#uR{n^&r=$@o0EtjPOj$;I$$PJZR$&`*L{F(4v%ot+5>c5!UTc9xlZr@M%lXF?e;4K5*4Q`A{w|<_W6o(lnXAE-lf6)ggMTdmWX&mTgVSl4zz3fk=YjeDgs${OMsLYgA^X{;G;2| z%dfS0%eNFlQ6D6^xaA)tf&2-uQ3vwbVC$+LU2R>3!<>|(*`sHgr=gKfIJcV>A|b`< zQ0ejzGB)5o(GI!#Q8-acIFa}K`lO$fhg?!&y_{Xvt9~0ci#{??6>{j*iCqSYenDsO z7@6C0$olz0wN=|VZ2%S*Az)CbNFx-)6Ts$90!HF7&l^*EtLhgQJpobh#cJIV&T&rl zV89EbECC9L@sYb0(naxBFKK(*0U!rJYsL32K&>Rsd__R~GBi9qdw3ZzaNSW9t?UU- zZ125z(;-g-r@N{h7kZYN<-na{*`nD>7_^J3_ikXO)=AGx0`?sQk~t=~Pv|gnL(6T) zcrusS=sp&(TLM`3@O}G?aM9jOh0m$$Nf6>#HA=iyuw^mwWcJ8|)+zO|rJY^+R2;C7 z`YFlDSvffYkqw=%Ts;N&mOe@)Mu9~XAnZ(~dmUr0(`-c}(kw*O@ah5o zhQmm8i=V=ipLLZ|dy+eYBY_I1XG0q#N*SR7@GPAN+(uzHz+o34_xD7#<`kFt!gAIF}W<2bmZq-H$T7qMj4F5>L-PVs9e(&*G`Mlve3+PU0j~EBRzub2(8|&=63&yd+T%n(vm-saUFHYJB)ZnJorI?D`D3^FIF1EYcq%d zeth?^$SWCMu2?2*zVd=Bs;1k=)1X<=ZqqPL7X9$yB?^#qJzL8@9mbxajAAc-OxQR= zMe?zyu--2;6bCo36{})(7J_|8VNEj0!C^SN-y$~TLtKcS-CMCW#liK5)p>jJQaPvd z=5jS}ckK{m>C)PU=z0}ea@Sp!PaO+sB_)XQevc;rnv!bzAM2jn+_fzV9*}x)_aB9w z{*VK_aj0VB@4rS;c50y;xHljnzipn%4^e;)=?7XAb(tGZIr5?y+m&j_vi z@Ob~)UB3Mbg)nvq9VvT0|Guqo`TC;>F-!qs7Ec?5XmTUuf!YkG@;+^A$ESiY5+O(DNQ? zM^K^Xzy&;GyE4ZXN?Ew2sZ7c5;i00U0zED3k{5?MBO~Kq81>QG&$rCWVFEY=SCr2g z7y{o=onM~bS6f(EfTlFasx&_^)s`&gTBqb&+GFTJL%zXKQkT|gp=1sQV{;3O#D-6z ziyt8ntJSu&Q_tjjifN4hy&|d9uhFlArm#kLatyiiQ!!JLhq2>Q&{?VM999RNbXDo| z@$qG)vBk@YQ+RNIALq7d-RXthK-M4}YVj)yr^L7?*5il_{nN_u z`I+*7&gAPE%tB1B>A7EHW4uoXyjVbuu-Fx9b#Y>YccFhi?MvZRWca-|Bus8sq2r0X zz#+b`u>P4G6BT;WiddvofUFr_!Ij#tW#0pl1#Is?)(!h7myb07U}^+tAEIZ|gT zYOlG%PDdL&&IQfm;BuwOJbktJ5m*gkA|gF^_awV&tdIIcpON~2R3DAqS_obEH8dnL zp7WG!*FXcUEwX;Xw+I{gjcT=Rr@ZN-a2M_2=J*4hFiD=-whdOq)RU!2dhoz=aC7fO z)hxxp-kDK;$>QFSOek=uj<%3d()I9;{jvh%OP)~aE`<5}_XZ2?AxU`uB4tDDx5`KC zAbYCJZtJ0PM{QxS{^q&ek3~njRJf08GAhTEB(fQ^~KrvQ?eCG z&41vqMSM9}M9QN;wRsw8Gu?`y2qSOHstC~Gmx2>D-a4|=bB+fG^nCwJ81ACi{ZU1` zd&UT>*Pw&9QAKC)i&GOKH2Za77n!KYEfyX=?}N<-@}BQZB;VLJGd6j?m(qwSyGEW; zL3t~4dj11YW3D!`{iXPPeSUNg$;5W=n;~W&?p0Wo0T-IG*|VqTyhlM%?5{O@WhGh> zG8Wylp;70uCs=!h9}&;V!qTMI{=J&3<#%;VZ!We7uY8GmE5%&}TYiW8*{(Gf(VH_K ziX0=K)hmBQQ-YEjpQdTpohc!z^eJZ!eFJ5^0tpKWte%w$)%^I>3&Dh!pD&fn#4ZbeNFenGaIOz zTK(=DFP-^xcJ_K!YM4sYvDn9@cxE%B1NTy{PguNPeUzYXfuRmo;idFoA?XUegFl8| z%i|V>P*fixSx!*MQMzdG$%XOTU&=q9tzi9L)Gn) z2~o3Nc&7At$#{ZG*315;rlucQuV4yWSh&Y$5S4liPr9;dfM4Dd{YG>w2_uYuAtuDq zjVBTxyTilauZf|gfd3=Sh@FM&^?-!i`_%9m5qs3-d_dl#mu|-XKguOT-O0tEDKpbR z;bvzreOwQUf4$JxObK~(ab1k?FEAwt_< zn2Fo*BKWW>R+}bDviL%eNX6H~eWOAS>v3Mh<%LpdCMLS;0iFOXz zPt8wYqIMfNdPN(hzt+M9_D%}>o%-X_yzl2`|E~pr6&%JvKYcJWG@;b;Iv(ALuC~Yr zp$8W$N+PP^6(sksj~8^8<-N}EAbNq@Ox+GkmXlJg|K5JvfJYFxML)UlT>c0F(fA`jxWL>8CCn~KB zsW@NTTfLxTN|oogIA~(O?SP$4EK>{VjPNa3e2TigI}l{UMY;p^$*z10=gv8Dd9(Wq zboO-`p3XKDBB*zmT`Ru#OY}!S1P;M)fZ~<{ieN|9YgkbXyQw!Z(?9@TA&q z{hgCqw|Ks`J>3ra;$4@cs{y`bxuJ2cFx_bc>CDA4H}Bf_D3|>%I_L3hw#|;dkp0xu zQ!hr{hNS#PH*5fBeK4J>Ulr=%VWIJE{Ty;ZnwvfdR8wRks9MU}u>-%iefP6$(6E%& z7pfkm46J0VZo1vh)N(TWQGl$l@+S*PwA*Ln8D+~;CzNQf0NxYit}pA2u%&&-C$t~dFjeI8*(8!1;&7%!SyxWC zY`l6%2Ttf{X=y=K^G(67bGe6us}j)IXF|1CL38&aCEH9Z6ie|s5Tk&|!qiojML2;m zPol%(KFdc`O(s%;z{-|zbmRp2_Rzko;DoG<%q$Uk=^8bPCgp)K=ya1NPT}p0gr!Tk zG;@7)4^!=zmm`m*MU2DK_U`G~VJCB9T2!x1=t3mm)<53z@0pQ_Hg%yW-9Z=#){-u2 zMizLCtsB;83v0LemV4uop9sWR`1$!aZiT~O&et&;B3@BaJUrj%>GBi|TQ3v2tP9B4ST;3>R&@YffJmVQMZ@l>QLzQsYmdf!1J_67dNbfRW=GpDUgxL z@XXG2wjCz@%=5PKSa^pDG6SAdBv*xs2n)4rqAV|{u5)_oGqDz6Y)(p|bYtHc#zB{y z57+(_16?s%o>vZ`&cw-(Sw@mN!2Q%QU=tJc3xM=fMLdDo_jybf-=TV}@4(7a+&~3w zZCLDioGe`*G}A?$OzTJ=V74v9s-! zKXW?U=2P{cy&Z}RdB8T>&9jr+?|bh0X!ma&zgwg$tt#x<&^hM2+Coxf8|_SLJm*xT zj@``0^?@X)+#`UKvI4gmJ8#k@_9id^KbWPo~N9B_}%gCN3mb!t4t3v5&t(12%(;V1Z9W=OssNHX@!WB%!&G2{` z!m^?MyCJ$r`vW!@-1WwS{{CyX*CT>}m1%qQ06>L8AHOUXAc*#P(X>4sb)&*`-^7hE z%H$$9`zyOC4#XOqmk;~&ot*I0XSgn-y{|s9(4|xP+qv98ovg|J^AFb^IP#)lC5-{O z(}SKcUdQJ*GzQiB+UdyWAuDqQl=sXiz15AIsiK|A%g}shKjX>G{$!u&!qZ%EVGIWQ z@8;!1)dq2tZ4QXTjLbf|t)|xjC?Leby2S_|#h*)69!ha%^ zG8wI?YF@uH*#y}PqNuFfhKnU;_;Zv_Y36+T_yin>qMDkd{x7teZLSkC6&PhhSYo=K zNpasdcD2(Rc{X*FZ8W{)#fRxqpQv7D()VSUitVvM2@yO)i@`Kv_OuyzXls$LyN+gS zKHiMIc~d^{`8CmD8qdR2X^?D|mpiI`v6RnL`XWb!WfO?l+!sq2Cq4a};qk>3gQ%%x znI5wH{sRHH%wzaLTonuRRZOf!l2j4@!Kt$`ZF-0We|T5)Hbhk+$v3tt4<)R<$5^6;!b(x ze%(Lkum4K)7xF2{swC->KXX6GYVTIY+t(-6@$0bvl6hdc{WzO%o(_L^z69$%!>xux%n+X3-ctb8fyL}q9U zOH)nd0tBNecRhTb0wMi~S*I>6pWg-C9&9xC<*g_(xk#Q2zLY50l(9~v|NS6je$U0J z#&!A~MOt^_g7SzKGGFKLIW(p0Pg+GCM(!M9)mqD-yEAfe|1_vV{xQwyYm~fTJgP-l z+TrgoZXBjaP_N2YFG}Nhjq$gL3!W*0N3o|XJ4tFsJye}d-gjhipF1hkSmRX}%j;6$m+(TR_J_L~;% z*Mokx*wI%UxCWpgLq812frY1Vvl(GU?&9__0Yj(|Q@_#QwyEc$9fR*>Dpj&vnZue= z=_y;7V>|EViE`E9u&N6KNx-q=wiC(Zw;8Hrk~`ljDq_2f!~SBvhp&YdD$Bwz$XcG` zmZulqXL4*Y0lSX!+<*$jqgZT(xgRYvl6!QG!GaGkAdY0Ib8F;OAu<-&`n3g#fxT`erGV=$nF1yp`)z??& zAU_uLG1i!L7?O408n-x^C(vzPDW{LMv{gJ|MFMmlNLLzt>qDt}#p}VDCKr=vSoWX) z=lT#(!1RRg0;P0?dQm`bIjK1>8?DaPeqbZZhXDt0LMmuO;C@eoAr9vlkJu za^LReNLz)KT{RiG1sjj+c539vhB1K6ttUj@dI3tg92N~7K(vU&ciq2kvq9&g}UYP$2O9b>b!4~P+h<`hKVJKlej;D z!w=JlE=6BX8WU*vA>Cb1;OqwuGxpSJH)1(|t1oplWvVdlF5-nDPM6}!K#4uQA6xlL zAku^}d1bqC`&(8^n2p1iEW%Tw-48F?#oN8RHZleWHA}1#V`IB!stFhf_iZ~^G|!^& zyU{X#_lDYmZaH4oA%+P(S~%_F(q07fxCYBk^u{m;x|7g^(4qBaIxy zol!L$ChtU%GDZ=FA)s7tq55LU8Y5n5{4{&`(rI%RFZE1b3(GGxnHJs; zr&cybflZ!<<4e3|M|xhCgkJWDt6K7$LJ9#hx`}bACrSM zVmI_c$iSsIPAOMLM46pX_n((WrS;>$Jyuj@N2%dM1?I4$t^7w)Y^f-⪙E>UN`s* z4V;(GaS1|Pq8U*o;H1ZJGZz19IaGNYFricwM@+{ik-qX>M>DS5;Mj@!ii= zf^tctETb|FfLU9I5y8#9|0Z#X`V(4dWrp$5fxi4%St;M+dQ3Rt=sG9vH)AoVzO=%i zdv*(~!;~>ntN^gV73v53u(ZbpZi>qf!jB~m-tdpHeZJ1W3&Aka<_bw_T$JP(;A#GI zkA!TnNesygCCj_-4@F!0KSr99tx$Mz1p+|YgEA}7g8*9a!@}rJ`3czarRC-C1Lqng z#}|mY^O>bS1E1uzPFR87hv&F%P1eSsPrrzYQ*qo}z)t{!KJbT!`#4 z;#vM`$g?E7qi5#+Ni-j_Tf>mxwUW2AMUPb#anvTgzMS~bgpi~WJ8j#l+^Zh&2xTa$ zi^P-T(J!)yS<_FT1z5|$$w}``LbLnT!XQGcUCFgwsWucXVZNp+{$@*oJ%Q(@H>d`c zd=OYR4`#>6hj1E##9DNM9iI0CY=j!6Uo&zErzw2%SYwMEqiTzkl@`H-NGk_t=Y?{a zNjq;n79L~)pF?#a>brWcLsa8aBDB^h*LLd^kol%}pgksp$9L|<>V1Z#hcy76Q!tm^V;!u4`Pci^G;@Jbpyi#tO>uIg z&A@w0{yGLwmRmig>hLP>xF53q*pWrd3|%^e8J$#mopYmr4is|3)No>;R;blw= zDBfqLNeDF4#>*}KQQou7$=#@@9ypF58M-Lh$kg@!d+?sexQ|R`=-Va_|ByiY%^s_IWvBfHuD%LkE{cB6_6dC~Loj-O9Jza;BENiudCyDoOZeC%YE5^7iZ1K$ z;(Q!aH>B%T>o%VFuT%0@*>P)@* zN9PG2YOiLb-Wv7X!$t$8of1|nqO>j~s$U;}w*1Q!S z3j#_T6DBO^Z~o4~i61G;J=MwDL55`Qcr0I{@Z`Z=+Z7wnzQ($9GH@`ZxGcV|u$k$H zamQ(2l(aJZds?P`R-$9)I;bb}3Wd@o5|Jrn?;r2w%Ku1{Pj@$>0 z{b{H92!SWm55B#U>V96fDJx|zO>7)@XpDcC0sq~%U$+`@=zU`cOVfTnc=DN;q|?@K zt92swh4k>Sq;sPXnG*dyU#@=Jlo8!P$C~pb#$?CTl>`0(Jx1A-2{Fl(kV+k|7>M`@ z1zUllmR2vNKUqt&KZUHceDv>+!6}Zilh<(cGZf}W!M+-0CafTE%q_dN;gA(kmcg=j zN&lYS)c5^4;fSt1C+xjiUYCc9o4%jX{J&1AH!a2K$Vy7y6Zcp#vwY;cPIbS)V%TbO zW|WQDZFsQ>8JhO}`{y`a&v;;{^eZQLA*xKH+K#5Jt!cQOySZLM2 zU-QgYju zjglRXnu%Ynk>g1DZeeyXM$zUf7dl=adw=?j6a*Mwh}r#k%Z?X(mY>vqdA69S++7ki z4`-~**2ge_l0GM|yEmTwbomSM=F8kKjdiu5UKKbatJllXb~q`DqF&A~Z5pr0z!pXy zB&@Cd7{WkJ`WFNF&pk=uBR2o1cBf3`-_dq)rdMk}^qUg5!}o%lCE>rstv`7erTeM=-=BhWc^h&LSi5)e&k6E6S)gF&^{UH~Q&;<($^OoaVa=@rlGphH0AbhuE zN#e#E%eQ1W=wp^>s;U7rju&k)H=^H;q?wbT;DwdzlUr1hcf1e;7z(NruXxCop|UQF zF32}6>|G2jfb;d={lhedM4XS`*?Dg*8Ox;b$KMya__#pZ_ax=_UbUsekM|wcmC8!* z{2H4=?zJlO`RS+UVrU4+QbmN5Kb&~hI5V)=6$MWo_L};CZ4Yk*8xE1K{QjED@`y(K z@&tjb7iskpRaJEtq$v6KAn(O1({s0effezuS(0Gag41=9Sa)RHo|@O;FaRn2_`cxD z6G)Sxswq@fP-ub_pKkIGTjC#V@0LEpz{IRPG~fF9LyaMMW8|Rh<@OWuFt5T0Q}2Q1 zqV4)95Ov$NJ`}h8pH*f}38mS;arAOkg018MpmPt|O?qe3gPBZhSz1Nz3%mgl04gQ% zN6-b9Khj%!Xb?MQ{}#8h1^=Yoki07deWCP~&+-%7(er)&#Jahj_j&CCngEhMaoef# z5qE2$co{#GjDY{@WZ~lE6J}>s-tLIZN;<=Fi-}?vF>L|{$}uyPE#EPBFC6*a#VX`^c&92z3Y5(AObK6ues?U!Y?8_umSPJLVbT2M1{ zZ>msg?RHIYPho?%cN#vqznHW%rd)QEpC4M1932F2xcNhwCIEOt&=RP9XHx`O!_ifl87EOZ#_%EbA3 z13AG{Be`VfN0%bc68Mnre{$KYf5_i@Vo+;Lga(V>>_S5Xwx|31zHffW$fl`jIaSra z0TedUzc{diF;dmq&uwMHX)Ju2Y!&M02f8Y8_`mQL)wkox^Ebb;A-p4a{ublojW_ee zRC@z9q*!#hr|s%aQ;u*d#}WZ<3FQS7rcW`Rd)4YBs)$eK^pbqTmfc9T zEP@@|GIlQTQ)wxiQWv#OCHidwBuB~nU*qFa=H}0M1;2L3@t3^8sa;!hp1z_ z5sMMxC?5~IakomA%uI~8-hD80u)wHD2u#N0anFY_o5stW{2%QGB@c1#xbBXGmB6LL z;amN7?V4m@G`i(PE1yzVGHm0Xa~~gD1zVx1_frIN&Q?K3nKHz@GMv@0y%>cL$Wi<) zcjVul6(RET7E<{5-u_`|rsVfB>LHDG`5B*ciqYV!2J2F{*ozh_{CuCnX6iGA9US`% z0TPH3fOKr&((HNQ@#Bttexahv(^bblFdsc6CyqD?q;WLaEMbPNvTnBplWZ?}!Nqv) z96lFQ%_5tDpATQY-^7*)=o?^!goKuA>;c>J`GeElJ0GAv%M=~jby#ti!J%W@bq8|m z*_+J?{hhlr%BpF_#o=&M_At+XIVQXCHz3$Xm+V-hy9UX>4DvqcFfR*VshDF&N6l;5 z$xb9bCI5054>Ra3H%axs(r%m^kl9~!k$q_C`Y6dqY&u4lY72S0wo5T@?Sk{zRz8Zb zVEJe<`A=*ucMxi~w=4<#WY!f|P4nOJxb|n%stSku?b}mS^{IM@!FBU~BXpMSxtxs9 z`N@NRxVHP1Z*`U{Caf1AzhJqY)W)b^XJ$SOb0qz1wc_bJugAA<-_|9$5iij2nb`2w z#q2o*k1nrBJ*nAJbNf)^3K|%o`H~>rxi>{1@zbYU@E$-qB0nnfy=px#-^KIH!O4a( z{m;&PdE<2m3Z(_T?{@vMPL^D<6jR&+MB^sevDl-zBuz_| z(4;LZ;eMG1)4%zxY4fnT^xK`(`Y`w{T7^YlHR`dewV2$Gs1y1EktS&`qn{*BC?q#= z+!Iy)?sz-@Z%{ftQI>a}d%5ooS0++da#9Z;Nu|^^_BA{8Vog=>VF{+*_a6$B4xT@- zYDf)$oh`k-z-+@*QWu^n#@6`$-C}Qd0l*?otP)7%CbU&{!r`pS& zl;>BNFs;DP4_7+>dav@$>?S_8TRN>fEtz=&@{;=Orf8Q)$?Lb&=&h`{w_UWHo{3gq zLwZlUd{Xbl>A{%eGC8VB3mv;K<{BnEk{NnU#aCA&Fkp;aIe3WS%OV>E6$vO56JzC`&*6Nfr`aiP&rw^nKbad3 zc^JCv&?tCcH7LFuG$%aqGsg|eidWPHXy<7#A#+w)#_b^vjbgo<=w!Ax;&dIcZ3AfN&stmhZm zts=4)oF`8HS`Fxxjqw0MA78vN&8YP^*gV1Ae!CJzeN-+7s?a2T*o$!?Q!{v$Txb>w z=W$(RY?e_vx$n6odG9{hpwg_gOuNUpQ>mw08=I?~ZT;8qnj74Af4#AyI^IS|i*{*9 ztwJl5GE(^1O?5v|fv%|jhy*%lc5&4g3C)qW-~}_v9DrC{*@KBudgq>7BwIEe$_2~U5_iuBehoG?F~Rjyh|%Vv~=EAu~g$H z&lZZ!v|hKwavVyHcUjkE@5M><^W{L1Ua1~OlnK3Th;Am-+f9+`B?uLf3D!|mmj_|X zt8U#(()_RvbnVaHvsah~p8H zmIOWiJaFINbL|71-yRzz{NfCsjpoHBbKh;Age;z)6&%Wo3}TY^xBhrTc1QKttUodf zv1?QX9NrgzQV!G@CQm?;SD z_)D8XT1Lige^pWCC%A#%%t?Ta`mq+e+n*<>a%Wx217tROl@ozt8D{IYsoWncY(pie zOO<7{vXq{op`$}w9)S9Wma9w0Yn*NHW$ylGG}p;B3{%8V({4edsB+iwC``+vKc1Tl zbiCq_rA|2&Zln|?-Y$yTdCY`PD!cCBJ5SV3C=}%xmORf-7sNIx^pr?4vU~AvHhxPW zBk*h!9>Wfvo`P*29%f<*2h2RF-Q7}f5M?=na#GrcaS4(M=|Is4`<)vV-))iHqMtkb zaUthko^*4zUt#`M)X20h_70!Eom z-37t5kwd|KGrK2PKf%bsM}fmP@3~B3H6i=a2^vQDAp3u{O z$;R)S_-)cVXS*vEf!Pjf71;AmRfyOxNEX>x;0h*em46Y+%@@1bK3Ynn59cg(s3@AD zRC{%=q`-X~s|rAgwrvr|lR0VHdRYPQh}G;TLaA_iNCA&h$umFw@cu=KH%czay5t-` zHB{aQ)lVJ=-vJ|9DDO7BS=6UGF9EKh0;vK@RRX|<9N!wX$(CTE%6h&m$EFPI7C?4s z!D~%QM{%tU*KoX%laZS^CDFNNk_?=-fbd1K^FHF3)ypJDV>Y0{ z!N?yuR-z~lt?43$c!_G8fUD0fl}@?eOMms{g|ZaXD^dkwRVM|Gm}i#ohdFM%gXK{s zRq(M&NX;1%`g8mDP5XzG!=E{BJ$^jlapTPpM-mQtULGjw z+khKy1F}()Egt?WoU8Jc2SG)s?eOrt|B|bSajj|cjeA95p>@>xKu?b$K-;Lc)VhFB zQO!(G{{+FFi9of^(dVQUWQMG-zo^WSN3{yv8xJQ+P(wNB5Zr3`_Wlb(@CbaPC-Reg z9`!U%78mn4BYPe!)eDDi;zn2{qjYcB6eBGgtgZMnZT46E^dluqVQi--T8zK_CATPQ z^FHO3&&7p1_%C1r|94!OX2w;_r>L?4yJx4t`m zN__TQ_+`Gbc(1pw5iKwK_*z}Ag^W?8Vu%h=V;=A>Y)VV6@eWt|589*AcvD$ljWG|Z zbQ;M*k*+Iq3XtFzG1Q4nNRXA^-t2^ryEN_e&Yw}H;NI>@Mx!bC6ndv?$(73^`-n#w zfBkJp*?7eG4On+L=podxp7oXvdI$Lj#JJ_jHJm+%Q%xz#9Yg94Oc-h(u~N+- zobZ7-kk}8t8NL_eiSt#bIk|F180;u09@3SDlNy(SyBf~xT>7T{{MmqWMji%JqFBmM zOAoWa06ZIAe{z*iAw0P)^60e|7bfZ>dO;qlD@1A+t1~7Qr+M|;kXNPple-0g2qx8r z!i}Dp5!-t6;REUW+-ekkaBS}?^sVU9-^sQS6TO@rEU&pa(rd)tPKK&-63buwe$P3id1_v8KR#@?vrA#7M2>SqkRQ1di&Ol=&d43j~ zbDWfp#~ky;*+}DZMwp=Rh$F4c*Cx;a-45lQGt$u>m*vl8cXp!**7XWZ<^T5pcrhHH zXQ5mH_+#s7cSZmgp%DHQtwoWkdOuq$R+fe30X1%*UirIc z&zahz-b#G%`a~#XMn`n&-ozgJJ2##s1x}v8_*j1Xx`y2S&*T7WwtFgj!@0nx`YB+* zIb<`w|HSH>%gChb&Zlr>$!8Q16>U=!FhzBbpHa{~te*u5!)yw51mO5jx2IACKbhlj zr!qWy24ErLO$V#_Z)(BQMZD-Aua)*L-k$&JoZ}SvGpw@nC!fdngimlQ7tUW1;U}lV z4GfpcWRb;7?DHE*3>#R9`Z({@zU7pGhFokgBFz^ymI(~YCO;QIoeW&HmUa5)OQM`O zieLJe?o7fk8%mp|jF{C6N)>XM!{zvQ@t!ItM4fprg`gz=esAj}Mpco<9`)b)V`{b*5+T)&;MIQVxK;_=zS8vt?gsR7 zqzU+F=7iv|48l>b>r3ACRl`%G%O~R|I{D)U%eq6X<5O5A`FuibuIWYy2$CP`U}5?rv9h-C&y#x_ zx6yRm)@VX`=I?^qf&yv=pvwHaO}8&*t}iKIYUWV;vtX~G@o&6G%j57bc)xdNeeUDl z{SS^(@<)NaolACPE{l?%7l>m$ssd1gVIXa{Yj*^tq@`U!99a#L7nrsTnv)y9)eDK) z@Qbq$eXpx?*KDNL?Or(;93F0enJ@A+;da=N_tbhj%Qr`DzgY#$z=7!fiyxs^JYF8A z0!|yY_eQ3hz3xaPj3a++k+iIk^k0-|Xn(Eg%KOWD_Vn`mA(`QAUX1;N5_O{lF=zp! zk&DdvqubS5g(2J$sRaym<$w?WG#^qge@_sh9`H5Nzd7!h=7ceuxZ`yam;@Dh^{HEj zpY#30b%?nb4uOJ#5GTH3k=&8||c>G%N$&8_C^T76e=TqI4-0YO}f&y&7 zX9?hdjo0WDy=N?SM+nlXwEu+ok8hduCv`!ra5G2(0r|jx^vDhbNOr$oqo=t_yByUY z$~;%9IPYqS08>ON_A`16GM0MWO5&B}L>us(?k!MUf2~wIGAPfnWP014musXXiK3I? zSqd!N00wag9GxN}w{KY2#t5hS^n3G^M9U!%tS~?TUJt2#kS75?RviA_S1PJ)?-gM& zP&)Gq-|@q>%LpmlfCTd|{a<7B_Pu&4{$Ts6>Jusoi1JBAG2+O^8}){^ zBeMK8)WjussO}w_Ds5*C^d%~>WA+`&kcaY6oU9pjBV6MyD41%y%NyZ2E{Z$fZcL>_ zLJZkbXsu_ntI!#xyx=Ld_+t;O(@a56Pb36C+^q2Uxs=aVz(a-Lxh58u5jj@s{vlpBH-fGM4b*KiW#fJK4MgnP)4{ zKR*!uas#lK$K4fmuSvMA$-T!k2W6P{M{nW{sjQOA6jyL}|IX|S?@^kq*i^wT z=Z5fWy`ifZtKyAO;iD9V-k3ODh>@7x?_s9Pbu-^y`<`|YtWja?N%)#mlGZ}czN#8n z#6ibomFJ@13{G|5zlX}xDQdjpL+KoNZO`!Ex%uVbsPmlrzb$b;wL@th(Wdxv9qA2J@rf5+<_}vW!RpUP%Gd)XosK;wKAVk8XXNu3MZEIBwEtc7|JNlWX zW#jw-XdXq@=8hM;k6u6dnC_x}-p}{j4d;%;25;7%KeJA?aDpyUzw!Yl`sr#$7>dRJ zHR)S-xXo9}i|1eP*7zWZD?%xg5_6P5sH9bi z%!5iA@dEDGA|l9~fmS7a-^fVZ_kM2bRX-9d)&A*Kz8@_h3AzP)KR@Rr_4!QvD+`-ase1w-j`8I+vA*jdtwK9R7pCo{GmZMIMtVmfGXD79Mf+8yy z;o@H_v&He8{FjTVDD4hvw;wYM6R_n;PHNBaYBo`+tEau3(tdfFv zZB>Ycij%85KyVtw&kcl`w**zZ-k;=>x{$*cZC?1vR``1${cWnTt!+5$SZSvAKYwzt z^YCu9Hlto8JKagJg&TS-e=o@8rWCt6KIuv=F z{7-%9`j(xM;}2<1dwO~xaN&C?LhUHbau&Sgu|cJ{&te!+#U*_35L-K-pmpciMk^w| zX9>D1a0yxF6CQ>_l%I*rMMXsc;*XTeJ{_!Hxf$M#B_FhkHtDg$%zdsE*3qGd;koa{ z9UkhtwzVc!rk+F3oKakCoBzd2oZEHZXwzbN7N z`pqCu$zOVAccZ+hHI5tVAc}>vV9bd?Ex4OITlHJk z)9*v(R1rEUXGlDhEei!8kh%VG25J=|?GV*kaH1#PX)ot{`uMcMA79>3HG=|!2Y9*? zbw=3Y%N1(UWg)&y&V>)n#aLmXBrakn1|2V9FmyMef|_J3-(Fyc>a zbH5Fz(5qP;a4w!J6aPzk%@WySQlf|bM^6^LWMb=OYtZ19D74=@X%CJZHv+zM)=C%2$rDp%)&s3O=$UJVq^pZ-NllsF<%bi&+JOOvP=LPOy`*f$?U z&CLu%KU0PzAb5;C_0Iuk06TqVrY``9lh)jMd2^1Q2ydx=mO!h!YVlctf8PW728upK zd|$}$#O3?3O4Q1sPamO=P^S1G|5X@f005lHfs8p3IK82A!cjNf=SVqL0wWEIuB14e zbyDxL*Bn%dG2)ZvNuf+Ue{1?Ed+HOiW^Jd1mNr7&PhLn2&~*DT+n0=AUxCzt2_v+E z3%FtDJd3_zSiCwtmPt$oRovw;M+S78!1V(sZDV0!6@%Ff0n~6hZynJf$DRwB?2v7> z7IoS6nf8Xp?ZiIcbb7e${5nEF^e=-LhScV2!5C+9Cy_ocX7|;780GN--x!=YzsK?N z#EyDgDBpjww@~sf5uy3?qO9YS^~K7HJArj#7ZZ)fbB1oGfChS~+O457x1PYiKab8s z`dCa1!B1zW2t+iC)|{Km{L`pDk4z7vQjLH^MRlcsffdr`!BDx>SgXyoHOgN@B2wG| zMnB#-Vy-0x>Em3>;kUJ>Cse)Qz2JHrM#=Pfi+7}tdn0-zj zck*tXhpEE-Z38ACwIn$t%N&rKM+8)RSeGS?2R03^L!^nt?x$=(S3bevU3`G@=j`wA z7r!JU6U_HxrO|o!Ap@)Z_aatQ&@Ju{Ul>g0S{flZlFwEHq{~CXASC+lF9_MZ_zs^SP&MK69|`swJ=jN*B$I>k7I4rOXU&q0u_up3Hf}ziQHi}awOY|gJXmJR+UqzumlwL>SXhg zQ#;uV!(}rg2?oB^^1$FgKIAaXEuzuU^PY^$vp}9dC zd8p8~I;4dV9y!AP!oISroWtnAUOwJ7Kseb6e!#aNwgs(+re+T++#;;MHe8|j18LIM zs!91fg!^)+P)t{endp6*r6}7N1_0OX8$CEKllzivTkfGOt^9}org_M4Aj2E*^Z#xg zlBU{JzHh}tKtHywWRI4>W39hfAGyDOl+KMB*MPKyF`LEe%%S0>4S5uuJZ-YFM5evj z^Ou&(?uv>JVGyWu+{n2nZbqTBM)bSWvrXtePOzkG%In;YZ&g+5Zv6if8AQM=1~;75 z05JAl7k-G$L!0{3`R?-T`f?ctK6@|?Ui&9GWR(~{`G6YP*6Ok?4?Qz;+{fP|EGE4~ z@X@lcci-i|w*EZ-1P9aI{)d#TF)$3xvQr}ahYA8 zllnYB3aB~E@A1GXZ)9F)L#gn40psA1eHt%=Qfv4lwVcL`$?R73`Oi!khTb1k1LFnn z&T=4K%4{F^OzWD10TCKNNsv8_dM5e>j!|^Yvt>Zr*$#wx} z5$|HSNEMv@SUj;+cQ~v$>9$c&rNvZOZ+?@a(odq*|8~A;%*76@;gw5}Fm>z3ZM6_w+Yn3mmFGWec3&fIjMCnL5y`F+*tV zq3f`4?ZHHfzN0n(86z$rFS&bk$O1@`gLZaxb-a!2l*K}YXIMz+Q8~P;@I?vH{C?M! z*ZKc;Cv?O!Vb^bO`1Vo%D@W1gS4ibUu>)>sct+T_RTZ69Z`1zGfa=I! z=qo4s{;drG_K%vUB-e@Z2$ak9pFa;W|3<`@7t#E_TtQ8Pw$HZBDWjs|QT9;a#CY?( zQ&huAY=N$Ba(1yrb<0;)!_I+$ne=n=7r?wy(t=sgJZx`YeBtI$LdeIf zG4+I6{{RwN@zj6XAW{G-_iYsiZtIQ{8$MafoNX~6O-lSG7=zy%5W0T)zsbKSYO8k! zGdFa?n$;zl?GYCCPWZ;f?j*$ls4jLPX$>(Mn9ah&Lw_^;Md!laY#Hgt_7f=~SL>HA z1Re?x&av6DOcG6*D8i+LQuafQH0CcS9OhLDf*84!m6n|f0EeRqt4=q1q!B!1C~mVs z0v9hzkGe~N-)AaIan+tBBQ3x`ow10r?Ed z2#9zE)$nP~ElJF+=nQ+VDR!v#Q zKY1{b2@e9?C$0&Snx}je4kX`8uO|fSoxW;xgUuUl+W(LJ&T_L}U%i%|@3wAypuKua-+a4>qr^g+5|4JLEyfyuj@L`^Eh6|YqS{6ukxOCEq|-+0&1Q= z7h9rPmp-g?AeV#W(+0q#mghS8)# zS5k(L!^lpj;rra>fURw#NOSrEz0l#OaqdzwqB1Xztkv$v*<;z~@Qh&#nBqz4^W=G+ z=c-B12hNUHl_!&ZtM}J?h(hyq{#vsrrRSkxJWP(3Sl)JxO7q0tGZk1M_jO;JSCvZ} zTGv0^nuTW?6I13|lN>OJSR)Dgem4Hc1qd+amX=cyDS3NUJ~;R+vuh-e>Znc%T~7e< zqY*tn>~@+CuAPaRQMmkgiWhf666F5Kz(Xqu)li^1u*-R8>-dzAPDxw8d~d`QW@+HY z8{XUdOtuef14X7_9F&rs?T<)Fa~H{}fp6+TdGZOt#6d%23$(>gk&(^Y-J;#lK!N)< zZ*>p3|K%XFDAAKMMX2Nfm;&6`1Ju_@P1toZfvfht(8u_hkxdQNaQsCLOG|@7jhuT_ z4bPRK%7aoK4qfHH4q>viB(ma`9W}IsT>)e%*7X1C+Lnt=q#3MDRg{tL4(YXhwfsFDV>rW-i(<9~nctH&y^XrCX_qVYTohsz>(HD{`71#jWzExIx8VJr8 z8$jQJK8~2n5F0Ugh7l1xLuYrLftJ24x>s1c(@u}*R?A)7ZGf#H;9>|^Cw$N$GGtr) zU8l60wo@+{zKz75+=s?_(-D~n@Qzts3CrmGlQQsNU{_*uL{<|gR=)zNB6MT_-GMyu zUMbzd14cU70|HY9b}oRRD)K;nr$~sVq5^v$Y)DX`!{{T`JS{i(V*ywQEw=ZP9y!1N z7^1DBb1oow{rdG$XZpJqnrVsRF8;Q8wFy8D?c&>ZaUG+enlzmU2p&$TXKHG`gUe|! zzj2Q=smjfO^y&QTMsvO_08jnN z&t`r((KWPqY%|V_`%_1S-B!RqS({!J9%5Crl-$*&F|{?bDLSo>EW6fQ`&~0Dw(i(s zIDt3KsYD!W10M+lB(&e)-9GGpSXT5J%YQ)Y%o@>_9t*FlLT$qYH zVg-63|7_2mc<1*XD?+j3D3o9>{5if3Fqjs7k*TSBQus%u@ywz&p&o5*m}WeqJhz*l zd13=W+G{hWe07AUDlB?b z+elXZU2ku%Ij`@H^_==HvFJ8 zzk9pgXrhGL&vYW7jc0L_zW6S$qW>wB;cE$g6ua|dC`MX7X0D;|`kLX~#}bZ`Hs05C zc3P~rSOXqtMF$^=2j+aMic6D;-0Dj_BYdTPm$D37+sv4J-CB)dga7HxS=-}Zzo*VM zn29u5ZvnDO1%~UU1Iz<&Bo-*83rd;9Wh_6G+s^lbdA6iWEUK6U_%z(^ccOLL`x?oA zznosiM5^HPIfAA(@Z7tXf3cOpC;P0x#U|e`aIoFXpd0;_E6b(DQE;Z+4I%I6kXvd% z$!3%sN+a4`*U39B#!mbf@rvG^$-tK~jJ}^|JW~pVjWhK}9hOwKIGU7sE5Way55H>K zwCh1l!|66ivh&8_5<>P3;y0j;$^Md!sV7|}bUM1v029;Xy{K2hu;CX=l|yoQ|EleM8V} z5feFo>jM?_8&H_vwU1kU@ZiBEc_VOK`2G$ilM%rF+Gu0?hWzDfQ3>@S&>Fc}Yu8i> zAL~F`^xygUZEFW!WK<5G4h*+6tuCqeKkko`*qd;%L}ns<&GMVF3aADk1{nYM zb(~{wD-eoYMJ82+`r^aD{1-3ESaWTeqEe!1*;6{CKlDy zU;bH=*ElXin+jBpV(&uc7l~96XX}=>+-T{M8qtb6X9QwRqswh zqpv;8t%4h=m$yqJ0B3`>diu~rb;mT-_I&iXvcdeWB_9=6C!|2=w>xEG)xxddSi>t z?PEVC)T8DS-HaUnko-r}@!+hav72)$3?a7Wt)Dtx2;nGjnsvqX}-jTI&0u zLyy6tvue7FuJ}&3?5CPLPGa+8SYK)H4|rqIzUz;& z@xu0FrwoTd8)2^MGSPV1!8$PRp`Zh%9kj4{%dP?jz#!y_y$BvQoZ1;Q#d)>xi@`R7fsr{C zxGA0z3>V+NVO|R5(ZB1i;d!VmEqEv1B@MVCrEx9oD@`Gz_u=77ycpf-(z%v0qs`&M zzq7N7T3Ugfd$k6i{`s*@J5U$>_YQ;L%>v*RbffrwsNOoRYu13FR*nN-0`D4Xs(R_g z0XFo%D)HhYz~6ioCC3M@{Cm3n`(B*PwQrPXRruU=-Y0UN;Uah+jmfc zg3`ofk%u@9`L3nt|95xsbd>?ngE(!)m%>CD_3ur@X=5LDlaiG|f#)N4<%^yhmlxV0 zJ}QDZNH8$GzxUs7^Hof$tc)$N+jZSIb3ueVaEA)k-ySP!X((`q{7lYr)KX12UG9TD znabyOV@$dMjISAdke~l3-n%RF--W~ztOBon_dg-4w0(mxW zzoZSLiuc-Da@IBRaFm|!%gX>kkt|Ph_;an!&a#O;ulbP`ureG{r6@oyt3=HIwimdk z54o_fJSIt)ZqdJvUEg3*mVXlF4iSo7Z*Av3$r@QZZgKR~Y`6w=$_vC#jMNjs&o^BA z7p%Rw#1fZmXKKlLuug?M z@3)2v@8y(*a94N7Z5=-xY8oQG95HKCn-{QL*Bi~%O>QE=)jjXDrg4ob=n?*ZrzEWL z{Pb+bx#QiuIC~}?cS=a9R6t|^uWB}!8p4K8Cq%-erfkY_nx1;WWwFMS`nNShu4#Qj z^UQ<$MUOt5oVuCL3gH~z2-uoOSiuMI<;OMHz_bV6IB)=$V2j${| zT>MQW2V~=+S%j12bFX1@1}59sep%%u_@}00Pow@`!3`RGQfSaO?gXnMkH=LH)Qcep za(_JeR-A+=0D6J>993*5RIP=}F8uub#B*zBl;F~c0`w2&6(jHiyXsbjyq@^2e|gc9 zbUYubKJFg7+wkO2%Ps%=S*Ga+CntmZ*BaJ_iZXoC$!PjWRRjFnbsB%&7Z}w5mmn%$ zUI$MJCge*`(OmN7V}?xOUPzgv4SS&Cv-F+RJ80Y@12FyR>FFC3Nf)0FUK*lJj1I}Z zbn&gzER4-lV?|{?dDnL_r08aVNv7!Rj(jIcb_}rw9f)j$vc^}pAmq84fB)Rj%<&5z zIhtR=Sw_*^CiwQ1Zk`ed#RK^PT^g@?9WW%3q78e9HBZR?29!JE>gpuGc)2V52w6GU zT*zDA1#1|HZ`+c|wyF?57Ul`}y+OKQh;RhRgH9=suY$bWbj!W8Fu1e6DUkxbSMa98 zAOctW*(qU%Y}{(B>W!Ter9al%W$O7alre4NQ|nI6CX4-zzXWd*(DwBA-|xM6)RDL1 z_yBP8>k{3P7xzw(cMjq#yz+>g2w<(4bZZb_0hi?x%*TNHZq@F7j^D34gIjxi9huMp zR|bp)L5l^(821<7z;ob#<1OmNhl95*#ICp*DRasejH^NnS>W`%2-~`Pup{psT!=7z~_4 zTKou&v)ERp3<8X+>RYpH1+V*EKHe6zPxWE@_p;nYQiG0<7uVO}=5Z490)H7bjJB0| z0bNbm>P6Czw5JI<&*D=4%U|RmH#eBNJ*kU|xZ#>5D7q*H6)V zcFwTGb|mCVcgRrw4&A4XwC5@&)_85|1kUAusebtEt2S+~ffJsUE^DU5lb+K%$a zMs0W`pQLiU>o0>+YbTpN3|&qRnnjVguZ!FraGw~qo$HwxkzfoD{rBMY^`MFEgs~C0 zO2Cj51?W;1WiwWMRs!*v*~O{ktY9b%h;(7vq_$pSR|bRY?e3`DrC#;^G_EwWPm33R zmCs(PArF<$O?UvQy4kUxI`C%Oj(nv_c>qRw=W~c9+xOxRx#?VXBismo1_6?R1k1PC zK%hu?lX>YE|G(G2o;s`*kliN$SH#PQwZxzjpeKEPz-g)*rCmhtxPpns8txkDKb{T# zQOKBZc~{zY=?Zv5gV~+Ly!OZE4#xUBS8ONH6MvRo^6)CKfT|jybfH`vR6b}IA8*R) zOKt7z4p2$TNqnDj8RXJy!UmZcXDCUawmWWZ^(qhOml)-ROsGtsf14JZEJykP>*mCF z^;5)ClE^}XT|NZNejv|Cjypuxv{u4{P3F#KD-or-N+!z__G;=UDhXa7z5_D~gZaIT zR1;Fj6*tsVhzNAMN`H9p=kU6tlaGWOw}e3Tdj_TSmTu{bt0#2v@n&t34Ep%Yh&cVO zO;(->AoSgm!AUWpG@Y_6IH4;6Yr>#op&@K%UyT|@xF}V?V*)h}N@V-}UfhSsJBj<= zm7pg~uC9(xc12x^`Ji zQ5!}F$Ozoc^om}y!ks_+o4|%adKDxIC%B!;0G;OeMaAHA;Uo|${x1rjbU2J zmAl%-UMWy-J;k0P5tv+Dyz?&Z{7D&XU=#e;rkdrobUb)9?kn42!3gowmI1Oo@aZ$8 zADWCLVOU#1&5THN-@>>G#==$2`^f75=59+?dp>T7gbsx~@r;WjN3P-S;H%)l_(qSEH9r^H_gDh)V2j||LOdR!KplOsZe2|8nCB4D11(7^g6n& zilZC|`jk7z$cg58K!dFKK!_^hjBd~!7wpIv9Q*PvLFxvk4|E4Zt30yxUota|Q7_I8 z2P z4atkgf(Gg}95P6Dd_p5`WOVB=Eu1fozp^G$Hg)n`6iut7uWww=$%zDd(z{%07gyW5 zg#+8;jes1SQhgB5D+cDMJfp{0#w*X-j3@y36y05Acqunbu$jfOy z!kw#nchefqf*L@`>l z!;^#Hys7c)P67#LnoS&!^j6&W+p5YcR1s~xl+vM3)?FNY+bzcA@j7dPUg_6|G`4t)=go8{^{vMWNVezUXH*)t{hH;|M}Efy~K(H_b;* z8!dbJ=_ieMgBm`ahGbJWFfW!@2%+Djg|#(WB8B|=Z#{q7d&znZX<~1!5P2ycVx)&( z&Dwj>0_u?8nTmYzT~m|?RJ0VqeIo;1g?4^7ute=gMiLwK6m-jYIi0rthTQI;LS!-b z#|8Qu`N;)KJ*D~&`M#oOJtBv>iHnV&(U$_I1`Um)YmGifrGNRpcEmny+UfE7JA#eB zNo?VOGZbg`8f#-9LInM8mhf8pYW_3P?04#V{+X;cVbTpP`n^M|IA&{_6z-K?KYu>J zxG1!(TS6%QEvbC(B9Yi7CE@R%#PDkL75j*2nA}0jWGk^2kB_gbB8MgAQ9s4U?jhU| zo!$zz%uf0b<7yUKBGit)JPy<9NO<})Q!zyXz+py0%+0kXL)`&tdC_!#7P5g2n22vp zxU54gG03?=Y=#U@S*v%RF;7TSIO|>Y*0K4Ck+R9C2+lK2TeIz($EVP)BQ{US4qP>> z=csGIB>Wx~<))VfQRmltlL@nj;4J}@p=8i|^>G6q3ejurD2daKHDmNiC~0a6)jhvh zHM+e2d{MYvJ|I0Zwy;R=rkpx7XK?n>se3D45Z>3s&%neY!l+taR$RRC;-RQz>1r)a z@6U9`jl^cBC=t6h#d0R248&_%SMM{Hd`!p8{&{%f>5385GVFi~!Wsax1)!EAef>gD z3gjx2j6Sr7V!wo63JI_VXeo-{mKM&RWLW#4Ek^@yal~KorJXQt)xgJgo!MTcroK|U z>qy8e#JU+B?JR<%<2pn{O|H)a#qi!VapTD9ICIRL4v_0~asTWDLCj%v!