Merge branch '8.0' of github.com:elastic/kibana into cases-remove-rul…

…e-fields

docs/user/security/audit-logging.asciidoc

@@ -53,8 +53,11 @@ Refer to the corresponding {es} logs for potential write errors.
 | `user_logout`
 | `unknown` | User is logging out.
 
+| `session_cleanup`
+| `unknown` | Removing invalid or expired session.
+
 | `access_agreement_acknowledged`
-| N/A | User has acknowledged the access agreement.
+| n/a | User has acknowledged the access agreement.
 
 3+a|
 ===== Category: database

src/core/server/saved_objects/service/lib/internal_bulk_resolve.ts

@@ -201,7 +201,7 @@ export async function internalBulkResolve<T>(
     }
   );
 
-  await incrementCounterInternal(
+  incrementCounterInternal(
     CORE_USAGE_STATS_TYPE,
     CORE_USAGE_STATS_ID,
     resolveCounter.getCounterFields(),

test/functional/apps/discover/_runtime_fields_editor.ts

@@ -31,8 +31,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     await fieldEditor.save();
   };
 
-  // Failing: https://github.com/elastic/kibana/issues/111922
-  describe.skip('discover integration with runtime fields editor', function describeIndexTests() {
+  describe('discover integration with runtime fields editor', function describeIndexTests() {
     before(async function () {
       await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader']);
       await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/logstash_functional');
@@ -63,7 +62,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     it('allows creation of a new field', async function () {
       await createRuntimeField('runtimefield');
       await PageObjects.header.waitUntilLoadingHasFinished();
-      await retry.waitFor('fieldNames to include runtimefield', async () => {
+      await retry.waitForWithTimeout('fieldNames to include runtimefield', 5000, async () => {
         const fieldNames = await PageObjects.discover.getAllFieldNames();
         return fieldNames.includes('runtimefield');
       });
@@ -76,7 +75,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await fieldEditor.confirmSave();
       await PageObjects.header.waitUntilLoadingHasFinished();
 
-      await retry.waitFor('fieldNames to include edits', async () => {
+      await retry.waitForWithTimeout('fieldNames to include edits', 5000, async () => {
         const fieldNames = await PageObjects.discover.getAllFieldNames();
         return fieldNames.includes('runtimefield edited');
       });
@@ -105,7 +104,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.discover.removeField('delete');
       await fieldEditor.confirmDelete();
       await PageObjects.header.waitUntilLoadingHasFinished();
-      await retry.waitFor('fieldNames to include edits', async () => {
+      await retry.waitForWithTimeout('fieldNames to include edits', 5000, async () => {
         const fieldNames = await PageObjects.discover.getAllFieldNames();
         return !fieldNames.includes('delete');
       });
@@ -127,16 +126,22 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await rowActions[idxToClick].click();
       });
 
-      await retry.waitFor('doc viewer is displayed with runtime field', async () => {
-        const hasDocHit = await testSubjects.exists('doc-hit');
-        if (!hasDocHit) {
-          // Maybe loading has not completed
-          throw new Error('test subject doc-hit is not yet displayed');
+      await retry.waitForWithTimeout(
+        'doc viewer is displayed with runtime field',
+        5000,
+        async () => {
+          const hasDocHit = await testSubjects.exists('doc-hit');
+          if (!hasDocHit) {
+            // Maybe loading has not completed
+            throw new Error('test subject doc-hit is not yet displayed');
+          }
+          const runtimeFieldsRow = await testSubjects.exists(
+            'tableDocViewRow-discover runtimefield'
+          );
+
+          return hasDocHit && runtimeFieldsRow;
         }
-        const runtimeFieldsRow = await testSubjects.exists('tableDocViewRow-discover runtimefield');
-
-        return hasDocHit && runtimeFieldsRow;
-      });
+      );
     });
   });
 }

x-pack/plugins/cases/public/components/create/schema.tsx

@@ -18,14 +18,25 @@ import * as i18n from './translations';
 import { OptionalFieldLabel } from './optional_field_label';
 const { emptyField, maxLengthField } = fieldValidators;
 