{&nW(MV~>ojj(*qR+9rZz4{2}1k_I^MiDERlaqPT`6)>X z18KQS;g2nfGlMC?k`aU;;5VWwFE}In0mI|bi@V+Ck}BGVm8%B?v{}lSecZE_A1}5W zl7AZ(@&~}c05>7AJMYp>^sjq;#Hqkw)GmA1sjFLpy~_jahvrrL;GKN017&1?TV9wB z36%QKI%WAx=Q7*}enq~%x=phv&_<}kFruWf2>KAV>QknLnB>)w|sEV?YeN3dYY z7N^MH0EMBLhY-EGG|MOSQ14)~S3_-7s6{kkQkp)ZNmo&wJuMEwI}vMV@bZl@)#8DD z4{;O$o{#HdyNsi&f#CJq58ANCG>f$<5RxFGnD7E{Q@LP}YRvqR9uHDLMg8eD>|2Qb2hFcW7zB3JA1 zVvF;Z8FNO$@)YIko-NjyA4%`~CnqO+@aa;C#CCPb#|RubYM=hJ{54Mc`@4hrhk!uC zrl2grk_J}y5FlV7pKorrYNxWDyYv9B!Tm0||FK)-P2CF!6K(Wt1Q4{y;V417P|HEi1+ z$Cgl{nZ%{m%oY!-mmZ>&=quKGpjg{2DG+Z6otb_??@~ZA8SVHPAKB>TIGZ*GB(67C zvpm%Db}e3Hqc)htAvQ5wU3?yP@i*dluy#|nHYK0E!EV?)Ai<%Po!2e6F+$E-|9Z4Sw%Fp+|u%-9jQnFT;6K}Q0w5=c!eJjK|ct*$SMQj2{ zrkUyb%zHZwiR>gD8Uw5D7`|6&*Hu(NhD@9kLaqh|Ke;Oh2hVhO`wum3wj42S%}@^X z)Xyf{M~8ZDP1!aFO~Y)oOCIR#dufhgU!Y8*g(RAb|F zlk$@~yK`b)Ocn!HD%>m|(S<&NT(sb!XZn<2Mu{)IcGlVb8a+nGYH3HB@P|&((};EI z$vo@v^D(dbsXwq|2>oF_B*>fK!w%n5La%QLLJ6*>{<8{W-GKQwg105qJCNB5+Kb5TL?ij>_q-1I zN&U6UOx>Qc-TtyK4`qJR%8oy44MAE%IdyA?~ ziLS%3d8aayPkPx*EuEbP5Rys%;sgJTwDH2VXNn7kT?hCHug|&iq6wQ{$_rG(`_*E-D;8<^Mf`q{PHuzE*qKiI6d@ z{*W!bs>HayGbFV*4s!wM+HhN(g7twH3KC#$QfU0KzvjL@cftIU%_yHi0GUpTiam;D z&rZeK^*JHjaP!X*Dj5Ayt_P&aCA@x;oE->U8rxK#ZLkc#;mYCm%|?kbmELNvL-DUh z-`EMTptjool97h}#|2=6f|(ddhuO*6C7Dnlm0FCqA(ytGnWD0L8~plp6mPDmhCjA_ ztvD@Gv(;&dkBtsB9pY&PNHJIe)`7CH9(bx65pj;3SEgu?bNG4<^Y+7}sqch7+yJJC z?r?4Kndds{p&^F3G3gL!;M=!|&^0=uIIeUm6JN_XGu2$Q38 z+>53|h}1a1^g;|spu^OSp@jw*@fjU1GD5P20rF$3-oY0=+YAP=oaSEQ^P&+7Y}j^6yfkM4Mxc(q)O^GQXJLY zVO+=cEA^fwZamn1!O8S+mXi+&@?8eDA&{EjEuOTc3SK_7exg5Y`fMVb)Nuu)&6YrU zc5m8V4fN_M$;rC<=%ODDcW%VcZIo*gnMLMXa2=Jt<=M{3U} zC~cdOCjc z^nN0neqIZtePhb|{sI2FZ25pAJ!FlI7xE1!C0LrJd7 z_3aVYhk);qS%h$HMB5U%%Sr)I1qkK(79f`u9{VczU1N?jfe3$K*j6Du>28br>7YB{ zIgP^mWA%t<74YqWrcqZX-V{uUd?2WVe>^Q`xv1cg_o^(5o6!D1LdS=sXdFUfatmVe zJ_w((VAjd=!zE^-b`c2{WIyKM3`%hD6DLmwo4CPUty#`o)f`u2JaKZO&{i5~FlfRU zIQ_$Nryo7v8dl%Y>Rdp*V&ZysTdjwIjV%L$*gPfO4gh5OT!;`kW5{tF1t-0wUoqI}`8Qi6G0&wWKaE9so{>JO9tXyTQmin2(5e@qPVGc<6o zD#oEP*>eXck&q2&cBIlCw6)Jv(gx%5LJPR}NAlGq(2xV>es2ZWie9L{Vcw@!`&Jly zY6dxQV$pp1#pwyD>F9ib+4(Ecx@V|*UjBOhlb-1Sb{9Hi*F{0+!MYL51r%Nw`UugpC5jzpSsgr zGv8IqOXkdPD9e$TEv~GRWS z$dRefDFtF2#PS7>G=xiu$O-iAY@g@90dh*19pUzm_EA3?PDk4nP3tBaM5Y3vWo=8~ zAMiC^iihHd#kqcU=0#YOw4>;vr%umE%@#bo--bmOPyi4I zC}`;CrXy6qJ)JBxUZ?sLyz0K6-eR|^4Yl%J;m-<4@Q>WOV1JRia#yU@L&o3DKw5eX zD-E$Ag48GCrZw&X^Dww2a z@mf+~jMtgQx?nW*zB!!v>=+;CFyVyAPpb~516=nw<8j6HX5%V^ityuiKzm*X0_@SDwA>s=B3VCLFrgkDqbX~J#+e9F2 zr0FHK&p|e2kOsgo!{-sB3=rG1vqKXT6=*`JLWwaG>Nc_88~cN^7;{9@j~x9fFY&Su z0IO#XUf?{s?m=q`h2rEiz*2&G4_G~J9ATwjTD8Y$Digyi<#Xhn*6yTWoe+Lk2K_=- zUY^Jj-4~d)v;$xU8GYQ>F=Q6$YHu@Q^vjHN^n##LODleb@qnF7+o=RdrW z2{Wayr|Qo}l2neC>Ve#N8p1tgMf`10u($p&5~ic2iTmkva!@8MxYleY@&b_7iJUax zby4=b)`vXfI(9sO9Uwu#@$pdCvyFPD1e4<)5xkTFrbim?gkecP^tH87zA`a zZRa|YGBbT41(1E&vv1?OSwpD$7!K0}IryF8z60F~K0}~x8DjwXMPd3RBwCruTah*_ z2}CVoG+pT;9$g!B=f4tqzp(HTMyM%!U_ADa-8p7pWlRQQ?_-j)@LKU}n>xU_dc>*v zY$;=TF^P$XIs*U2=!hcWV_Mg9G)TqXJ~YM<1g5*9$_iDtd9$I)lXSbI4;aput&{zP zjTU68SesPm6c?;N^*^8pL75u7v%Za|-Vai5L@pDptwU&pq^A&6H9zMTE z)0vw6m0SzD#Hn(|{1oGB-AiEqT0@_eTQlgCgJ~PZpYFSq zOs@QxDzqcNKv?Xdq}8B>cl^uIkaVHi?R+e;H(GS3H!k%>6>5s`R(iXv)x<(Zq!mKy zU-v{)>#q)W7>2NW6Y(TG*n$xH1w@a)K>+%Ay$t!;F?FTkA&S3Q4x=r`0x;nN_zUU> zuX3C!3$im~(#Iqfd&6elR(!HF_#^_~T=r32n9W05T~F4VLK@)K7iIqyU~%2_>`}fY zaP1zp{m$bJuh3LZfpS(drPr7XLj?$V?$qr*WD;3<%liNbMsN!K?#iF=^#P?ENy*_?k(UZ};PiHA;FoqH`yPHrC1M zm{stuCtf}BP#H^{{syR&mQhiL1CCaJP_k~GVL+!JqADEcWQNB7+P}n9wWzQl1kz@} zvJD&qW`@f3)C)?2d0r8MccZ2oNs5eS)$S2f)prxHQ1w7er`gCw>Pt!a<94Fc}f#EzY=kl2M$G>@0fplxc(ixwY`m?WjL)j#MT8EFejz+1P!zJ8i| z-!TnMK8YZwpYi7(A8_D5q8^cy?^;hqNla9#|KR5Z6KgP<#!`rq00EcXHVO#jhPiV1 z?VRt~b3+;g$pYyQu>UK{3+lct7``feBf+^WaIWSW3Pna>k&%k+NdqTm!5#49mKd}H z!=Zyc{xJ1H(m!d}$GLaC9RgDXlL=(fK?CX2|0rLFSbx9gH*K@YEY|jtvB_8iA`t}G zrX0NYhNc483vAZ+li_ZI<+h_x7XVU-cF?}^w$>nMgkfBX$ba){&zxC>orHvcqQdb4 zh(poqe#RYrPbT@qhSD{>w3oMvnuv;4EFBQqBPb`rTD6N-SaD9cSQK2uje_ttVNAwg(L3z05P}}ZDKnpnyb;0M~ zKSEoK;Aw=FKFWmwRg8zONXP8^FaTO;Y!B!h1<-Y?#w}dUY=66ZVVJFO8DA$&EuocA zi2$yK+n+TclZc2j6WztbPWjH1*=6_P@|7f-#r@~f^Dg9$n#TzXqw0(gRrbfq4LQaE z<~6x|ig9@QwkepT*|wc>_Wf0gJEVcYdk1Q+8BaSRD2H^Aj!rJGRP7sPWDp^SHXuY)UU-;3>7eKYqplSLU>M&IEkuYfeLc2phQT~~qhNMzeq zEPb{gS%xGg!Fuin4X{Lz-ooAPX{VAnj_MDhlTLKtOGl|uX7LyS&%qlw4l*wgBi)UD zB|7VQ(XweQy2C9$y(pELsc!e0ctnj2ml&K)0KjH*ox*YjU-0>@zNN!$tia;kbqmy* z#tcO+b}<8k*?g@?kJ+6?mESkj%BPRc5%Ps7C|XvCJARFot)tN3$tXP)ia|OaXv?{r zcZ{K6fq^g56xE)et}|=!a9f{&$oiM1VrJIu&Uw*uCyKWRIyGQnvX#c><_F+AKK9PW zwt>4gFva8E^h!ZU5>No;7&m$XM}mo9So{(95eErSk^o=aJeUbyXOsdS0JLEMPEPFC zG#k9C3^f|ugQoG|>JjpPBqb%U0t+{W7Vxb&_p?Jt2b=s`efz<{3h@u_sS>$r=EG@x zU@irV9ML0owJ>AvP48cqsmtr`enK_9c|cLN?I`5BImw!?Q%?%y z!lLJ29f@O7k=}*=LCagP$Lm#(2eU<@01gl~oSjad#}~}d=@zJM?%Hnx^b&_e2ttV# z-g=*a_<2Y>uBB!h2#deN@xyP~qYDU+!`Wn_<3f@Tv9L4uJaY{m7&o=jAcj#uV5FU> z)5X>@+I3mqI9+#7JcqZRoj9gUiU2mk`5QO9iR8}}v&ddZ0f8rF#UAml; z7NQr#Klf+ikcyc!u$N-&+|wazu+ho(wbO3eEk`KprP93ZwO3p_v*@jmUGVLB<)n3= z94`mp(iSy`hA?;pEFEbE5W-t3fFVf!3ScA^C)Pn^&l?=Ts{(m$5V!or^jLZpmRV>l z^&!g%$+$qQfVT|?H!|kSRv3Ls%Guh1py4|fMfMkNvVD|@>Lf|?S0y3>lWXHcCFzwm}T22 z*Wki%n$J8xg{~oR@|+6XtaKr|1P)D@VsAKCBf}e$zVsx%?SuKFm#XILMlZCeydF0) zzpRRapmiX%!ZJV{ii!6$Cq}2{zp}WkoY+>UakWfNn$MpEu_b>!GFIV=NQIemb$J1^&=e##W zRs2i@(-W?heTIggMAuM}iBWuOa*q9*#-R6J`x>wH7IAg&bAi-EB9Qc+!4#N*g;R^x zzSC#y+8vzu0cQ}BIu+&CtB#V1Nj!|*9>Fro)Btnusetpnn?SLEKka&X$ybLM=>v;YJhMmVr{?6*Km zcd>O8)#iIX=h+RNDYn^l$h)wcMWlTn*j_zx=;-=dTM?+;t1lz@Nlb>#KF15q_LkL% zNycU!7TcfYMcS0_VCO9P7^N48{YNkNM)91#W7B?NN>v)`zgH#NW&Jjr}j+)3K_gnKg`Q)7SkdxGJlXi z1jDZ=nQvA8);FE1PPSx(VE!x{&FLk2x~QN$5Og=D!v?Ziwjfs_2sqw0NKR9w=$O2l zok*CY`~^I^BXl`D-|0n)XbIv0C+lmem)ed@%Hi7Ia|M4~yeSyY_A_-5jLa z*!4fw_ic~<3akWSs`4Bj?rsG_yD)b}A@$j}fOh%#A4q~A&@aK&!sz?ooXG8kQ5OB? zaO8J(fmWs+wh3Uqfd7IO=w5FGH#>ppbCigifWgi1H+d#QcJjdw`CrR01OaMqr(th3 zX@6^mkul1;mssBFML{N`dZ#vf=yc=P8v;iz*BW|Jxb3|hg}Ylj&=U2|qItN-?}Q9E zrZ99wbma+?{#q}#Z@$x6eIxxhA-mpLIr)5k@-jM04Lw^;exQYWTwk;L?EQZ@5Hv`O zF9yZcaBn0({Z#YS>TwJ0GE^8^LpuBI-^WC{-vO=!yWS^;a?c`!J_cte<>B0aAZJX1 z-^ucqZxx*2F6F44Ro#99Lxi9pdyDc}A^&nD9(X@iY0(db5Y~H}Nr*VGr-3;CrD9FY8rpjV0S-rec^m}2aSLpQ#QBD2qDB1;^5-cl@q}p1*%i$kWJh192PMIkj3VqnG6fmBJDyjH63OOiPaNphIGox6O9nwv zfa*=*Mr9Lkk4&7*%?%*nz9Y&S+ugM$geCp~G=$F+MEsBu2Kb?cf?7t1Rgl#ueDwTK z0kk9jOnG<8iX%jYilVKk>sytWkU5(ZI9REJA5`^t{O|C&HB2#-ItGYlv>W=&rKECm z`6|yd82>60em`8D3GVy-`w`$ikTQPyvTU@%4$7Ta)4X!@oc^}Kn!Wo$T8^wS7Aw0h zla%tk1C$2fTQX$!uv(lDtykUS_@(9assv?G6Cu~(cdi0;6*vQb7PmDyOs1uzcpy$^ zPlaS0wD(OFt%LmAXGu$!ZRp#(yEACIe>P1JpKJ2|E|X9sBs5sCGop-TZ8b*!X0dWf zOodQ(&uz@-F+PbZ&ym{j0vV&1aZDu-O1KjtV-*i@2ylPh{Rc6(()WJid*urhKS4kF zVtoo$`p>E+UVk!OuLlL?rfcb3gZRhdf83;{OfSXsZ~9rJFxgKJ;B!W!LbRCnbc5fP zCf_^2JLEG0z%D$*y>^E)uXaz+#dR_{n}z@}W6aF=J+q3@e{nawztwOT_xY1cU+B9r z6e*#tK3R|y74Iufu}52{3z1IqHS(byd|1G(^cpMr#dF_m`o9&cLp#L0C(~@eJhlRH zn;tPO{20VEn47a`Z6<{;q+?7y@&>OXBm)#^(rDp**LEbL?&lG!DCTRh5YF?Pj1|WK z;2n#&rmCrWeM<|p8ExLz;TyAi^CmwD7l8MI@Rzizvq}-`q%TOm(bMz_XnAmy+It(j z*Ur};NV9EcC~qjPD$4eyrm?k=#X9dfiolKMe`~{k$Z!8<{BNN5ODJ`SX^T;lQY&L& zxlXzN^2rCqro!Kp$yfd1b2eQCDUK^Wl8!JzfeDC6GpMK`w8f<={ZS|htuj$)Y^)4B zF)+WLDorPq^UA(&exQ@*QQ`r32?<1;{CacSM@0utRW)X!xz5<;CVNqqnxw=-e+kMA z*{}K#tAOmj+&nzb1lQCE?Vo!s1(Sd+U_C9$`y`b6gGqRDvDzPWqM$1b0S(mJwxiad zRN6CmZ_t1_glBYEzaUXr8BSrteAj1@RQN+qVaAZ~aZ+|R=J>lu5)b?2O7}fYD1E0& zH8#JSeV(oSK3$A4wzt&|+j5ZTnIm*8j|eIq29;e{B<+UNHfNf{q|N6FI?-b`dww?8 z5GU^Zz&-p!eeLmkuavK#vpG|Wzu5hBzr*CK!RWJm#^UPg%<5hUhA0X)0a$G1tH;8u ze$F@Wp>H=M-nC!7BNAh({;jnyy9IM9dTt5=;I9V&*x$c@vFquBMPOR=_j%B)>Er>9 zYIt>fwLLJkwR^-zj zLK81fAY*7%F%~CWjUOEI_i#P};wRRB_4Rq=Ed#Hq$ZATQDAAtQlKVidOz%_ceYC3m zCQ&EIAKrJGfWB#~pQ*MrX70UKr5T(t`Bu*NENf1L5c_PT`f}}8esS!rYR!ABv-0PU zBIP?cLN2$u)i&FVu(-aJzkV7oc(D7;y%UHcNafs9T@9wWYBu^P8gCHclA+4Wpm<+|(6!;u4G3h;aIM3VmB8b+~(Y=HB1&Z5% zIo2Pm#rO)>$7@A(fST_!UxytwHm3O+OV@0z9beACWHorJGpDAJ_uJ8cNRTQq`Gz%! z&_TobeYJEnN@Ru@aP48)7}KuUwur7ft5-OvTe0P1y^fYH(<=YnSUz8W@J0(EWTdrI zO7>xQ@umAKOVGu&XqRQmeq)-B>Uk`*y<>wA8@q(IW#xr7A5plKxdh)S;Ow?hW^+c) z*5}Wy4J!hS%5I;`ZDa(OJX2Q$`+Jdv{flAArWA}28;ptpe^cEjKK?4_#ty90c&hl` zH46r>dpI(1w+99W6mGv=(Wh6P9-xNfI~pEW#bM%IF)q0k&e{pC=QK#*VF#%lTN!~-y;_!W8(l)Xdf|0H|q4@ZlwsgW@UfK zGDQMG5QkB4;3xC~wHx$8R{Xi(R0~8m@DnZ>{DAfR ztv6amfPlf%0$E84JYo0P=+;m16(o5QyCpU7=H%(qimb0A-jQIm3s%xPI#eK^2PG@w z-+VEWTx$%)XbkWJC4!gwSAoKzZ#ZdLD4+PUG1Z0_yuQAH8^oAZ{dHqiT(61h zc5ibF++RZkQ{X3nSPen7SZFaW0M0JrAc;o0e^~Fx$i<-UuZh{Z-xts0U)+J9!GiJA zhUBx#uE@3pR7hV~S_0w&__X}#EC^dJUdI&EHPL%+Qc?dHoIZBbuE4Vw+O>328(FFt zQS0EuprV+`vb&KsvuyA76@=8hrF&d}9o~u%eFQBw5@m!1x=*?cUm%`=0V?n5CdW&+ zT@{3Axtv?%Xg`BO_dC*h4Ky|9#{o{3~c~Fg5X)1hz@?w6PdV74G(CgqM>>TfnL-RHg zC_5YmFv~I-P2}jJC$>F&AFFu3o_~8e=B!6hM$>*dPY?Qt5ekp&DiNSRiEbV?8bv~U zJq^Bo(Qp!aGR{?tGL5(B=g9zvJS!FVui{rD^m24|5dDDLZauOwhaJuXW0lGTJ$`wz zmu0teR2n-fAT{j^*eNH@<_>xdchOWSSWa{I2*Iz_pe8J;}(*MWq1c;vn;@kfx2T&>Co!Sj<_uVrlC@6>oZG+YD8*yAsJar(Un7>KV8oBLrq zIoGlpcb|VYS3Iy7$vx7{n#O6L?!oNpQ1K_i8`qZ@k`? z4+%eKZ4^~hyatzVFHTWxLEwadYLjwgZ@&FKm~AR`osh?ldbr#+Ez17L+NpCmgPWAi zXymSgF+O%3e``66BMq&J{L#Oa2!Kzoo<@xQyJ7anEVrU^=2^qD*0t~a_ z>wt-U8bDx-F5YcMf=j?V(+G-Y1g`}d=eUIt^j!$Q4f&ns)z%b_ z)qYQ?AF6U8{tqdV!RbXs1OU#$Oa`2u4d-(8O!gWbHv$chKKKbYu@|*TKo@F-Fz_y{ z;50UePOE;UhLCulbSBr4%;f%#aQa7e)1dPJU?`D$T7!O#(;ynbw7nh2lM*u`PWG+( z2oo0)c_7*V+E&o6@-3!@LCT#i97Ql2#J}=&3`l@bxt~rnBgx_RKlyVlH`jYot(>)P zH2F{Ew#F45 zOww-(EDn_>#9CDNK|POzvq2H?9f@e3!gX(9$cVG~MA;M4xcCNN&UB$o@~RZ=!%Ay= zX(PLA2`3;fLCkTl%L@WHkTZ)0s8T<43w}*Z$S-;(VTeCgglDP7>nxIK1v$K6o#Ta2SU=_@N*J(^>Xg-TrV8qA@r2R$Ah*eru~s7mTph@O znvz%7?U#yCaWoU_VqC)sUNZw;CA~p|jI!#zJDM;y8PG0Ys-S*I*)%W5T#vs#%QRW> z9(c*1D+BT#w6Q>WsFPud-C3ZalaqDc_%BrDku{f(=b zEB|>+`dKtFf>Uh$ZT+t4GT0+BLgM`%ly0|V-0Ofq&wuzgOtdh>s$j5Ddk_anKm)6x zisnIgw{Br*RueSbPX!Cp(Q=Y)XY2;8pd6J!*&?|~M1;SF@#(}DC6#;fv2~DmQ}GRd zqhD`4G$R8i*6hI%v;1$U%o79d6&@^$oGxgd5bN%Q51bVOSN<}2%WAt}1IJMPrD)%h zsr3lU%0l3;TTebcF;!#6v`Z^*sDB$18%rW+&+Omd<>^O|m6`bm495R7ohMcwyfXmDN$Ces^!^j7cvLG5SK^>(n=r&W2!=&#yiJ^3KNeo6 zKC0vRAi`Vz5}9#iefyS?`TcVrW;}CNN183WIA18W=?m0T3(~fSLgx*?Cv~AQ!0B+R zPGJd`-n0ql(ax??7%1j9GC(6ne;Mf!>M9!ca2$aNm9WUWgd+z+Q0?yV%gV}r0_eli zfsRh)*0j~Z##I}Vm?u4B!c7BR>=6dr9YJrq)Yac-=wrC}BwO;awkJ5pYi6E)gbtkQ z+s~o)>V{j9^EO@nHZ{)2k;C7u?;`0b;APsffFiSv!U_2ds(?$u3>|#ph*VS*;dz?7 z&W21It+ra}w!d1s1*}PVtcwiPEe7too{FA_!HI=D12y0}y^Xk@Lt%jDaESjoXp%Kblf z3SL6$eKD*7yJqcox=XRAxA|JzH)YZ8l*%!O-?RC&6){@bWV{-CXHfJer=e`XqY;|W zC$_$>pRghvvvP7=mTw8+g6-HR;33I(QK%|3I2MeiirW0WjwR!Pp7C6ep>4NkXee`? zn3|f}MpF@m+Qw5tLSlhD_K2E;NUET?<|Evk{5UE_;&9iH(mT2d>~7*n41foY}6w#{{X+~ zBC*u7(0QZruv(+_iE3!O&s+bfkq5^=J>9DZ3wDgd@q>>v4({8d$oMI)BG)fYj4HyU zw=^R>*7BSOxQb&o?JREs8yH$yroaMfK17m2r#1B6N#pT^q(Jzb=-DX`kh2bcXNY*2 ze;+zH>024Ej6^VI0#)TdHsyYgX`L3m=nlb`L<+c^>oo_$vhv^mR9v4d%PzA-2YTZA=P$Js^_Ibu-{q!<+dYQJ#0v*Eu*iekKUJe228%3;FKg zpl#3NTh?$(6$!UCe-DU+nuIm;?*6e6;B%QJt4-AZ>UH}apkq%--}K%Wxyek3S~WCG zh?s)ky?fVeqAD7yFUpPYYikGt?-2R;?X%M;$Hv3qXRaY3o`QOB+WsSe~s~0d5Fy+AKKbZb9_(FLhnYmlR zV(sT-Bq~^xwMVkikp@2dJo=a>;*0rj-R{gr{iVSAPhXm~twTK09^-uASJLSdUz4PP z2fvxE6WxzI2`Dvu9J{kqX{9>Z{!52#tFH{KI2*%Q>UX@3AwE2e=+^eW`}sbSAYcTU z1ShMKXYVI17N~7M&CRKJT_Ux)f{a{|Tc{*2=s|f_;C6J7B_or0?S<>o4{$qPbZscQdFcV7jgOrpMeHMDwZ&ao)`a0uuvQuR(f_%uoVUfie>z>bzvu1dV zjS0Elqk?6r%=za&D1v%EdMLQBVWk!ld2cpfS%XTfB#nyVz}^sA-GV5Bv~);FgVG=!Dhkp9(ya&rN-Eu*B5dhq(@J;WxjyH6 z&bjyg0r#iNFor`md+oK}nC~;65X*{?C8n4>U2{`e-8SG3_j6Qiz8(q77+G zySF`z+c*xpOA=5$eoz#_CnC}TH09<9-yO!Mxo^+|+D1Lt`G;%)EKx9&eYc|15CeLc z2i&-rUB!rV2pO3(xR4R^-8JJ|Mi(dd&J?qU4At^^O(?rofA@!+BVrUk1qDS0kjRin zP+cvatc=Z>jhQ{x7AUcEQ}4+WPy#@X^sk{IS)dyr9Cj%0(W&QW_MS4^!vlQyir-=- zsby;|ynMmAL}O88m4R@c*$2VpMUouVQh7;sPx zDmJ4OTeBy-__7|hO*5^F7F`5=0NC14hRyD|Bh8=(4<7s-{SnflpxnCX8r2!kueA_~ z4gg&m@CWL_7<`E~Xmx*GkI03(Oia?*$>}y5=Unm;`yVlN`;(WS+Kub0Vh@4K)S*u> zUk-8Dh$oKz@vn?lpp8^($do5 z&lB;8L@ve({Alrmd_cv)*&!}hHN*E!R!kxWY~#k{nS7)H`!Q;ArM9TM)aDGSlj|Zi zb}WneU#BDKdL3{1H9 zr{>FX@G;Uxpq)fL{%R9ApNVl|ysp=Hu(t9ML#)hp4jR&6g|o31GW9@dg2+?Wbk5y? zFl%7*D2#OnHd_GdwvtS+_3s@GC4M?StP!AF7>n zk=0$ix8GHu;`50|S!CaYv;5%NS4E<+QiqDW%_#L6CT62GHxi}9aqq6U3riG1XaPnN z(z)j*^W3nR5{9%K9G#zHiIv(SO*T05Dl6lICB6B;iokHHe(L04?=Sb)GeMUm+^!o{ zu1XG9m}4dh+Jb(;p_Rh&vEf*I+J5N!&iG{KhAL~l+GHBwQ^TMHa}!C)G$?5kDg$o0 z1foK5T~Oc4UGx1em2@t<%=-2)he(Td=~||=0MITYm}LI+=}TZ!Z5f^K8X?~ENRRaBEliy8ZB;WKaV2{XA-F? z`Tzm-MKAtnX%!gu0A1v8Im8Erb`Y)q<3v3);{{|QVq)UIv^~6p32*I2WtVEYPBlKn zz>#Xf^L88JfDOlNARW~IUMv94Jacryr1^qt)u!iw_Cpxt3vuXu;)-_aPKy#IBlYX_ zDL=@mRSGL>3CmEg+U7Hbd)uP6=#6Sl*`Ni*Susb1)kZ8GjXfw~sFk7;9{G=F8zX+C) zmP7dl$&L%U8(WvWb$#&(CeEk+k;EBPk)rr37FGy0VhX(9qIxR`>)IM5&r#V{*48ud z?B;=kFqbWPdIt&Ch0M-)G@F>9qSD`yK>c~@t*XuF>HMl%C?57DNVy~(D>F7EE~JG> z+eCpj3X!csG|wd%%31E;w7 zxW-~w%-QF4UCP&aqX7B_NBl(^@TdY*tcF-HwfIK$x0y@ToGiLs%tR{N-d@R(9YxDd z{H1tFW3tfDD=atRSv0D=h$_A+8&!R9pCu^n&s{tvrZ2Z~A6G5t$JX?`MH#>E(8E<> z8ZIhIvk~p+i0M97GdC}nd!`Z0blY*w@rwy@n(Dm4_ zOt~bERrI~5-u<=x-Ae!J`d1A(DC5H7td|NZImxx(fCkuBwx<@E)?^-M&p|i0K=@Q!z?!H;kJJF0Sc_6jI z7UI6;=i8CuHYrkLb<4WKdO0Ot!rq`ZeBWdN1jr48eJQkuZ|+eUF74-JHU7;t|77>+Vk_CH`g%9r*?Z;;;wV zjF(3e_#HHz%xkVMZrV1X@EG*74{;(jmGj?=W5MawGYnu8fOFY+ z)98=qhe>tEgf+&i8^U@BJmCa~Whm*%ioEvMmd7SIv2%unk*Ex0s#YvTv2o*mDJWP3 zdG_oH4yPG9fDD|ju-zsPU*wVr%rJE+r5(zy)t&pU0p>d-@~06LS`LJgbDNd@ghr>G z9KaprtX?u;Vw^b*XJIt%yl7avH9rRaFXOu@RgNAHLU-J@xP;F65Dhlc9I`m(C4B>K zuiz`NrxPFlY2#g5n|bzC9rRb7AJ3!;Y$S=GX|HHA*&UK{m3Lw0^e;2oTJT30^_Dw( zg1O4nC9fl9e9x26PTUZ(-t+X%Kf7C_BD)%`nH63(bz?_Oj-2AV{6LT!feB*Ba!|u5 z!?M3_@ScYQs*U8rV%Q$2;hnMU?SukR@uNzWzs{9mH0WriPQT61nJDQqTSyO)!w9~w z&NgIJ^T*!ZB)7Ni+@n{%76QMW{(LJ#Zst}K-5DWRd7JAF@BLmIL8>FagFwIO3WEnH zcBVqRpV<)k&_RD(Z8JJT@+U%`g}hEsNOu(@WZ#27e+m}KxLo=8H#;p$qFE=v|NrN# z%KQ?LvG{)vZEBAwuld|*HP*6Ay3wUDkvuS+onw7gM;r9+-MjW~5)B zp`#Vko1+kX_%~Y;_-nJKbjRdko*zj94E@IHdNeA&y_K-$B?jhY6WCg+{1)QhK(-!K z8I)k6Vx#0VH1n&A$qMIIxY?+N!}ao)&_|5h+21RC@rM*B-8$7aw^ID0NiO*y+XBM0 zbrJm*MetFM73)YN+#b3MDN>IpG3ACMz21e$U^U~FnmeydYmkxD4R791hWrj@S| z6vhbVJpevK#t;}#{X%<`pJ*|=i21ek3qQ5T-+7TVZ-a|n^cAdEiiR~ zzr;JzG?kICh%R5f$rB9;4Z;~F4x$(yceAX~E|rJvvJ&@!9Y}I5vI8GAD%8-M`e!{F4&XBy0cXy>Z5MV}Xc&v>QcJxi<;+p@924O(@iN5$o{ ztZ))y?znJg@fQ#I&C{(*z*tQF^|)DGMM4US>LCL+ngGeP*i?hL%i>=R3_4W&P96x_ zjy9j4O`RuIZ()_LElFBoL?xjU?3NBKv=cfTz@1Q8`DGTdGNXt{^%PIRSjXB#71+IB zdf*X?&r)a;G8?4^b=^o!RZNPQ8`5lM7SklUl_CHS({g`pVrPFJ1g1i=+OB^A9BwhE z^Hl5lv%USJV4`Bmw$v7uYe^Fun@|G3ImXN=Incwwsc`W{B;Cfequ4tcMi7!+R^s~# z=TX3FAo~3g`qs=9%rkdLt~VGrZW=eeeGJ0PpDB z`*c5kY*+2K<;}x!IhlAdG>ezPe>J%#^Wyqd%}`lXW-;^4x}=v~vyydZ0&v(zCi)|D zTk1Z;#A^?dM}D_Uvnz={k4!?hCWJYoQue`N3yET|ri*7vxqEVJXQ1M-j{98Iw*?&7 zmhI|QUKmED1`QFsAH`-o@#y8YG;)VL z9K~pchoy-qT=$i>&Qq<-O^=sc__p^Nu1tBlU}p=(It?DK&-An9H*@2vQAEd1UInjG z*I%P$enxR+nqDBe6&>CPe*z6Nh|M_rInonR)=CjZSM!bDa>z^M2Qc8+v}avvD}EV3 z(IqW?;a&T6Fo$xs7y1Q|e z{q$8voC0c3h%z(y1O1L02-?kf^AR~gmVx-f^H1qWFU8N zUbcQgzIR59VadgX{+i{KIzHOfdbbHXR4F{vb}TfYZG-BjVU^az3^(X7U>m{>Bpxd* zve|I29xhda3F_n&1)iwO#g89h@i=aZjQ8$C4EdKVc}@48I1|w!a)H#!|SPagpmOSKf-UAggS7G%x{w{RFQdk zd3lC7?cfqr+Pq<5VPN~%H#XJ*wWms9*$iiydUcF$-OEE3+)o%q~N z?A~Y|G)%RnpciWMN6%xJvB!$0XVe(ikL8L3Ev9b%xx^ssTeJJe6|H@pC0;0-zdmRh z5&O5j<_<0LlDp;=kfvv&)%(wavmN)(f&*nc&0GOXRQpDAZ0hp4Anq5|Yg=a}z0*KP zo~u1xGu2k$GY3}Qh4!m>533JON=^WmSg2X|;kqFZaxg*XdO^L0p!T5GZ5z@gkaKj{ z`QrIsw_5PW0r0kL(vuB34v3uhi1??e*J7bod(ZnE%@y?@4Mtt1+0R-bLLjayOlh^c z=xdJJ9gyz>!v*%uDHAu$N0$BM0U1R21!|B&>#ZVIYH$x4{)jyH*w-p2RAl0}M_RwQ zBp4`zPD`=tqu=e;#j|-F@e_aSf7aDg z`AxlGtIU6M0Y0avzns0t666xw#aR`q!`_NeZ2)bD#U6ZDm4#<6)dG&Qbw;4ylixtn z;S!2iOTcDdYCrW;#dnJsunYiykknyB>XLjM9^(G&xun18vC8Dwo(4rd;*D~TzHrLS zGlTA;FCAx`L_Q|`VEJt)9sLhkwmZ8??N3UTc(;$l9`cUl&~n(zFxW;ts`Di%E%{Re zcumikU)kf^&2lU$()7PNbBnJ;tjY5dB^^%C+vn{$$b1U~uA@hv0&--NUif)(V#dka zmBn0umyFNNvEik!apN+17!yTEZE@~Y>CMDPrX%WMD8vCgF2qM2{!@g#;3xW1*<|m* zf$)%_7l&A78+^Z!Z?zIkFhq~V$cQaiNJC3&;o|ZE7LETk}`8bkQ+E-!lMN@gIQOlw={Nf{uvEY0HlDah;U+@ zlVTUNBB!?rLzK7Hx~6))^0}|b;@3Q2rj~Q+*`;gX#>Hwwhdxx#Ea5zx9VOTt@^iy1 zHJ{hmzp!We+$+T1iDfMf$GV{MtR~@W;UE6Sj6i zEiO@nZ4wCizV<8MB*spj668DCzw72a<+G2NQ#!1Tx;+&(5U=7ssF^joI7f|T!eB0jt8t#+YO*>B2+2M^n8+AGa2Z9G4KIT?C$!)^h%gm3hE4?# zQhl*G&Nn%#F89;2>>{gYb%odIW4nnIWH1~??!4Y(Vu4txuVLDAIzT39>tIP!gk$r3 zQ&VU&jf-q@GoO7mV>9}D&NW?)OG;bYTX2|4D`OiX(1yerM#dx$8)qTTxajv&{=Mkt zW$yNPQsN^1zGk-ds~z7v(p>R38uM@7_Z5<=qYAvBi?U!(WJnd=v3on=L%j3Ww455B z-7A;i@;yh4YyPwl_F!@98NmVq{opM%PV3ICqy?ceFSM2W)H6wdVQ?(ko&Y7|@bK_= zc$ljCZw02*Ob`x-H{i}R{k=ZxbkE>bh`;Pl!LscqL3=p7igW`K?&bY1?c(B8;AM$8lk99Qj!P9pQrgl!g zk*Bq6$&MorWN?`3kY=GO!Y|F5!ko(UE(?!H7Zb(nKrSdjcIhtZg|e`*`Ak52p?bJX z=lvHAr-`p$=RUa8aqYx2O{LHEN$8?Pt%Q$dOgbW)vNFSgDZ$u^K`MW!etr9kSv@Z7TP7gWcR>C6#qCoCg_d&G!C$2`biTc>f8F_U zUE8vY)1=4ZW*?Pg>$FZXwLLAe^CBcY5JT)M?SC!@9qhu|>u_VBQ30h;PfzcW$b(E8 z`}_|{L!r|`QEGm`iv&0`71}02KjxpLB@Q>KM|9;P=4@1FP21PX~_!YjfAX5 z-TP^iN`vCnQ5UpRYT{ptv_eUs)TO=g`{#ARzqAWq^{}(^zkJHfG!x|VX`rB@YAUvM zD0eIucfnUwro%a!AXz*Ll5ORt#`k`uFT)(w97TbPxrJ%Cg=xp!CcEKL^K8L`oV^Pi z^kS^orTP;T24}n`j;p>28}i+k@}-3%VgEI?>mFT-C^Hb8i4U0*OH?b-+v}S0e9he{ za+>e_1a5xCaKy!f5UG=?4FEAn-l)I;R6U_EP$KFM|X60x|0aor=tb#=7G**5ww zMar?{XXh1~v{Fk#iNAa_OJ559~KfSF|W_EG;#e|l!Z$gvGbyG>3)mH*WD$4 z881woi|@NB~TJ*Uevt z9*6_WD=Uo~mw3EAo>Es&1*Zg=vb0{oIsr!?jc7gSWaa?l7-TFHGyF+M4T%{ly}m-p zhIlcz4xf3Rk-l(s?H3YmwAYK;QTaKEU7V#xM#jFWYM}Yh!{hL4iYzkrr7Z%WE~nrY z7w-oAf7Dg?f{#a@04e^0gZ)X3a*5Q1BcoU&Q~^6W1X*KkQM?IEc6=- zlpZ1P+KY0svjbl>NV(!YI3A9ajOe<+CZECFn+~=cAel&@n!89ECWCZ>E!kV>_A<#; zs11#NG^xfc&ZQ`Le^^*7H0vOONW{>)WyrmG*G+qwo`Em(+qWsz^3mtK!?Krluxb0s?S` z3(7KPxLU+-W_U(E{X(i8(?epTf*$;bV2xWn5SE8#E?6=HveY`uygI{ffM%X4f5`iM zoh(=wZ^H{${-W~AwPb#h@++P+$nLDF3TM=$Dja0+UXNtV!jLu#5CG3NL2~rr+6bQ1 zxN`Z^$mpYIZ|UGtojXdw6@v*c&OaC0CK@j0bu7UZn7!(%s}H3E}+AV2*vNQ zJ46o_rBxH4uZM~P*=y<&kQ?7Fo(}Iq>f++^ON`vYAX|=sZ@brslwY`HP|Dz2ry+tr z{_Bf66vmA%ub`j|P~g8Yl8#|pS_r*syPB;f@}=9Y#Abvy#+2}%D@Xnixdaciq`jDZ zZ*8K>O1OLNdXfPn=?G){{fo3Znk(t7y@0o-dL}2*Outxrv6VAktp1TdE;~*ns zW@d(ELc$o`+-Ee7xP-!HRC zSQh@bukG-Q|GkUXuP3Nx9pWxrm58o`285)`3@&_Fy zK#Dir0nLYrJndSw==lzLsBQdBrM6!A*f;;@39G||gpSOu7A02!yVg2Ek#!156 zB;eWEwVV!l=imxjL0b%?tDQ&g-{Yp8r@qt{2o6EbMDeMwbEeTR$X!XbJ#hsj{@JQ+dB)iY;ZNaX*pLb|22r) zsex*Ne6#C(-SP%zz0*<0K_|#$Z_!5dHeNwyNw~^?#_Yml*nTK1uXHU-&Mp?>kx|%R z<>27>^2;B&WRm~h9J35c3W}RCZ?}SZFG>jMqO!b%?=wHY@SbYpG5OA{>*!P6VPzrH zNRsFx{ukyqlkrXK7Ww{O1fUxUhzM{jR7W;VcJlweZ~L!bgg;*3Rc~ZxmqQHcLARyE z1LY1AMO0Q6fBVyY+FGx5E+j1$Ok|SbZ~gNIg8pCSiFbRF4o8P-WkgdXraeGmb9gjV zr%X>6@1IA6+%m!c-ZD&BGK;satsVPKEg*_Mz{EiWi6L%>oiI$Eb{?06Bw?Lz9rmJK zgb_7Xv!&!VMeTW0U`H1hf@Y1ci*R(Apt6*J=tWjGc9$#;!NHumAOFw%-VQg{1+g8h z*}zCe@m~OA1VE?38vr_{fe&o2o38=wd#(Ib5CPPI(b=vfG{Nt~o*>BMv|Ya2Wt35B zeCGjL4i{6xZCh=!Xis0z&OH+K)0c(J(6z_6cez`p{CKVEAI268iP1QO`Q)UCtS%VC zr9I8fmrPAffqSEf0yr3KS>X8a@gsxJE4U4jrlZ5d3G=_p+&79A+A07h{BY<3looH^$^Tv7Zf;;Z7E(Louma z51Zfe-@i;~+^9Vb>K%!!ndWAN(FBElWmIK$%J@@!0BB`BzQgpQvKdP?bhIJI3NY^8 zd?$^s!VsAbWRjvs$(CX$egbph>UL8<3RIRYzrvUmDW;BL;_TOrOP4dKDJdyQ-cV;K zGB?2^i;j+lM+QJ%tho}M5H2R5*kHIpj*AF;Zj(37}l#-IW17Rb~b!>LT`#%}qyWKo{xYf}1xx)t`A?)4&V( zfv-@@OoUf}i~Y#gx7P5_d^`#=cYZyJm;5W&CzzO0wD{vy$^!~ld~?7QXH)uwKexOE z8H-ixPo6X=g~2zFf`;Z+YG=QIUH|o;yyQRLedZ`Gn4=@da!~$R4AQ~V2cMY6WlI^@SG!vTO>M?X!+?sq6cPjLt{pTH z;C9V!Uh=sf5?uZTowg98KD{xLJ~ly z9`pCKPUehtJ-Diz7o?grB?qcupucR3zS;Gx$^6PbEk5TH?Bqk9!y~c1tbzojLyG<4 zGL2G{ujXOi>-TYZToPUF?N|If297CGL!WD>!P)(QHH_Va7AD_g8E3{e1M1|sRk|R)t0?x zbiLE5Q-`hPW`w6yM=}K^rHQ?^kmOkEQ*M*mO-zgSqi~XMjJo;!Prl@RQ>==I|cwAK(BMPn+9Pp-cUdk*D747y4m^ zMDns@?at>X2tQ$=cj`X-YW)oNmBWclUS`-uZqLof9(t%GD)mz1d{EhA>lrTbE?>V}PxIWe&p(vqM- zRdh9a{P9b;N#V6mgWgf|*^F60&k;9(<P>(Aq^{CP{6){ueqaa#q+rV0I zC)4uekT0tTwR$IYUEaB4&Tu6#5IVq(^NB`A#tQQCG!o!5ufpSr=m=2ya(v3dagDLh-44A8zwHiL6NDM-}ASu43X`!oyXeO$CD&- z=tfA(ZMK4^ZF{yLFJDE>bb6DuvtEeNUYcNB6T$y7S2GN#`5fnttWnZ43G5 zCvLtcXu56SWy12(1%#vUh0pLqZ^8-$c+PNtn)z6LcYYLI*w~4QY{0-gTKZEGgrBKl zoUxYLLhvu}KVW}@)WcZw85dCy`apjUbTrC~8445auiz9m^26;VolP*EYV>wO6p!ti z-<{SUgBbO%@uft?#Fqb3&18?wHuskt7esZBp4fQ3p8u??mcxNu{>ceu(`$4LqzNtV zzUNhcDW$17u)`CFO1D*EgA*2*)SvBcgD{~8@r*c5naX79?Zuory8$Tkn8@ZF%IZ&A zvvu|zc6RYjZAN5Y{0sYH@k?la_xkOr`<`v5l>jzQ6x1xWuKnQ;pAKY>K~6j^uf zEJjC>q20+28En^x?KFLiys_?Jb$%~9gOfNp9i64h6RHRZMj=Y7k?XL<%i)%L?{ni)Tu*@HMe&p2HZ0%5J3n{Br2q+e%^o<=-`}{mcGY(*N<4SbmbUYkkhRl~AAt{F z{McTxtb+sqJw4a!U!Tps!uES9#By)Qfx3xTc=H45aG-$h?wqMQS6oibrfJ$GdTJq_ zC`KI7bmIT4hmWA7L!9r0CR~V-JWV*>Vvn~iI;s)5Y^juucU)yjt`ESY%8HnucR%=< zvahD8*#e5uRv;u|zntITm5|8Sw15+-mA7~D;9c93XNy!qbg5Svd6HyZ&C0v&J~?(Y z;z&W4e;I6*h*XN4+s%d?Vwa5b-?)jS3rcn*Zt(fmfam~PJn`njYUraQnA*jfyiOSMazz}gAqjr@KvnT9_3G4j@SY&(nV9eAIA z`SSkfPkeU!>wD59sKldh_Ehg`)}H%YKg4jTttRYH#wXgUfJ~@_(^nxdX{fQ`gvCx6 zYp$xT-F8YKF0E>P`Oi>+PX{-0gV0h)%tQCM(lPoL3jX?JBx1~g27uwvt z(Cx?-H3JcdNEMmD2xsxTwz6C&Ko4tO&=%vm$d8o(Tek%+E}usbMH5jWjFSi^+_!0=v?km}uN zU|0+n*CZI(glvV-y>HBU6@@ZL2==LUKFa-sD=FqYpT> z@ZGo7UsiRZz5|4%PZMTHJyY-zc7O{-HjgrkvG0=ZRCG9IA+8bS;2ZhH$hA>wJ+3o8 zlYl6lnjqRR*4$Xv-ltezdQPXFfb1@5+)utkXveHSPy7Hn`!?j-daNAEklcF7Qv@tLhx7~&f5SCJas`;LQaoO)7trKSb3J*>ewe3Fxp~cO}`zkCS(l#bYkr&dt zn(55#^j`K!`NWzo`EF#1Z4v-LpeleqG@u|ozsc@nQZ;dd;u~?qh0!R{GhU4soTA-Cy^dI@ihjI@fi~e!R;1QT27hv_64lD>QsSf#v}l zdurdvxrm!ey!iJ!9Yz+S){j2J3{Kp2rhN_r;h-tiRPtnak-$rB4oeK6)fRZRT7O4M z0*!1`sMURR_LeDyMnv9!e7bH3{tPg*`LduJh3H1Gu_0FoWTH>S#)kulF`5K)o%aF z^N%RqP0@977S*Zo+=Y)U!xSwC_v=u}IqFPzc-IkZc6$g)nJPN}V(UD<`G_I%DLYZN z?auH)jjKqu#C|-KX&C9Y{9QU3pY=xm%>`gmW{3ojGrF1vn#&-<;U~zl%p4!HIc!R0 zQV5X+&H<3^yLTNdG@x_@_ZlF>fG`2JDsn9F)=cZozATPRkU%Lu9|jya)c_JkWU-Lm zhS@-PepGN?X>^CJs~G8@0ht&a>WCtSuw9Q{wu$~FIXoOF5!