+const isEmptyString = (value: string) => value.trim() === '';
+
 export const schemaTags = {
   type: FIELD_TYPES.COMBO_BOX,
   label: i18n.TAGS,
   helpText: i18n.TAGS_HELP,
   labelAppend: OptionalFieldLabel,
   validations: [
     {
-      validator: emptyField(i18n.TAGS_EMPTY_ERROR),
+      validator: ({ value }: { value: string | string[] }) => {
+        if (
+          (!Array.isArray(value) && isEmptyString(value)) ||
+          (Array.isArray(value) && value.length > 0 && value.find(isEmptyString))
+        ) {
+          return {
+            message: i18n.TAGS_EMPTY_ERROR,
+          };
+        }
+      },
       type: VALIDATION_TYPES.ARRAY_ITEM,
       isBlocking: false,
     },

x-pack/plugins/fleet/common/types/rest_spec/package_policy.ts

@@ -56,6 +56,7 @@ export type DeletePackagePoliciesResponse = Array<{
   name?: string;
   success: boolean;
   package?: PackagePolicyPackage;
+  policy_id?: string;
 }>;
 
 export interface UpgradePackagePolicyBaseResponse {

x-pack/plugins/fleet/server/services/package_policy.ts

@@ -489,6 +489,7 @@ class PackagePolicyService {
             title: packagePolicy.package?.title || '',
             version: packagePolicy.package?.version || '',
           },
+          policy_id: packagePolicy.policy_id,
         });
       } catch (error) {
         result.push({

x-pack/plugins/infra/public/alerting/log_threshold/components/expression_editor/criterion_preview_chart.tsx

@@ -47,6 +47,7 @@ import {
 } from '../../../../../common/http_api/log_alerts/';
 import { useChartPreviewData } from './hooks/use_chart_preview_data';
 import { decodeOrThrow } from '../../../../../common/runtime_types';
+import { useKibanaTimeZoneSetting } from '../../../../hooks/use_kibana_time_zone_setting';
 
 const GROUP_LIMIT = 5;
 
@@ -126,6 +127,7 @@ const CriterionPreviewChart: React.FC<ChartProps> = ({
 }) => {
   const { uiSettings } = useKibana().services;
   const isDarkMode = uiSettings?.get('theme:darkMode') || false;
+  const timezone = useKibanaTimeZoneSetting();
 
   const {
     getChartPreviewData,
@@ -242,6 +244,7 @@ const CriterionPreviewChart: React.FC<ChartProps> = ({
               },
             }}
             color={!isGrouped ? colorTransformer(Color.color0) : undefined}
+            timeZone={timezone}
           />
           {showThreshold && threshold ? (
             <LineAnnotation

x-pack/plugins/infra/public/hooks/use_kibana_time_zone_setting.ts

@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useUiSetting$ } from '../../../../../src/plugins/kibana_react/public';
+import { UI_SETTINGS } from '../../../../../src/plugins/data/public';
+
+export function useKibanaTimeZoneSetting() {
+  const [kibanaTimeZone] = useUiSetting$<string>(UI_SETTINGS.DATEFORMAT_TZ);
+
+  if (!kibanaTimeZone || kibanaTimeZone === 'Browser') {
+    return 'local';
+  }
+
+  return kibanaTimeZone;
+}

x-pack/plugins/infra/public/pages/logs/log_entry_categories/sections/top_categories/single_metric_sparkline.tsx

@@ -14,6 +14,7 @@ import {
 } from '@elastic/eui/dist/eui_charts_theme';
 
 import { useKibanaUiSetting } from '../../../../../utils/use_kibana_ui_setting';
+import { useKibanaTimeZoneSetting } from '../../../../../hooks/use_kibana_time_zone_setting';
 import { TimeRange } from '../../../../../../common/time';
 
 interface TimeSeriesPoint {
@@ -33,6 +34,7 @@ export const SingleMetricSparkline: React.FunctionComponent<{
   timeRange: TimeRange;
 }> = ({ metric, timeRange }) => {
   const [isDarkMode] = useKibanaUiSetting('theme:darkMode');
+  const timeZone = useKibanaTimeZoneSetting();
 
   const theme = useMemo(
     () => [
@@ -60,6 +62,7 @@ export const SingleMetricSparkline: React.FunctionComponent<{
         xAccessor={timestampAccessor}
         xScaleType={ScaleType.Time}
         yAccessors={valueAccessor}
+        timeZone={timeZone}
       />
     </Chart>
   );

x-pack/plugins/infra/public/pages/metrics/metric_detail/components/series_chart.tsx