`FKfgcFx9y4CFF}wOk zCEE>Kdh3cuSq7nmPsO9nyuEP-1_nOF#L#@Z8PbgtYu*QEfP-cx9=5=81BZJ{2hUP< z0y;`Lz4L1j3H$i?_$T4fLq^IlqVO#8VA`XBHCqLF9m8nJ7w2ZNk^%(W{AcnMNn75M zEF7F!rASf%ePVZ^kA3{AS5sz5fucJl)`!K#Um7VY2G;MW3qlkJKYB5B=1)3`1~Lo_ z;y$!(>?7&(D8y;zS3(Br_xYs&;K>M{n0ZA#PeyW!pxqXJM80qzPCmV^Yv;O6XeWoW z75Qhu7YmMcPyq%tXz?*#_j;a)t_EEtbN&zWv;65^{H^L^M|;P2r+^J#Qq7!3ymIXh zS9?RTEi;;86pMLeSfX+I;MM2!)Kx`wz2PP(6Q|~G&{e_F7I;0dmaWoKmE!#wRi6tG z)qxfO%p@)F*PdEWbGwj)6mNY95_{neDEJ5YE|JhUuq(gZ=JGhtv*WparP3Yo8>{gY zSg)O>Y%KaM_26<`Q~dS~H;6vL#SP(X6EDOBdAb#!!i2)w$SD-MP=@Qf<;`-uN-m~rH^^q<~HslZAXTPU7*%oi&b@3Vhmk3J!U}hdw z)3*E~Y15Bb53OI{X1G#buU5LBGBT2qkRq{IO@~D~Xh0ZK>ToX6@bk`o!iWf;m(l(U z16P^zFK;ScCGpnQQq!_ULiPDG-aFpPu^H7s?0SxxBM)BpNi;;EuSJRY=}SCZ)?zKQ zF@`Mz!_3msd9XcFkv6vF`1v1Q!@lw7bv?GK%G;iPOY?N9z(3HPqP|tz_N4v`>M7rP z)!&?tFWcy34rTm=b)(wld818)=x@&8$XGiZdtJ_O(W9u6>vfZ}S=xA;V-@BUHKf8s zB=UDk?y?l&B`Lx;j3HNEUTNfE;@}87I`U-FeE11rzj)C)dwCVCMKc94<m6iq;Jd7DTK-E5r8NI0j09Qc0JB!tkbl_@^&KJ;q|HDnjz+^Don?iQo8t1IPl- zY2(4s@kbMNYRwuPtD9yY?YL$(NCR*woCsw+T+}pg0GY-|`#gGE>r*&Nc7AJls|B%A zf$ATLzWAOHM0;71GO^>02{yr`WCSD^M?i-d$XkL*VZaH`uRVH}l_DIoU;7n3j^4J; zpKSgnbp8s$UDV;y*hwF#l0b57Jh$;hcqP}&^^uePF3**!52=$1m_MczKuaPvdeP>Y z*ok?3qhrk5CrwsAVjx~=#erZkeal^(-=*c4z0@Io*Ttp00{EFakTGhwp9bcRDtEVS zR7O}|Zt1hcDY7@_gn*v24iT!EA8gE2pYDydPaT}H_r7qN&-o0Qs;Ogs$7B*mON_9! zVQ^E1K^kc+;(*ZAD~kP1#$+=fE7eCcJ%dfTsLlEJhyCZE7AdKm7!kI1Wh_y?^O<|1 zwD;5`xG`?bp!%pIJe9tE+6J42pvy$sm{-Pj)*~X1XzWQf`^a#!_JExWWkOntR_io1 zcH%nW1>KUG6zy31#gL;b%Q;~T>6}+y)5EVFhKuyC9YQ<0x|)VojrYRpFzdN!!cqe5o%ZztsP(V5lJ}Qa?!tz;}l2t zKnV}%2H1bgUpw$4yPCE(idIEtCUAg$UE}W;U&LgIctrcS1EQh_YxeuKSqOR?Gu=JF zOP8A*w??anWehi2C$*!A;5-N%n7MsV+!6HvbedqLqaYC9z$lw=r7Eb^YkX78p3EHN z0eLk*U`!CSrG(tdTa1kUFd`5#C;rS2hM-zTv zLU{K)_Eu1Ipt;k`oBO$}Y~^RAW5b2Un7|#}+uM^kUirbh7{QiqcWi+SNAPh<5clAP z*y0AeGQ>C>F?aF>(d`DfFgySJP%=C^JivxBGgbJI!8xRQ9Rr%SA6v*6DW`nWD3Z}; z4zV#n)V;lMG-srPBpHkg-X}rqfu=hPgw>}G&e?_^X*-B5U{pG8(aZm-hsLN6YxoaJe z<-(MdzP}+jk$&)`Ie0Qgr$vO2W#iJ!)6oIC_HV*|4jZO%oGk&RdC{e%rA?`tf`qVd zJ`+EUyGUvHzPq_t!>-m*5O$ViueFMkKSt*(9@R`J<>AEzK(3JvD3TsN_&$|}=0cWI znw**%k+#8$8wJ%{*Xm9uRyE474_EE|6qtx^GTIYTJrf(&qG96t_8zIx-d22ei;WE@Ovbr9(D^Z}HY=jX zXNF^no}yyJQXxF1ts5YSGcMXaolw(=>A|DbpCp7kZ#jB!ankos8UQ0SPz51g@gT42 zTdxS={rkaeG{O1&B7hNytvjOU*a)~u6yn?xnt+(sB5WJv3K1L2j;3OFkHfWl_Y5o{ zCCcw*YFJYqbgy58)nF0|M&n1cHHC21w(qTu?T^MG4+iy9m`XQ_T=PTYWi*aEnyvt0 z^Yjl62599yjADWThcp)uD{4fyic!oC)$%pCuA*LycOP%Vbo|t374O;?5osP2f05?G zTfm;!V}15RuEXjNzrtx4Fc_}1r8oFvt3wl+a+&Gt#QvOy-vuJwFq7cQ+qC>w{2Lq! z0}j7I?$IkT3&s(Dy}i`*~pk(Tfa&$;Sl&>s3oHD5)1x#tt;U zi@9=JbjSO9(!AydhT!jC-xBW)My~QR%1z@*Z(Md&(UKz??(vNJiuIi`!Ah|KO@PLc z_Us&6`pzq-g$Xx8E@}f?3Gt{)Obk9TxK>Z+4~P&)ZS8&`NzyAmnfa~3q=N0Us323GO_Sk zeFzzN-rg%;-?Q*1%~K83V!VE(Z3FA0k0-<5j&#)YcP0tHi!^S&PbFf4q%(M!T?m_+@YBtVWRPJB)t7*Pu0H z@iSQjYLESqvh;L}2+8~G`3|FwBQ__`I0z&T=wSuT%dZUX;;N$#X=#KQ&kAsP_=i&5 z)rIa)kYpqbM~nlID7W<&HsCvkWOsn&q`IM@vNrvF`VR*uBjcpzg<~AB_58E=+$Xq> zas7?y??U4yM4p&Z>)JSKMq+)g6}^I%*pU}9_s2Hy zBm4WY<^dlFK8s7nbsj0}d+i9wIVX}wJ~tM<4Clm>+AZ zIb+S(Et9hKUp9t&MgnxP+}_!8eU>~)U1@RJ#b)*1*)H3l8>6D%y5CnbRgON>-E5Et zd1OLDLNd1_QN`sE8{5B3Vk7qxl@!cdwAl@6C^a=9RT=kFYbdya1?`WQfuz7i)>DP# zxmgfOW^UR#-vrEyk!IpQ_G{2oS-*N9A0?fIYW5?wgWx4z?*oTKv5W4QK~5^W`F7u1 z?*oRV0~6Wy8;4Gq-lV?nfF-Wyw@?}7OQvSJt#)O^Rx0CeRgA2W?UCyDpZN(03T~OB zYrEFscl3P4bKY%O_rlHpW>XiJS{m$=n}hr`Fq62`!FmZC@b`do za{l}K!ql|C@cw-2yPff+Kkrb4$rI<$o90oJH1I*mjGV4&+D_cvk1(M0XEn0TZLu3v zPh6djt*gEd{1U{VApY*6OswxjXkABFP!bMM-(uILHf{vWxF-~p#ycYN(%gSCzMpTVkQZEgKAR9*>> zNArQS=`BvGmy=3T<^lm)SJOk>qCb3)R_$AAnj97+xi;ep;eIE_0BSVOJAp4a*r*|4 zm*+K`T7xzb*MpmHcNa!mgl|sMtuIKP9})KRWUc|sW2)DWR8mS>st+J!2O(>J1x z)+-c5OWhWHNEN_Ucft#4M#ggo(IZ73G;XK61(37QXT?Mtu?;?Jsu~*2Cx_bv=o|RB zxw(6H`uJTRQ#LuXgWg6Q2#tti`i1VA(mrb@SgXMhl7}*kgp{}ME_fEF6|t&^ zT!GBu;wa!uorW8`II_MN5ChG#W%Il1OrJARwWUND4?j<_S23ovp$`XJ7qi3KEgn^d zW3SgFfi{85cN3@6Ipw=6mhj?%cQ}`vvDduC+2-FoZxGeO-~s0d5vaz>H$wStce!q~ zcCuDB@xTidC5z(k$?~0htcpN#6XGlg*b4y5apwt6MCS%W^=(v?ssqxbk4jV;oJj;m zCvU-Hxw?mEW+gymQA3*68_3=T#-PT6Rtb(<^z@rzPbOAO)gQ1VQHj4{2*POVTZ&eD=NOosR__Xpvw)vr7f3uym^3dBBrt#+akXE%VsI>ZVXj5 zT+IO{w25-ZEyCrRQG+O^9lZo-Pwsf$g=3@M{@T@ZE5!^kl3OAo6c1G)wLEj_D0WMv zmMI2y&&?{T^G6B_IA!BbI0CB^zt{T+J=5Px0@Whl&OEI~GGO7B zWGr^-+#hJ(Bng5I6&?$0%fwd$Z$Bzi8<>4~xu06bNsYaHnxn9I6-n8`b+c>su06-YNMmCFjwmxj2MwvK!SVqgj+5aHh z`8EK^F!o2Mm_2fapLc%&8^~9XF-})8A3L=>%KT+%X=Q~$Kw$T=;R4SCO--0wDJdzS zZvsRtiYWuNT&VYr>DDcpL8s@9cJLT;f6dr^f@yU~AP&#_v}8yy>e8lrDA*2S;ZeTH z7E@LTj5u+j^2fq6S?>QV&7jKUOgS{^PW8gpx3sj(^p~};-ESROtRao)7BzkdM!PTX z62Br%OjB%_(H3MwI)byG)66Z@;bOKxDBGWu8fLkm4am*{tR{WnStx^u(D>VRuvO0nM@SC&gUaBl1cBvp=J?H zFtrF}qR`052pnqYHetA67U$sSsG* zUnu+7&dBwlig85LGdM!HaQ_L+zEDkVgl#7D@|IR~e)3seN}IL}fBEqdrN3pBl3UZ(C#GmP4znyyI~7Em8D`AohTXg3b5(EM&^;bE`u}GvN61bZ4n= z+y&L+t=6Y#Zn|jLCQJxy?Ukydv~qx7_+%IF*SCN>g7ULxtl(fd4OZQu-_;@miefz_Nt8PO>(6joxVT2fg2Q};`bwk zIa2BCz`_sc08FGIk^eZV9CHUleGzLb=7N1xnS~MS%H3qi z{FiX3k3U|oOM}>B#59lBxbaedsLY^uaU#H8ko1U1)WHLkoBWClmTTcBNiZk6_kDl= z7JzwQhh|-?z!nfWQURTx|9W|_^dn_uB&;*p@9gkoc890>_#uZ@bU1A6X1dG(idpF| zYih9*g`g`SZecT6qhQDbhMoVlHEnr8f+INEX%7?_5(+L2A_$9cV)eoRoVUM0`X z3?i$|zQNLP*ePH~!QXs$`H>lBvqlidF71vUUW=|z9aKm1{%rLeb!lBS+h_GEmOV%) z2<%>bX6=N&KC8RGzaM$7GRhIXO>mv``*RC6-gxg$YZy1YyuA1WpYeo?ldbNhnh7|~ zzE?aunyx`S>L4=;+>Q%%UXxH}{K!K5-hnv^lqr}es2l}G0fCsO-0?acsr+9S%RRqg zg{aCtc|zq`lltKUNo7+|%rLAooT)m^*ykQ0NF))6nztaJErG*UHP*&vO+X^7`y~$C z=OT%)c{d8}#MU?c8g>VV1e=!tR~h*aMLHw6 zUq~kJ)xbx^x`-*5-nZBs_3UETz@*+X=1%Jth!*e zt_3@otR{vu>G@`UL0@B?A0wUeg9fE>% zrvlR5C9NV|(p>`5($etO@qWKC-Wcy+cn&0!anD-4n$t1D|z&n@>AzOw9r|i*TwB3YgF@M?phz%@|h+}_t^OpERFd2U$2zdY6 zafU70YQQ@0SO;N#4oDxr;H{g7FSZ=0q5cc21&p%9BB|gD0U(mE*N{hpUrK;}Lq&CZ zyiP>)G^8Mr-9KQ*cfe&iBo5KQkJEM}Ocx9LohusSk?iIDB@eTm?D>D0!S`>JNMJ?h z0^ju|V)G!jsGbah^s}8UFXP4bh+zJCsu7E=XQ&f(K2R;c+T!PXIrFnu@QbAfnX;FDWwX!$J=K<#CK}u&tiS}C#A5X4JLE*UNl3B+t=rHVfRQf!MAMb!+#BTU+%6t-1RKOgN#P><#(F0I$r`B%`hI9*&bG{gw zmr#1mI-u9DKhgn`xDgQ%LeQ@5a=MOGL<=}U8v8nF{)i(ou$E?X4$Y5WX<-Ri*ZpA}kxBSTt6Wm1puyxdyR{4fhl6r(jSaAH> zT>HL$08B3bZzjT#UpF1~IX_BDO6qBy{~36;IYZHtjM$t2PL9~k=R|e6k~!T}0a#cr zd+#gX6>*d#IscxYUNZ{H;@;W!RbR8Me|V1fy_732F`n)TEcY@C-3aixDUZYHdN}60 z6AzSkl?rC*QPT3Zd)GAK<#(DnzgbkjD}|JGFa&+W_pM^O7-HQAr1e$^qJ3X%78DGb zWJ%xZw3QNOT$yE)iKJ@0=lhu#SKm~W?Y<0OfY+xtSIZuyj}j|f5e-n*Rc`~oZv?LT z=g$QlA<;|`*F&92RbOi?qJZSB7jBGoJXKV9Q8cX(s6T+FH-tr%>f`Yj>#I&~AylLh z)Gz4k<0wlp3b|MVyI^tj>E?L~nwJ)0^A9tMjrd&p+hbmBSZz{$LPlq|yyJ<1e zNnW$2-iwe>#6`sGjJsu?v3NG=Q$UmC!Jj|EijE3OO19qO^cz8P*&;?y%74^V^>;=u zaUFG?2`T_tirBhd(ou&}T0pZMz+)lAGGfM+cHQxd0&dJN8Q!AW9_E-IMt zEp`G^$^M!f>cKao^6~a6r-hJwira4DSO1R-V2XIvg2=X1%BG5{At+TM47vVvaRj9U zT|H2^g)oQ6_`Dx1rVt#K(o+AR=OX!KQfsWj6bH^-D(dXdg{HqEC0pFjW}TejWF_Qt zW=51-3-unxgpfVDLAu-9(fW)_?4@EyRo9q>$F)xJJa9q(l5&9q@LG-jo@s8b!Nu9J z4A}R9_5zW$!KEM$01K^gSvxy**00!!kp9UR$*cy!;=sItVbaxuawzc9dYh}V9)mNVuUvNX zrXx;}D9dWoDL>WS(4E~~ON*S%xuajWz4dcSGB+?Fy&S>&{->f8Mv>q&z@e4PXu-*- zWE@*3kfb3@-#PVYC8f9LAvMyTMfn~XB0E%dOxIh2^Wn$JM(EuT#xYqQvHRJG6`cYQ z!N9++UCX+mWopu@&4M#M51LT-lf+s-PoLL95v5qX*?}#2T{ctaimJax-;Zyr2m)4V zK57dBfd9mUTbBPB6fxQj zEciNN6Hc7b&1uF96MZjAUR?p_izb##yz&O79~rs#UzLv|iZt;8=d@$p+*Fex&WTls zP#|JfY88LZ%Rub$BaKqVaZsSou0UE&E{i!gM0C>Ey*4wXG^$U}LU59s$u;;1Uk`Mt z5I}=_elho58X7%52Dr8Va~%ZTTjN%GeVbF^MH<56y%aLg%zLkUzNUWkkRh8at|t=f zqPZDMPzItL!Y%C0z}+Z|jqINB(1aQQ3ZY?Knhq*jTJl8N1(Y$Z8|{mF8qt}=M_$!a zK~$36NxX5c^637Cmug4E_C${fbf0D9zlWiIpZ$IN#|`^RBdSi}ac2Lt^>i;!?jwg_ z^|TGGT+rKBRAM$+Nwt=E^`MH&&yWAtLX13MF#EFinK3iL8-i0T?|2MN_Of?R2sZcP z zgTW6`+l+#7eiM@e8tkm`y<2qf-_RFqdV9Wq_|JNJLa|qCW6gZgs@p%7r!` zbYMlj*Y5V4Rkr6yl#G62Xi)R*8V((|py8$t8ToVTn?&&6UW#MX_b|B*%`!qIu6J2^ zvQuonT<{tY*w->a;x-ulAz+ngG8T8NSA2PzYO+ML@tzPvgI{+_gVRo|QnyYUVSWO4_a z7!v9-2d3q5b-O|+wSmqJ-@y-k=Z2Z*F4<`hVwtA<&2^K+g!3bAx{u_*<7oan&1!OW z{)cfD;3=zb)6$eQH3OUHfeZF?^Dt_jSy3p>UNurR3?c-KfWuP7!pK6ph|>mB+O1fL zD`bcw5nV~dJ{t78Xw{0yJ#?ewrXJdwduzHXTQa$_=6f`#PMN|KFFAX?&W#L z{pbZOG5VRB2i&*;gLAukBB!qs+56M;dQVcb=+HoIIH%P@Y?*7t#Qdv4>A)h}z`U%C z0=W4|m2H}&O%ILyp&$#2ii-rj0`$bwOrMwkFL>Grs9q z%hUXB=t7AWlf7&82pgXpn!`cRK(rzT3GY^XRh%c%xa&3z7V--?f?sRBDdte__Uv-fxGkS zA>HxrtcVwUnBWDMyx=)IXc`n0Jn{r*u06zOI5a21(HceD>8XZ>2B0k(f1U`&iXrJ-){ghpp4|@YusVz)Cl~gi4^J}gsFCMZo#eA3@ z)(NMah%zKxV!zL9P=h>x&$>owm%P@i7zOJN<&sw7A24;+(|gt5A<2o4G4bVTyt zXeB-D=c@hKrX$kyfZ_ybDWG9-cj}>u1s58T) zmzVdef@s?TrtNXUc92>Lf-vGX7)zs@;`!uQuE!hgY%`?gHD&VzulMKC&QCmi#N{ma zKIB>M;Y@4fNkx9<8OqnfP8j*vL51oe$bk1X`u1DyS%UE{?EbVki_}f_hL#v z&2Or)%|4U`8a%%7jRbtsFadi(Yp`NL7)LcCv{wR%=97b&{gjVpQ7sJ_v9mYKbrRp=@=xP zWmRY_QV*ut_DnnJvlG$7;8j-E4gT=L_p5~7USn%hJ z3<&;mAm9Kh7Dy0|?=kw_nHs>ep2g;Zk?;lw^ALuh*G<@cOi6Ao@l3$Dyr7c5eZyezQZYAy=%s&KNcWF`6G1oJe;GnBl|AJ39-s6kYTUo{fSyd4z<7@iGAy*CcBx;FmY8 z=GrJi#6+m(e${^b^GsFsLBvc{We4ZA%1H(UEkYCsYv$6Vf0{Ww(yspi!s<~_JJ_|3 zFYke;cWGbgE(>PK_Rke!K-WG;u zdMfTbe!Ur|3yukrQc|z?cNW5BC7szV(wgHk*kB@*%R2MJ(W>Jd>qF&mD{9&nA2t1qGS2UzeNP7)%S-px z3N0&~P+2yNMNAur^el?1mdSV&BqHBEqV~L0!2=W*DPsY)19muqYy%v(KamY`M+lx3pUhp)+in7hMB zs+@F8wnhT`hc*iuDMP+mVH)h7Gaq4mrWtK3`kn`eXnbT$(2i?&Fgb}HXCpud)*)K; zWY4dbAQx~;Q^ZAuw;BZHkghc-cfJ}3llwiZJ5-ixv~^AiO_Iigi`^}+%Z~s9VM|;$ zfZ604;I1Q5^pd^p^Gi#UZVho1im{JIQ@PFlXhYX4ErVjx=|=hn4S%Y4irbd#escns z%>&@=QGJy8@^Ol9r%x5hcL6$Q({Dv@CGq0xbFYXI(r`o$k{Pc{j~Ul>Cg^4+K=}wo zqW?vOH_+6ufe8YhSGO57IY+3<%%C@>n7qDta;ozHJKzn}+EJ0oEz2p^Q==vH@}m)v zk!5|B{~?R-^by{f4>LuA49!2MIvYnvsuk(s71N17S1GWSKXiyCJD+eWcXzk16Qy{~i${KP*~>F-zhPz!(l8oOIF>E8lyPNR=R`On zy-jn%MD@T{c$aIO)Cbk`H>gIq^>)XfGu8R3mtE&9Pkv#?2FC{?!tH-D5Nb+IP5qA3 zGAnEN1DpOW6siao$r&s|5uF9b-ckHz%=rKEokR zsbs+e;3MYh0lERGvB_-AJl8h9)S!TDw+F**D<~s}VYpBr@6^<+etn0OY37`)FZ1C( zE*?g=t^Ez(E7>f;v^jT`aUqNy0k+=Dzus5*;9M za?-N86p51{Q2u+$o-MzsHpj_9pJnaCpN%TAU@Dqe>d%#IAKJ*j84X0lnWgeQ4S2uR z5HPyF1RO+Kf+&+I{b9F2(N+si^2p^Sh4RVG=xqP-q1g7Kqq0s>MZb_5r>PdO2}3%0 zpdaMS7YeC%NlAG05WCsrIc#x800>Vv6&LS_b%28jaE(x(rL*nV->AF(kY#{v7cruO z?*C2f%-^tAKbWHz6#tp4eE%_bBYX6Pi))(wc>e=_{-l2H9_@w(RU~Fe;l5CSx{)JIQhqTdt9Ujh)@aOcm%=wH=u7qk=TY)2lySTU@t&;Hr)wc}FRf};IfHpum?%K^DIQ;&;rpixTy3 zCFGS=P?FTLsJdD&8@8_kOB4obRupt6Sb7XtBVrPS3dY~(=U-lMflK-;+{>p@Kc4+M zU*7#|rC<^LeZ}DltF$;-Gz)nlfTo0|^fKMn#;V%0WkUV~Kirw%53W5v)xV!TD5+@s zG+FFDpm~d#i)`oF>WAZUkyJ_rH-1l_dx1(7tNF;I))Z&7$m_Oz-yw{+;Xl#o1~{@; zRb3mk9lcNfwTac%VW&EWRjmk%-!g6g2;Kvdkf`6xtaO9D_frZN!CA}@+BIi=muFb( z=2JjoqKK2bcB9aJ$f#lI_ixtR^n6;Bf%!Xo`{FT+G+MxPiHLjsErR2^MkM5o0{Iwa zE=yu&lOFFL>@<)$X^4U*5kW5JLzEC*OFc`~Et!Z+yq@b1Z30;%-z-v>34&SAmbHno zzGa($^b=WzA@D>y6?t;`0gQs%D@@%I2h^*Nx8Kcy=b0WLT9B!Y0xEJZL<}}jFae7X zB(0H&5iOlPOps8-O30*+_Fd^0Flm8YKXN6wgtf-+gzb z3litZ4XU3LqFRfSA43`P0(Vt zXabpTykZ+^A2Kf)V)uJHU-vw)yIY3LZG#2jnaU-&;(sJ^eOfN-Krmi$aR=!pAPD`o zGqj>jDu3y3D!|wVB?+d8_sh2{&LG~9Uo=m}0idCxC|A!j|a;i&3mlgwrDUTYY6-$#Bps{E+QLwwR~k@)8e96eufKaR`1ZfubiX)W z27O?w+EtqGJhVZLc^l)^TpDgFhg{4FGF0Q;(HZaDT;I|KN+os4Cv{yixov4vWo@s< zj(Aw%gwPj^O$}tLj91f3_D349VU5kr&H!7-M%eS6d|vZV<>~RM*HacCI}4$KNh`Vq0%7$jvX(8&gW(4gN8%vZZ&N zO`K~wc|PHnW)o{|rYCGlq)(fI@%4MG6}@x5?3o*gwptxAiM%$$HLE)-zx6hFLcDL{0W0 zOrBquzuXV;RyoJRwD0S${9J&t?WSIIn_sGkKX#Di*CviY-fjL`!Alf+qX2R|GeV$g zQ}S=UHDXODA?6^c#D<=p?;Cae`D91K*It>*HbVxHGqQ~)^bQXMH-vhY+9W*y54k&dgs5qR-77m zc-Qs55(DhKTV-j&>rvrX=(c&gOmJY|Q>j1`cDy5sxbsG&A)$*g$6xE%#)%fQfe3@x zFPGL{nZVINy0;+4wg;DJ3-!j%aueTkKenjfNtxnG7B`6Us!M=A4c-Nq6Ag;dM_=Qq zc!}^pmgfx@F!>(jtnAR^<1SiH_ffqs>6oUXyj+e zpHySH4*TzZ1;Gq`8M%ikBYy?y?*v!~gAQ3Bl77{&A$h{AizeV`cVx$Xi0 z^IL^9ukY|L5dY3w{>@xTaxg37(~{5%NKmqFS*5xce!k9w@ihK5HmK*7$8o_V3sGDkv7G~NzVqK$br<(a8bQ!01LD!lqc53(4-U%jdF z9V*)~F-&+y)tX%?#94ThIMUnrHd+#u2dF4s?bMhApwtW_pQXci>BH4tIKTZh{bZY0 zNUp&j`@7NIlm$J_rOi$EVcgV))9vW7Q%>cZgp%^oc;n>%E5(|ASVU0V5)T0&2;kA& zqN3LI^&j`y=7I=6z=M8M@2 z0tN9KT0C0$II^bFWl1t0IYSVNr!!Z?`FsV@ibdf9z!eC8+g{w^-9v#2u^k&ns`k## z2aJqCz+wTjWKegLpel9MO7DNgnqb3KRx-KyU}1rR^SiplmRy4ZhjNM& z`SxiCR?OBAGy5O~e(`^i_Ldv9QSfykt~@BJffEe_{gAQ%{{eVwbb0T5-UYr3_7RgZ zKnDU=L;|-&0TG`>g(j0`NHB@==ah@PVDZfbI_HX7T0wFcik}Q=i*l&6DiHTIh^Q4e zaDK|l1-@TSagGGxkY0g9cOsrzmJZ5Ka?6xWoO)a6H?Bb)Ebfuw^Dss(TOatVTxRAS zcC|eEDucuynXOnsc6R%w7^@IYBh#xxl zl*s?hWW4&9lqyQ*4+Hul0v1vzkW#*QG_n^@7iYf$r{KK#8kJA_Y?~JUmB+O!4-gUE zqPpMeFlqvoV;f8@cY6R2Pjt9{n83*gWqE$QLT*Cc{EzmQ;oaTo)n^|l z+;u^k-oVJ{b-7Ca(w&l2>RwK#Pu8o{Q~qLp1GpFuSvj~Yi~@s#!qx^1BdHLsu**DY zeXYR$CNIg=^s>suj0qr>@=S?vF9KQkwtw@>)QauS+OK+8J`!K?(tB{14M~*8xj>@= z+T?O~=pW749G#Y#EIq%Qmy>fVz2EtZ|HJUSd?i~KJ+aw49W{;rltA7fVxp% za?b}F+Vb?8Ap7iulTAGM=0?3I^hKZXIR<0{RYi=9e$O|`2ys0yt<;2RF9~T`${t+f z@P|^0k->_zsZfor46h4c-6xXZl#b3aix1CUIwE0eMpL3=Bz+E_%yRD;XM)U+bjsj& zxqnG!E^rb!6O^UV(TO=X;+aU7-*EkuL_>|eg=bmX@Yk4o%$_JfL;q3qZ)0exJ2~I5 zA;`?iN(*xBm$os(TsRfZj`*_ce8)F%7pSMa77PC+ly`63kW?LRZU~ox-*a_>nxpdc zSSTA4R*0~VnpC%a=D8kQe}D#yjVN;JrC5o^QeRCa z;ONoLFrS9C$rN1RzT2Vzr@QfSs0V=$eJ|`VxqZlloghSP!;u#n_&KI;E8Tb<>u490OaBP|slHXKI=_-p`Q{F-vX!%QGJ5cH(s7G4_|NQ_qDwXINs6`%{ns zEC-MKTbA7Wgi4s{-G=Ehxc3*y_lkZ0VYN2|uL!?ITl? z#2g*}Ug1urxb^*MZeC|=2(gAXG2f!l-E75Qk@I3w(l_Vd?CT0|zZe4hP{=+tMhSjL zt%)cHu4X*AmTrfRjF98-3;q=cz5s{p)lRIgF^LiTh-8D*jEqH;5V^b8Q@wz03{YjG)rOI&>SFjO zw%OeIU?qNNgO6?g6|wDoo0XRr$f@`|JG2Rnq2ibmZt8?)i=N?iI5HwDHJv zz2(gxSXc#J%+ai32gvwJg1fI9Rxr5xUS4MWjMDi(E&$JRH%CH(fvvoqX(D?=f2>jg z>b)z5UaGOEKT;@urPik><$0846}g*!=z;VUWpojo?!~bEh>S&ugP+ch=9$EG$$kEjKelFi=puuid=PTvtMSXu$2`RkO#{Dq33kgltCb>^+i21SlvdH_@)%Mfn;H zs)10BDX}J~^xmOczhT%#3;Z+*Rt)tk&1z%q9mcpS%F5|}emAUqP~w$}*7LxT$X7(f zHMjV);Nf`Ltf=6h*e{vQiRXF2e(X@0yUNr{gPtA{35g1P$!|6su?`%OHXO-&(NARD zH*O!Hi~9Qg(o;61R2Jw`p~6;FRgL+zbA;RX%9Rlp4WhdX?r#-~=C)B*GUP>Ov_ zXC1?r;v{ndrLU|i_^d-Oek+^5&z#7~d_$K3LKTf0a3$W7LMT^Zb;--71_sZ;b`<>a z$}F|~^xC%$89}0kEQ}G`<#f{U%Ga4iu26tVv);bF5|W|az^Cvt_MUjh({ZvcYsmve zX}f$TjySEr=-50cdPZv+zB*_x+14aoR&(_}S2EOyJ@af5P7MdD(6SqDT>1Zg1Y(;1LH;T7<5@rDzfb%38&Q9h>;HZM|HCDPr~bbm z3ih|2{ok+u|4$HYdpeAYg0jspSryY^uvlAk^{w~!`4Z5?T`NOD8B`HSQHLGPlcXk) z61VKKd+g3YPp=3&n2RKN4I8=d8=`*8E;B0kub^<1Sk5+TgHv*(9^Ktr9n7+L8}%FR za-}b101{UL4bC;zD=34{QWbu}W(0VRYH}yq#=Vm#*23xaPMx7Mnr5g}fzMf1{)YZ639B# zpajam%K*6$`=>oqiql>-+aG5x!+xy)@9!ND8j6|F2!eU*6`q@B=YOl4`ngkh)wxHr zO~#53*45Ta+sFoydkC;UDC7%+h*Vx~ZUjh+tnKdbR9TvXj3YyUY95u^&eJ|p;*}VB z@jLjB#>9uO&^dzE*TmF#ZnFJzjpgY=RyGXz9%{+qQ56#)_eH5t!VU1weJ$s31%kQ! z<2Ysbso#vwzdPt}-@~E44)Quhe0@=dL=*Kk4UfOfT_yBO#d4p!CPfofJLhx9V6qCD zZvr3{R}8FO4JOM?vz%hZA6t2>L<$vD6obr*)iNzoSMxp`;qBC!Sz4;Ph*ok!*M8XW z8r@ZhU=vd{qDdWNb(n%w9S7)^lA^k6vWmuaH54VHRU3(E@}XMo~*q08QHS(^jr z2Kemv(o*()Nlq(In~p;uo()Y+6~NrS?B$zZ9a1znCx6aoM?n%a4fIZX64=CH2636A zu0b0lfnb#G;~G6me3os^C(v!pVCu;E^mO%L$I((&d~uScU|>M0N(Tu$SuDsoBM>J+ zrJ_hYsJF$dgmu;?jDdlZRk^lTbDhzCN9?)31qWXTL&m$|| z<&*C)PPx92tq2?&0^XjL7#lUMsF=gphfr}_N`Itzqa#nyHv1WE-|pT`)r_A+g&#G+jA zNSxwWd_AR?BD{sKq@ac7Kj$ebH(UjQd1e?J1PU}!il(NkxP8~Z+JnDuwuESdfCAp| z&%agu{lsQY}Al$HnCRgV& zD_YF+zs^(Psll6T;fCVv%o*td&IKU(wcp;1wGPorg${S34NqTw_qbk0H&>=v!P+Ui z@oZ_GMmXY?!X-fe1!cQZ7_{Y)8Q!yz#@Pp(r+)^)qSo}iRGMwWm8Crw*t6DMM@L`Q zh!ZP*XWqB(W11aJm+idk1azmAFi`JCA)Sv#jw-f4h>a$@e7Uz&0@{k*48MDdl(Yj(4yI-br(pn zwGx7mZq4GOd+WOWdZDiRLO1?+O~IeWb-DBP zri=VoGS{3$qbDP4g8ca~jVx)Lb&uNJ zNJiK@g}i^hh?FlsR}cd{7;^u$Te5|(7p*V;(k~glERK3e{!GS ze%vM_;=1#`X{DEUYY4RHa54Q4;K`bRxA_T}jb=atnm&)ni-{=2%>C3GH;B=an4#D- z(v*P5<3hMlvrIr)aK<)YBRJa#mCk)HYShl!e0p)4nRpgTq5} zXJ_ZvOWwxq5tJ^Grp{%-0TdYp1u_l}4rrId=43OC5SA=gOCF#7YGL&dvRoq`y`xpm zaQnpJ+xyD`^79q(lTB;S^g&I`fmDC;bl*6Vy#9LK^^>SbG#;at0N2F`@qOrAuG=l2 zN9`U*Bg#NYo+qn$NtF_P_UMdcx7W&zlQV(GIqG^*vt043nOredfuaIZ5tJ;#nQzxn zvYu;cft%ArM%GA8pqPH`ZYQH*LhNp`{dS~?J@l!~fs_iH3Od?lv5)yxvP|iSLgXA) zox%H}212^Qm}E;QqX92YgTU^1FpvfEmb&7)m=-H`Pu8RRmJecLp3)IKR#Z@u{Hnr9 z6k({L%zJx|v~$UJZDT`)HAd|_rb+$X*v(BB-ltvLDv2E?Z9luvZa%84sG!3S+FS?> z@?CbZeW~6cVoE(wg%+AE(?}u7N_BjG<@nqa)mI3QMEmuN_)ZHpG!v z%yfO>?r*UH6+l+c@Z^A=>~T)dU;4sr@HX{>1eTflb!j|E za-{z0Ss$Ka)ndH3cs^c~?X%Fyan7@G-nQ}q%UvOoos%cy`D+=w<=&)Uc{{FIrVRK& zt8Z_T{mcWC4;UzfV;Y%zf%J{%;%MQZQVXW<<@qz=L|h$^zUb>+e*B{3*>Z~41+E%a zy&VY7P0Y+fpbcofW8KIRxj-m|>jOX0exr3-jAiVa1VFOzu$lR z4i1VvMN^J95+;tm@72PvlmonmX7iDTnzQ5SfiL3!CGqh_NQ_s`s;W|hNH|ep8uche zH=;}mRag%$&0<20hdayQ^>a|Odq;i>l-437PFY%7uKoEFt4DyOCKU!9O7Eo~^1x7Z zrAdFiUY^fZ0_&Vfr}pJ#ou^5h-FKlB{A#r|-b>dy5HoaGqZLR^{uYhB zS}(9a@Ab32{X^r)aPits8@W2?$6-*S$?i*WYUFXsi0QyHnEdigPit9v%-?l`|J*D@}X9q{aCmxb#zg^^C4U)RW^pD>qh%2dtK zMRl95>XH9kZ<V8V@&k&)`Ys2#@f+CSQkiTg=IhG-D}J)e3} zKfRUW(e9xZY4&P?g7u=tm#g-gquPgtmW1teQH&dWw74bqD;o^wYxCsmAV55Dyqr>8 zHlZ<5qW6r=JdJ2-CLP{CB@k#Cgp?H8pKIz66}<9cjN0QDd7qlNYxFP=T-sOmf6@I3 z2&?}6k&*@V1*o1^0E*+{mnq>=c{R0!N+jVW#B+u?GId*nXAu&)6O)tKwFYyRlO=k- zHh_xEa zZa6q%Zt>BsRNJ@1CCu+!_5*!59h?%Qc>ZK4A8edliHW(+UOte0r?*ZCPT=Y(*N>5M z66EJz^25HDE=^WV=Z-OPaqIC-ryqQTzB|K(ysBm4>vN;cKZMH1k&Tr#4RXm$rQD>j zh6%koB)j2Ral)Lmt^AeMd5&HhEdIg5El-ryW%sQJjhe(Dub(=JR zVgwO=pPHkGU*(A-X2;_%ku=}KGB;IS|2j4Ogt@ESg-~8OV~>lJ{j*le5GuPw4dP*m zWjh`i0NQURKbLshIX*EIr@%)vG@!9mJ6B(>N{73jbV{!9bxRrQvtQ##dgRRe;tCYY zG~kx1&PSHA#_BD(;F634#Lb#`h)>_VsYR4HbrmjRK5lsRgyU|@7vQ&#_dag(xtLbJ zmx0^w%#dopnk%t5ZC$Lo0o9?=58uR5+~J<5I>ks|t`^i*+4cWoW6+dAGS$9EC7=A8 zJ$Ah&+p`dP4B)Hh)5~>wXKf-v>8o`v1HMwhkK#rPC@19w0Cb6RkEI_ypc;%cO@v^c zMfqMhH8&aAGTzkz|K5D(YY>fWuNfxlYNvL7(A96|U6f=9Q#a?@G#RX7$-K-P{ZXIw z<-ry4-HgI!REJH1IQIUWx=NnU{7he~x>>J=SLZ;`z<3*ORXfk<3Vspx&?C(&E0d~; zAQPn$b;oHC)-KL6h_eb5w8=KMHq$k)_2FgN%4*UlG#y@Wo11vdE9AdQp}lG+?g&C1I1;2$<^ zS>DS{OA|)2^r@#ukK^wGOex5A5oPjw-g1L^~1$_8Q2F~F5g7*|ABs>BTh%D!1R7?K^$A;_qp-5GXF!Y{N0sjgE_DCa?>wRQEx{y5 zN9Xm{x~ZHr92fI%Ui{wnb{(j*etRGnY-|x?taEzYc8xox{9kf8eq28UN2wENro?!7-7qfF7*sV19N}LGL`6=bn0IO*z1rs=$qxI zJUoq|SSU{Lqf|}?myF?|p^VdDU+w||=8aYVgXIFFEhi@+9|!+dKoef}g)hinC(D}e zVC4gl5#Yt)k&!>83Hxum9kgA%D!r6U+ly;tmud}{ECZiEIH|)UANf6B0fpiLe>&O; z6Gv;86LA+SMvavaB*Gwx^%;@8-$Lh!eXN}qblG>=FJu|SG4Yh4&F0p#nKXDiJ2cA0 zi26(@c)2Mhei)mJNs8UUC;733+^+cF|E*Al^P{SSkHa=tW_;B}LUzV5-3Q79#NHsiGKFL)-T{?g`snV8DMj`^hJ zCPihdx;ZoU&D9GC+<>+f6uc~2Ut4l8w+B+`daZf!u+yJQteDv75{6|?0UI1 zZO8i8R!BXh^<5&>tO*C6QD*6>nw@{HF#Vyl=hJLIJgjaG0Cd>-NgP9vsDZ|a&L>ry zL|&&N&5vfo_>wsf!rk_0&tg9GscBKA#;#$*CW_xi7D|U*fS|Q>SBuuofYePS=eE|@ zI@3?!GCDM3|D1)lcq8bE87Nf1gN=H*x_=MtJ+1^d>s3n90kursv;C(1IbW=`ZnnN5 ze|bJtuW|Oz?s|RDO!^U3q0e64rC+qX`gvp=?S?NADX9mwy&h^iuOfsVK;odrK_K&7 zAKi4vXBur2mZ~2p>0faN9`7;iO)@au&d)S#{662YNsa8wS7rzTi6UbMPo?F)?oep3 zZu;?D9odtePFejz-D0r4XnDQ$NFm`5=w+!!5GqUC#dsc{ zVEUn0;BRS|>9L-_c}}r3CHQ*GNU9GHnaj#cJ?wxH)?7a9pAvnp;5%qG?iR<09n|GO z>fmHG1TdN`>eVYuf*Ws+A6enc-)LqAVd`86l1X7TMRj`w`4%($lU2jBv&C>N<5h(| z=5$*Up~mguv`y5gGV-y83`8LaH~?$|Wo=GaGA8rC&@}i$T|Lfka3;f#ytqtTd9s{( zx8bY|6NE1$$-TVp-@3kdc#LcV=t9X{?g?I|BT!vklGC8<(+=H%iZ1=q7Z%m3s1OiA z8tK1NlnhGFrpMW@@@w;~c4@ClzNY?81#l434PuB=^%_v}noz3RZY>s!rHt_(NMtFI z?En0~CemGD*siZqnECqlvTBh-rru-RLM?x^VEFgq%ye4b<7hQ4{Y*%0|E@Xw6|b^f zm-jjuoaM_db&2J~;31MRSSpukuof!hY&wgS8C1w{tQv6)qr)w!a8`@i7z(egwovo( zYI@X#6oQFHJ^k%3l&%e8`(MDYo&klJQk{%Jod$?b;*FYWR=y` zzMaM|7>NEdl6-n`&Jx|;X+!Jz#E()`*i%&cD#Trv-RNF?_SjA{KdY%O+A~nV)Z--^pOUe^xHP zZY+4300=HqGqXMDVy{;W3ebDGq}MtHoA(z;S+2j#2KCYBO)!562{60$3}2G{fTU*G z8Qr;Qvv=9?_s0uQ5><0$p9mDf{DnFgzUR$&?a$Ji)Z~GUa~h$1(#yx$z^2P*RHhmI zc!rY060NY_eFIK3nUk@vbsWshpP96$U2VjlC467JIJGV=879Co`R0Rq)8GplWU38e zA#Y$~WTirXO;ts8eOJ0M2jtO$;4B4FN39&+&hv9nS?RA?_LTE*MntDuKVfHP zW)>|^(){*H0coq~)1`JaifR$dMLWLuopt0O5@H);9L!ZSkkns{zn7HZcy z4zwXvCRO5Rh`ln>zP`S!4?L3&-#=L?DDPG4nra~;>7tt}|9697PI0u@>pcQ4}|O55$m6Ha>Ox0 z?-Bpw%9CHte!EpnqYhZ@Mgvf@LWaM#scg+jV~nllGlUwIM~_vGdiSq16rEbNwfoB# z-Xu<2+Qwb+@&bcuZx+OQlKFvMio9qyGp=n7G9rcKvP-hXvlO!>*v3b?i>Y)pHPbrz4w@ObIx_mVo3}2Yn`KvMugM9hm_I3$+UxXX)e&*$dLQtI+-TR4&x z@0n-e7>PCo&Q{b5N@kalV%=hnYo2&h4NV-wt@lz+{ITKXpI9G-*YNAx_jnYr@*ojyj&6d)9-Wwf<5^4TSlraq-H>zt-0UFhW48g|(5^%R6K zl%^}so{Uu61HEST=i#Hl^~n}P?NsINW)u_(6v^j8D#(57Un$ZuB9#D&0d9!caDRWQ z0ZsZh_kglLT5i&tY%f)Bum&EHR#sKPJdwo{^*i-!P?oF_KV?szb()RSVp~xko6Q9F z!pU1$>Z^f&?OGYO(1i_~J6Ybd1NB+99;eA$Ik~x#ZSLD5Yh+y;jyi543CX7mQ2?!s z7{+O5T|@-G&b-2*e&R5^Pd-)*4F?Q#%se}GI!Uyf z9(lnx@X(G7?!UwcF^=ipXuR6VilN#n9O!q>@Ff{Lw_Yr=CaH}vP3X9wi8Lo;DJMG{ zI3==Cy!3EgBqjgywycEF;!fw7S=LHtwanz>=_dy;)w^E5*Bhmwl$koCO&nMKG`d6L zU>&4s%VzeH4_9*Z1=9qrNk)8Pzce0_AFe?OKZxbEukV17F-$OfP?&ajV^jcP&cWT4 zf$;plHoO5VbRb#LMF52(Kxe?u2fFQhu+mV8L$605u!B&oybtf$t4m+9nLm(1w;pZZ z_I|C(qWZ{0X-h%PYlc1Nx$A?wmib|;pA+!Vh`23hN7CPXc^+eDHXKK{avUn88s}f( zE|*!ByYsZB7I*t}(S9N`#{lBMe7 zi#x2|w^H)(Xh`B@!&l*768Ln`F` zPsoq0r{6SV@EpzgI)H8=v|lBOpIQxRJ56VT;;z&z+yIX3QmH$M3s9PHoPd2~1^`p4 zKmaX(&f&%8?1d~+1t1NJ9xdB=_nsb}g^FCCbR_XTm4te__iO2ns1MAAzJ1b%#d%H|$2HjJ>2dSOUU zs;52uS;Z1uZ{pxgb~}fHt!Smoo>2p^nR$yBYKx$Igq$r%=U$xLqe3|KCvGpv*BN%e zw%%4`zAa4G+&QFe-{bQ*I*J^+kZ&m7H`-atlLW$Xu7F55v~pi&^poOU&%M8mWK zJGUM7X>dy+_#@59dYu1qKd^RBz|3VFjXm({A8q{0!KB;x5&?>L(Ul7iSSm-_sKAKZ z#Qlq|ZsQ*wNIyMb<`){PO5NMJS$vNq8E&6CH1|~J&V8wS`H-bvgf{62iw8`~9eyu2 zeh#;OT}O-3LJue_yD>wOjJaxC2_}!ld$LpM6vtq>>)7eJ^_aXS5wL*~=8VKxcDCnU zJ!?X6DDNMx!gaFYJ0Ja#-sjDyE6DNvv~dUHz}`|xzDkC;I%KmxR!@SdlBLDB3Yi6A zdih0xY4hf)ai6`Z=M?1WNZaWk9j^3Q1O-w7#rpvTh=Y|i4@O$NjLSElXgjVxUIwuR zkK?Y<^-jj(pZa0^S?QrXQo1!4C)2G6hF`hiON$&Sy=`Z)xl5adylsT?OVN%>fE>6v zy++BBfzEx^-Eb<0{m|TWCyTg+{t{jN^k%6{C3xYY7F^+=Qli5}UgN4P+N$Y2zFaS= zLa1dB^b$Nx^Q?3mCl4mp^j#N?1qVR8-=Tv#&O}*PIJclM*plvJ54Ja~e@+{LtYQ6t z=tg#A$nmUF0UFAmjDvndRY@}qB!Yobw1d%xe9LuL+v!oFtggftn>J@VZTXdzs+5Cj z4x7Op$v3>uKP1Fpz#_$KKa+o%PWy^!x)j+Wn@Vpcawyd;Cs?