@@ -16,6 +16,7 @@ import {
 } from '@elastic/charts';
 import { NodeDetailsDataSeries } from '../../../../../common/http_api/node_details_api';
 import { InventoryVisType } from '../../../../../common/inventory_models/types';
+import { useKibanaTimeZoneSetting } from '../../../../hooks/use_kibana_time_zone_setting';
 
 interface Props {
   id: string;
@@ -34,6 +35,7 @@ export const SeriesChart = (props: Props) => {
 };
 
 export const AreaChart = ({ id, color, series, name, type, stack }: Props) => {
+  const timezone = useKibanaTimeZoneSetting();
   const style: RecursivePartial<AreaSeriesStyle> = {
     area: {
       opacity: 1,
@@ -56,11 +58,13 @@ export const AreaChart = ({ id, color, series, name, type, stack }: Props) => {
       areaSeriesStyle={style}
       color={color ? color : void 0}
       stackAccessors={stack ? ['timestamp'] : void 0}
+      timeZone={timezone}
     />
   );
 };
 
 export const BarChart = ({ id, color, series, name, stack }: Props) => {
+  const timezone = useKibanaTimeZoneSetting();
   const style: RecursivePartial<BarSeriesStyle> = {
     rectBorder: {
       stroke: color || void 0,
@@ -83,6 +87,7 @@ export const BarChart = ({ id, color, series, name, stack }: Props) => {
       barSeriesStyle={style}
       color={color ? color : void 0}
       stackAccessors={stack ? ['timestamp'] : void 0}
+      timeZone={timezone}
     />
   );
 };

x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/series_chart.tsx

@@ -21,6 +21,7 @@ import {
   MetricsExplorerOptionsMetric,
   MetricsExplorerChartType,
 } from '../hooks/use_metrics_explorer_options';
+import { useKibanaTimeZoneSetting } from '../../../../hooks/use_kibana_time_zone_setting';
 import { getMetricId } from './helpers/get_metric_id';
 
 type NumberOrString = string | number;
@@ -42,6 +43,7 @@ export const MetricExplorerSeriesChart = (props: Props) => {
 };
 
 export const MetricsExplorerAreaChart = ({ metric, id, series, type, stack, opacity }: Props) => {
+  const timezone = useKibanaTimeZoneSetting();
   const color = (metric.color && colorTransformer(metric.color)) || colorTransformer(Color.color0);
 
   const yAccessors = Array.isArray(id)
@@ -78,11 +80,13 @@ export const MetricsExplorerAreaChart = ({ metric, id, series, type, stack, opac
       stackAccessors={stack ? ['timestamp'] : void 0}
       areaSeriesStyle={seriesAreaStyle}
       color={color}
+      timeZone={timezone}
     />
   );
 };
 
 export const MetricsExplorerBarChart = ({ metric, id, series, stack }: Props) => {
+  const timezone = useKibanaTimeZoneSetting();
   const color = (metric.color && colorTransformer(metric.color)) || colorTransformer(Color.color0);
 
   const yAccessors = Array.isArray(id)
@@ -113,6 +117,7 @@ export const MetricsExplorerBarChart = ({ metric, id, series, stack }: Props) =>
       stackAccessors={stack ? ['timestamp'] : void 0}
       barSeriesStyle={seriesBarStyle}
       color={color}
+      timeZone={timezone}
     />
   );
 };

x-pack/plugins/osquery/cypress/integration/superuser/packs.spec.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { navigateTo } from '../../tasks/navigation';
+import { FLEET_AGENT_POLICIES, navigateTo } from '../../tasks/navigation';
 import {
   deleteAndConfirm,
   findAndClickButton,
@@ -15,8 +15,10 @@ import {
 import { login } from '../../tasks/login';
 import { ArchiverMethod, runKbnArchiverScript } from '../../tasks/archiver';
 import { preparePack } from '../../tasks/packs';
+import { addIntegration, closeModalIfVisible } from '../../tasks/integrations';
 
 describe('SuperUser - Packs', () => {
+  const integration = 'Osquery Manager';
   const SAVED_QUERY_ID = 'Saved-Query-Id';
   const PACK_NAME = 'Pack-name';
   const NEW_QUERY_NAME = 'new-query-name';
@@ -77,7 +79,7 @@ describe('SuperUser - Packs', () => {
       findAndClickButton('Save and deploy changes');
     });
     // THIS TESTS TAKES TOO LONG FOR NOW - LET ME THINK IT THROUGH
-    it('to click the icon and visit discover', () => {
+    it.skip('to click the icon and visit discover', () => {
       preparePack(PACK_NAME, SAVED_QUERY_ID);
       cy.react('CustomItemAction', {
         props: { index: 0, item: { id: SAVED_QUERY_ID } },
@@ -149,6 +151,52 @@ describe('SuperUser - Packs', () => {
       deleteAndConfirm('pack');
     });
   });
+  describe('Validate that agent is getting removed from pack if we remove agent', () => {
+    beforeEach(() => {
+      login();
+    });
+    const AGENT_NAME = 'PackTest';
+    const REMOVING_PACK = 'removing-pack';
+    it('add integration', () => {
+      cy.visit(FLEET_AGENT_POLICIES);
+      cy.contains('Create agent policy').click();
+      cy.get('input[placeholder*="Choose a name"]').type(AGENT_NAME);
+      cy.get('.euiFlyoutFooter').contains('Create agent policy').click();
+      cy.contains(`Agent policy '${AGENT_NAME}' created`);
+      cy.visit(FLEET_AGENT_POLICIES);
+      cy.contains('Default Fleet Server policy').click();
+      cy.contains('Add integration').click();
+      cy.contains(integration).click();
+      addIntegration(AGENT_NAME);
+      cy.contains('Add Elastic Agent later').click();
+      navigateTo('app/osquery/packs');
+      findAndClickButton('Add pack');
+      findFormFieldByRowsLabelAndType('Name', REMOVING_PACK);
+      findFormFieldByRowsLabelAndType('Scheduled agent policies (optional)', AGENT_NAME);
+      findAndClickButton('Save pack');
+
+      cy.getBySel('toastCloseButton').click();
+      cy.contains(REMOVING_PACK).click();
+      cy.contains(`${REMOVING_PACK} details`);
+      findAndClickButton('Edit');
+      cy.react('EuiComboBoxInput', { props: { value: AGENT_NAME } }).should('exist');
+
+      cy.visit(FLEET_AGENT_POLICIES);
+      cy.contains(AGENT_NAME).click();
+      cy.get('.euiTableCellContent')
+        .get('.euiPopover__anchor')
+        .get(`[aria-label="Open"]`)
+        .first()
+        .click();
+      cy.contains(/^Delete integration$/).click();
+      closeModalIfVisible();
+      navigateTo('app/osquery/packs');
+      cy.contains(REMOVING_PACK).click();
+      cy.contains(`${REMOVING_PACK} details`);
+      findAndClickButton('Edit');
+      cy.react('EuiComboBoxInput', { props: { value: '' } }).should('exist');
+    });
+  });
   describe.skip('Remove queries from pack', () => {
     const TEST_PACK = 'Test-pack';
     before(() => {

x-pack/plugins/osquery/cypress/tasks/integrations.ts

@@ -13,14 +13,13 @@ import {
   DATA_COLLECTION_SETUP_STEP,
 } from '../screens/integrations';
 
-export const addIntegration = () => {
+export const addIntegration = (agent = 'Default fleet') => {
   cy.getBySel(ADD_POLICY_BTN).click();
   cy.getBySel(DATA_COLLECTION_SETUP_STEP).find('.euiLoadingSpinner').should('not.exist');
-  cy.getBySel('comboBoxInput').click().type('Default fleet {downArrow} {enter}');
+  cy.getBySel('comboBoxInput').click().type(`${agent} {downArrow} {enter}`);
   cy.getBySel(CREATE_PACKAGE_POLICY_SAVE_BTN).click();
   // sometimes agent is assigned to default policy, sometimes not
   closeModalIfVisible();
-  cy.getBySel(CREATE_PACKAGE_POLICY_SAVE_BTN, { timeout: 60000 }).should('not.exist');
 };
 
 export function closeModalIfVisible() {