**PW*!q`H0Xr&Q) zsy&;VJf0eLe51oSP3JMl9w79i>?(6~yPY`sqNvSl&%6*|21InQ(vqrpe&45)5r*m$ZfaX=77){77f4b*nxNdl|STPFP_Y?9Wk6{GllNtRF(B`ikfU;OblwSb(bv+*dcEHv}~Y41I} zn)-saQS6EeDk9QE6r_V7y^4tR8hS4R(vjY=f{GMFlNO|x0HGs+5D}H$6FNj{=tv2H z(7qjizTdt7!oBM~Yq63*NY2@3_TDqkJo8M0)SlQSMl~qF74w2+Cq+;G>=xEA4xa^t zi{|wQKEnqlBX`Y_V11!||F~*1oDn0jvgY#a2smoX@9rM49PYMs5IP?m!zU*#z}C4K zvM%)q2rrmohlZS+sZ6e$A28J3K&X9gEq3`>`7Nr3qtN;ojUwy0r{v(LIL?b`^_`ud3r;0}Wh$dw== zPB*V6scyz$X-nlLtp{o?SUtl+0Db~m%Qx>Ukw33f*KHcpOhtSe&s#>IEj}qf z_M7lY>NhZxdh*~y;;y~{gSKOt= zKV9wU8=}rQgem|cyYei%-_Fg(7&tCJ^mMo!&X&PtkpADmm0ly$sz54+ye>5+Sq>Tv z8ia}RYW*6!mEV~G0cLCme;3~A6H3_Q z>*C}Y3us)t_^cy3$HeJQ`)DcC5QObn;mll;_e7Lf5x{gag3Kj zL@+GD0KY&}hM?!VKp$uBUm~Y$+^P?F6?*C{z}^(!kx~CI%3$$h4*t^w*ev>sJF5%= zr-h-^jf*u#c~e~T9Xz*Mxo+_3n~pUF?=y%~03FBWa~M_&fW$C9&r7*H! z;{w}gi6@u&ytc<5nAd+CyW#_SGSq6#18D!nbPII@u_*HNo5KhJR_G->p|E4e`qcu|tKqcrHH-56Gf>+;gsMSXX zc;`!itfH5xtqmq8P){qo8!c@zMiUJSsIx@W5DO5TI>&jJNv%qVw<~IS`+gW(fb!dke{9P#h`T#t&~+p;DPqz@+)25D z7ZT1YQOYqCvdl(l)@d0o4mq6e&+EIR4!|4V07(1B1E7@A zJoUdDv;QbSsfsE9>ic9DnC}Y}Me_0u(Bhv!tX4SxyTNcRQS6dc_&!c?F>>8%83*_7w__%Dqb^xrq z62@(3VX**Q#sfCK;u?``?kvzQMum|Myv1MUuO~+FjS-LpOlsZIN!R-Gba3^z5WEXc z7P%$#1RtgjoIXkXT59S)0^4rULAU^N2LGGDdJ_Brwz^aI@ zec-Ibt^NWg;6HElZ2fiGUY^JuaI7okX-P1n7h*FG=V%7h-7jQp(%ihn>OPrkN8Sb% z{u@XCAwXn=vk343`1dBn>?-(3D)0XW4?Ly#vhW#VPJZ(D`1bVQWszU~FTM8vtDNHh z7{A~a{&@nDe-$IeWe&G&)7pbs!z zBVJK#?ui#U?|W?lB?&<53Dzb;#V;;3$KoYDnL!2@Ox2>sMvHK3bwG9nGfRseh7W-J zb?kQK31fos#pdFDcb_f zgp#EqRRB1w%}}0rNS>~qXWCdwLe%g2 zs&{p&yWHX^x!&?BmG{5k9f-A7&Sgd4kyi+h>s#58@RV`%@bD<=IP38u0H~`Zc!ju2 z9K^CUZ*$#rH#m-#UmY&D6)-pl=JevbTerc7EApmxk#ntbdu>|VK)|U85H|r6lQi5S zo9ERnqxJR`JU=7Y45(Suin>o0lM}=TTRnzBLG|FaIBtf}Qv_K8R9Hwt>173j;`dO+ z=FmM}6`_PKDF!usLM?N0c&3r#L*U&*;jiujXIVGkb&cDqE?_~OeEIEq4;k~@zxX$L zyfX+`i~fpl$=WF9K3J@it23k}oInDOYyn`q>Q-0#AVK?7GP!E`Gj*sknlvW>SieJ{ z>(`MfpjMO7Qow!X^aQ*+a1%2>Bp1CqEAq7jf(!l~T4D*ZQrgPo7*ckxP|KN(PyffG zz@0@7Z(In`(c4=OK(sj^2mD}8fG;i%p$i-rAmJm0g#bhQ7WxXY4Q{~oa*!RUd-9MN zyo|$0I=tL0wTz^aecbm%Q8O?)_V}&>@|b!`N)ft+7`-Iw-xL5A zz0IS|-BB?sMoFd-UB7hJhfInc$T+GZH+)`}TSIGM?W_+2uq@s{ZeY0}JGvhTC}c)4 ziY)AH4tuTAPYg6)&t=7OJ%pL5`pic z_wc6{r=K5aNx&CCSbghPklTA7Ek1odWa$C^S$CEl@`#5A3;2UR&K7#D?roHbPJpae zln;#k#o=jkdi&ugu&sx0jE>1<*l}Cckw`=CSiu&iY~zwjGH(~Kkn3O^ZE<*&mk%ET zlrYb+eXF4`6>z#AiKZqjUTl9Zt&hcUUwi)yTN$Poz{V+-(GNuL^2rpr=ac}W?*;lv z@$EN+Vdb=lVjTdFkelvWeS^|-0(qg&OI+Y)S;@&$lQD@qb}4z%el|QeGwh1ktQLMT zg3;g&nR;~*(B*+=2C8{L?9&Ej5umk(qK^|OetsTRq2P2vP#e3pB*-xgyrr`!s9!^> zk%@~Szy`6R&!7aJTLMP*h(Zo8jhrzoU2aRr1ib^vIr`8Hu7ORiq`y1Sx6=kMz>T`j zH6UzvGhDqH;@FGf16@r(Q*CpvRiDky7b~yebzXQUz@+kIHqK*hDNj&lBWDQeN`dK7 zXwM!=J{1uLja_U6-#%g`5C~l9nmiJ)*nQP6jOTYPFKRZt7jzj*WIYKyK8lqOiFJcWvv`F_EG)B73@sWt`VM-vosFq~T-H|e!DDX+SRhYw|I5{uV zMHKEK&I{7>5@$dN$^|3u&pUK3FTv`k{e#R3bjS!XklSsd76u|z0FY`=Zvg<0&w!!( z;9`D8>6lx+25|d8>Kjmoq90{`0rd6!GEa(g9{?2*5o`F3rT-W=8PX!Ae;CFThGS!n zuer_%xpMval%ci({mECSPG3(eusl(lb@Ib`&Wh7}lm#zLuQp{cUcbWhn?moQ=y~oS z?jY}nj+u2tqEd>mW1KLT-P@r!rCYA+bu;5$aw;8%<6aaUqa$YO}ATbO#<2We+ye1O;&b;XSeUHPShKMeHyr+%6G2rtKyWVfn-5V~HCi!qtP4>n9pSiNk{suYp4JwO@gIkXkZk{746d&)1! z5A2}eoeb#N+1qp9tI1*N6NKj2jwr>aClvnp@i-kQ%~y5gJt}uPnnSdb$a+TQ-vVN zgM@O2O8)xdL>n6$O~NAh>fgfhC&}9{?~J!(0(kFTrRdiCmq39%m#nOXXzHq-;pK0} zD+u&azu-?!$;OX1*(;vnE>Lzm=B~azrh!V>gnhx|j|!sAy@L6LcSj`JH4hCFxY^*k zxvKep$XqH9BAMS~M>@?+`vKl;c|KC#zig)7w??3#zF7hAmP+b74=zqtR=l{L| zynONQ-vyEX^qA?|ZSo`exIO*v%*ijVMw}+6$NnDw`xXB?P-H{+UyJ(x|Gapfwgi|5 ze~*ViiK<^$tj0YXpRsJdfLw1Blc%%v&IIukQ-32a=vX1-ppC6-&k^Y`vL+KG;_=4= z=ol0}HA@SpT12QOaPPVhw^l5-r;jcAVjkqHLen%M&EYZq?FsONG&2K*vjoUn$~oZG z2BL&W8qAX3%A)n=Awfj#5|bol-ES3cF+^P_CnVm8QPizJ>x>+&+Wz$j^ic5tJR1i9 z#6;D2&dmHk-vLEB?4_^L=#c##xE5MowWqaLk!}#eKz z$UpEE>C8x@#J2-}{`m1`A~ZkMN^pixyE9;m4mb7J3;28K`R|F7$J*f1X>?CMT^?LD zsd34jR{OQbyMBD2Eps&dx+rANj=4=(lP>j?OkOgg5)n5GN11)pRT z)0xQdH`4uGLmZm7R8J{V<8RbPd}PS0#T`D3yQeh}w%&MH<&OS-I+EV~rA;@Vc5uYZ z8>*Lf#z5=M8uj1pexY0wM7$-_zp5fKEyPg?_JhA%0N2SUwSGv$$RyC;1FPl8r6McV zu-=H5582r>JhNkKocQD;Lw0_U3~TdzP%80ge@$n#Lm-X~D~?9)u!t`}j#?FnP7AU4 zS&vy67P;k!3?GMlQ+Ac1Dx?W2@uC>7y{vaL?kYURd3rN>V5c%|-6%9Qy41gyJGZB zl$xDC=bIqMnV5ACCO_&cZYJ5{XCgV8?`zs<{2S6~A~t?eRYPrPt4F4U3*u04{30`D zuVnex7Nf1wQu!JR`&H*u52@Lbsi4A6m2S8P&Dm{ieb{)^W?E2J!8p4E zW7$L=QBeb2sF>Oo9WUkReAD!IKBLYvk?S6B5+tYIhoq_gAVc@y==P?T8P=b;RcAR? za}59ZQ9<%IRw`TmH4-{o$HlLL2b!uNuq3V69v_`b5%LLNL$AZWw2-D+BupColW%=R zcx4j65E*JlLo!08HA_rHhk*G=+kp~8EJi?1cilp3p?V0nK_0$yG_r#z^EK}6;YnaT z52F}GFj1?c3vI9oHWl>IPJMoZ^=l+DPyeEbi?(4safQH39MTLsL>c%U66Je%__{<8 zzxHS3FmW=-#d`O9a3!J=Ve;#H`6Rs9vxk;lX@oe*2_G~QRsA&@8p>iC&9QUWoc2YY zX&Z_-rR59cs~ZxQ@I~tnv;x~-RXb$5PL#n+s$ELY5)kohK1b{6NQv4ORVSwuoT%T$ z8+2|jZTK;}REn7wuDFTLcs~gSE-N^GtM{WEST2Vx>L>7-K53hSMpngGhNdG9_o)}w zf^K0-YW?~qQ9(W}>BPO_%4Zuw8V7%9P@9|gfBtw(hwK5~>B4;Us$Jy>rgW7++F$o+ zZ)@uttzMQ{u5t`10j*2eROCC@h8_<`P%-ap-#f2V_R`9wu9-D}nw_>aH_0qVOE$1) zi(8*t2f96kTgEh+GlFue)KT0QxnmO=U`-$Z8eA|8U*6Jcfrp}a^fQAcGB&lxWDC8a z`NY;q)V|)Rb8CsmXwRZ|(R$@;pM_rQ!}Xu?unQv-U{wAHHRItEZgE{}PR9?4wihEW zx*yqSQt~w_(B40xYbKVUMM%5W(4A)Z{O8{s0NLd?sU``qvnS}`k&T@IY)^vqFb2%Q(XY=d*@pf=@acvc&{v5nrBfMetJg^5EN&X9 zInO2!6jNkpf}-g6YuE}^X2RdP;SuR43$-)T435fGp;enP`bB!>k9z0!GX9MHuxBl*A>gAku0gemm)@pe>)JG-O`v#%VW4mayE53Zag%pdRF*% zo>iAj98?EbKcDKd>{NN%;wMg-)AqshRB~!JCsorlXWE|J_`Y@bzu+Lv4a^R}Z25h> z-5o@uhnS=#&5s$&&WZWCAPNT>_3h`c{`{GsjSGE^Z47aq2x#GBWtmBCJY^@DzO?aF zuBXCpGEhIy&S{}che6im;mcdssbzZ=6)c$wK~F=&jg1Wkp@NJR-&BiR5_+f3qBucY zt%^1~5$`f*Shy7s`Z&%m8LL??f-~$fWlw0NZ~x3^;p8uU{2M7Zp`a9VYe4O;5)Uh@ zyq3(~XNU87R-lyv-C3FZqf_Baf2NwbjVp4_Zin4l*sR+2&hTA6`q9iF{_N{y@O}uk z@j$5B)hoo}@KjaEqesCn1IM55cP$aet$e=jx#=T9OT(!dIk^sYytE!45k9VOgC91P z$gtxP{fyhI#+Vx4ts$@=-3gN-Mb=H*8`b$mHfz{iZ zH4Gixs!+3stoJoJTLbKc(q?TGfBIv;N9=8GAQ{X1<)NRH>>< zcP+2obzeS++c>Ro=Wk?6ULUE>%u_ty(hLsX>JnoRw0U!Mu%!jOF<4dmi6)?pRtUtt z1A!1PrpDE@XVXfBD)9B+bpk-7BTeqqSJo|<0XJiSul9{>6O{*dFaV&Di+QPRd&_*f zS5*Edj(q1Ldm;9q+1xl00~!E^_J9x9MvBXzc06KwC2iC*e?j-(&u@pQOlKvTRQz^eNAgXW5wsQ7+-9i>fCJ7-vazv^V>O9hKQAQ~LK zZzLYXEd9B3_*!4Z*eaBL#6>i~@6UP6*lUa1|Gwf%fXkXYFAq^ApgG}mxw=}OT{x=w z2A|2Zz0En0|LsT;Fihe%C+Fa>{1TdjOH=`E)GF6e!A_%whP-AG`+`99Bzr!==#m&;32r~spTZQ+^XGpTKlAdgxORLm!Z|3Vp z(t?*=qc}tY?$>G{E6*NLo%DP+tiRjuwY!U!USQWq5u~=R#%07aE&pw0A1q{_md^B% zj*f5JeL&*6L|-xD0^Ni%9R&vWUi=^Pxf40%oswv0EZY{7#+2`wrfFyA5RpIux|v0` zH&htSCmzD=HV~8CV@=LED`Av4dF&*^zW&F+ofYGFuO`RR`JYLPpVoS~OP>ZCjjiJ9 zO=()9`bZ-1*QK=%xX_=!ezaQGc1-=zc=eUzNzzS9avdA_=sruO0-KFsZRikOeB=6N$4!M3`m-jy0dz5YeqR(fwg}%cW zS?~UepU#qz8*|o&Qk@HP!YS?eVhbT0#kK~ex*G0b;;3)VKb%>@t3u4${0S_QqQ$mI z5vNhrW(&}MXXf7W!9{+my3#$goN4?!9(vzR1?V8cxTK-Z2iI%(2FLTetaG(rP*W5cO~+qb;txUrb9g_}OhqpSb9-#uH4aAcc%}OBo8AGO<1)$W1JH@Ydfr-&cR{+|L~Wz(lmCY0MeDo=b;z9k z{5>kO3$fop0kq@J%1DaGwyp*&fnBBO8eP6gE_}JBh^jieh{1+IQ5QQ2%>f-V^huL)^PLX#fvat!o$hNTBO>D2UJ8&lnR z^N46`cHh7&My9C$wZSvzC{ywb1LsRSmlhn)W2u6O+Se6vvY0mB>7@zrS-*>7s|yTn zkgzVwclj2H=&-L03h$@YYSwC3w0V&bpp)Z&-NK@g1;OT*t^ zn+Bh+@An^@6|&yN^?fGZTimcXm7s@o8OHl%eZ3Y~x+mKZ7tp9+{pt5VTX>=Dumuwy zl?i+0m{Q96`q9lNMW9IuL+#pUT*bC+f2a9#A*V+EpL!eUQ$epjMshfP-&yu1)Gx=U z%wZM+f`onC0|+Z4TjH8scI&Y8l)bJbB%$;inBGp9hR1Z4CZ?95q(&UUGN3#|eW1_* zwqRyuRFYL}c)gr`dV3ghN|@NwZh;J)gfc| z2%({G04B?>0tDxf2Oq*24*RzP59j2eIrb%Py_dx%GF37@4*YJ6acsxaU~3dOs=wx? zJD@X*XFMJk2EZAG*P^a6h*ZU>{^D4O4!XrXxFx{NBjz@-u?%auC(x+42IvA54mrt{ zq5boGrjf2Fh;>W1IXO(hzs-uQs*z5g*>Ukgw%jP6#ld&hpwzZ zBxt*2d%BM1cA{M!l%?Vk(lAZ0F6F3e8)rIultN|xIjt~=s5dxhvSnu`s;}yjR{Kgu z{+Hc=@H0o|2`R_Oo*LWv)jkceiR+v1KL)r%dzN?VS+?W5(gck+HZBxp^sCoS5?(wMw6?7Bf$u8b81z@3?2Qhq;U@e(K_9N+>b{gS^n?nN5yp!> z3aKZwY`!I}H2Yx=QW)8|a(vj@+-jXSIo6%W5~D^Ned55`DASo4@vL}VvU7{^m_Lp+ ztGle0=+H<#x7;?1pgT{KL8f5nE$**afk?LS^*QrnvAx*=6>vGaUSY``Dkhco>Ezhi z*}Va-7@6eQkqDS)BrZO}_p(o+#6^@vC;?*Pv=Ev7sA#NyU87e3-APT1m!9uD)L4&7 zT?kO=?`E#Adb;QtaxlUsGrp=)VqV*{UNcpt_Vr|SI=ZGXqrZR4X|kdOwn6}sMg7gP z_60uYXZ=U}_oV>=X|=Ke=cVwyG?FN*5S6Pv8#8vWL8mIS49+M!hOqhZ^pz#wm(j*) z{xb@m6E9FR-TRo`qGfWZvlzjGzwXR@DA6}GVL3je<+#Y@ zXBkODYwNJ&b72nUaYruVFvJ43)DtmtRn?SMi5J%DJgxQoN3C3RgZoxLbE2I}Vy^bu zW%oVjTz)>EPe-a-t9+ZPub(NltPfy$3^+wNlxTbpv#Hu>vDxkZ)nz50s*g?S6Icv} z9P{q+j~QE`3yn3wHX}AmLqCeH@98m4PKK?=FiREn$ORfw%S;+d`MC@U$c3?NhHAY% z+~0XNSAip}#2Qw+^hxuX3RyA^9&xE~o9CrX(_E`|)0kw$RPc7~Jr8FqeA?jrRd78= zJ-MQdJ3-InFuY;Oi>dj(XGA2WD|2l~kY7NfmX=fjbYr6>sQu@6PmPmMfx@eyN!0Tv zz{H_)UsyIccm=E=$9U!5_Zwny1Zmb-!GdHR_a%d zSw#`$KwvypU|jj@Eh4RFn;z%9SV8NAtEukU1dLivSyqbybaEjm16|hs#flz_7~tnH znR#;Ao0wkfI9DV`SPP=r-r$JCtoH3|?LMD~uH{2%966;p4K=DmtHO>?biurUz)rH9 zTO>o6S|b0@amaQZ(!24&iX@X(XGAkI#BHvFgD$`_e=}ssAPqmG1-h%YJB$~8Je2LB z8f*;NCmeY7a7sy;BBBEz0uAD-wifgj#VuT=J)yPJ?_wmp!XU>dn!P8g4VR}P*09ua z-Gh~f5uBo;PYgv|^@<4u{9|*X*e|3TTiC%OTbE^7>sF=dbIXhF4x9gDE~i%ay^kht zs&l&PGnM;Sgo>&D+!xad73Esz^7mV(PU>}|&`OuouT97QG2Q`&V)tuJuLY|XpAsh~ z)`|(K_a=NegA9z*@KTe@l}C#UKTkgH^eZ%~Hz>V?GVPe0kP5M&r+1W{OSI$SmNcOZ zQQfi8!7whm#{}ri;27BRA1DE%QDRtrO?0Lqw{={Cbw(;$gk94lL9`>C+1$ zSKCkHr!-%!+4wi^{-|!4Kgn7PZuyIWhpGxgmk;C&jzN~Y+GS4_h_^d}I|$852sOdPu!i zSMjF{=Y5dNven47dtD@J-x&UTI%1o+h zq}C43Ol0UhdBJ$w9reHhpgp3+TU&nW>ymXr?*2)0F(ul#yQQB=F-}8AF-w>_GeJQ? zR;l|}rp`#;`c+_G>U=kUG^n4E; znv>J~8s?Y2vP;G0cfPnm>N{YL$Or~tf&O{OmH%(wXbeGSUCkY>6{ev)uOGJhe1BO+Tr{SyK*qX z6>TC;Y+>= zpci<%VYx}59b~od#95HPF!J+7DlUt;=mrLc9~lwyOAEZ}va+)e+~juOCRN$u`B6fi zpP^7yT22;0&*B=FiPA|F68L>GvUZjl$)%VoZ<*uq0dB}WmBVwF2=R3p_8^Ncue==b z9WRHVv-pBE9Ms8er;VvM2beqj3|gT70jeGjz{tQktXS1k$H}huKh+YKU+zo7D~B`^ zzmNVJ`{-^@o|FKou{00fc#AAIPmLX$B?G_T4%0zRU~V}AWp0IgYmR>S-BGPJKAbS? zElD73ug`j?q(~ANtDQzV9n!7vG{q?LcZxUUvJR3NXOSVi^!uLt^xR$s`5L- z;}Z%#v&sgoc)EqpO|$(_g!)TvB=O0H4_!0lCs|sJmI+& z1u$E$5JATe_C0$gy~z6N#>NDL2_Sp+ZT);HG z#fl9(th{enQ@pxj_UL`KRd@Wd?r;!m@4n2jgXNc*b8y2iAsHXVxmIN8SKL28bftGP z4KV%cQRucdJgMK)22uFn5Y}>mxLz8^jC<+7<`NVbW~3`F77l?xuvv;1FEa=$hY=St zOPvj#O_zpIPPnNJUhQg|ETMLTmllTQId$h<%C(bVS1~W;g-6d3i+(Qjv1TYYr5-0b zz+#riCW^9^Dn)_@y;lz$Qg8XM(DPXe;nt;Z1G|UvVqN_c$gyk{<`nA?D<9#-&e}+> z)LMY@0Geb(%cI{HReK;dyE?(00ntFg7)yy3VJg6DF?{`mugZZ)rBcecFBdAO?>D|x zme$R*I=T^)QteW5HVQHLJ)n{{Bi6_&EYESN9)a#PH)jC^hmWG}CiwtxUhd|PSz4Df zT-Z7e;>hvQ^b6Qn8oT&rsu;{R52Vv@S!pBe2n7^nvT|~Cmx8r8Lbf;PQV7jGpsiD_ z2ty(36oN81R9~lSmF7+!92 zqbg2LF{K>+xK7L_Ee{rKFRunCR_j7hm@1VIp|C^v4Stg>uxt%} zNPus<;PTndgdHn44x!BIDn3L-VPE0soLi`ddS^>E*&n{DR#fP&=9EDKrvuUWgaA-j zgibRFc(pvgWy4^EYQWOM%>NqGFMVXk+^#$T=9tJKTu+8C0goRW&ZW+kzKBQw$QX51P7+()Q7$=~*cISgKjvM&R zk&o1pN_xR8yZlu{eD&H&k8ebCSpD^ybW>eju0wo<8X=>DAG;!fUK+yP@NcJdrXdbg zM^nfwDb$7T(dP0^xGnl;2TG3^9y1D>V7p69e&2g!P2Pf*u&D12ZtA`a z*z5u>HK^WWa`;AiQy=E1K4&<*(_}M(3w&D*3H`sb0JSly+?7J8G$=O9Z4zk6x#&FD zyZamwp@-K#=OsQlOwAULjLG;@&LCO|VcdvE-tD^g8(l^uQBImrqbIOm4W)~hW7-ZHF1SOehA66twIq@WT&L%iBA zcoFVyol(xQgrw8|;w1qiegiiDC_rF$X1%fpx6z`tTcErVA~el593(WnKKR{68m%3s zHA}bRmo7JTFyT`%BV~n>o{+uNCZx5d{g4mZ?)0-;top7kjE!s5LbY~iS0UH5>U;o; z)X_+hl4LElQ6s=IWH!F>$#zWMdeG^x?`AHQdTG@Plx{pC>jLb?3z*zDjJ(mwxBYdm zHZF%Rb#VFT37L?@x}mL7XKMm%Yep;u{DgJ@T3si7oQT)2r)V%QaRFWqj+5iYCt{3; zC69KP3z#WqH2vQo8~%y|d7*i>CevZjn!qN%aT(NFFpsQ?u8!1eMd>c7K^bx}L-jNF zid>TWPXwK-a>APVAd0gA1H$?H4=wNG5aM+sd^->SP{UrNnHGufxH;biyM*@cmPknW zd<7B3C`vmlDk-T7>K!i!99jj+?Dd>7--@y1rxn6N7{qL*LXX}>slu8=wqVO>kp`6uC4^Xsy57y zKT9?|QTLIeiTWMTm6pT##~=Bk*r1t03ltA|+t8aiSSqqyr%d33m_*(XATu&#tjxDs zEWaY;1GO*1cB;IF!MCJ7`J>PVJc{5a}jaTBwzmmn(kApK;}I z|7W7Tb#@L8aJ3;NpFTwqpZyZ%s^xr`TNh90^C?ZBh-8v@38Aa|bw z@>7PnY8TOdNw|zGG%fmo?50?A9!!04R)zL_&{qAQj|LS zRFe+Gfy{3`gnH7_qqW>>_1ao_11-C(ByKgVJ8pn{`v`eAh6Nz&djgL} z4JpyCn^IRn-QdY|HQmA=vD2Kf4;GQvcPwHb?W==D`}-2@GaQGc<|`COBuPvigbt=X zilNKK!|TX{mJ9janW36zJ*C68W*vCGwmR>^@3Xwf07aRqBMKP;S(?FF9DA%PO6iX6 z?X?PWFC#w)cv8oEZ1!Hwt`G=_V^J0F>=7JPD`tv<5;r| zHHEuR#6Kjn6TlY#<@wC9R;nmnnqGw;Vy(#H&;m(q#% z{KL66eF0^}1h{`f4`SX_h3bGg3otd_`_|qCtDBtzG8oR>MhgZBlZ&C2#rd${&h>_C zduM=Q0g^+%?L-jSI{?yt+ziqS##$pAH7eFa0%k8q`@8O6A`?<{baa5bLOMCu)XiZO zL|B|qxXg&bzWZb=ve@B>+%FvqzIWQ!GA57^j2=WVe(l->HUy#!;gz>XAKt>0A&l z-g@7{VxXxREqgr8BjO6xT@X}=I_IZeXSpV!|KXZe%a~>+I?cXa3UBNpl;@EhE0VKI&ldWrofG@o-h5D8;v>-C_Iul4zdanex^_-qwC?xUw5Eef*UHA- zU6~R~nqbdT*W)$4_rpetQcM*it{}};F#sm0VheS(EHNv~&FHb1bI0b_je zMFk1OTP0ytdt-*hUi!f_vN;j`r-FA80kElD#E&w4zdFffVKBNt5*P` zGGCT`OZ4>ncKq2N8|we+Ta^@8JZlb_;qyTfCd*ZgUru=7A1_0Iv`hma8l*IYeL^AXcmP&A!>%vy8h(#G?^Y2Qd=HdyP;@ta1olzG+H*w_EM05=!Xk%7bVd3;&4BX97QoLkxKln?qdC~e!<|N>H2ZVnU;)7JM4OGN?@hVB=L6Vg!ycZSemU=Tk zLd>;p7wqnyKCJdlpH}_RZe7`NbuPB+KAS=Xy=eHizn}A)*JHNzDk$wz02yr|je$yO zNl6pXyR%3;^OcJzy64m>iaW8*L?r}cQ{9D41`(%cbM3SobtVt}oiGJcq+gqwW=7oN zv}9dVKm`{Dawk9$yv<+@BSw$>C4gZ9^6<2p)~+WgI3hJX zC+_b&Mf0tnewTTUC3G8ur8@tKM>8sT13nI8`InY|rw1l1S>i=K=t4q~2P|vmS_nBm z>-CtYR4)MhrqOq85)Mk8U|FLlDKziR02mEqk}ICJ328{AC#K~=BwEtiJ7u$q?<$FG z?XMFi>)o9P@<8NeCC;06>)N$z-bZ_M3r!KX`UoYaJT;H2rfpPPui7O|*e6Z6wU&)M zZH=|Q31bC~Lp5R|kSBd1Hd{g|A%M-)Sg9gDZYF-fk-Mc6D0K@x zZ57fmPIP|6wJwpX-XXFb%Zg~rYgl7{aDp}%deLA~h{x|`7hGE4IV-(rDp*Y}DNv;< z_||JsMVObf+t3=`dD0jCOzY&2vbi0KPgBXKe&GLyoiCmZl(Gy|?AjfV+`SUw;$|QQ zb(<2B$J3+joxXfAQ8gW%sz6Bf=nK#CpuV?vRS_twnVy-^QpAEg^-`f7#p*IQaoYFt zd%IR^KTgT^c)Jv#k4*G6Od}c*>H}N@-t845Pvhdp!X87PCf8Y_ptqs;TYfLO=#|6M zWGLCLZ_fQ1Z=?1T({Hw)O{_mku3H{;@f~sTr5Ej>&F-U8R8nlS_G`6&AT7wmSw4l3 zWs~}AQsR|Q0d>~HKCj)7zYwTyI03E)nRJtXkZ9_*5$s+`&rM5Ll9_EW0NPY;&!@T< z>W!$5B7NYXw!w$Hh?+wDLhwC#Kb)}W)7CP2p|tRy{4AM9=~5!^X9>d`8=tK*)V*{r0K9HeZgb+(nxmJ zby~ZgNK<;DOC5d@nR@>bY0?CJS4VS)cZDj(E-_2{YlA!n1Yb(+zjn?jG4~Yx2sB5R zJ)6+A%|+Jv274yE%1(h107~`2UdcqI^lb)E63nQ2Ae%yFUdpD44!Yj;6Hpf_MxLw99(>duJtIBJMs*!^CqimkaUI_+r|%w9il%C;?RrwbX7>vo zb*Z2azeF|;1>ffR2a9!|Qt!7(rA&F5{T*75c|b@6{0@D)4viP_e5M9Mm*&JZ?3jJH z_di1&!YaUPdn#I<$C&ZBEgYg6S7ee`Ue zd+#aG3YvSDROV2nUGu7zvsA8jMv3rq?=Fon`3{vC)uH5E!Zk!wr&2h6IHQl|kI&!m zzVsfHhyh1^v1`%0y==tJI1hBOtoE3C)RiG;dEvqZ5V<5XSYjU)MnrS-kM_n2X8V9j zPtM%ukc<%VEZcWd^ z5wcFnI|jMaZvVOqS2`YCMebh+NYxP1FueAoN}WEOJ+vihjRUWHH-_v*Rdmj65usxW4kdqKUrobh3VLFB72X?Dj#5>iQ zQw-;Nuq{q$4fX!d1W2B8Kk5Zm-;MfyHP3TwtKv2HYt|?-D$fE4$DYb{%_ofmP!D;H18B55Vl_mK!`TOf=E@Yo z@;l+Z7^xLZe7-Z-)uGiDZ=s2GvcR^ z`Fm=_p1h~Ra6U1DIHVnp{*O$WkG{sP%855hw8@(BnSB-=&HTX5xRk9GbZ5*5ePs_x z%ZT>Y*4{r;0)aJZ8X8#8nm!&1%~GnD$=ij#&;P><47LCG)R2n&ADc}}8S Date: Wed, 6 Apr 2022 17:42:54 +0200 Subject: [PATCH 34/47] [Discover] Disable Load surrounding documents button if "Context step size" is 0 (#129586) * [Discover] Disable Load surrounding documents button if "Context step size" is 0 #94898 * [Discover] Update tests --- .../components/action_bar/action_bar.test.tsx | 12 ++++++++++++ .../context/components/action_bar/action_bar.tsx | 3 ++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/src/plugins/discover/public/application/context/components/action_bar/action_bar.test.tsx b/src/plugins/discover/public/application/context/components/action_bar/action_bar.test.tsx index 5a4e959ccb576..db1a05fe7a9c1 100644 --- a/src/plugins/discover/public/application/context/components/action_bar/action_bar.test.tsx +++ b/src/plugins/discover/public/application/context/components/action_bar/action_bar.test.tsx @@ -79,5 +79,17 @@ describe('Test Discover Context ActionBar for successor | predecessor records', ); } }); + + test(`${type}: Load button disabled when defaultStepSize is 0`, () => { + const wrapperWhenZeroStep = mountWithIntl(); + const inputWhenZeroStep = findTestSubject(wrapperWhenZeroStep, `${type}CountPicker`); + const btnWhenZeroStep = findTestSubject(wrapperWhenZeroStep, `${type}LoadMoreButton`); + expect(btnWhenZeroStep.props().disabled).toBe(true); + btnWhenZeroStep.simulate('click'); + expect(onChangeCount).toHaveBeenCalledTimes(0); + inputWhenZeroStep.simulate('change', { target: { valueAsNumber: 3 } }); + btnWhenZeroStep.simulate('click'); + expect(onChangeCount).toHaveBeenCalledTimes(1); + }); }); }); diff --git a/src/plugins/discover/public/application/context/components/action_bar/action_bar.tsx b/src/plugins/discover/public/application/context/components/action_bar/action_bar.tsx index 07cb6029a77de..0168e2f82e508 100644 --- a/src/plugins/discover/public/application/context/components/action_bar/action_bar.tsx +++ b/src/plugins/discover/public/application/context/components/action_bar/action_bar.tsx @@ -71,6 +71,7 @@ export function ActionBar({ const showWarning = !isDisabled && !isLoading && docCountAvailable < docCount; const isSuccessor = type === SurrDocType.SUCCESSORS; const [newDocCount, setNewDocCount] = useState(docCount); + const canLoadMore = defaultStepSize > 0 || newDocCount !== docCount; const isValid = (value: number) => value >= MIN_CONTEXT_SIZE && value <= MAX_CONTEXT_SIZE; const onSubmit = (ev: React.FormEvent) => { ev.preventDefault(); @@ -92,7 +93,7 @@ export function ActionBar({ { const value = newDocCount + defaultStepSize; From 554ee7b89d2974b57a6900a87f28c44ec79e2b78 Mon Sep 17 00:00:00 2001 From: Baturalp Gurdin <9674241+suchcodemuchwow@users.noreply.github.com> Date: Wed, 6 Apr 2022 18:44:33 +0300 Subject: [PATCH 35/47] add env vars to collect extra fields on apm for performance tests (#129592) --- x-pack/test/performance/config.playwright.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/x-pack/test/performance/config.playwright.ts b/x-pack/test/performance/config.playwright.ts index 72f809b07017c..cc290ee19d2fa 100644 --- a/x-pack/test/performance/config.playwright.ts +++ b/x-pack/test/performance/config.playwright.ts @@ -44,6 +44,17 @@ export default async function ({ readConfigFile, log }: FtrConfigProviderContext ELASTIC_APM_TRANSACTION_SAMPLE_RATE: '1.0', ELASTIC_APM_SERVER_URL: APM_SERVER_URL, ELASTIC_APM_SECRET_TOKEN: APM_PUBLIC_TOKEN, + // capture request body for both errors and request transactions + // https://www.elastic.co/guide/en/apm/agent/nodejs/current/configuration.html#capture-body + ELASTIC_APM_CAPTURE_BODY: 'all', + // capture request headers + // https://www.elastic.co/guide/en/apm/agent/nodejs/current/configuration.html#capture-headers + ELASTIC_APM_CAPTURE_HEADERS: true, + // request body with bigger size will be trimmed. + // 300_000 is the default of the APM server. + // for a body with larger size, we might need to reconfigure the APM server to increase the limit. + // https://www.elastic.co/guide/en/apm/agent/nodejs/current/configuration.html#long-field-max-length + ELASTIC_APM_LONG_FIELD_MAX_LENGTH: 300_000, ELASTIC_APM_GLOBAL_LABELS: Object.entries({ ftrConfig: `x-pack/test/performance/tests/config.playwright`, performancePhase: process.env.TEST_PERFORMANCE_PHASE, From f5d008e1083f04c0829310be4fb8c681d17a5d01 Mon Sep 17 00:00:00 2001 From: spalger Date: Wed, 6 Apr 2022 10:52:33 -0500 Subject: [PATCH 36/47] skip flaky suite (#129380) --- .../tests/alerting/builtin_alert_types/es_query/alert.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/es_query/alert.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/es_query/alert.ts index e62ad1db4a652..cf2cb8c6b0f1c 100644 --- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/es_query/alert.ts +++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/es_query/alert.ts @@ -37,7 +37,8 @@ export default function alertTests({ getService }: FtrProviderContext) { const esTestIndexTool = new ESTestIndexTool(es, retry); const esTestIndexToolOutput = new ESTestIndexTool(es, retry, ES_TEST_OUTPUT_INDEX_NAME); - describe('alert', async () => { + // FLAKY: https://github.com/elastic/kibana/issues/129380 + describe.skip('alert', async () => { let endDate: string; let actionId: string; const objectRemover = new ObjectRemover(supertest); From 3361c822f8c2aab4cbcd59ad892c7985f764d99c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Efe=20G=C3=BCrkan=20YALAMAN?= Date: Wed, 6 Apr 2022 17:52:57 +0200 Subject: [PATCH 37/47] [App Search] Add refresh to history panels (#129463) * Add refresh button to Curation history data panels * Update logic test Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> --- .../curation/automated_curation_history.tsx | 35 +++++++++++++----- .../automated_curations_history_panel.tsx | 34 ++++++++++++----- .../ignored_queries_logic.test.ts | 3 ++ .../ignored_queries_logic.ts | 1 + .../ignored_queries_panel.tsx | 36 +++++++++++++----- .../rejected_curations_history_panel.tsx | 37 ++++++++++++++----- 6 files changed, 110 insertions(+), 36 deletions(-) diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.tsx index 7fb91daf2e590..e49ca8974ca2d 100644 --- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.tsx @@ -5,8 +5,9 @@ * 2.0. */ -import React from 'react'; +import React, { useState } from 'react'; +import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem } from '@elastic/eui'; import { i18n } from '@kbn/i18n'; import { EntSearchLogStream } from '../../../../shared/log_stream'; @@ -18,6 +19,7 @@ interface Props { } export const AutomatedCurationHistory: React.FC = ({ query, engineName }) => { + const [endTimestamp, setEndTimestamp] = useState(Date.now()); const filters = [ `appsearch.adaptive_relevance.query: ${query}`, 'event.kind: event', @@ -31,14 +33,28 @@ export const AutomatedCurationHistory: React.FC = ({ query, engineName }) - {i18n.translate( - 'xpack.enterpriseSearch.appSearch.engine.curation.detail.historyTableTitle', - { - defaultMessage: 'Adaptive relevance changes', - } - )} - + + + {i18n.translate( + 'xpack.enterpriseSearch.appSearch.engine.curation.detail.historyTableTitle', + { defaultMessage: 'Adaptive relevance changes' } + )} + + + setEndTimestamp(Date.now())} + > + {i18n.translate( + 'xpack.enterpriseSearch.appSearch.engines.apiLogs.newEventsButtonLabel', + { + defaultMessage: 'Refresh', + } + )} + + + } subtitle={i18n.translate( 'xpack.enterpriseSearch.appSearch.engine.curation.detail.historyTableDescription', @@ -51,6 +67,7 @@ export const AutomatedCurationHistory: React.FC = ({ query, engineName }) > diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.tsx index 6a82108b971c7..db47bd1841736 100644 --- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.tsx @@ -5,10 +5,11 @@ * 2.0. */ -import React from 'react'; +import React, { useState } from 'react'; import { useValues } from 'kea'; +import { EuiFlexGroup, EuiFlexItem, EuiButtonEmpty } from '@elastic/eui'; import { i18n } from '@kbn/i18n'; import { ENTERPRISE_SEARCH_RELEVANCE_LOGS_SOURCE_ID } from '../../../../../../../../common/constants'; @@ -18,6 +19,7 @@ import { EngineLogic } from '../../../../engine'; export const AutomatedCurationsHistoryPanel: React.FC = () => { const { engineName } = useValues(EngineLogic); + const [endTimestamp, setEndTimestamp] = useState(Date.now()); const filters = [ 'event.kind: event', @@ -31,14 +33,27 @@ export const AutomatedCurationsHistoryPanel: React.FC = () => { - {i18n.translate( - 'xpack.enterpriseSearch.appSearch.engine.curations.automatedCurationsHistoryPanel.tableTitle', - { - defaultMessage: 'Adaptive relevance changes', - } - )} - + + + {i18n.translate( + 'xpack.enterpriseSearch.appSearch.engine.curations.automatedCurationsHistoryPanel.tableTitle', + { + defaultMessage: 'Adaptive relevance changes', + } + )} + + + setEndTimestamp(Date.now())} + > + {i18n.translate('xpack.enterpriseSearch.appSearch.engines.curations.refreshButton', { + defaultMessage: 'Refresh', + })} + + + } subtitle={i18n.translate( 'xpack.enterpriseSearch.appSearch.engine.curations.automatedCurationsHistoryPanel.tableDecription', @@ -53,6 +68,7 @@ export const AutomatedCurationsHistoryPanel: React.FC = () => { sourceId={ENTERPRISE_SEARCH_RELEVANCE_LOGS_SOURCE_ID} hoursAgo={720} query={filters.join(' and ')} + endTimestamp={endTimestamp} columns={[ { type: 'field', diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_logic.test.ts index fd6589330e43f..7e7702b4e5d67 100644 --- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_logic.test.ts +++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_logic.test.ts @@ -95,6 +95,7 @@ describe('IgnoredQueriesLogic', () => { describe('listeners', () => { describe('loadIgnoredQueries', () => { it('should make an API call and set suggestions & meta state', async () => { + mount({ ...DEFAULT_VALUES, dataLoading: false }); http.post.mockReturnValueOnce( Promise.resolve({ results: [{ query: 'first query' }, { query: 'second query' }], @@ -111,6 +112,8 @@ describe('IgnoredQueriesLogic', () => { jest.spyOn(IgnoredQueriesLogic.actions, 'onIgnoredQueriesLoad'); IgnoredQueriesLogic.actions.loadIgnoredQueries(); + expect(IgnoredQueriesLogic.values).toEqual({ ...DEFAULT_VALUES, dataLoading: true }); + await nextTick(); expect(http.post).toHaveBeenCalledWith( diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_logic.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_logic.ts index 798117ec353d4..a2f3a22ab2126 100644 --- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_logic.ts +++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_logic.ts @@ -58,6 +58,7 @@ export const IgnoredQueriesLogic = kea true, onIgnoredQueriesLoad: () => false, }, ], diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_panel.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_panel.tsx index 7d024d2bf9428..b3adf5b62b32f 100644 --- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_panel.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/ignored_queries_panel/ignored_queries_panel.tsx @@ -9,7 +9,13 @@ import React, { useEffect } from 'react'; import { useActions, useValues } from 'kea'; -import { EuiBasicTable, EuiBasicTableColumn } from '@elastic/eui'; +import { + EuiBasicTable, + EuiBasicTableColumn, + EuiFlexGroup, + EuiFlexItem, + EuiButtonEmpty, +} from '@elastic/eui'; import { i18n } from '@kbn/i18n'; @@ -67,14 +73,26 @@ export const IgnoredQueriesPanel: React.FC = () => { - {i18n.translate( - 'xpack.enterpriseSearch.appSearch.curations.ignoredSuggestionsPanel.title', - { - defaultMessage: 'Ignored queries', - } - )} - + + + {i18n.translate( + 'xpack.enterpriseSearch.appSearch.curations.ignoredSuggestionsPanel.title', + { + defaultMessage: 'Ignored queries', + } + )} + + + loadIgnoredQueries()}> + {i18n.translate( + 'xpack.enterpriseSearch.appSearch.curations.ignoredSuggestionsPanel.refresh', + { + defaultMessage: 'Refresh', + } + )} + + + } subtitle={ diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.tsx index 431711132cf7c..84907da4c3ef7 100644 --- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.tsx @@ -5,10 +5,11 @@ * 2.0. */ -import React from 'react'; +import React, { useState } from 'react'; import { useValues } from 'kea'; +import { EuiFlexGroup, EuiFlexItem, EuiButtonEmpty } from '@elastic/eui'; import { i18n } from '@kbn/i18n'; import { ENTERPRISE_SEARCH_RELEVANCE_LOGS_SOURCE_ID } from '../../../../../../../../common/constants'; @@ -18,6 +19,7 @@ import { EngineLogic } from '../../../../engine'; export const RejectedCurationsHistoryPanel: React.FC = () => { const { engineName } = useValues(EngineLogic); + const [endTimestamp, setEndTimestamp] = useState(Date.now()); const filters = [ 'event.kind: event', @@ -31,14 +33,30 @@ export const RejectedCurationsHistoryPanel: React.FC = () => { - {i18n.translate( - 'xpack.enterpriseSearch.appSearch.engine.curations.rejectedCurationsHistoryPanel.tableTitle', - { - defaultMessage: 'Recently rejected suggestions', - } - )} - + + + {i18n.translate( + 'xpack.enterpriseSearch.appSearch.engine.curations.rejectedCurationsHistoryPanel.tableTitle', + { + defaultMessage: 'Recently rejected suggestions', + } + )} + + + setEndTimestamp(Date.now())} + > + {i18n.translate( + 'xpack.enterpriseSearch.appSearch.engines.curations.rejectedCurationsHistoryPanel.refresh', + { + defaultMessage: 'Refresh', + } + )} + + + } subtitle={i18n.translate( 'xpack.enterpriseSearch.appSearch.engine.curations.rejectedCurationsHistoryPanel.tableDescription', @@ -52,6 +70,7 @@ export const RejectedCurationsHistoryPanel: React.FC = () => { sourceId={ENTERPRISE_SEARCH_RELEVANCE_LOGS_SOURCE_ID} hoursAgo={720} query={filters.join(' and ')} + endTimestamp={endTimestamp} columns={[ { type: 'field', From b1ea2289a1f244f7d99f976dab56d5af53c677ff Mon Sep 17 00:00:00 2001 From: Nicolas Chaulet Date: Wed, 6 Apr 2022 12:58:49 -0400 Subject: [PATCH 38/47] [Fleet] Fix missing encryption key requirements make it optionnal (#129593) --- .../plugins/fleet/common/openapi/bundled.json | 550 ++++-------------- .../plugins/fleet/common/openapi/bundled.yaml | 6 + .../schemas/fleet_status_response.yaml | 6 + .../common/types/rest_spec/fleet_setup.ts | 8 +- .../fleet/sections/agents/index.test.tsx | 117 ++++ .../edit_output_flyout/index.test.tsx | 2 +- .../edit_output_flyout/use_output_form.tsx | 2 +- .../epm/screens/detail/index.test.tsx | 6 +- .../fleet/public/hooks/use_fleet_status.tsx | 2 + .../fleet/server/routes/setup/handlers.ts | 9 +- 10 files changed, 261 insertions(+), 447 deletions(-) create mode 100644 x-pack/plugins/fleet/public/applications/fleet/sections/agents/index.test.tsx diff --git a/x-pack/plugins/fleet/common/openapi/bundled.json b/x-pack/plugins/fleet/common/openapi/bundled.json index dfc257b2bfe1e..77dd66a5c20d1 100644 --- a/x-pack/plugins/fleet/common/openapi/bundled.json +++ b/x-pack/plugins/fleet/common/openapi/bundled.json @@ -115,10 +115,7 @@ "type": "string" } }, - "required": [ - "name", - "version" - ] + "required": ["name", "version"] } } } @@ -340,21 +337,13 @@ "properties": { "status": { "type": "string", - "enum": [ - "installed", - "installing", - "install_failed", - "not_installed" - ] + "enum": ["installed", "installing", "install_failed", "not_installed"] }, "savedObject": { "type": "string" } }, - "required": [ - "status", - "savedObject" - ] + "required": ["status", "savedObject"] } ] } @@ -410,16 +399,11 @@ ] } }, - "required": [ - "id", - "type" - ] + "required": ["id", "type"] } } }, - "required": [ - "response" - ] + "required": ["response"] } } } @@ -478,16 +462,11 @@ ] } }, - "required": [ - "id", - "type" - ] + "required": ["id", "type"] } } }, - "required": [ - "response" - ] + "required": ["response"] } } } @@ -539,21 +518,13 @@ "properties": { "status": { "type": "string", - "enum": [ - "installed", - "installing", - "install_failed", - "not_installed" - ] + "enum": ["installed", "installing", "install_failed", "not_installed"] }, "savedObject": { "type": "string" } }, - "required": [ - "status", - "savedObject" - ] + "required": ["status", "savedObject"] } ] } @@ -616,10 +587,7 @@ ] } }, - "required": [ - "id", - "type" - ] + "required": ["id", "type"] } }, "_meta": { @@ -627,18 +595,12 @@ "properties": { "install_source": { "type": "string", - "enum": [ - "registry", - "upload", - "bundled" - ] + "enum": ["registry", "upload", "bundled"] } } } }, - "required": [ - "items" - ] + "required": ["items"] } } } @@ -699,16 +661,11 @@ ] } }, - "required": [ - "id", - "type" - ] + "required": ["id", "type"] } } }, - "required": [ - "items" - ] + "required": ["items"] } } } @@ -779,16 +736,11 @@ ] } }, - "required": [ - "id", - "type" - ] + "required": ["id", "type"] } } }, - "required": [ - "items" - ] + "required": ["items"] } } } @@ -888,9 +840,7 @@ "$ref": "#/components/schemas/package_usage_stats" } }, - "required": [ - "response" - ] + "required": ["response"] } } } @@ -965,10 +915,7 @@ "type": "string" } }, - "required": [ - "admin_username", - "admin_password" - ] + "required": ["admin_username", "admin_password"] } } } @@ -1209,9 +1156,7 @@ "type": "string" } }, - "required": [ - "success" - ] + "required": ["success"] } } } @@ -1272,9 +1217,7 @@ "$ref": "#/components/schemas/agent" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -1297,9 +1240,7 @@ "$ref": "#/components/schemas/agent" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -1325,14 +1266,10 @@ "properties": { "action": { "type": "string", - "enum": [ - "deleted" - ] + "enum": ["deleted"] } }, - "required": [ - "action" - ] + "required": ["action"] } } } @@ -1452,9 +1389,7 @@ "type": "string" } }, - "required": [ - "policy_id" - ] + "required": ["policy_id"] } } } @@ -1501,9 +1436,7 @@ }, "statusCode": { "type": "number", - "enum": [ - 400 - ] + "enum": [400] } } } @@ -1611,9 +1544,7 @@ "type": "string" } }, - "required": [ - "success" - ] + "required": ["success"] } } } @@ -1649,10 +1580,7 @@ ] } }, - "required": [ - "policy_id", - "agents" - ] + "required": ["policy_id", "agents"] } } } @@ -1680,9 +1608,7 @@ "type": "string" } }, - "required": [ - "success" - ] + "required": ["success"] } } } @@ -1721,9 +1647,7 @@ ] } }, - "required": [ - "agents" - ] + "required": ["agents"] } } } @@ -1758,12 +1682,7 @@ "type": "number" } }, - "required": [ - "items", - "total", - "page", - "perPage" - ] + "required": ["items", "total", "page", "perPage"] } } } @@ -1847,9 +1766,7 @@ "$ref": "#/components/schemas/agent_policy" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -1874,9 +1791,7 @@ "$ref": "#/components/schemas/agent_policy" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -1930,9 +1845,7 @@ "$ref": "#/components/schemas/agent_policy" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -1951,9 +1864,7 @@ "type": "string" } }, - "required": [ - "name" - ] + "required": ["name"] } } }, @@ -1980,10 +1891,7 @@ "type": "boolean" } }, - "required": [ - "id", - "success" - ] + "required": ["id", "success"] } } } @@ -1999,9 +1907,7 @@ "type": "string" } }, - "required": [ - "agentPolicyId" - ] + "required": ["agentPolicyId"] } } } @@ -2077,12 +1983,7 @@ "type": "number" } }, - "required": [ - "items", - "page", - "perPage", - "total" - ] + "required": ["items", "page", "perPage", "total"] } } } @@ -2108,9 +2009,7 @@ }, "action": { "type": "string", - "enum": [ - "created" - ] + "enum": ["created"] } } } @@ -2153,9 +2052,7 @@ "$ref": "#/components/schemas/enrollment_api_key" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -2177,14 +2074,10 @@ "properties": { "action": { "type": "string", - "enum": [ - "deleted" - ] + "enum": ["deleted"] } }, - "required": [ - "action" - ] + "required": ["action"] } } } @@ -2234,12 +2127,7 @@ "type": "number" } }, - "required": [ - "items", - "page", - "perPage", - "total" - ] + "required": ["items", "page", "perPage", "total"] } } } @@ -2264,9 +2152,7 @@ }, "action": { "type": "string", - "enum": [ - "created" - ] + "enum": ["created"] } } } @@ -2308,9 +2194,7 @@ "$ref": "#/components/schemas/enrollment_api_key" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -2331,14 +2215,10 @@ "properties": { "action": { "type": "string", - "enum": [ - "deleted" - ] + "enum": ["deleted"] } }, - "required": [ - "action" - ] + "required": ["action"] } } } @@ -2380,9 +2260,7 @@ "type": "number" } }, - "required": [ - "items" - ] + "required": ["items"] } } } @@ -2408,9 +2286,7 @@ "$ref": "#/components/schemas/package_policy" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -2472,9 +2348,7 @@ "type": "boolean" } }, - "required": [ - "packagePolicyIds" - ] + "required": ["packagePolicyIds"] } } } @@ -2499,10 +2373,7 @@ "type": "boolean" } }, - "required": [ - "id", - "success" - ] + "required": ["id", "success"] } } } @@ -2533,9 +2404,7 @@ } } }, - "required": [ - "packagePolicyIds" - ] + "required": ["packagePolicyIds"] } } } @@ -2560,10 +2429,7 @@ "type": "boolean" } }, - "required": [ - "id", - "success" - ] + "required": ["id", "success"] } } } @@ -2592,9 +2458,7 @@ "type": "string" } }, - "required": [ - "packagePolicyIds" - ] + "required": ["packagePolicyIds"] } } } @@ -2619,9 +2483,7 @@ "$ref": "#/components/schemas/upgrade_agent_diff" } }, - "required": [ - "hasErrors" - ] + "required": ["hasErrors"] } } } @@ -2646,9 +2508,7 @@ "$ref": "#/components/schemas/package_policy" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -2693,10 +2553,7 @@ "type": "boolean" } }, - "required": [ - "item", - "sucess" - ] + "required": ["item", "sucess"] } } } @@ -2779,9 +2636,7 @@ }, "type": { "type": "string", - "enum": [ - "elasticsearch" - ] + "enum": ["elasticsearch"] }, "is_default": { "type": "boolean" @@ -2802,10 +2657,7 @@ "type": "string" } }, - "required": [ - "name", - "type" - ] + "required": ["name", "type"] } } } @@ -2829,9 +2681,7 @@ "$ref": "#/components/schemas/output" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -2864,9 +2714,7 @@ "type": "string" } }, - "required": [ - "id" - ] + "required": ["id"] } } } @@ -2892,9 +2740,7 @@ }, "type": { "type": "string", - "enum": [ - "elasticsearch" - ] + "enum": ["elasticsearch"] }, "is_default": { "type": "boolean" @@ -2918,10 +2764,7 @@ "type": "string" } }, - "required": [ - "name", - "type" - ] + "required": ["name", "type"] } } } @@ -2938,9 +2781,7 @@ "$ref": "#/components/schemas/output" } }, - "required": [ - "item" - ] + "required": ["item"] } } } @@ -3059,17 +2900,11 @@ "type": "string" } }, - "required": [ - "name", - "message" - ] + "required": ["name", "message"] } } }, - "required": [ - "isInitialized", - "nonFatalErrors" - ] + "required": ["isInitialized", "nonFatalErrors"] }, "preconfigured_agent_policies": { "title": "Preconfigured agent policies", @@ -3091,10 +2926,7 @@ "type": "array", "items": { "type": "string", - "enum": [ - "logs", - "metrics" - ] + "enum": ["logs", "metrics"] } }, "namespace": { @@ -3191,20 +3023,14 @@ } } }, - "required": [ - "type" - ] + "required": ["type"] } } } } } }, - "required": [ - "name", - "namespace", - "package_policies" - ] + "required": ["name", "namespace", "package_policies"] }, "settings": { "title": "Settings", @@ -3226,10 +3052,7 @@ } } }, - "required": [ - "fleet_server_hosts", - "id" - ] + "required": ["fleet_server_hosts", "id"] }, "fleet_settings_response": { "title": "Fleet settings response", @@ -3239,9 +3062,7 @@ "$ref": "#/components/schemas/settings" } }, - "required": [ - "item" - ] + "required": ["item"] }, "get_categories_response": { "title": "Get categories response", @@ -3263,11 +3084,7 @@ "type": "number" } }, - "required": [ - "id", - "title", - "count" - ] + "required": ["id", "title", "count"] } }, "items": { @@ -3285,17 +3102,11 @@ "type": "number" } }, - "required": [ - "id", - "title", - "count" - ] + "required": ["id", "title", "count"] } } }, - "required": [ - "items" - ] + "required": ["items"] }, "search_result": { "title": "Search result", @@ -3362,9 +3173,7 @@ } } }, - "required": [ - "items" - ] + "required": ["items"] }, "bulk_install_packages_response": { "title": "Bulk install packages response", @@ -3400,9 +3209,7 @@ } } }, - "required": [ - "items" - ] + "required": ["items"] }, "package_info": { "title": "Package information", @@ -3482,10 +3289,7 @@ "type": "string" } }, - "required": [ - "src", - "path" - ] + "required": ["src", "path"] } }, "icons": { @@ -3535,10 +3339,7 @@ "type": "string" } }, - "required": [ - "name", - "default" - ] + "required": ["name", "default"] } }, "type": { @@ -3548,14 +3349,7 @@ "type": "string" } }, - "required": [ - "title", - "name", - "release", - "ingeset_pipeline", - "type", - "package" - ] + "required": ["title", "name", "release", "ingeset_pipeline", "type", "package"] } }, "download": { @@ -3617,9 +3411,7 @@ "type": "integer" } }, - "required": [ - "agent_policy_count" - ] + "required": ["agent_policy_count"] }, "fleet_status_response": { "title": "Fleet status response", @@ -3632,29 +3424,23 @@ "type": "array", "items": { "type": "string", - "enum": [ - "tls_required", - "api_keys", - "fleet_admin_user", - "fleet_server", - "encrypted_saved_object_encryption_key_required" - ] + "enum": ["tls_required", "api_keys", "fleet_admin_user", "fleet_server"] + } + }, + "missing_optional_features": { + "type": "array", + "items": { + "type": "string", + "enum": ["encrypted_saved_object_encryption_key_required"] } } }, - "required": [ - "isReady", - "missing_requirements" - ] + "required": ["isReady", "missing_requirements", "missing_optional_features"] }, "agent_type": { "type": "string", "title": "Agent type", - "enum": [ - "PERMANENT", - "EPHEMERAL", - "TEMPORARY" - ] + "enum": ["PERMANENT", "EPHEMERAL", "TEMPORARY"] }, "agent_metadata": { "title": "Agent metadata", @@ -3663,13 +3449,7 @@ "agent_status": { "type": "string", "title": "Agent status", - "enum": [ - "offline", - "error", - "online", - "inactive", - "warning" - ] + "enum": ["offline", "error", "online", "inactive", "warning"] }, "agent": { "title": "Agent", @@ -3724,13 +3504,7 @@ "type": "string" } }, - "required": [ - "type", - "active", - "enrolled_at", - "id", - "status" - ] + "required": ["type", "active", "enrolled_at", "id", "status"] }, "get_agents_response": { "title": "Get Agent response", @@ -3759,12 +3533,7 @@ "type": "number" } }, - "required": [ - "items", - "total", - "page", - "perPage" - ] + "required": ["items", "total", "page", "perPage"] }, "bulk_upgrade_agents": { "title": "Bulk upgrade agents", @@ -3790,10 +3559,7 @@ ] } }, - "required": [ - "agents", - "version" - ] + "required": ["agents", "version"] }, "upgrade_agent": { "title": "Upgrade agent", @@ -3805,9 +3571,7 @@ "type": "string" } }, - "required": [ - "version" - ] + "required": ["version"] }, { "type": "object", @@ -3819,9 +3583,7 @@ "type": "string" } }, - "required": [ - "version" - ] + "required": ["version"] } ] }, @@ -3838,12 +3600,7 @@ }, "type": { "type": "string", - "enum": [ - "POLICY_CHANGE", - "UNENROLL", - "UPGRADE", - "POLICY_REASSIGN" - ] + "enum": ["POLICY_CHANGE", "UNENROLL", "UPGRADE", "POLICY_REASSIGN"] } } }, @@ -3857,12 +3614,7 @@ "properties": { "log_level": { "type": "string", - "enum": [ - "debug", - "info", - "warning", - "error" - ] + "enum": ["debug", "info", "warning", "error"] } } } @@ -3890,10 +3642,7 @@ "type": "array", "items": { "type": "string", - "enum": [ - "metrics", - "logs" - ] + "enum": ["metrics", "logs"] } }, "data_output_id": { @@ -3905,10 +3654,7 @@ "nullable": true } }, - "required": [ - "name", - "namespace" - ] + "required": ["name", "namespace"] }, "new_package_policy": { "title": "New package policy", @@ -3931,10 +3677,7 @@ "type": "string" } }, - "required": [ - "name", - "version" - ] + "required": ["name", "version"] }, "namespace": { "type": "string" @@ -3970,10 +3713,7 @@ "type": "object" } }, - "required": [ - "type", - "enabled" - ] + "required": ["type", "enabled"] } }, "policy_id": { @@ -3986,10 +3726,7 @@ "type": "string" } }, - "required": [ - "inputs", - "name" - ] + "required": ["inputs", "name"] }, "package_policy": { "title": "Package policy", @@ -4008,10 +3745,7 @@ "items": {} } }, - "required": [ - "id", - "revision" - ] + "required": ["id", "revision"] }, { "$ref": "#/components/schemas/new_package_policy" @@ -4031,10 +3765,7 @@ }, "status": { "type": "string", - "enum": [ - "active", - "inactive" - ] + "enum": ["active", "inactive"] }, "packagePolicies": { "oneOf": [ @@ -4072,10 +3803,7 @@ "type": "number" } }, - "required": [ - "id", - "status" - ] + "required": ["id", "status"] } ] }, @@ -4152,13 +3880,7 @@ "type": "string" } }, - "required": [ - "id", - "api_key_id", - "api_key", - "active", - "created_at" - ] + "required": ["id", "api_key_id", "api_key", "active", "created_at"] }, "upgrade_diff": { "title": "Package policy Upgrade dryrun", @@ -4224,16 +3946,10 @@ "type": "string" } }, - "required": [ - "dataset", - "type" - ] + "required": ["dataset", "type"] } }, - "required": [ - "id", - "data_stream" - ] + "required": ["id", "data_stream"] } ] }, @@ -4263,9 +3979,7 @@ "type": "string" } }, - "required": [ - "namespace" - ] + "required": ["namespace"] }, "use_output": { "type": "string" @@ -4284,10 +3998,7 @@ "type": "string" } }, - "required": [ - "name", - "version" - ] + "required": ["name", "version"] } } }, @@ -4295,14 +4006,7 @@ "$ref": "#/components/schemas/full_agent_policy_input_stream" } }, - "required": [ - "id", - "name", - "revision", - "type", - "data_stream", - "use_output" - ] + "required": ["id", "name", "revision", "type", "data_stream", "use_output"] } ] }, @@ -4340,11 +4044,7 @@ "type": "string" } }, - "required": [ - "name", - "title", - "version" - ] + "required": ["name", "title", "version"] }, "namespace": { "type": "string" @@ -4380,11 +4080,7 @@ "type": "object" } }, - "required": [ - "type", - "enabled", - "streams" - ] + "required": ["type", "enabled", "streams"] } }, "policy_id": { @@ -4400,12 +4096,7 @@ "type": "boolean" } }, - "required": [ - "name", - "namespace", - "policy_id", - "enabled" - ] + "required": ["name", "namespace", "policy_id", "enabled"] }, "output": { "title": "Output", @@ -4425,9 +4116,7 @@ }, "type": { "type": "string", - "enum": [ - "elasticsearch" - ] + "enum": ["elasticsearch"] }, "hosts": { "type": "array", @@ -4465,12 +4154,7 @@ } } }, - "required": [ - "id", - "is_default", - "name", - "type" - ] + "required": ["id", "is_default", "name", "type"] } } }, @@ -4479,4 +4163,4 @@ "basicAuth": [] } ] -} \ No newline at end of file +} diff --git a/x-pack/plugins/fleet/common/openapi/bundled.yaml b/x-pack/plugins/fleet/common/openapi/bundled.yaml index d91ebd515600d..1592f4124fbb7 100644 --- a/x-pack/plugins/fleet/common/openapi/bundled.yaml +++ b/x-pack/plugins/fleet/common/openapi/bundled.yaml @@ -2277,10 +2277,16 @@ components: - api_keys - fleet_admin_user - fleet_server + missing_optional_features: + type: array + items: + type: string + enum: - encrypted_saved_object_encryption_key_required required: - isReady - missing_requirements + - missing_optional_features agent_type: type: string title: Agent type diff --git a/x-pack/plugins/fleet/common/openapi/components/schemas/fleet_status_response.yaml b/x-pack/plugins/fleet/common/openapi/components/schemas/fleet_status_response.yaml index 0d0c3db134386..cf0f0f60084da 100644 --- a/x-pack/plugins/fleet/common/openapi/components/schemas/fleet_status_response.yaml +++ b/x-pack/plugins/fleet/common/openapi/components/schemas/fleet_status_response.yaml @@ -12,7 +12,13 @@ properties: - 'api_keys' - 'fleet_admin_user' - 'fleet_server' + missing_optional_features: + type: array + items: + type: string + enum: - 'encrypted_saved_object_encryption_key_required' required: - isReady - missing_requirements + - missing_optional_features diff --git a/x-pack/plugins/fleet/common/types/rest_spec/fleet_setup.ts b/x-pack/plugins/fleet/common/types/rest_spec/fleet_setup.ts index 198aa111c6fb0..5204b7bfbdbd1 100644 --- a/x-pack/plugins/fleet/common/types/rest_spec/fleet_setup.ts +++ b/x-pack/plugins/fleet/common/types/rest_spec/fleet_setup.ts @@ -13,11 +13,7 @@ export interface PostFleetSetupResponse { export interface GetFleetStatusResponse { isReady: boolean; missing_requirements: Array< - | 'security_required' - | 'tls_required' - | 'api_keys' - | 'fleet_admin_user' - | 'fleet_server' - | 'encrypted_saved_object_encryption_key_required' + 'security_required' | 'tls_required' | 'api_keys' | 'fleet_admin_user' | 'fleet_server' >; + missing_optional_features: Array<'encrypted_saved_object_encryption_key_required'>; } diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/index.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/index.test.tsx new file mode 100644 index 0000000000000..35353b9aaae3d --- /dev/null +++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/index.test.tsx @@ -0,0 +1,117 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; + +import { createFleetTestRendererMock } from '../../../../mock'; +import { useFleetStatus } from '../../../../hooks/use_fleet_status'; +import { useGetSettings } from '../../../../hooks/use_request/settings'; +import { useAuthz } from '../../../../hooks/use_authz'; + +import { AgentsApp } from '.'; + +jest.mock('../../../../hooks/use_fleet_status', () => ({ + FleetStatusProvider: (props: any) => { + return props.children; + }, + useFleetStatus: jest.fn().mockReturnValue({}), +})); +jest.mock('../../../../hooks/use_request/settings'); +jest.mock('../../../../hooks/use_authz'); +jest.mock('./agent_requirements_page', () => { + return { + FleetServerRequirementPage: () => <>FleetServerRequirementPage, + MissingESRequirementsPage: () => <>MissingESRequirementsPage, + }; +}); +jest.mock('./agent_list_page', () => { + return { + AgentListPage: () => <>AgentListPage, + }; +}); + +const mockedUsedFleetStatus = useFleetStatus as jest.MockedFunction; +const mockedUseGetSettings = useGetSettings as jest.MockedFunction; +const mockedUseAuthz = useAuthz as jest.MockedFunction; + +function renderAgentsApp() { + const renderer = createFleetTestRendererMock(); + renderer.mountHistory.push('/agents'); + + const utils = renderer.render(); + + return { utils }; +} +describe('AgentApp', () => { + beforeEach(() => { + mockedUseGetSettings.mockReturnValue({ + isLoading: false, + data: { + item: { + has_seen_fleet_migration_notice: true, + }, + }, + } as any); + mockedUseAuthz.mockReturnValue({ + fleet: { + all: true, + }, + } as any); + }); + + it('should render the loading component if the status is loading', async () => { + mockedUsedFleetStatus.mockReturnValue({ + isLoading: true, + enabled: true, + isReady: false, + refresh: async () => {}, + }); + const { utils } = renderAgentsApp(); + + expect(utils.container.querySelector('[data-test-subj=loadingSpinner]')).not.toBeNull(); + }); + + it('should render the missing requirement component if the status contains missing requirement', async () => { + mockedUsedFleetStatus.mockReturnValue({ + isLoading: false, + enabled: true, + isReady: false, + missingRequirements: ['api_keys'], + refresh: async () => {}, + }); + const { utils } = renderAgentsApp(); + expect(utils.queryByText('MissingESRequirementsPage')).not.toBeNull(); + expect(utils.queryByText('AgentListPage')).toBeNull(); + }); + + it('should render the FleetServerRequirementPage if the status contains only fleet server missing requirement', async () => { + mockedUsedFleetStatus.mockReturnValue({ + isLoading: false, + enabled: true, + isReady: false, + missingRequirements: ['fleet_server'], + refresh: async () => {}, + }); + const { utils } = renderAgentsApp(); + expect(utils.queryByText('FleetServerRequirementPage')).not.toBeNull(); + expect(utils.queryByText('AgentListPage')).toBeNull(); + }); + + it('should render the App if there is no missing requirements and optionnal requirements', async () => { + mockedUsedFleetStatus.mockReturnValue({ + isLoading: false, + enabled: true, + isReady: false, + missingRequirements: [], + missingOptionalFeatures: ['encrypted_saved_object_encryption_key_required'], + refresh: async () => {}, + }); + const { utils } = renderAgentsApp(); + + expect(utils.queryByText('AgentListPage')).not.toBeNull(); + }); +}); diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.test.tsx index c6d86a3fc4fbe..bd486f3c95641 100644 --- a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.test.tsx +++ b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/index.test.tsx @@ -73,7 +73,7 @@ describe('EditOutputFlyout', () => { it('should show a callout in the flyout if the selected output is logstash and no encrypted key is set', async () => { mockedUsedFleetStatus.mockReturnValue({ - missingRequirements: ['encrypted_saved_object_encryption_key_required'], + missingOptionalFeatures: ['encrypted_saved_object_encryption_key_required'], } as any); const { utils } = renderFlyout({ type: 'logstash', diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/use_output_form.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/use_output_form.tsx index a27e9ad80ddfa..da6c8b1aa3891 100644 --- a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/use_output_form.tsx +++ b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/use_output_form.tsx @@ -35,7 +35,7 @@ import { confirmUpdate } from './confirm_update'; export function useOutputForm(onSucess: () => void, output?: Output) { const fleetStatus = useFleetStatus(); - const hasEncryptedSavedObjectConfigured = !fleetStatus.missingRequirements?.includes( + const hasEncryptedSavedObjectConfigured = !fleetStatus.missingOptionalFeatures?.includes( 'encrypted_saved_object_encryption_key_required' ); diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.test.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.test.tsx index 376d6b7dd39c3..9448294109819 100644 --- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.test.tsx +++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.test.tsx @@ -527,7 +527,11 @@ The logs were tested with version 1.10. On Windows, the module was tested with Nginx installed from the Chocolatey repository. `; - const agentsSetupResponse: GetFleetStatusResponse = { isReady: true, missing_requirements: [] }; + const agentsSetupResponse: GetFleetStatusResponse = { + isReady: true, + missing_requirements: [], + missing_optional_features: [], + }; const packagePoliciesResponse: GetPackagePoliciesResponse = { items: [ diff --git a/x-pack/plugins/fleet/public/hooks/use_fleet_status.tsx b/x-pack/plugins/fleet/public/hooks/use_fleet_status.tsx index b1665f0ac2e76..b05df0c619e0a 100644 --- a/x-pack/plugins/fleet/public/hooks/use_fleet_status.tsx +++ b/x-pack/plugins/fleet/public/hooks/use_fleet_status.tsx @@ -18,6 +18,7 @@ interface FleetStatusState { isReady: boolean; error?: Error; missingRequirements?: GetFleetStatusResponse['missing_requirements']; + missingOptionalFeatures?: GetFleetStatusResponse['missing_optional_features']; } interface FleetStatus extends FleetStatusState { @@ -47,6 +48,7 @@ export const FleetStatusProvider: React.FC = ({ children }) => { isLoading: false, isReady: res.data?.isReady ?? false, missingRequirements: res.data?.missing_requirements, + missingOptionalFeatures: res.data?.missing_optional_features, })); } catch (error) { setState((s) => ({ ...s, isLoading: false, error })); diff --git a/x-pack/plugins/fleet/server/routes/setup/handlers.ts b/x-pack/plugins/fleet/server/routes/setup/handlers.ts index 83c6a25f96b09..dac5828329a22 100644 --- a/x-pack/plugins/fleet/server/routes/setup/handlers.ts +++ b/x-pack/plugins/fleet/server/routes/setup/handlers.ts @@ -21,26 +21,25 @@ export const getFleetStatusHandler: FleetRequestHandler = async (context, reques context.core.elasticsearch.client.asInternalUser ); - let isReady = true; const missingRequirements: GetFleetStatusResponse['missing_requirements'] = []; + const missingOptionalFeatures: GetFleetStatusResponse['missing_optional_features'] = []; if (!isApiKeysEnabled) { - isReady = false; missingRequirements.push('api_keys'); } if (!isFleetServerSetup) { - isReady = false; missingRequirements.push('fleet_server'); } if (!appContextService.getEncryptedSavedObjectsSetup()?.canEncrypt) { - missingRequirements.push('encrypted_saved_object_encryption_key_required'); + missingOptionalFeatures.push('encrypted_saved_object_encryption_key_required'); } const body: GetFleetStatusResponse = { - isReady, + isReady: missingRequirements.length === 0, missing_requirements: missingRequirements, + missing_optional_features: missingOptionalFeatures, }; return response.ok({ From 1c4c81521303210d10fb0e93e06152d588690ea8 Mon Sep 17 00:00:00 2001 From: Kevin Qualters <56408403+kqualters-elastic@users.noreply.github.com> Date: Wed, 6 Apr 2022 13:21:25 -0400 Subject: [PATCH 39/47] [Security Solution] Use correct title for close analyze event/session view (#129547) * Use correct title for close analyze event/session view * Add test for navigation text * Remove useless useMemo --- .../session_tab_content/translations.ts | 2 +- .../use_session_view.test.tsx | 71 ++++++++++++++++--- .../session_tab_content/use_session_view.tsx | 9 ++- 3 files changed, 69 insertions(+), 13 deletions(-) diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/translations.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/translations.ts index b2343b667dcda..1f0135e631858 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/translations.ts +++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/translations.ts @@ -17,6 +17,6 @@ export const CLOSE_ANALYZER = i18n.translate( export const CLOSE_SESSION = i18n.translate( 'xpack.securitySolution.timeline.graphOverlay.closeSessionButton', { - defaultMessage: 'Close Session', + defaultMessage: 'Close session', } ); diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/use_session_view.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/use_session_view.test.tsx index 5af19205175b2..110e581a4f6a5 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/use_session_view.test.tsx +++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/use_session_view.test.tsx @@ -7,10 +7,12 @@ import React, { memo } from 'react'; +import { render } from '@testing-library/react'; import { renderHook } from '@testing-library/react-hooks'; -import { TimelineId } from '../../../../../common/types/timeline'; -import { mockTimelineModel } from '../../../../common/mock'; +import { TimelineId, TimelineTabs } from '../../../../../common/types/timeline'; +import { mockTimelineModel, TestProviders } from '../../../../common/mock'; import { useKibana } from '../../../../common/lib/kibana'; +import { useDeepEqualSelector } from '../../../../common/hooks/use_selector'; import { useTimelineFullScreen, useGlobalFullScreen, @@ -18,12 +20,7 @@ import { import { useSessionView } from './use_session_view'; const mockDispatch = jest.fn(); -jest.mock('../../../../common/hooks/use_selector', () => ({ - useDeepEqualSelector: () => { - return 'test'; - }, - useShallowEqualSelector: () => mockTimelineModel, -})); +jest.mock('../../../../common/hooks/use_selector'); jest.mock('../../../../common/containers/use_full_screen'); @@ -86,13 +83,13 @@ jest.mock('../../side_panel/hooks/use_detail_panel', () => { }; }); -describe('useSessionView', () => { +describe('useSessionView with active timeline and a session id and graph event id', () => { let setTimelineFullScreen: jest.Mock; let setGlobalFullScreen: jest.Mock; let kibana: ReturnType; const Wrapper = memo(({ children }) => { kibana = useKibana(); - return <>{children}; + return {children}; }); Wrapper.displayName = 'Wrapper'; @@ -105,6 +102,20 @@ describe('useSessionView', () => { (useGlobalFullScreen as jest.Mock).mockImplementation(() => ({ setGlobalFullScreen, })); + (useDeepEqualSelector as jest.Mock).mockImplementation(() => { + return { + ...mockTimelineModel, + activeTab: TimelineTabs.session, + graphEventId: 'current-graph-event-id', + sessionViewConfig: { + sessionEntityId: 'test', + }, + show: true, + }; + }); + }); + afterEach(() => { + (useDeepEqualSelector as jest.Mock).mockClear(); }); it('removes the full screen class from the overlay', () => { @@ -131,7 +142,45 @@ describe('useSessionView', () => { { wrapper: Wrapper } ); const navigation = result.current.Navigation; + const renderResult = render({navigation}); + expect(renderResult.getByText('Close session')).toBeTruthy(); + }); - expect(navigation).toBeTruthy(); + describe('useSessionView with non active timeline and graph event id set', () => { + beforeEach(() => { + setTimelineFullScreen = jest.fn(); + setGlobalFullScreen = jest.fn(); + (useTimelineFullScreen as jest.Mock).mockImplementation(() => ({ + setTimelineFullScreen, + })); + (useGlobalFullScreen as jest.Mock).mockImplementation(() => ({ + setGlobalFullScreen, + })); + (useDeepEqualSelector as jest.Mock).mockImplementation(() => { + return { + ...mockTimelineModel, + graphEventId: 'current-graph-event-id', + sessionViewConfig: null, + show: true, + }; + }); + }); + afterEach(() => { + (useDeepEqualSelector as jest.Mock).mockClear(); + }); + it('renders the navigation component with the correct text for analyzer', () => { + const { result } = renderHook( + () => { + const testProps = { + timelineId: TimelineId.hostsPageEvents, + }; + return useSessionView(testProps); + }, + { wrapper: Wrapper } + ); + const navigation = result.current.Navigation; + const renderResult = render({navigation}); + expect(renderResult.getByText('Close analyzer')).toBeTruthy(); + }); }); }); diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/use_session_view.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/use_session_view.tsx index 22208610f85f8..795582dd4845c 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/use_session_view.tsx +++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/session_tab_content/use_session_view.tsx @@ -67,11 +67,18 @@ const NavigationComponent: React.FC = ({ graphEventId, activeTab, }) => { + const title = () => { + if (timelineId === TimelineId.active) { + return activeTab === TimelineTabs.graph ? i18n.CLOSE_ANALYZER : i18n.CLOSE_SESSION; + } else { + return graphEventId ? i18n.CLOSE_ANALYZER : i18n.CLOSE_SESSION; + } + }; return ( - {activeTab === TimelineTabs.graph ? i18n.CLOSE_ANALYZER : i18n.CLOSE_SESSION} + {title()} {timelineId !== TimelineId.active && ( From e046687d11949c6ef6850dff6c40880bed6ac0c0 Mon Sep 17 00:00:00 2001 From: Kaarina Tungseth Date: Wed, 6 Apr 2022 12:50:44 -0500 Subject: [PATCH 40/47] Adds the Lens 8.2.0 docs (#128986) * Adds the Lens 8.2.0 docs * Review comments * Update Discover setting * Update Discover setting * Update Discover setting Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> --- docs/setup/settings.asciidoc | 2 + .../images/lens_annotations_8.2.0.png | Bin 0 -> 53804 bytes docs/user/dashboard/lens-advanced.asciidoc | 4 +- docs/user/dashboard/lens.asciidoc | 69 +++++++++++++----- 4 files changed, 54 insertions(+), 21 deletions(-) create mode 100644 docs/user/dashboard/images/lens_annotations_8.2.0.png diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc index b0f238124a008..c0b37ba9ec6f3 100644 --- a/docs/setup/settings.asciidoc +++ b/docs/setup/settings.asciidoc @@ -682,6 +682,8 @@ sources and images. When false, Vega can only get data from {es}. *Default: `fal `exploreDataInContextMenu.enabled` | Enables the *Explore underlying data* option that allows you to open *Discover* from a dashboard panel and view the panel data. *Default: `false`* + When you create visualizations using the *Lens* drag-and-drop editor, you can use the toolbar to open and explore your data in *Discover*. For more information, check out <>. + |[[settings-explore-data-in-chart]] `xpack.discoverEnhanced.actions.` `exploreDataInChart.enabled` | Enables you to view the underlying documents in a data series from a dashboard panel. *Default: `false`* diff --git a/docs/user/dashboard/images/lens_annotations_8.2.0.png b/docs/user/dashboard/images/lens_annotations_8.2.0.png new file mode 100644 index 0000000000000000000000000000000000000000..bd60c1b60be6e30660b232e2d66059929fadd5a3 GIT binary patch literal 53804 zcmZ^}1yo$mvM-DVcMt9)1SdFyTW|>O?(RVbCwOp|K(OHM?(P=coxulYkeC0t=e~Q^ z{oc1{_3qkL^{c9`?zLA>^^R0glEFZIj|u|=gCQp?sRjcBTl1GbLVox64y=Qpg@Hlc zv5}Bak&}?1QgL;%w6V8bpT6`bC>f^r(v)S~YgwZ?k*Xr4soI4Vnn!5E)?gJf1VctM>$R)^h3 zS#Hz7F%fVcKM{;8pBBw%@CO+4=!3aZW1zISDK0#iEI$x4AI9If?_iX!Vr0ZQa3u7# zy#s_WQ`+Ug`~GZe>rHER7tLG zM9tggR>hVfkeQ0iFb?{}{w=tOU-h@XjT(<#aO>P?N7RINiUHGh>FyDl*)AiWGCr?e zutmnKNfN+5#o+gMwM8~;B&hNshT45D3skS}Qc}}Q77UppY@oJ?O?@UBOc7S#c!@Wv&1MURFr){DW(I~k9}PX|Lk*l~ z4@wIx+cpxM7}Iwc4l0}pcp)l;RoMfy9^4u@{2<&KSbJCkW1rc87OCb*I|G@zv z){9{b50UHnWkzTm#cq-ApZ;w^YQjK)?NFF7y2y;B_HqT=o`wg$ow%K_9bPZOq1V&c zx2B(uOo_-U`gTZayM>Rx3b`4>3)zd%3vD?X`dzD^bSLLZ?2)d6xEt3fT;#h*NOu^h zKOUP2!7Z4PI=F}N6HNuxs9^yCR7?1XI6=>)+lY1IqT5GB9QuAR97Z+`tj88RLYhO zL%#l(i#16D?jI9fK?hkq`86p)CEuT(MGrO?tO8MvVn;Le$7d(Q$2oV?>gdHa#mL1K z8ES$DOUYOQ>K@PT2m*rw9s*t-fHO{acn>ZQ-cz1az^ugC>ha`~UVgJWs9z}XH zWgTUM>hX&HrC4Wc$1*2uOIw9N1K>)}4AqLLY0czzM{hp$#>_N(zjOT#Nk1&@?}Ye- z5$pO{okAjXhj-BlgG^TX#^@wxq!Gl-F++|!oreC-%GK(`Dc^p2I zb8>NJ*)$DQ44wbv@6EPh<=(R0w0!ODo1@t@ZImjM>Mn|-ALiVu8@j0_SRGsbxcqzU zH16|KrcI7bXFsGE!+y_}wxO({)dX#=Z8gf?YsFKcU*R^LAy@PBMK1YhoJE?Imf5m{ zax+%5k~3=$#;&IAt}V4v@0{gq<9(~(ZFxMQ z$VEBLnMa?yNDNEEhm%EM*--{4|SHxHbGZToLbs zZ%0u6-63}VyL?=E92A=p+vxpP3cIk0O<$vAr=+T>Ixg!6RvV+atLz?ry~8_(b_ODP zuc^lDcIV3!pKrHyhdH^`9C?Co-lz=pfCJ+(B1eSgD8cM8xs64U>C9V z;61d@L{UVBM&|X_lLcMR`OkTTg+#Z6&8!@Tb*6G)wWYa@@qCN2aow~mRyO@jJ#2kv zV?-CJ!zd$7fr?KCPmUVTzYoPj`hxp%LBZYSAJo_q2{-gE8ow=rk3mvf&DAc3^$wHG zrUBQBxDknUiEMU0cGa)jj}lKEgQ`-y&U`=!y8=`^0){w2B?<(}Bj5$|JN#DZIq2tiAa;NR= z9%7^qEOYX*b86WMC_E`1o;-{rA-8gT+7$2-+MTW6MMUi$&41t_j#Hxwl8)DX?n{imw}gO(*=3Lr#tr@&x#LgX`6jV z`$rc3(*BDtN-rhvg5NoIrQa5Si}nvjjAuca-A+J@`_m(l=hqfMGW!Bl7oz)Qd7-z_ z4Bcw&up^Hn3xEKiFC!7V@okh?ex?DoP_nmHC-YvS^|YJnC8MnFFn`~Q3C)l6`X9XP z@kOc8l;q*JCj-m@N(g~b6W9a%d$;%LqI+)$W(co%@zdL8yYEC<3Z!LdJ<(ufepsl& z1cp<>6q>2VPzL7YXq*|*$h&#IkCzfJmYp=mxl^_l3&whs zJnu|q5c_F3y%5E@h*Hqa9<@ir-0$#BKK^aNxB-snO8JG+)r_**jF7j$ zU(&(C-Gs{9!QRnLz+0H+Um5~`>3`U4G*tgmakmqu(N+|3+y4KN0`Q{oe>>SDU|iF!?7m z0LQ;Q{3q|<`a*2~O#Oc>h5uS-|Kk2#XaH0pw*R|m0jNLvO%q{YL}BD4#lCvOo_9Xg ze;W1JO7q&<6mWXz1<=8`a9AW^!z9AVh7s!hM2_gk!5n|>eMCz2K!63rH8^d738?&eT`#?RxMW9{Kk-4RYhnI$zhKGmOy+5zj=Edc2{V9H*oBh!w zM&+rT53Phn_48c3yo`b8%F!@(xXH3Nw=sKE--J;f^N7f%(I|+Xk3Tq1nNL0E2jn~o zVx+eEOd4YIV`fLfa~!_wMSGs&iVKl_q}v7>I{zJ){?%S<3jak$PoMGX>!sIvuP-P^ z8J5y{9SC)3z6}B8DU-<~M~8TAxd>JVfcN>p>h=xFPM&tYcS4w(-A7H`(8Kdx z)nH06@PVrt+TSg_%y-%Knz`nCR&sn z5*fsv5Z-VqAS~qGUhOwezSVt{YUDl3A_A>2a;T#b1j+H`dc>{AU4hoyE>eyBMp;DO zo}YR}uC7NftJYo~n%74kn)G~5=$pMSAm=;Q{vI@jFBxZkciJ!R1}*F9!b0z2KMd`? zcC9@<@NS%#?Jx!Cx4FbQ$2_;xUp#by6}>$D&NXv=XIb>y{2U>*!p!U(e-4da!rHGz zp5q-4jzo@{jC=;QLFaew*l1Hz?SaEfTYmkOZ(~~?$}e7T>kh9^z;yCQnK16%w@Rnh zMx#f1FA3DK!@RfE(#EEWjxD84$XRv!IPk6f@>Jxh#POExtc1m@c?x{lYMJat-mBFxgbh0P0HpUM^K@UQ zU5+`uXkE^w1&llR-`aH*UroKGZ*H#!AMRVezTY7b9~uyQPUKJaR{f_jEdv?(Cm$A<<$#m4jfbu0SR|7n zB!z{p=C?zU)^Vd(4BqCB^Emo-R^ZdPqs;q!`eSE9_2X`q`=cVZfKi2kVLiReo3wz9 zivd8c%kwv+DB&bROih_63;bn5(2yNgvohS&LcN2HRbR;Mr6*3!D;0@ zo8c|Ei1H~DY4zOjX~Al}Zzw#=NN4sj-OY~eEt|WC*FYw7R>AHV7rBBa{&K_3s;;>@ z05XpYSK=7pG09>($X}woCK_%Ke3gze^#P5JuNJZp1^Jrv@Mrp^V~4-H?G&o#?}*8= zKr|s>QSPYNH8UKct1-WP?t9JO+;U75sJ* zr`NVp^n`7euCT5ypD(sD!`pA3(N49T@ju?xzOsmbJM_NoAc8cV*mO(phq}Ijn*>{% z_cTTBJB*hl=~bp1)cDV`M|>S7D_?Sm4%TrrP3l*)a4*|MAPFB7nAy6HpH$07`6$wU zX|vj8GiV0s45$hx0V7%5CBm%k0fs~%cY+8+$YpKK5`gCEef5sBI0=kC^zLsHq< zDz}gC^I9Uh!EY;~8G5=(--VkS_LWx5Q&22Z=hvTuQO+ZPS5Sua!&Jh_fq^kJuKCDN z=-3g^B~_ISSx|{o2`U!ejUaG{UIP5^s^@s%mIwAg5EH2BBkUTu^Jf^2jp%-BXF$iW z3O!)nN~8^ae7u%W*VIM+MkJdKs*MqX^gAILY8ah>U$Hics;ADZdw$}xItd?t%ewc~n*&Qew(5-;uFE!?)AE>UePXqa%+4PR4mUF0O-td$@q8QIk^J zq>mBZi&Z`Shqglo5&k2i|2o-g$y`BvywdtyRC0)%UNcSHDnQ8@U5F)r1)LQ&U^}ik z=F{;J;c%Io!b%8(BEEiJE2M4b?sz8a&~5*B1O6>9@z(&t%}GiMiq_$*ti%uVS;NFD zEu^zYeY`{BHz) z;5tJea!z)%2QGNLxwY&FaIZn@oo1J}8rMj}dam8m#Uo8%M~61xn^PC)a&x_58SmnZ zimJ{Z9jkv_XOjmo1($d0Zxjb;cG{Zq;rc0q3-2b6c3Mu*TeXJ?+H}il&w^mSL4bwg zaB*Jl4aNoj$%q0@LYWhhdoJ!${m%G#c}n9Pa(uYReM9MFU*jCRssoZIX1(6*>E#o2 zx4>8rid9M&GGf9&8tC!sYwuk;${clA-}7qgeL~J8dzAD^Xdp2)`M7;!Wht^cDLc+< zpz_g@qSvQtNqL-MoU1}>8Rl#UpQlF7!OQ4J5$}9iGG5_Qiz}=Smx4}WNUh*gnqK_F zMmg{y2)eE4Q~7Zednw0Zz55$fyV!|=Lw?qb?Qk@R{>E~DG5b@J5B?}2^z_gyc39Lc zH>|4^USVL?yHRmZ)vB8h%d!kz1XC2SD=Tto4{DG;B(u8_2ykx3A)|#1|2f;3b4f2# zGG5U;EV)n}=)r`ya&%cepGlBa^fO(~a|(&j!!~aEy%6?HoF}JkVWA zDac95YLw{(>U7y6Kew6JedaFs^f5@zh44X5+e0@hN!;b3idTxy(;{;wzSUyAx)ICr z19?dyw^PR$z*;X6f|6@bBQ;p&z&TtyJ=`5W-csv z-K*s9;?|Y8p8<2-?sS#ka9}#pd!(s0rDh*gjJ=>e1_8E{!r)Q6%pUyvJ;^vOqTn)N za(CEKM8qM{plB3(bji+A*Bg9eS|2fnfg{7V-AiD@9>vBM2i1`AOQw)35sRV9b}(Ek zeoK0f>!|Cs^Ab}}@zdyaneSm(xuetB$OdFvRrF_LJ8oB)Vd&)<@UE>L=sSMwQhUSAssGG> z^pB@0A0!c!7o5Fculq^w;gDi9#Y`yyfP%J96;xrsMGq zqtyWkcGsgf+y`flAmN~#01DN^PkUvSzqwdiszf?>1R@wOJx!&B;)%WX8j1*3HXjlk zkyT+fqyOfWF%*snZv}5|_J~ALllmOU^6B^+Mdc8yfq|P=uC51V$4k!)U|LgB;TJ0R zCB@d38&t5Zb*D$BPh|SVKWGgRkp_{Kp++_`dOD*}lpCY&&mSMZZB_&7@Qn;O%ug*= z`>~HZSy<%M#j+gLFMNzZ8YQT&%;jZ7)NwaQH51+IVK}1&2$b!9fcXCNKjAOZtxMHD zsECG3WaSskSV}#d%WG{Mc7_b(C7tu2p%vIRuQsrW={Y78F7z6LFplwt=@G(LL zDN34+7t(@2TL6tcs%puRiEw4XQsrmB`s1zFa8T^#1@Jp(H8AqfI`D6;_o0d)?1mGx zx^3h?U4OBjCnwJpks(NC^(M0VwMHq_RTZ$5+M)>!Cn1_4|Y%AUcR6+2zCmmfJjuaaK={kzni!v7-x0I8v{2v4&;#LeEh(BE&#?^$7T zE=HrB)yJEU=GK`Ct^D|L`2L7@ebS54F3j^>%i1i&w2pvwNjtFiZSa@J({Bd53`Ksl zp?!af`9f&>68gUx@u@ST|uf@w~+251X2Xv85NjAKyL&RL;q6RLw zj8uUsL44?0Vyn(niT6c8ej*Za+1T&_GG9vzvFZBW&8&Ruuu8g3v9t4}e2>5+*)6{%Px@w$w_e9V){Bi7U5{8sp38X#TKFU)L6e+u zN!u}h-w4Dhd7%W)F?-fYiG<{y^?c)rKfD7Jq2eXFKR3Q@A%TV2;HWpBp;wo28zD_? zUG|UlsB5cHe|*D<6PUOjv(w_nLGET(eW40dGlrfhG@S#?lC=k2xvwqAPQ9t@hB zYLB~~<3-ML174$Y%o+$*&I|Zzt6I~0!V@5VBZ0lzQ+#pOwK4bS-bnNc(c|Uvm#xbB zE}++iEgZ|x5lb?KjE63Q;B+ZaKn;DYfB&Qn9`B(Qa!jCC0Ro$;i%NuzwS+ky9@ju-)70Jo!n9x zPv*#lOoyUTKE(%$_4GyJ3P^F`>3*+sv9I%nYWD4)gT1AQVq(p`Po=jtd_F&!4tpPA90m=^J$cP`Gjn` zVO1`*e)kuNy((0^ls?^IO1+I)tfj7Lf8|YF&kC{W`&Bej^E7N7gKsDjCMFqPi@U{S zL2M1=&L$NhDUAvVD#J;{s(Y@KRTv8Aq|(F=??y$*7-#;PNslj4t#C@~bu5F2$dKmr ze4#(2x0X#bI)%ivA#{2 zS^S-5m}JdO>lTCG^t&5O%O@|)6{c{zzZsgTSprjmR}Pw7hv2!J0s|!c$zMdbX(f7_ zTk9z34k-=w9^0?oTRxL7-EYHQ8@?j#PBHL7g)kH4&P#bxu^=mvjxsmN=*uu=Be(de z(M`EOyj?&MZ)n%r)@cg{O85(jke*oxC16o<;!7xj>{rpAMae9coaHXKt@y?{AuJSq z>{F&xQdH`&LR4n<4))d*h%7UE=$?;U_O-9G@32AFC6?Xvnv<5bDpf1SG@wflI*aT$JtRV#dwQyC2;i zASs=2ps%|bC zQX(}h^Q1ZetzB$bGkO%{2{Hq@`KWA;g05u&6jI zsTA0Iu7g7q>1;Ea})*xZSX#{r&4!NX*0S z8;&xt7=Ir99bVHT#4=*J5mU1*J3}6cKswZuy%VD)HvF+asAoI{!eB%i+LZy)ra3 zaE|Vc1)$!_x&%}k>836zrPDu0ZE&w6}0E!BmZuYc=myGKo*KBVc3ExJJdgYzA{#5 zET^X$24zv8! z4svKsGwd?SZmjALBhSE64`R0vm9fw58YF|vQ?9#CkJI~jI1DNf%4GhEzsu%U@0aQ^ zJ+%ZO@wz4<^KXLv~Ivy&eUL$@p^R2IDXG!W{vv012Ia%o@2{1I6R4gN4W=h_QGNm5i5? zk^QArROE!F7=ElUb-hl|gU{X$j>z!VC|{?_4>!l!`Cza73GqS@pEsXp9lV~(G{ATD zX%2IS^9a)JAph2`sc%tc2d_B}UZ8#l@cMAIt;b|*5+dlHJKFG@siI&{MHknzQ2B%V zVs?gH>p2HUWyTC>bm<`v)>3oKOJrr?^_-sajoq_i(~N^Jp%p_WE<*`cD-Iyk(s<^G z?I3A}&%ZYbk%&MR1Pe+u_@&U%U_={c3hEP4iE-GVHMIgKZ%$M_aczuvm)y@c!SvTkN!0N1;o*v?Tyfw%W9 zh^jtm;yYl{(I`_rWJWZ>e2xZj)zNf^J1HMD?EQC6<>)Nk(QA)uIW4 z%Sc-Bj)&tukOJzW5s|@>F9is;SomlM=ABj|5UO` zMXwv_9Zlc;*;dN!(D*VL)G!^dH)k}fKPe0AfqvWSi7Y|pu6M&BBd=*=81V8HJ7CT_ zjO~vhcXeZ9dDOOeX+|Q!=Y;GS=C(?bpF~&@hvqgfw0MreH$eq;Ay~{-YxDEbJwxIB zzaOGizRK4B?v!cS(Yk`w>Rwo&NM~TruC%mG#3bKu*1e@idlJ|}9zOYn7<&1 zO14V5hn@$rq%bV763JYl2?FaPv!NZou9vsO9wc){Lnl|8;~oU%Uijs?AqeItSv@pA zsaSa|JK85AX}gdmO}6!YZ2QT`W)dww|2)}A0Yl0uTdfS+%!6}kgcz7Zxj>!Ec+ANp zcXNei$AZ+7`%hrQ?h;zKW%_;Yz=a4p=K%y>bzR?WnT7>3n?1e)I<7hsg4dY{NSmk4 zBKeoqOr0c!9wPd^*$rWG;|C(`@L`m?I}7}P$kqly^;Ch%S4^NTx@1A@NNw-F@Jpmx znOtms7oBr%N~i>}H_q*h8tbu@E}u1GaUsi5ZS&Ihg#(!LLGuk+HscTE=Jqu)ewOrUwRZ zq@10g3Y;(xl{@RF`rv?s@oRMyYAL-u3~lF~E$UKB=g=Uy(KDG3ha~Z;C|LwTK}63J z`xrA+3u)XG1j6sUpbPssS+&*sNe@(3aJQj-2)#uvp*y4WITTUx_?5fA+h3;k_Vb<0 zyL70`zpfj;y+-I-u(XoijGgH&p^04SBs>fcNPjQWQD7qE`{S4Iotjovoi3Ax!n-45 z%I=fZ{-9`C29GG18<8%Pun0@u|KSObqRytPLgTQhit_pcua{ayr4f79g$?~E!N*R6 zLB6n(3&4jkk?8Wt_3JfF1TJTe%{VM&4|A)}3Pa*bvi;SP@jJp}(M2R;xUJtRRE)}9 zgSm9nd&0G4wH>Al%ruJ8hF?Eh!J$11uF+UDl`R9j}BOsO^x5VpE@j{}S4#XN9YZwP=F*^d?7QLvWd>?)` zczOHqBt`hjmn%ZRH;avuE4Sf`D{WIh`>I`1_?gpl<&w+mS^gg6NslRc&_n{VVPGXTjj!`e%uYEr-$mtEYIQGt#T=U}tmw z?oU~Fnyz8}73gUVdo3-A^<2|Jz|Rxm zMyV~`G?d{|=be3Qtqc?l-Pf=^xeZSe_+!c7;CpPPM)e8HeZb`vGy3Y@Hbim5e?4bSx6kq$z&rCmiosM}{B*;H0INr0+jO9l$JhMK)D}Chk;6HN9 zYav`us1Nj>Ow~h*LlML8lN+pC&7Ow>(pLWJMr#eCg41&KZ>@2%;lX3n)!5CuEgRa+$Ljq2*vq10-5Hodr|exPFeuQG8Q- zmuxu&!6_Ax+EnR!O!^rZ?vXn-W??HM&D#)2GmkD+TVIbgWaBg80-!%nwXua5)r<4n zo}CLl_v2= zbs2&7*jW4xN3Sa5W|n>+Opuvfb1@w!OLo$Pr-gyb=e@}3ii}wBW;!;9 zk6Xh5_rv}6Z!}xd+r5r!oR5G;A>iCY^|yHQp7Z6A`jTIhqbxr%i0@OL-lCTR^)I9L2Nqi-ZwxZqIS`)jv>p}zf$k+lC8 zzRX()?A~YHD(CNyu}%&9KbE&YLXr+9`Cx}bRCFF5c7jh--N=6y19vgi-6LjAd}6P4FLM%WS0 zN5l0<1hlFjwu%RVbbuzdf4{fn>&sv!b5Nx^?aaY0Y=}l)eUIcfy`AKz*oDr-yR8x0 zjWx`ky<%l49>pLj5iPRnnX-(}TG_+bo{@gf#Z3$&zEh5@r==IxD&I8&$57U6p1@Fl zA}g31etUUUW0semC|goTUDswBKaw761@U)1MSPcQ4-+TKpC#y)=F!+s?!cb+oVn{4 zSz8+Kiq7zw5EsXnh0C)L!hXRdga?neQ`hmyQiIXO8-xvB*^3j7z97?KVm!c$=}|C9 z*5cxsg+TMo-|b~=vLH)e{d^v)QwZdY?7iuoiva%m6o=N9 z0{MaRsj6qe+CGBEIvU@l!8aOi)1NO<+1(&NV=BQ}znC-zGiT4Nmm11zC|iJX7e=AL zIsOpiW^1#S&^2S`pqQY_Es8!YYGnLpbrl>UJ;n5!p%=#w!;zF7tx0Q$pZ3TxwCnyt z1vyjI$#AU!mPN(1&OxT5l?QGmwrk9;1BZcPOx)=vvCaAG+l=8awwfv@eOIJimQX(K zf~`PMDQ()`9{o$IQZYU>0bC)Snugyh4owF;IgrF^(vx{3`3oBzG?Sm8#m|Ocr%bpF zN!T*(S}V~69mf2SxQeW$=kiC}^C2@^3lL%{Q@YaA*GJ`}c&at?8*CB8t3Jg9*c>vE z&Kzi4{lN}bU{4Oi9cC<8%^pe`GVb6y(|&QyzS5Xp`EaUt{}~m_Z@48xOV90n5*ZT% zz4x$-okO1WNWmj#s<6NRmNXd&V*$B;ZIj6hGE1G`VEW<8Sm)o0W?=t|(FjBJ*H!Od z4(4+m0+I#}3_Q6g0JvDIwFiIsHDNQxD~)r#&L$T@HpUFZQQ^lZe4oGdrV)wP+F@%U z7X1XH7*+qqx|lVo*ffn;8E=1!uxmxoj7YG-QxL}bor$xaNR;wkj_0Yd4`6!rV{#Y6 z?7Jgk=pW53&s&Y;=ooTkqp|*OwCz&$jvk`CpWBu$znpeRM23jfgHPV8)afzbnEHiV__&WgdDPy{9Ni)wxyhT(?Lj#A!ji^xHO#7aDq*6Ea zVSPp<{cR}5nMI9zjsTvE{&!Qf(OY4y7%(daqlZT%Fcz@+lTY>7azfln8R@)2bwfCF z4VW}^qSqH!pBPTl@(olJ|^+RD&A%Ek=ZVyAxE4!3ZcD2-*y=a z=MM}Gt;t;u&Gj({VLYJwD<0RpPMYuA1)G&}&cW$gsynT*Be1s3^joKmqO0q0)hcxs z3W+=+Iea(oJp_8j$8)lCIOsj8lr&Zz>2&zK>ut}~S-qNge{&JESGGBbK!>vVE&;d) z)qE1)yPM9C7MeB_M8?YXrT?H;(gS;G@BbS~w>0&a5H?5e^@4(A+VKR>ROJuZ!@WrSfmyFXeulx30c7Z|CX5@$~(W@coN0WeKX7^mEnd_B{l@1lDh zeX^P^Zohe>LU{V;_nSPqiw_SwO-p3HF=QjYdo!)`OGMPkgf`9djG|TIY!8JbNPo2G zUgY6hPb#PlkmA5TFtBBwW(~kG`oiCE>v%I~*1dVmVw`wt{as*(;AI$`{)tU_UM8Hj z1K^bjXaEoZ4E)Q*k$sIysuRAkKdEvqji$p5GpX<0#!WS{;BLrb5!d72+$oN$F|*f= z-HA1I#sn`V+6p^_&`v|fk7D%-BMcOznQeyy!3|*Lukn8je<(C{e6|0uOAfp}aryO< zULlYIvJ(^>%72^9SH+ZASYd_U1bni71GRp? zE}|WLo((lh1@MRYHS1s%Z*&EB^W<+z2g?xK0zq)lmW*VXEuoIGtR|?7!gcK8;VdVS z%m-?j7@0*hveX3`G7D;S!X&DkAyNjjH-LLVfC{5bvWo7C7o(@?rT17uw2zSD%ZO1w z2d%UGsCmj{f0oAT>}=4fl*<+0;VjW+EFs!9RghM7_MwlVpwAsWo7~s0_qKwl2-6>Q zH*t(Gk>dC`{Q~khChb=rH7GPeihaIKh?CGrrAMFardn>)=?MsBwC`ruaG=x3zVKR5faC|RzNDhM_9!MF{ z*z1BzO8v<|Hw4kxMhdU!@ca1^coiUSs%!soAqYc@XqdIxRb=g-8 zHdE%&A6J~m>gzKkjmwD1#cx7AljRq@U20bdPc-7XQ#2kIV%Cw@YWhVXT*Ox2JxUC8 z^O)T<1BRjEHGa;bE}qrI!nr!fsjW_CaS|DO9{txYBDpMIM0o)A`NrA3ZfZbCb?JSu z@I@lhFrBCUZl|$L>#OIuklYx!L8I8-CHFNT#wY3FdEN5w`R1D5WlFc-{L5wcW3lfG zlyb0wB$F=wi+@5}?hZPEiT(Bmc(WR-?a1{UM!k9zZw?ZzID35~k7f~X`|5hLPg%g< zTkzDh=y$ZR%AGyz3cKZ1$~8vGSM9&@3%uO%SQ#)*d<}g5T+x~k2f|uI)M`vI8MtFX zNv~b|k(Hc9fi=@IrdN%O2R(^C$xpiIbw4EcmI-GkTGQrG+%CJv7KUq)Mm3xY2$<_kaO(10>%4FFVzGvc z4ib4<7D?XQs)9CFci8I@k5p?Hf7;&QX|?~LVM$<_N8lH+lAc#3QvXx&#z9bciU7F~ zJu|rYy}vy(JNf3z!1TBc>;;*;6vZ2gh$f>X0u>xjW{nRHN@mA-ESyd~XZX9CpE1Tw zRK-QqGFAk16YTr<(BO^3^k5owUow&$-}U3PAaYph&}JVK)R&Al@F#b=j;P_H%49K_ zwzi{zJ>Mi7Jn*6{*S7Pw3d-S$Y zgVu^yA@iEEiDf)xhicGK?n0Dx_(i(9&6asz_80XW&vM~ZwzOTk?+)VsmS0+Ii+8ZL zx^uSsr&IM1a)X%rz!_sKRSsEfV)cPw0JQC&f+Q7?oPKk*B00p+(4q@&VZ} z@4k!{d|`OZp7ag9yV2FhATk>!4W+>o`*`IoP;tcgT}4S9N1VZ+YPsciKJ1`&IBGI1 zOCE|-DuZ1z?t?UPl=I7~#~GWstPyIw3eCy5j$n<$_SrQ1RQ-#FMP|`4hYK7H`U>ck zty(q+;6nMfjsZsNh9t)68Ql1PG>H;=*|*9|A~SH?dKzzDr+l7j-VlK}0at~qjnPu6 z=Gfsr$X8`f9hcvfH1`O>LS%u4X~jO;1L7 z#zsZ%U2V}Eqz#R9*K)aDGM5$?#V;r$s+hx0ygoeX>j(?YJV(Y>#D*1#Se~aUo)P4tHcjk3 z8&_+;Hlvz}*sSCa6x#0h4LMOr`TK2ND)u?D$U{#!qlk_fYHkt1-x`}#9=6(Y1G!lD zP$Wxq{V1t$j~NCt4#yW3j9rjDqB>;ibPFUiUa$6sL1yr6wCgTWi21}TPd6?f_QYg> z-*NA>Zesa0981%bYGUnNq>1nQG$d^6l^=XP4LEq+=!OJAm-4zz_5`SeuV}sC`W?Fp zeUqHQ4NLDdcZ~Y1TS7LyucO+_ZjEz}Nxl}GH`LYeqjF5r^Ev%O=o#s!tNBfU>Wh7S zwcoH^HOCs$55R#Z4>O-B?WJ=o6|VVeS3Nhkf4i$Vl1u0E(ZNH93J2Yxlh#!DY1ia# zR6@U7ieWcRk}~_^K8D-H&Tmgn{&O#j zpw1nD_fgP+`3^hNAYt2$c1G_(+sztQh>MaH?~+GK2%O6p!BWX@f_p9DD#i%Ztbx<$ zdTdKOnK=Twn)KyW3hr(4cM3htRKC#^P>m=Kby&PXxmbxpYu{p)M&yv7{8HMe^{Mu8 zIhc`k;z{BS(4V*H(acVYi4_Z69P*hdO9#a86BN9xSUFO2#FaTvABUlRWT2C;sa^3J ztvCC?ciQAHyVMLaB7fqGsl(W3ezs;Dy*~&S6Q%e(6=dzGY+z{cL$I@(GDgcm(fS+q$b;&a?Gd_RY6s1dNJ686 zb?$4%x_3!LG0ArEuzdIA)-|{WUq>qF-VbxbvaK~i*t`n6^Mzz2&i@co3)ws4f8|&m z4(cXOlC;pC1LPLLbx9Ckp{_4gAI}XN8)l*CBl2qEC|DIc6Ko^DPB`pe4kY#_69{mLz z|8`C|tZI^+Vdf7wz@95&`8aRP2aLjT? zb>{X$l)8emq=_$~G)lO`>LNmQl%D=V*nOR91Aj$x`W~e zVX82%C^YWhTqZ?5d0{BtfG#>85a*$d5@%hZSG5km&r2 zffk|lKYwnDOqM?f4R%@a zWS6X++Yu+jgq>Q7)MQ()JAm2Jcg zEBS#)w9d(=yER&lcB|MYbRj+YfQaeAjvq@%h7^Q`^)WibobPPtbZstQT>ZHEl_5x% z8Sg`~f^1B6Z+hZdmPTtv25D*G!&FuiLwu2lxg#MwL(Pnp6#FfO$uKp@n@u~b9q*R9 zZm1&{$<;2ZR%AMDXF2g;?mfd>tbe)0D7ha^j1jXt>JvxO+GkGsi9Q3o^jM6Y=)iD} ziF1V4g!V5paM~`hetup?#XK}wNgs{3(G>RCnAx*AQ}L00NQ7C;L58B%GYD9Wa4`Sm z_?7H9?}oG!Zk<{3hXJ5L3dYGCu3wMAHnYJRyEUT-xEi6oucCoqHKa08py+QAJ4rqx0(@Fci# z^+Td)m7wy1Rx$8*oWLrwcZn97&muGxAw}2jgec}^Bm(;gY@(y}V`*r83Nx}r8_^gm z)2H-5`}9oKyAqf_wYNusbD-kU(@FHZ51Q-`?DxEG?N8%ZZC#*6 zPEH_YWKiw|hIs`SRZ?Yk2teT8iur;>$F(T|55zf=CXP@jgQQ^~VqnwVP)x+l;APn| z)DkjBxR_|ck(DNlRoD~YCgve8Cd4-H5k;PaPxm;aZAS!zS$vUDq5BIoA=(HL%o7u0 zca~QELQoSjiM?7A2t%NxpXp0Kf%$v+tjG}h45@Z(uOnY_Q2SulpLOHepadV2hodd5 zXcDvcph8oAhdeZEh)ipSU*TXBpy3_zhLtz5X?+@0XvzqN0m#1l$&n964DVJ+@Hc#p zY%U{%awjm(VzB)4Vg9QD0I;TM2#_)}Xcgp|%!{VSwGH4oY_mAFOFkxcG=xpv7&{ZL zyK=vVDTb{w;WJj<2tAGo_z@N{Z|A4=n*bkrNIL^Q!j8$S>cGlWG4Zd_M8*~K-uyId zOo}F&t=T_exTCRJW76U1+g(H_@ZJuW>80}9;*oQ#I8#jj%IFKWo2^i1P0-ZP!%V8vI98668F}4 zUMd&DDL-U#W%C!IT{;OjCiM+PQsyRSjty9<*-53_9Usp zA>QufG2#MF_Lo<6HB$*BlPnx$-&db9p5w};t@y^fBqd=>fr!G4^#oJ!tR#-%pxpZ# zy~{%l&$8m=sM6M>jPsFakKBs-q&ERlA=UzeMH5jO+0a`vS`dTHghZVRdMg~m?;|;3 z;Eje!scbR=ize&Zh&ovY;-#jGUrd{!U$6_~!1o2!K$G{IV= zGsWVCGR68QFcFr}B}DkPjnpB8?kB2%kdQ~~$J?u|f`Y}95h+T;enfJgh#Y2ig-`n)Z$L&NwBX&zb z3BO7?!?DU%U?qyQ0bdj*Ks80A63kc^(#Sd}G^9aQ^i5z^LVvt@CjP4Msn${x;$dQc zuTaB8vSO|%9~?D+gq##pad;A{?q~(z(;yO01fASQ*!Vx((>|XBLKz6b&0nI2*HfIp z%9PA)e(VqJ4mZGyAjZ$Umc!(Ra>b;V1}qLQ^2)U28D`*9na5BHy+T+5X3>HPk8vC= z1ua3R5DfMv`G@sJh!*DSdLdG9-VL*G8aAtB*{+Jl|D)`_PJ{#!;D(M92SAMr&>f~eCc0h;Dnao}RX z%BmknoG75nkQA22?AX!XV7hNxrsVYUphz$#y&_V35@&*27iiL zuZP#s)kG8$@tOlBidLln4rjo)Zh~v(%O;o!A#VXy^&`DjrECoo$`^2C;~z7w-{;dq z5Ezo!Qz9cCQ*BIHp2mbr|CwOVz94! z58jd-QK3KSmQvG@5QV=jxIl8TW&5zDKiHT=uvbYGLrKHAC7Shl*5<@sB=OUN0C!YtoW)N6vevf8Mg{6<`K9Eh`Motmn*J-kF56l@SK%Dj?{mf=M+ zInLbWtE+BXuAZ!LEVTte0TV%C^WQU*zlnI5M4%k>!DJByJYGRKC4>Ca68zy_28wq!N}m^@2|vQurmf3SiQlu3Fr{GDT~^R( zTS=7#TKKI=<3E&DC9bI3iZWXloaKV|szfliKGg(9xvfY0wpUn|Jd@0aykQbDg}Fi} z*b0oZnHtONEww!%@3G?9zI)A8P}~+Mqhw|#Fi%xBw>ck0GrisS$Fj2#AegR~nwR9U1U&biB z&gGUq6(gLPz(UqQ+)?*Fn0!4z#f_K7tg(y%7U75hgUAr85`-Y7gy-9m2HR%XIIb`S z`U=MS*8_=GTl(;;;DHYGo84M0^Jp|XRie*W@#?M|p={b3dnP55X|ys^9UXX6hZSon zg7gKNH!G8MU8G76RRtAq;C&tVPNQ*Dt)V1gN6dzR#;X+bb+q1;t&%>C7h6W>qt;<5 zfPmARN6TX7^D%}AERlGVmS^{B4KrtbpsDY~ z;X4Y=4^3(>iQ&~Amg4R&7~N}okhvmk%8rJB`HB?|sZM8E!6yF%AP{^cTV-DM*G*JG z5oZB2C2J3@&B@&8b*=_Q1Sf!@DbR)eS@vAYob(@B=a@49rzu-9lhsKGf@5jKWy~>k z>Tjxy-{X<@nkkjkT5?RPPnp&^+5(R3qqQ-y7k#GTR7IimczC6So0)f{RKn+VCc#P3 z#Ph5AQS!g8Q1tSvoU+z8DsV3+RoyV|B@odLu=lpnbYUJ(gv*ixfVn1@94iq=NDCuk zf+TXkr63$*o;G~?6`0o2+RQJN$R<26Ibx1UO^7ASmujTBOi`n)YAqnhD6Z+4=GvZ6 zBnXqlN~(@TSmOd#;Tc!cZN-;Zj|gT{MvUDm3@GJi0wY?W2Kx?o0RFY~137h9qfvVUI73o*l-rbLJBnL!hF{{+TnBTL;1 zW|>U8HtDLknb`0oNo>+}r{iqp4Sh%O5%M2XMXejwA`yJ;N>-1MfTQee`x>p&;eZON1R+z7wn!) zE&0hAClryg4mnw{!ISfx5U5pN&s{+3hv4)>tb9+Zh?QYNV3JQ((iQnW3(7dZNBDfa z$NDXqCp6Jjq`+A!z_(9=o5zy`-YVf-0>P_-LAgaOArbIt#Df9|s#e}We&EA{a7|IH z5!NtC+2k3}pC|IS7b{9ah4N+Fsh1C@2451B4BkL!GB(@V6gIq8%ENr@@5TLuswni7zJ}p#G?{~K3kyRS z0c}-z1*5}EH5Zx2Jq$LqMWSaXvqlvl#+(=YFp+sj6*U&SVQ9Nd&X_C~&wZGqB-S5=Qzy?w2H?d6HV&_r+FV+8D>|SvAq+SW=kexnZI_4^(Yw^!!ZJ zc!x5k>cGi(oEP85s3oIA)NBoSE2A(G=dnt%J``^=DRBFO-Fa4}f(hqM9IKdpO3R#n zAlb(7K{dRYU&A&x`3X!fqh>}SJbFsXgWO8(q3Yz~$K5S|eY?%31wa&6GM+bRw0LMH zM+GW20~+iRQXY-3h`1H2Z8W=`t1+*xaIU68?cj!&WtoG76{>AED-6XLsX=^%I>pWs zH{E7IYqB;3vPE#vn5>c*zifT70%O9)xgk|1tJE~!ye1da1S>EmARMF0ZQp0%5~4zw zqb=LAtf0I_d6vyJ_3wdKksqZKsEJ6p-{Z8D?txXRrF3(nW+V_i`*o&>j4*@Y1VX64 zXp$^~%O6?yEz?5zCy)B!i3j0v9}1Ng{-uixXn)-WT#c#tICr zHn}ySOh*QK(3duWSzn^GRVZAArVZr9(F9l-SMV;pST;qhh{|#zTD4Ix0Y4O8KN`zo zmgd8fLjN7M^4w{FQyl@Geh=OEV3mGMv1QWMFEIkVFev4k5GgRE+@LzcJND5CW8)9g zHdAMbW=mu-JGl@vdwVTRMO{&r%Ml@P8$B&KP>42)_nJ*&Wjj>)(4Lr_S&i3O;gslt z`dI=V?9bIY7^;>TV5Ib*r2TB!A3yZ57I35`>BEW=!Ayt}?ADhpp1}5H$ygMe7Hwph z)avOeR+^9nUbhG`a?r9=mgjrwYw~AY31W_4yObVjsnU(6RBB8zL8oVBFGfAnoM9YIv#^NiV;Ydq>(r71v{n-?6${|p^BiG@bl=Y z#%Hut5$2aj2pw?&CnK6^yApIH|!sqCy$sE0FG zZA+{uYAJ)16Eg4s__g(%8}x?X2m~Mbwbt4obR04W3sSK2~VLC_fqg^Yg$NembCF74l^g`hbq@mt;IUI zlf9Cvu!%Qg#Qo~DsRL>KGHBc=6Q+pN09L4)K*8B43ihhxstP$(_~)3acMK$+Y-%ufgeuIjEcU<^_*)v8=~ zPj#LsUDi(yhuoG-z#+2yc^JBIQFwYC&K?i{!+=vgY^HOCLtL#6W~1TNHkBj7!TuFz zL@=*aOTGs7Bd`vzN^M;dh;jIFOEG7_IND&{TM<~WwWAbTzQtn^6{{F~b|xJ9l0K=O zL@;h$!081ijy5Fv3riLbRb~p7C!z1x^6=ScR(AG4mvq@DVZ|(!uVSL4uzu9!Ge;Pv z5nx=A)5;OIC=9XQWhOAcT4Lj#Sa=Y6g!Zkl4LUJXoq;z_s|&k)!JAg`po2M z0#3DF#L{3#3^XxBg|ac=8mtJV5(NU;QCsL|Xp~r32Edq^z?4gc(Y_(}NC_ZdC@~~9 z{MN0&bVWNZyJ)6$S6~nqjgiSP^=3<`KN9&yE9_w~6QWGGoFB3$75Wq*j~gqiOT3DF zY6EU5WsFCKlV|es$iJW??^r3chofSvk)Ee6ivahA*WTNz*#5{eq*7!%~K_A*J;YN*iI2wBYo z)I5XBc|GSg1<&dQ+dG)~nLh@lt_h4Y1{5$`Eu}`J68kT*Q~1HVqQd>8AU?N1bxMRMCdWOv$9Ml=Z3)?u{yMDlm~BGD~}*K5h9qk zcQ)BC@g~IbHH-*&h2roS4noTkeDG==80kyKA$-s}7wmwLnGlH+Sa$^mO;s1;5uukJ zZSiBF0?8ZC3Iv#`iK4;Egnp>gkMJ!0cyvf`=LQxTjbjS0>dddk)3UZ!49mLY7th)R zrtN_k4BjUG9GLwC#z;{@dtqOIgJ`UvYNyai=EAFp4%FF(6p27kOthg|oD>le$=Fnd zPHkIZ0^*J~Q`rcO2SclNXIx#j&+O!R6=95E@MpSWr%CDw&p;@GTYK+O+~h9+GDh5r6(vI^@8~4B>0+`k?xrl+5_9%xCP&B`GpY z*oQ4O2crPu=wKeRWf05B19@;*Lh*`DRh~m~GEeLg%;ps(U?RROyjKS<GM&le$5N_Axspo|ehm`d^?|G()B8LjC%hD#>yl?={;4t1SF{6qOZjxh004rD^tF zmMXoBso%Yive^s1({CL-)+*Dcpu#acMlr(N&3x&;Ee)Vc;zEm83D7)Nbg4~I# z&04LgLg=)haCSJO4H~1}D=;?T@6|!`l1u z>|zguG%8qV2{GhS8wO0oi0divTv{CAJjR-?aKLu&W6Mpry9$~!0ibty=Xq~gFTR2- zEGX6en8AgqiL*7)#@?Ny9luzCaS0-m?Wl?41_)77q~WM_HdP*8C3rM_Qg=MsL@g(d z71hIpSi7R8km{{R3|bdAt4f8j8gWoKb;cQ~#$E_V{*A(gtXP)9M5;0-W8<+5pLpJ~ z;24y;Ca`18pxlvV?&Xw6NQ&PlKzyFFday`k_rq`Gvb9C)r@UeyZoFlDN` z6#~qtNo^w(aD7KuVFIiR4im+y99_5+Gwu`Bt!q@YvgPBzFl{~l$Yv<>U5HQ~MJ?IC zEK_b$c>nFbg<2)JowI+!< zVQ4dvBG{`kDIMPhfG(F-l)Mxx!wF!70>zFC1GA*|$*$@e(t&c%sGBNk3Hqlk% zo&;7VK}?c_`)NfII*dVhm439N0wV&3jA0^VJf^1M(dafJNLC#DDzj)`!`c!MV{kPN z)`!HgsxRLZ9tbYRk$IC!9yWliV-1HtHMr+JyHk_Lvt_KwDo zEa|IO(r|t*T;sN3v>`*XE@#1%Fw}ZD5F1R04TD>&I!tW*i|(v-Dq+y!%!2@(erTS^ zjZ8cWIxSk`ID-jMKPxL+;D)CZ6FkD85oWJLm(cUB@(<5C}L)9LobSnz{>` zp4j8qqeL1xlkgk$@M{Dds}Ip2+Ocozg$vGcShfsDEuLzL93vQ>jM|d1Nk39BVm_VE zI61Sj-_y1Qj$_8Zqk<#!Y&9)fP9iG34fg(y?dmzNpcd}i1V`P`s?}0a8UMEQUr1D?s+6YUOc}+wYX}cZ_WDRx zSJ?_fK6sqS2J8!s>s(D0Gj)Pv5J;GaxG|b5LJY?u{PLdjtmio^lSQopqB$mM&uSn1 zC&}AW=ipNPZUCz%hxUH>yogM19r=GoJ+8zKgt5S$- z3TT_(7GqD}?U`PJ0L;QC&se=d+T&wv+u=%ky~93ws^17!CdoKclaKNUq@^WqE-_C* zI_S7#&mcU`7aiq=3QH2KXwbBYu%eK{g6n9&9NFb?v`4#` z8oc{$z)|H+WP_kn81&Y*;m9)9yUp{Ac8=9H^w48{0tE+%{gHv#HqU??dIGb*ze>+k zjz#HNC&dwXj)`HYGK7GFmI!H&x6CZkZo2Rm46z-audc4S6VVtvSxFo0!Vh|aFL_DO z@-#p~sCE_>7G<(sm$T8Kx$K%rMmQL+32ttn1|Jgm zQLo1_@~=0o@}7K5U|Wy&6^%pY$a%FpM;lqb(kj&2&F3rX$?ID%l4` z|8U_4M~^qT({>j0Zgp+l_>}WLSJu{yztH00xgs26KO}vtcIY3Yx#&Rq7O7q4ERt!= z0Y1ivol&B1ld+=-Pp}|}kCbnbF`+tajH*05<>PI7o~9jsd;VoCbFM4m*gbCTYLL}+ z%ZqspTA=8fEYQRa4*?H}iQMFfe#d9IeJdPkn^02V8qfC~9O)3T;OLVX!qxg#xC=!a zw~Hz_uki!kq&%LcjVLpWr&V`X--dC!C|+IBcw`K0Y5ZWW#tRYNr$KPBv8-Rv&HA)zqi*lZq*ifRh98?M=}+eOr6Wi-b6`xl6nf( z^9d2`#jyYFE8sm(eLet8ON4xUkU5hqpPns9jaQ6K-hYW2@zn?5h5&A4Dp z%cph4XQ3=v<0E}FjYyw#J_DIai^OMI2M_drgeL6g*MKS7bg@_;$UZjjAn_4#< zigj8GVc@3E_@;8PEy2v!h+}+Ap4hi3T;M1riWS&a$36SfRfE9r$W$3x@a0t@q%}zO zJ=RH{m=F-``yCKY3V8H_Hmyv|q+j+V(~qXe@Km^`aEG$WXMG#XQ=iqDt<}@bXYtR0 z6>gj~S?Zo7wt2?1rO%Y2~PlT;K@|2s@I&XZg}PjMhA}=a$Xzw&zmZ zVlrHyMHU`@CC{>X)vgNKu@!wWKGlRn6IiyAx~z!)gtqx z=EE$lESAW_OlwUCqS6Ff1DaL5?t*0?jDS-|Hko#zyh&2M7FC)`Fe?P?sB3=SYeq3I zZO0W&`V1|;J0Cb6v(gcqwy(fZ0o6yUk0amGl=qBb2Vb0p!Ax!jV;qpNbROPl zuk_>PwQGV6EmpM&Zqra9egrbqX@tl=BTpZ%ip{jzB(^1{ZWI7k*UM7AvWcR7{7ZFO zIV@SdY5xL`!IY_BDE|ijI|0W-osE*^$6U8#%#GPO#vZgZBUXgfp|$l zd!GFAUt-?O<0Ko9s*&~0(WUr8U^%BwD^EAuku&!urvVE7lb^)#7aFjFuwDVeB~ zcG67#TLzZoRWFYALM^D;MOj$P{2aSADb({N)|(Xt@mWvSvOlvpAdJ~_Bpe$avm{S} zEFD74dF}S#NZrs0nG-LX%_|ma?E6Sz%W1zacew{~JmTGrWy^dX1XN!OJjeq!=UFUk zwZtD*Jo6)fmriNcKslhx0{;!{lEWZpowTJpfu0*OMx2U>BiCJq>TIC1NL$boENRoXjy^ro5YYPlTvNEWPuWu(l(PchhJG4_Dj4HmGov2 zUI+`_U#a2*O4-K-e`SP<(Va#FK0yYDuoTI zcxgl=RR_y|CNR6VX4(h}9l8!!SQRpuN0AJWh?QJN*O*UT0g1E~N;m@9Kt^k?EBQpI zxI%?5+LGup`Vg}%))4Tli((chcz!`+5#=Vqmkyp%f;Tad;sr{i{3hfLsKD`f1^XMj zr--1M1{TbK3rv3ei|1;=xqJem@g&X=FUe8GufRs{PTV*={|^qhZ4(&H zF=(K$7kUjMsXEys;u6VeCh#IK?Ws2HEja3E>}04wGgfj8z&6}LWCKQ8J68~_$(R!_ZK3b z*`5M*PHjZ0VXQJJ%$TOvn7|rJjB|LO7<%w6X&QLaCOG2td?*tlH-L{0i1$rk|1vtM zl*Uc`Ggl`ts!?$GAC!^k`P=}aJq;E!zn{SL9)hskwHdUhc7iIrAmtibRBV%5`@L?i-eZkyjV zNlr1_?-i+xFWQ2f;6O3L)JMQ+v~7NmoKy#jBs@Cpz62fE6Pe@hb?bH}sf(+TN%bPb z4z;ptMZbo=8+Bn2$0N95@xhEF0{}oYGGH>;BW&0sq0N(HMyIv(>=U6RM1GL2R)`5XWztW7WYWjX#!7wKiQbF6tK!G zmBik0+?2{+GL!YA=8t2^R%A|7DPpy*y+dL@CgI+ChN&GNM_a*_cv2l8-I%kWVZ^TjWQ}HpnF(^sVVEXN766A9 zxu!ELb^tb*WG3E!fl9za+SQ?WgcSek3ioJ^VRG&^H(3)?`vZyy8qAukOgI#3OW_e9 zGP0@8CFrFIkuy@$P6|?Cs}l~V67`{xWW*DSnA!9lPeh-L0*y3LsS*KUA-AOX;T7CO zV(ekjLJ6_4PNiiAq)6apdlOLjI^a|4L~&;Y7K30k(E=#(kNQoyESP=8Id~xY<#tmp zyS)ftrs1G3v-C6*c*59CcO)^+aGXd@Gi5kxJd|MXgkK9^TVzu`8*0#hxKD3rJB=(U1Qmhn^S$A}4L zO$N+JLJuAnQ~1gGAQcASJjG;uDr*SJp6v|@&!z?=__D8-dLfEorj+PA;#mSuQ)W_7 zq5Dw8Id_GL($e(MG`V9?H3fqZT+zYrBkilj6(%^BNw}3Xo#3eht#sL*!Lrq861bR` z@j^^xPj?Hpc1H-aM`a#QP2w0R%ast=F=Me zKQ6^BpbdeV9hEB1R{D)i(75hu-*9)@dkXNA{&9YYmC2}rkI4ehDbpasY)BK+Nnzj# zD8>oig2aq$8Xlrv5ZVX@0Q{$w;492vOA>m~@-r$pl&2f9h@iP|$7_J5gd{Zf#{_%~ z(I&uP5rC754?>3!$>wwg-minytVZ+BZokq;6xvK&YCclf0Ph z7sew3kLW+Ex?~eiv*xTbUf?k)rV8_9@uM|wCgpsT%%r-}!Gv%_;*XWik(|cTm2^WD z*B}#ka-#t9k3FzPArYUf>c)G#9Fx^_PYbpJV`Z`@;m&f+n5zaNxkZq3!U#_ zXO(C@>xIiEu;iiP*D#U-gb54*n0U=34NmBbP@==x{AZ&P44dL7!$7^rSt$!Ar3Xz- z9#yDgf=GzrMnA6*L{a#S(wjyn5ekz93J9KvB$#%xDfE`wWkN;x0m7(YKr?@&f`k0g zV{NjS^|dDAvX?4_)~}-bGSquu6coV_2#5RrGRk^2HB?H($BBb5Z04xaP_+zf#vgU2 zT68~~b??w+AA6GVbfS^#=N%Y-PKyTv4{*il2Xi)#^telKNc z?y+V-dyfhO0(#VBD=-N?G}?Hzchmea3`SNCB>E9^f<?pKc!4VzDN|h~<36j}LQ;tXRka{D` zQljmsRl%{C)o?&y>@X&qGLv${2P^0#+I~s6{3t4uxqKeKb)tUMst~yjH#O2usD$um z%Q7=Z<+-F^VR#wx-s}-uq%gW>cKk#2v zuJZCt`Wa3tq`u1~M+5{i+WyG^lgx-slqwD!SPIT`tM@XFD$R+Tq%+Kl z_0SZKkcx4ztUcgLRs$7mn#{n#SVT#{Q`vBBuoY-Vo&Knc9~1CSHfg=(-RQ~0e+{;u zZO4c{t&L*{&G{%c>p7I$ON1^!EB^3A#>}QGRU{bDET@r7bC-z}W@^$=1zf<0Iu8}M zF1b5v3TRrB>P-4`WPxBz;P;tOu;S{nN#3Z!2eDn>kJ=R1!8FW$#$Qz`D#{D-)Ce2x ztYC}w6pD&B`5YY0!9p;Nau~fBCLbNABU9;-V!VN*CMnXxdmSL~U;&tJyZhti3cX{4E&l@;ptTIFvNm zJUl_TETXBzi!Gb1zYwRM7w{87OfjDjX=GFw;6*mX7qn-%^=Qvp8@0|JkW2rJ?J{0Y z6zR!U(Io{_*+!TQ;eW^o@ z&>1tSc_EHSL{I}aCZc$rk3KD*DrFv8EpV6vpm4-1xUoJ=TGrelS%#--k@e1;IP6Ra zg&H0(28U>d_Q51Jy%m_>pW>*1X$lQf8pgs-%O0DV*z~(uRxwHr{9~HC+^_ex{XU;D z`@j+vUJ4mJRPo|W@6MVuhOnphz;wtLb2l;4=Bka}E`*^ElLY}tS(QJyyKV2sF$B6A zF8tx?$!!UpL&1gXb(6pZhCsQ&{5maGY{MvLYCF`RP z8y+f5hV1cW!@HG%reQE_!oq}zT*Wjku*Q;%glt{pBvaL~|1-fX06~7foTB9(Q5{P_ zG~IojlR{`rIzd;vlu;`r1eT>H!4QR^AKKnD@Qd_BzOyFrQ(X)g_SdE=5Nv=% z#6}-2)Pyj&dSlIP-9IpMPvg81JE!cYfI5|>AQkKp-?9}H=YuzGENVp%S71%fk;N_d zyiwO-ie?SXdBw)Zj7Wx40itGF!3E$>JL{%x3zR>U_-1;NS|o3zh#ZC)bk!b%| ztFL1P4&~r+dDW~Ow9su$7h6Vm*2Xu4OMn562n0++445VogW}5dbu<6A;-I$J2QwlA zx5)&%GY%Ms7F0k=>$DR6h$$GQ%l5#=pw`Y4#b5Qu;MP;Y6;S|^4W?Kn=W4yhr)1>< zV{Qz4|2X3y8(5@_p&J8o0H2SijS}{5Y%^P$!Z?6HNN|{s@F%oIq9Z1mSk9xlz)wxL zjmAejL^?7?z@8*-v8_|B{#b=I=>P!VAo$R(V&GdNU;#r#SjP3q`6V`vZ8Z&Gqb60s z!O)GX+6TL{W3`zwGHSgw%cJBS>%6$%18bO9MK5?XS%Eb`zB*{yDpUJ>z%ix)Y1MML zb~i?(Z+IdZhPO@9GJDPIU@dqy!K&6KV^Mt=$0Az>q^WeJ8s$*DZ9hrjLJl^WsExWA z3pjD)uE1DTqP3GT+G)oko2*iy*jP_iAeAVwFV|rlI7~Ae0}LDh=ik&ERivVzZ4w`i z*o;jl2BfXPCYd5%GG8KB`83bx2B{6-qKM!yR=N+B zaU3Q@^9U9!?5!Fw0M}F!%ySZ|gs38lQeK+JlglO*HSF6iO_IF&3ZBU(trggbIyAkt zcpU8%G_S{;SFlMM;a8lk`WuL*3R!_+x+9n_smXq{3QPQ9@Sub=CE$}LRWbDv$=vP* zOQJX=IVSSOgaWS7`bS?jk)RoSzt^ALaCbi3vK1`#Hp(Lv00o}T{;A(n0O2M9QC(>7 zi;D1J5h|Ljy8@2vBAmz?gF_W4Hktfz^x=mvGZWs8<1^SJ%!4pOB4{FuLEm_=izYF)~(bw@LjYU(M zB_ArR2XjH}d#FC7?+9_&Inbf-;CPh9LlYRz6$}~`Z(1G7K;$Qm>4bIxVFoOkXVc4h zk0OVMeE`w)ih~UD6Z%SLTU@!O`;mH?z{E&gNfU#lW*KQhDEdJNeof(+86=C^_GO=H4$_VB)5;Atw6!?`@50m5GPL=R{O#qNZKnJyDqQxnQgX0ntji8vc5E&Dk z^)OLHk_=in@XE{zc&?2p(Xg2i#klDK$}u%oQ0=kI2-s4&1InmTkgw`vSOWa$Ksz8B zw1jai*K=VDoec9F$@G*44$aM7^Pz-{>gQ|?EIQ4LE&UKQcCLv_cQNWCciQG21M-=S}Fv)6n`mD~x&9#o8~QnRYs#c))?tcOLUS&5f| z#A=-}$%;LC29JT9X@hy+G-#|>eb?sYsQJu0}}_F5Sj z>Wl@p4kp@<3A7648}>6z?liPs{FpmI9g?#v(m&FW>@V^K6#~?r98)L zNKJ_ylr3a7@+J-KR%RrW$>U)i{MXk5{~X(1rjG5HU>#hl)?4~fre@5}#Lw(aMp}dd zrlF<}YNw5PgjcnxO4ur&n(EH9mHuzOT{Iz*ci_+$|I?l|^@sk$ZI^?6$<5PaXr~BX z1k;)15jZxz(xj)D0DnM$zcgSZOd|2>k+Bf62ti;FJ=wcKvyP^Nrnrc@*DtTw1pVk< z^h9i`_5n!syxQN@3QQ&$@0Q#w16e<+N~|Fk<|uf~j$=IZpcQ_4db0P%4FINS@n#%k zR);cqA={2R{emwazUH2?2Zsp}$1zOrO)Bp2DvmgegXDUnVW5i+O_LdqS?2lv{j7>M^wq4OxN3gTCYH z)FQfJkLH9v+8IpVWTHCi<&gA_Jmsjr>4|a}yiB4#P9SmDf?7MQP>J`jgRM+7P_8|* z?rwkZ*fhRL@~D9+n#QO&2=|7&FrftfNc~4~1vaMfkTe*+M0(s;T06mf{j>R zrQ+bnGTR2rm;@62wjNf|(^zFjf(#w3F=K^Ka6_xT^3)AaQ5jWE3h#Qj2t*k;A#R(tUft; zMtKCw*d?>#nM4s8RH0CB+A~_{$?D@H;}2@O?mO!(wSf~1>0m!9B593&1*YHQW@5Cj zHJNCzMSwbOmDaWvHnd&K5Qk^TvNWN{vQGd1{|v540(ZAJ5X zgVhhNO2}e@URv?4*U-1=QAvFo@uslOvuB&Ezy^cX%v;}^><_UgP58C(3`ieY2-%jL zbBm0Whlt)a<-`%I=NuuSq{b1tF1A5GvTXsAM9Wru$EP`QpsB>rB-xiuf5&VwjTIQH z1y(1VMH`Fo3xvWJ41TFA{UDBNmbx(pW8-&$^?~^kGN)@$9AAO0&t? zMFRvS=hBrmyN~O^T_4zYGB|oZfluQKY;5KbHHBG=>p1qdj}(?mL?um#RcXdnV7kHA z^XhmShBYvi;vttP%!cS>|3K?;B?1fJQxJnE45#Gq993XtJbF5Nm7z-6N_hn~N*(v) z^(I?^;e5airv0ybvybpwY9HG8nz6Q*0hLLM6($Tlwxl+=l@!e@&s%0}?S_gw zTKO?p?EKIe8$G?{D&+61<$$5N|amLi0OPZWf zmZS1I5J$n#G#DMV&3H5q_Hhjp>eXP!sBc7ZfOQ%jc#o(;Tp~*2I307>_vQn7VJxlZ>E2VL0 zTX^Oz3qST29)yrm*}*dIK82>3WjLxZP7Z=K=*K;of}`*oXM50%aYrIPAosa3vBYQo zP4j;lk0`Bik7x`-q7Z0IYd$FRvgH{EeOI&sGiyi^Uv@w%deyWO2M3GUd=mQ?d(+Trh1iKKmzZkN-p7OIoIDXPxyN_+)AL~CX{fI+ zSh=$*Lb#6!xr9d;^O&CCn@J|{JC>sp`x@h(z#t-4AL4h~nYT&KV3DX}Y?G)$>Y$T62(Q|Tc(Acp3y&w?$(}r6XDvU)UeD7^( zEG7bB+&KFBF_E&;^o}ayZIjv=56BxLMpznelSyY0`3Fl3lgzjh@^o6(5S&N0A05bn zgG)&@6h+su@GHbKeqAwsP4+WGKN@w%)^JzP`F$va`$S@s1q89va`NA9xD`C(nyfhl z&I*q>eKA(x_%)N1z<43fX|RmTOlmv=jxxy@j#|~4sdO^TlOPIB$41w{Ggq#y$u!e( zTaWjWcE|ZeC|TOui4)j3Tl00Zk|x>8#6OzIUt;&6R1z+0?0SLvb4Azgc&8(Om^pOu z*l}fVs-s({xkGO(Nizn~jTnQa}*0OeOSzd9i11nLY zNRc8rDEj|fKn~vZ$>f)3k6#=ByX;^35-UWsTnwR znh@D@gTP!f!t|Y=Z0J*2$q*fdJGZ3P;>Z!HNNAolnMtSTgH~M@OwIMs94oLHtun!B zs`)uLH5VxPx5X$_TVtAFQVuS$4R{0L&KaqNOH;|x!;R|A!4Y@tMKPIpr2P`XYOG2? zIvt_qo`;jFY-BVx&mI`syO|Jc;G5udq%&EXI76zTQ8i>MBdv}&mswRpuv;_^P0*G) z2{(aVhKrtK562iR29r7tfx=aFGB`O7l{(0Up42menPgz{(h5P#UJsU9J=i*PBCVFC zCvLkzd#?)B!Bd8_W}MCFYGbv}t~fI>fvrE;F>S00!Jc+g4Tcq1+{;Y&PtqKfetD|B z6WV8$TUEkMmjmgGmu74qEIlsZ$S%2Iua-Rp4){)Dl8M@T$xUU|u>!*xNBcv&nlwpO zH|a2;MdK1((|l>iO0bCd(VYwl)qZ1d@knzfCVfjz=n|SW?pJ-tH5Bt5UE0~zxGzxv zZp(_sb`TRw#e&r^M(8+{%Vyh4JrkI^K*OxQaJftaP*x|0QZ~U(OW@F|T|JF~(1`G~ zly-urw8Pu^4lMDR<(V{%$!h~oMRdg(&8-6KMN%3ux;SWzOS|RUj;ZAK z&9WuWwOX8U#4Id8Z0o5B&RQlgA2cx2xNN3Adv`>5pD$h8pe@cVWj8UGOvzk7sX0WX z7c-r~Pq|`+zdDSoPqrj*Cv2i_qHp24+ZPnmYS73ns1`cr`+-p4aBA3B5P~ZpB~`L| zo}Hi4%6&9hmjYC63XB45qh{*n>WFGvqyYp13QxKMtFTE22kqHRh|;E6f%)^wniiZW z&B1Hdqj6NgG&ulh5Bfd)*F?-O002M$NklnB*y2GU?Hs zc1YFpGQAMDWwspAnt-jD>V;jv9~PKwFEb#$mI*906)=m?g}`+rHd67H!&3%Es9V zbtZXoZ_@%a({?o})Qb>eb!nl%s$^6FLG_FWJoNlPdX;A+9dB4AFgtUxtV#5W=}5a^ zmn{UM@!0RG$Y`~PKb$#xaAz%Vhtbmm z=@sJD_?5+v_|=an1Z22^z__-B*}KZ*;~(b+?pHF`WN)xSL_=I#foW1X zlcBsneSR`YuPyCp#Sm6tRnF3&4&1VF44ideY>D>eP8?3-KGD~zt8<#bHY9X| z_FiS1OeE)UtdNH#?YN+5+rbiEu#!F8KemYC6%Gsa6mhF4DtKCIAA=hWGWe=#*?HB@ zEo#N*P6yVJivBo%VD(vNOfF6szdHP-HY=23jbO`Sn;3zy@qp=4Tgobnm2+hjE9n`W zajH&{J@^Ppr1MMYOl=bwJe9Z?)io|o;3`{$htQzU$?)x-mQ}Uq zgM~?in07Ez9UJ4|5g1WKcC>0BRku26#NNj0wwXyMrzVV^&dQCsO8CXt(8yT0FfH%S zz0_Hy5(>kLS_NJ-=Ql_=&@WXy>$0U09YeHmLkT{HvGY)dKYHNr!D8iwL zSYT$26Ozli`X;c@6Ej_K6*X?d)um83(J2_9gj}hfc>^>|(%3Dkk8luR#LJRfQE@uR zHgc;PFp*+vnzLZL94tI*;FLgQ*VZ>=nq?1_y_?GEDHx}0Te?*vt)8`j5uuH@C82uOR(3R@b?#=Xx9ytB=Y?KaBla{w!>2Y%P11H# zTG?A=YxRsq^UpOfCIug^$*zQ0+vKy9Wll}R*(1-?)u;1@t-!RRMaeU30rhoLXRAD| zo;CFbG%^<9)et$RiHP1Y%6WbHXHE5W{29wLNiQo9^yTYwF}qis``Pr!-n4qwsX^rj zK0DGP51eev0*Ti;^-af!Bs^C+TbExLbk+SN-hXwT+Q z$Hq_eIeISGr`d2Nybbguf(AkZrXvgtmD)4CMC*U5XQWY?&oH4e_&ImMJKOidtfoX8 zc&%`iIRa@;*S8-kRv{A_s}?q}sT_A(DKg2)As652(4*R+FCNd#_L*o$^;4b%qtYjT zMwvAoLM5gh_R~?BW)9WQQI(;eqzp!#GcXwCLalaqPI>b2X)tnfR|)*!zREN5@tMI5 zvKb^E5^ zG%9{IxOt|22b>3blP?cr18oI6JYk;QGUX$i1-$j2cKJtLKAzxH_!X?19MQWx+zunS z>^yFfpU5WQVsvH6us{Q%u_eA+@(1Y~e{uRV%j)0!GppCCfp9kX1gMalrTllELK2>3 z^)!CZN`~D0&GIr>7?>N&yC&R)AF2#FPB%s2th8kg`Ll<5Px*XVt1~``O+!4GpGi79 zAj-?w0UAnERu;mO8gk{^O3P$lfDtq0+LP^M@$!rnW?&fFvTUJJ{SGa}7yiQv98{z^w>Q!Cs;Q}lP+l6QR?|B=AkLA9Q!rW&TKsVk{FQeu zeICA?dhGedqqB2U7MUK+I?yRCY`Fq&=~?6B@Xle;J7+6iG=2|fTX1k7ZXfl)``#z3 zh%$VkjfNNc!888lQ~p^lf9|UlVFiXI#8+VHdzDYW=j(0wt{hI>^m+SIWZlJt$O=po z4E&PkiG0cY_p~FeU`*TPODHws=K*5=FecUB@kq`EJ9a(aki(LH#&`Oee@0W}wff_W z*cP~ae1F5@1LFB?%4~c`vCzj@=2V>_N5kKSvJPRE1K1{{+~LRpZaplz5!94XS+Mf37md>xp2&uaQ`x*O|5OJ0k?#v-pjFc|E1_q6=1SYxLpg2^(Pt_n zh(>EUr+?m|Q8Yc7!~8exF;kvnl|+gSGpL!Btu=q9*VJc}&mj%QotagH1GK(qcc*Lv zgQyP5PKYQ8Gkk;sfjznOWf$iL@;#MCYnmCFOYD4$+?uuqqu@Icemu2q|-sqTf(UNY#cj`;9M|Q8&PgQM7^yX(n<6iW8pw&kTe zwvfRnD6D)lj3z5j(H6L4s}Y_QZs!3#2j9pD#tX?5gBG$9_6{(D%M8Yp-mxh@TEiF= z4<>2Mu{dym=tIezyj-OpL1x%%s-x)uH+}TJ>zVNjG|xRd1taA(7ops-@6MJ5;EsTni{nGkJ|v?!$w`Ja%mnjy;fsXd3xzSu7(|Vip@S+PC zLpGUJgwyG{;N4|)wq+uF+t(kuwXS_A94cJNI@MfD7+V0@EsW|h^kk)ZpjdNR^q3ZP zwt=qOoS0PEQ?M{nP|<`@i_#^*nDU9f;GyT%g8Yi8CFi#2QX9~-$FU3w>%J!Ga9%Gb&FzG2Low(3 z?dEH0)vo2uXKE}99PELi5cr;ZQ|^YJDclWDd;7tjDas`AEKy)vrdItXV@ntfNsZMs z=d<5T(yF4ta%Xx;W7#Ty(N(ks`V;nws%R}B1hdHYx`Lx}Xi|7CgLvKamVt>j=*I*= zdig0-y1pFZJi^2dUnR}u0HA*82lHY^Sd|G=3;1eMAf=fN?69`NWucA7$JMkMYjrre zxtKkL?VO3G?1otx9Lh_ML#ZtXdD#s*i~^GLe0Y>uYRf#uG43VV_&=1(zO9Dh!?w+p z1#fJ?SB2SefpS}RdCQ*r?#7{3>N4q@I+=Zx1yVyj!Xs82WNJ6ZS^9!H(hSSThMcKT z?63+r><#@Y{Rce{4swh|{0Tg@nL_<_$)9R>5;KWr@x3!#cZ;_i$iz~Ur7TxQ1SI!G zz8<=BVuFZ04P0ugNIog9JR%07&MM)0O;i4&ibnHw3Zbl|al%=Cs538a&dc~JpS$pP zua5fHG+ECsDn21vpT8(vb9V)426GD9=GJ;xQKO)go$NMkfkj*OB|#@xSP`)@afPdO z`~Abr1coEUgxYgut94uDK4ldRucE~6#e?_dwm@xxA(tO-nz@-9z0J$A{Dw}~sHP{y zpEv;_=c?e(3_=buOA(RmuHu@Q)4*jt_Go ze5lzqDiU@k+y%Wq@4tn!Yry`^KA%NTCc6+_MOs_h67$MrX%kpQjkM@E%!F3U{t!1o zyC-5*Js_%qo&1;G-69WEh0s&53L-Ji`~|_O&_JA-Dl@sT+2$G*hpj3kHh0`W3-?J` zG;=)oDoFt#9FABeOc8CrE*ODFZJ`+0zFQgrsO$~|>9VTvIHB!>89Dwmo4P7NEtRTi zlyt^mDsL)lEC%qFLyTE{Y{smxv9?ub^s8+GgT!cF4BGjNQ^|@hV1&7B5NG{q+vTob z1YVMzc1MI|0>cBT>(YH^gr?*23<@#kGFS1wD{iU)W?hv~ozto$tTM|)VpC%+e%k(! zLdhIymC628H7USEM0jpuwfz&bfkz@&(`Z(!nrFgfrHMyt=5d*2>HC}7;CvLYVG62K zx&s?#OIv~Y1Xd9narhOUita!ts-4{;6AFoCVh+cP_ZQXZU`M+r1b*daSJQ(n~_=}t53CgRq< zCthW5p~~bd1dn4`Wn1~W4NlQ;L96IZ(GZVPvjUd{u8&6!5ehtdC*&Oy7$%I( zxIff0C|wrV((MJ{)FP@>ENEMG2}cfGz^k}E#@v#{t9S!)u$UECEfciphYLH(7LmpM zd`(p&1ur>PL8<3jEkI_}oY%h8`tn|OeN6VMly7*cB6Ail&I+*(oPUBqTor8B0sZ4w`Xz-5X;N%=3!GzaR8#oI%g9kI4Own4+gL6`< zVB4>PeE?&HLQNj#HHVLiUp9%K!wU@d3R`b3C}ISv$a(xB^3K{y2`fcykjMn4=&T)4{Wl`-Lh zqKx{xtpn36dm6-=tSS-5jtLBh5%{-GH+qAKiCQb@S)C*F{o2Mu+XW$yM8rLRMaM}N zbbvWr730(`SZ}w*)C@ezf`G}nDlbHb2AN89BjjqGGS$$bPI&yrOhKsGgy;f+&3J;O za&Jx*2{S>siJ1%69Q{?a)VfX!B_-34?<=&<)%#Nig#($K0b9`If$#ywK`<0;;sv=a z6PSmT>K&?fB?8@`<<@G@`s$}-U?0qEoVBT9uMcYh!j%1?yk^-BE2TXTY-3R>#$*n1 z`jyH@kzfc`Oo%ptp)%J1~j4I?U%0j#1k zpMui3q@f~|)G&d`vSkP?m0KFx%KtDLs>Mmo8zgs*gOTc8fvItri5QDSaUiO36?-QP zMj|%YMx%jT?;iw`xhG4z4yjy1AIV*IO~()zkY-l1M#^pDOpK{Hytwj3DWTGLImei$}B@3&9x7=jtdstlvG-)g%nuLfCx@ehjusU)x( z+Q&?atG<~@Z3Wiwy80gyIyjH8N5$o&Wjj}`$&!S3+P)&oRNvG-{kgnCdS!C zkCxnTtv!|(9B4$`BZa+~lt*}vwKZiANWy`GgS~hlnn{MoIifZds^lll;YyDq2f`h% zQcETG!w#fNyR;BQl|XVvr3Pp?GQcggzEUZHU9DjzM3j)a&+-|WH0aDhMXNtNJLvSm#-~YR(=m;0%IA5@XZT^ z{@E#j4}v*khMktEAGXY|ilR*zH(93^ElPz}N6RwvrFQ93XdMOyS|o@1>^gBqXPx6E z2Q%gp%xg2+Td);aDKLfxTsW*+2q|v2t=Ytuhg09V@fy$4ENE&uz?unBDmIVj8JiC>TSDz#P^_GxL40Vyx4M6(9FZ7Pypi7Z9r;f8Ln8 z`d?x2V4C4z`fe5!whUm^ed^y(ln>0!n1J{_h=kC^^9s#9H6ixhkpK)%DrnCZ4r~Ab zA{5|N_8HU3xnw-=?(A!o8Ll=dx$5qyfEW;NxsJmW-1Ojmcg0)f^8GLNXdi0=yLe?T z^OCK5K&m}f@wNw6A%d}npzPRKY=x8>o&jS%veG~%FmTK=6gTk9ZrdO9PB$iuFoALP z2DgFwoBrzWy0n_Z9eQq&3HmS->LvDr&`p>q(VlAy8rlW{$Xr~M4|G+=M!fF3EQ~Wb zuWDs5tqBb6y>6{91z7;$N)Nt0sBgc^Ue{`w5UJO+S~Xa=>_f2QNxGw(8+>I_7X2I+ zT-S*Yn$a-DY%O2theeLzW(ti>hqJ%N19YoWCOMllh&@_^OLB!hFoHI0>71LbaQg$S zWoagUTY<@w6bn;{;;dzR?H<~=amG@n+9xnWx<&{Cc0rmS-gIR;a&R7r{h?`jthkV9 zhm5M8Gg$0KRx$Q6rkS#mkVhnDGm&cFsrkauvYP3-9`%O-Gp`jG{mNp^l_LTPHMSwM z2}$?nkQ0Dh`UAgqD%IUPt`{L37}4&->oR(*%EzQRb{J_{_1sDsgIkr3FQ=E?XTX# zrQufz2@X>ebtL82qU;sRA#gAuT8u}Rh=n^@ydb8v5h;|Ih^k1KCPx)mJA{!cinRWE z#wfwrfz>AG3fa#rLmOfRHg|q9&=7f3^Kb;4D0kzsXyM#d`Z$T?B21Ot#2k60cFR^9 z@(*MJLqNgIoLuKVsWMNH<8p0orA%NZR_o;`TC)`x6PPyUmrFbA7B~rSF+vZS$s#gW z8`@U>*kBcop(QTLD}5-A@4wdGYCySS0+WJpz@%Jqa<=3kI?5!6rVY@#XX-X^4P*kdzDVQ5D`-#G z0PJiBck?!V?DBCyH9<9TnGGwj+7%+}D?PzZ%*lT|g9xQ#LfyHcONd%!IO7QRtTkQmMwv4^HANvVlbl>7>Bm^`;M>@;9~+K zNHFK42By&>05x8SBC+yF7c#~xIr<`BL?bI66c9Z1h-6ZhV$+679UmJ!nz1?j&mMXI zG*nb{tx6c@gi|yARQ+Y(ts@|(UWTxBM2APtq)tYqbtF{8>W<4K?Wlkrq5KR(8rTGe zrpL)@1jBj>UO|pbqO{i@E!i8-eM0sNS7wv-C%Y1Q@vK`P?Cpb}n~BGDX&wiN(f9_< zN!A6?a8Wl5usTWa%*x@S=vOw|*>q*ANr2AX6R5dxLXy z^XG}c(ExqzKiIB7rdD-D)sD{V2ALhNr>Y&o)(sA30z(jq;xILyNgki9br-vP>MI;v z^SRx2kglHIV~z@N2T>{J3RQX}ZI(U5#mh2TAkBv%Y2eZo909iE$(Cw>eM~jb5`nNG z+|9}Zkv+|U$_M9HX}N4*ySHV(=(iP^?r}nqv%?Su)TeIne86MhH} zRrZ99i2kBqN!;=;KqVlYZVrvRGi9G+XJJay2NC| zxk8R-AcOi!D!y=G+V-FZ#-tIju)lbcyDp|L$W9ez9}`n^xX7|kyq&7O_=AB=V00H0 zV7fp+ZLG-KO!nlEdPk0zV5MWhCM{N1Y-A8Zfuz9I~lu2pUqvF@HZ-}rJm}to!m}xrofp)4T#w3D1I2>_) zE5rJ!%w0UdB#JYYIdJ4C*hSIOvp_rKgqsk{;v=($NHnuBK$Zn%tMu*{u5e%z7(E8z z2qpx;WA5BVEwUXZ>=}yHld&npwTXHRA4D;doH<}3v~G#2NkXk z=Zx7vwDlJK46uffMAP%*T7mUznhBJ{yhcn*4uqSvv>0Qw=yCB!3|>r{4Cbdg!&R6D zLK@~CVrAmMfr)gG!X3fR>e5yw3R6ZZ%R$1BZT7hogcO z+i@LDh^EL4P~iB)jL<7+8rjZ5k)u~WP)dylx=@jXTh*qgw%?gT0QI3`+ymaRm)&z^}LDjd8>fUzL@kxVEnkK=VC0NLY+0X_!Y<9i#5 zUNU9-O=w#~mDHVinfvzTGQG9oZsx`NxGGZ?fkT6b*YH4!0}W>v`@O*!@^R=MM?C7#0&>=H`j7Oefz0gf({s&?5DK<6})EkpjR2%Pam4fy6iP4FTLZ)O<#!#tgi~n zDGZ)bmapDgNIw1TlHnXVdRjy%V}Zm9jPQH|xrzCV{tkEo!}O$m1-Z52y=LeY=8K>i zVsSumN*j$hhYVb$g@LrsVeZ2sLeT)C&V*c=w{&kixpFhyg>wd7YkwUk>nWLwj{6Hq z6bBx(lQLPSoI7nM{D7Bqjmdc!8LX5v+a!q)W$ z_>OJQ1he0oBFGm@0gh!wNnja&>FT^RtHHw73`c-9xG1xava0*o5LUi2Zq9$!@AO6i z37O1fml4SF#a7cNgFPwsDKd#ru1 z8X>oKSY^s&#|oj3s>(wSe5u+(q95?EHb6sj)u$rtlS7gQPdOnN+bXB^K|0J;Bw?;Y(3?OgQbC1f&R~5i|=_=;n1?|zTJnk=IJ9`s{;s^L*xV$Zi z8yH;aIgdwVl-^S)W5-6sv$g{BnY;JON-IGZ?AV9Ag1O?zC+Ff2D*Bhq$zh+*S73uT zxB(~fcTsSz=@M4PmajBQL*{@g0=Db7E|`}r*Sv&Ogo2F#u>FBU6)W^%v;GWr0uv*F z5IksDQ*fVDQD(xnZ4s}f(L%_fNrI7(QY(*kvQzS1_Rq5sHGms)FI<@q6TH6|8X(mX z^$FT>ZfjeP0BGK%-ntrc6FZVa+nAn)DZy8)Qf9QuC(PBcufTc((m>)GmB6#Z6ScS7KFlH|-#Zn&)=XnaL#$yHe5 zSNLpN{o-l~zrZt+xu;h4_6|%L0asy`A25uOe&%T=Ma1dXqXyD|gB|Vj;ire@PCWyL zF!U|L$$3gHN+mQ~zY#eafF9rv#tPdf&;O&#$*1ov<-CClbSg6SzCyZT(#Ip%EQiBF z#|Tni6IhXf+l)#RdeVmQa3Rt}(E&p}tiZUQeQ1_oaj-D4&gd-61Iq<|J!J()if*Wl_%lYKrcMv+9J0wPt7WDu9-`#?{_aPIKM&z z4=L44dC!YbU{8T#Bz7cXz(l2alu0IMbjUJ7O6}^L8+%{FWcD^V#gtsP#O=as9A<_| z2aJE`i@rYNV7qi}-b|yPf4r1cXYaZPGFD}06*=_H4fiN-!l2cN8K z|7%e|by4t)K2`PFV3h!5@*+TO=B3wLi-a9oR}4fvQ=uYewxJ*DfyS)#Y{A*zZ`6UbC>A(V#%Hz{mtoN4V7Pi?co6M_1^04RV3P51DSlQT!+SJg zu4K7%Z8*<=<;g^k!9Rz6?b>#Q5wdg^sAP(HxKE5AzIek0kJM1bF#NSiT7%f`u^ZRD zVCg~FZUD?6V1JL8otzOIj-#+y-(XH$%-0_8$U{$F!FD7i_r8a(gxkW)IGp99AQ&8i zBy!OcJeHxu4)@L#bRHW5Xd1czC!$>4c>a9y;N$f)xOP#QxVMWr|2UjyWda)#5<1Ym z&lHrjL9F1PGB*%Kqwgf7Eb69I;^^&a1HZ^!SH$Au0?A=RFoGE^6ni_7^0}QBw_O;m zQ!;a!GTr@nMYrWnh44{Br~x&@z=Vy{%GTOJxwZQcLu7*k%N$trEsswiWDfbvF`ouwy#bvlr_wUqq)7zUhC?%&7ShnK_)Pn+Mva@R??{w;+^lQ z!r{t{oM3hT+$$H7-@p6FR?@v}^`L};j|Vz?`t!fJliYsof_akK^Wg%ucP~U{VccRT zxnWg_!*f$|!Vu01OBxUZqfg7zWqWORC}(;Dw%{LdHaizQ5jj&~2PZp>WPioQiJQ`d z7j@mc2@-!%upf04ql*XzoKLp3iQjAD)IU7M9>p*-0(+WVxakvEFQhROqJ+CS91Wqs zVS>t^w(uZ zy#Mi;r$^+X_tF2Y|R#nq6Dn$5V{o z4P4p-STHnoS`+};q_-8ln%`fPC@aU=)$ai1re!Ff$!L+d`DBUFGD z6C2SgCgeT2F5IkgW;5i5>hHE+eWqhC)!^jPopE&P^nJuJldKvOOmD2!Th_=e4 za5qI`D^-7hbKKqu8oi_g&34w!iPKHv5tc)hdc?NFoD`9#GFzuI zXSlkmUKU6K5EJS7OLG=l@6Lx$1oPQMG_j1hH3Ks(4OVNBvTiJLlcqVV70X%Bx@4;uG^Hvc!}iCDOv9-6E(EB1fCFKbys0Y{Zi zW<&%&o@x(1TT5ooPl^ero(=OMNEPw$x_t4C%gJy4?yg`65dl&G(E{;4Q4zxE*FX6@ zx%tw0Gl2}H$yB@w+cWvtMC2yK7I3wDWc#3ciSlRZY}wMTs#2euV3#Qcq?_!-DI0$PMC_7>RqKh!=?JE7nxBpSuTPuG)cx8+&M zg!T-;Nf*7Jw_drN%qk+lJ3su$ZjrW0xdjY{8o`I4{MnCwZ=WxJ>AK;|>uOPKaF5`5 z5ea@JQb>`A73}k|%IwyxQzx+SAA44W1mh^gQ$@}9ao$}&0@aAZ!L>8Py3c2PCo`K( zV1m)dU3V}(JGpMXbWy>Xx06SoE}3PdUC*7yzx>G^+xL3=pTC$~ROBCvPaEZYyRw6P z-qQpI(PyQ3;)Rt@=4GcRI{P+ST8!X}wVj?a*+|~*#9Pn%n zVh{k_7P~4}=F8XRK0m|^)C>b%WirC)tY_^1!n)};BXuQGh#3y4g*9@eNdl)i?CqFy2N-`O=L~I?&&8M zj0JgjPs>8K^k6;ZO{Z1(lzoUVN+13DVe-Gf`$6)RKYT8E?xjn%Djjyw(>N2Ifga3< zxDQ(jFsCIj6)>?iJxS~#niNQA?gx8{XBnNn?BS680R}?PP06F$WzLXw zv2b^w0uvKkGta$rAz4+(EKJ@c=$X-s@A5d*cEw-+$6qDSf9Ya^1;i&cD=@@=x;w-r zY@k)o%2~rarwj{?P~ka-7a=AUZba^7_Az8@(6GAOkdXhvX+xkxgN0SejBvE7yS;9A zn4MXDAP_HHo7D#DGvYqq$PPw+2FWXL-jFBMx|s+6?61CJ(cBxd3J<@0=Tk-N-%bAU zw_miqL9@BT6hoXC-~?CxXMgc}@~gkUlYHmj{xtcsfAd!I#@C(`{|Dg#%`FKLpZxZ* zd3CWr`0c-Z-8@T&b>9Wp@Uo=;>k@p;iU-f3Et~w|o;v`AU}*E&&(`FAU;I0!?FOtf zLn#ccyJ5d?N~^G5?}=oMHeG}naCBhvn0*D;h78B28hiF0 z7#!jz1~x0z&Cgn2Zs~%7kWo2}! z`wb{^i1vT@@yE%JzN;1Hs~3_t|KOJKxa}{sighIvbYLaq-Fh=oagFX-M zt|$NVzx*b7a(5$LNjf;Z-`DEv>aBTm`T_}7uV)y7Plpo|=L|uz@tXRACFsBn>GL{+ zdijNm$uIx*C*Li)7q@UFVG)Wm8@O~nYAIa48q`a;@L>@_`#Z8=!k}IlX=AN z>HNd}gl@CSxbghOHMufcwSz#)5*_%@Nu%fdy>3;emfaG+)IA?*B>Uo_}&M}m;dN?^75P4 zO(Efo9D-wLQWM@7?>G)E3Lg53KqJ{oOkcV2_Xq#!*W%@gO4r)F)d{+ z1Y{27hX&r*5hm&}txPy)$+@X7WD@G3!POh{a;ln3UVQ%LWaLPu#5}mlgI6ue=Cd?; zL9gy6Fi8bMM)}#Vc7$eyVV;BsI;`7(p>`!sKcB!mtJNy+bk(6?n$}px7ed-uU{hVQH&_6JaX+UmKR_FUkot0qhPF@p}H% zt9GvF?|*zRIe79xGIj1S`EX%0`KN#RYI6OBOGaxG5M&;rBCwu>$usdAUX8 zP~LjK`0*#nPyXwN$qR2@N-#J14dKqD4w{WCDKB2O0bI}2@Nh6cY!Z_K(rTY?Fg>cK zRTd!U<#cp%`z9s7Kn+6%*(BcFT{#Y^q(hbwl9-u4fo z_M6Z9EPXctFBrIJ?~QNVNdE8tx|3Y_>QQoTew2T?BHn}T1~$2+Ev@@ zekyOnwjFKp?XYWfPc~ zv=uMGM$4oY? zQ0_n2N#6ZG?P5E zeylP5j?cX9vxFS^P)z0(40rC0Yq~Q<9(*zbAMb~Kqb4%u(&MhFsJo06h6p-@7fy!TKvyPG`Gxx{b(tJjh%3KV-p ze>H}jZ>`W7e++)|(7rxQX^U{@;WfEIW-`^0(vH>9*kIc*c~ev{=erKh^pEFmd%o@5_jCfo%kbQ}*aa`BPndLSdMx1v({2)GMr_|9>N*v4Q>w;1aljDueR zi@`|itT4x=!7phN+fks^mNbrdF+n4|U^kc2trQ2cR1#E;prK8L%?e;*(W6FlUSY5GfI~?$uzVbJB?)j>q6?H?4OS%pTz9%tmuROOPQ|^v#1JE9=@^I!m zl1pY|AtbQB?tj%2hgHH+4u9}rS> z?kUAG@CUqMa+U9TfJGoA&!k_}A0OMS#Qjav?RzRzMkHwCNamKGt;R z2hJSas%zThnYptJ)+g_8_PDEWz(nd)90ai+b5VnGQHP3wEuZkbx~7XGSL6k_Awfxg zcSfQ96HW36vGIv;K_wIQ!M>tdOHl616%{3b_bJZvl~Z2-h!c24XPq7?PT=Fc`^i|7 zJsRQg@>^GJRd|9&UQ-<{f5uFn7reWWn3Ry8laRurj8*ZLyhIP6F?|*MUZ!QeB|fAb z1p6gzCZBs#-j%ys$(-k&eO*{0d(*_XB!CG*;z!*Y3)Uh8d<4jVY4SKk@=fgeYRpE5r>Y z{vK8h8uT{lBObn+n{sX$+17r=OtK}u;(||v1xrrPOB+QKyupeUXDN=p z@0CZ}`c!zgD>KQ9!t13!eJz<*{vwlCBOSF`p4H^2SdbQFMw2$U$-@Sp5UrnJ(1#jd zHm-o5Oh%M^ulxBP>!gZ&2YRS7rFATmR%2h%Up>@VRaW(d&iX`CpqV@!IWjdlH}`h+ zZ|6iC`Jvv}Mr;-#f`iCq4P4H+v`cuDU6GKTlt#MpWGCIL!rU?`^VF;+bN2ZxTDmIH z4P(G)jYQ-W>BB0k2I^G9^8DrtAo@CM^?$~7g239Ev$h332oAo z;A_UiruMVU@teN~n%sBb!P8VL-*bCf5vrfZ2bk9cZ{!FnFv_W@t>(p>Fg5>n_jZ%l zo|{eHzIe^}%J35<2;XmAo{#MZ99|Y3Sw%3BF(60{bd(_H{aFbd5^^Xg0J^hI!WY3B zeMWM{1Fq}^PqqA_U+^6sUQAq!r%p~vlSgvv)}AbVC-fL+txQ3Z^3ixc&hbh^;5ncC zUG|)BXtU>~ykR!%)Ccyy!2OD@R2fsh7j8@^CtC3yX}>Fsvj}I}q_@WdS_;2YI@%tk z;1c|EnhdwLb*T1u+a^-an^qOS;1#!c7_Q|x&8wc<+s)t%^|ku#dA%%o)WbM-Qkl~{ zBYE~VpCWHe8O&Cfo6vG@FKKgPU{=1=Mjie2cOWYv_E zMkz8<9+6cX&EWbQqP%d&97%uGJ&oDOI$qa7UZEPJ!5mc)}eXLTrR& zKmmgRW(GKBNK$ylH?2}sZfo;t)NBJnC`wL#!6yhs>P(->gn2SLnjC20kFw!-82V(T zl__o8w9&@4$%7}&$;pu|X}!(_v#4HjAJ^iQDVhDe-w#wr3b)F#2Sa>2CNhK$X2@gPERF4?a0_a!!bT(@&I$W4wNJjv z5+|YKpy@h(>8uj%0w*b=Jp4WvRt3`v|1+&U3szhRT{P+=o%tZ74~gIWo17a<#)OC6 zoiV$SmI;k()nhX#`$_@75k0YOUcd+Z4Sfl8Y=*IQJ_?;2heMP`OZ9C8d?$i8HcrV2 z;f7VeDMG?4CI#R?`=3Ya(|k-HT_8|2Ox}W(Lz;R3ZTN3WuwD=yxg^u*DBfnE7#&sa zKzyI_m4GpLC?5fbHg3ikoseULJh`Sc!7!khSU3bq`}CW#Aje?T=a?qP`3q8bglj^i zk?%k}fg5vkJE$1v#QT^W$Hz5r_YVy28M&%Y&W>s|a$o});b0Z1Men1EW;COH9w_DM z2(D%o-*E2Yq;ReAZ1Mj>Uf?4ytC9E(pYq?ttlZp%zsX(gt7}Z*}eQ7oo1>9R(OwbXYI72 z4``ynv6xn3VY=$yxYsd|aNY8bjk_V+p(py>_&6Mh3EgaeyJHz)1Jt7h>#=O-vd6sTWzbFTU{!Y-D3&I9xYU0UM&4kS+!l<>D=W$E=Wm-Sin1ibhw}5g8E!Wdqb&h9 zsG!%7bwqsv-i+Qn3v>)P$@=N-7=F|ebWES=3%}f4X@i(mm-;_CHLW*lTa9MzjMyrP ztLUxo5g%isl4&nRzjhJ3NgfM3cQ zjQXM!=-|8`a=IMJ_$uJR;5pa}6X>X5Y|}Pllteq$vDl8arFXPK-SnF=gz3@> zxXA}0Y;WvOA6Fqv6fH|o;BwQ`<8hfSM&wn+s-zjla@*>vwwdx_JU*5aiuO;Yr(n=P z+^+gEh)lD^;2%4XlY>B8m}BDWF%@OU4$Yu-woURjEs{c{8|_nRJPt)#kU6@fjv#B` zO$7h`{+{vb_;`Qbm?rhHr Add reference layer*. +. In the layer pane, click *Add layer > Reference lines*. . Click *Static value*. @@ -154,7 +154,7 @@ To analyze multiple visualization types, create an area chart that displays the Add a layer to display the customer traffic: -. In the layer pane, click *Add layer > Add visualization layer*. +. In the layer pane, click *Add layer > Visualization*. . From the *Available fields* list, drag *customer_id* to the *Vertical Axis* field in the second layer. diff --git a/docs/user/dashboard/lens.asciidoc b/docs/user/dashboard/lens.asciidoc index 1fcc3eb797b59..513671dd51238 100644 --- a/docs/user/dashboard/lens.asciidoc +++ b/docs/user/dashboard/lens.asciidoc @@ -10,9 +10,11 @@ With *Lens*, you can: * Create area, line, and bar charts with layers to display multiple indices and chart types. * Change the aggregation function to change the data in the visualization. +* Create custom tables. * Perform math on aggregations using *Formula*. * Use time shifts to compare the data in two time intervals, such as month over month. -* Create custom tables. +* Add annotations and reference lines. + ++++