Merge branch 'master' into eui/37.1

packages/kbn-docs-utils/.babelrc

@@ -0,0 +1,3 @@
+{
+  "presets": ["@kbn/babel-preset/node_preset"]
+}

packages/kbn-docs-utils/BUILD.bazel

@@ -1,5 +1,6 @@
 load("@npm//@bazel/typescript:index.bzl", "ts_config", "ts_project")
 load("@build_bazel_rules_nodejs//:index.bzl", "js_library", "pkg_npm")
+load("//src/dev/bazel:index.bzl", "jsts_transpiler")
 
 PKG_BASE_NAME = "kbn-docs-utils"
 PKG_REQUIRE_NAME = "@kbn/docs-utils"
@@ -26,7 +27,7 @@ NPM_MODULE_EXTRA_FILES = [
   "package.json",
 ]
 
-SRC_DEPS = [
+RUNTIME_DEPS = [
   "//packages/kbn-config",
   "//packages/kbn-dev-utils",
   "//packages/kbn-utils",
@@ -35,12 +36,20 @@ SRC_DEPS = [
 ]
 
 TYPES_DEPS = [
+  "//packages/kbn-config",
+  "//packages/kbn-dev-utils",
+  "//packages/kbn-utils",
+  "@npm//ts-morph",
   "@npm//@types/dedent",
   "@npm//@types/jest",
   "@npm//@types/node",
 ]
 
-DEPS = SRC_DEPS + TYPES_DEPS
+jsts_transpiler(
+  name = "target_node",
+  srcs = SRCS,
+  build_pkg_name = package_name(),
+)
 
 ts_config(
   name = "tsconfig",
@@ -52,13 +61,14 @@ ts_config(
 )
 
 ts_project(
-  name = "tsc",
+  name = "tsc_types",
   args = ['--pretty'],
   srcs = SRCS,
-  deps = DEPS,
+  deps = TYPES_DEPS,
   declaration = True,
   declaration_map = True,
-  out_dir = "target",
+  emit_declaration_only = True,
+  out_dir = "target_types",
   source_map = True,
   root_dir = "src",
   tsconfig = ":tsconfig",
@@ -67,7 +77,7 @@ ts_project(
 js_library(
   name = PKG_BASE_NAME,
   srcs = NPM_MODULE_EXTRA_FILES,
-  deps = DEPS + [":tsc"],
+  deps = RUNTIME_DEPS + [":target_node", ":tsc_types"],
   package_name = PKG_REQUIRE_NAME,
   visibility = ["//visibility:public"],
 )

packages/kbn-docs-utils/package.json

@@ -3,8 +3,8 @@
   "version": "1.0.0",
   "license": "SSPL-1.0 OR Elastic License 2.0",
   "private": "true",
-  "main": "target/index.js",
-  "types": "target/index.d.ts",
+  "main": "target_node/index.js",
+  "types": "target_types/index.d.ts",
   "kibana": {
     "devOnly": true
   }

packages/kbn-docs-utils/tsconfig.json

@@ -1,9 +1,10 @@
 {
   "extends": "../../tsconfig.bazel.json",
   "compilerOptions": {
-    "outDir": "./target/types",
     "declaration": true,
     "declarationMap": true,
+    "emitDeclarationOnly": true,
+    "outDir": "target_types",
     "rootDir": "src",
     "sourceMap": true,
     "sourceRoot": "../../../../packages/kbn-docs-utils/src",

x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts

@@ -19,6 +19,7 @@ import {
   ALERT_REASON as ALERT_REASON_NON_TYPED,
   // @ts-expect-error
 } from '@kbn/rule-data-utils/target_node/technical_field_names';
+import { SearchAggregatedTransactionSetting } from '../../../common/aggregated_transactions';
 import { asDuration } from '../../../../observability/common/utils/formatters';
 import { createLifecycleRuleTypeFactory } from '../../../../rule_registry/server';
 import {
@@ -44,6 +45,7 @@ import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
 import { apmActionVariables } from './action_variables';
 import { alertingEsClient } from './alerting_es_client';
 import { RegisterRuleDependencies } from './register_apm_alerts';
+import { getDocumentTypeFilterForAggregatedTransactions } from '../helpers/aggregated_transactions';
 
 const ALERT_EVALUATION_THRESHOLD: typeof ALERT_EVALUATION_THRESHOLD_TYPED = ALERT_EVALUATION_THRESHOLD_NON_TYPED;
 const ALERT_EVALUATION_VALUE: typeof ALERT_EVALUATION_VALUE_TYPED = ALERT_EVALUATION_VALUE_NON_TYPED;
@@ -105,8 +107,19 @@ export function registerTransactionDurationAlertType({
         savedObjectsClient: services.savedObjectsClient,
       });
 
+      // only query transaction events when set to 'never',
+      // to prevent (likely) unnecessary blocking request
+      // in rule execution
+      const searchAggregatedTransactions =
+        config['xpack.apm.searchAggregatedTransactions'] !==
+        SearchAggregatedTransactionSetting.never;
+
+      const index = searchAggregatedTransactions
+        ? indices['apm_oss.metricsIndices']
+        : indices['apm_oss.transactionIndices'];
+
       const searchParams = {
-        index: indices['apm_oss.transactionIndices'],
+        index,
         body: {
           size: 0,
           query: {
@@ -119,9 +132,9 @@ export function registerTransactionDurationAlertType({
                     },
                   },
                 },
-                {
-                  term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction },
-                },
+                ...getDocumentTypeFilterForAggregatedTransactions(
+                  searchAggregatedTransactions
+                ),
                 { term: { [SERVICE_NAME]: alertParams.serviceName } },
                 {
                   term: {

x-pack/plugins/apm/server/lib/alerts/register_transaction_error_rate_alert_type.ts

@@ -45,6 +45,8 @@ import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
 import { apmActionVariables } from './action_variables';
 import { alertingEsClient } from './alerting_es_client';
 import { RegisterRuleDependencies } from './register_apm_alerts';
+import { SearchAggregatedTransactionSetting } from '../../../common/aggregated_transactions';
+import { getDocumentTypeFilterForAggregatedTransactions } from '../helpers/aggregated_transactions';
 import { asPercent } from '../../../../observability/common/utils/formatters';
 
 const ALERT_EVALUATION_THRESHOLD: typeof ALERT_EVALUATION_THRESHOLD_TYPED = ALERT_EVALUATION_THRESHOLD_NON_TYPED;
@@ -102,9 +104,20 @@ export function registerTransactionErrorRateAlertType({
           savedObjectsClient: services.savedObjectsClient,
         });
 
+        // only query transaction events when set to 'never',
+        // to prevent (likely) unnecessary blocking request
+        // in rule execution
+        const searchAggregatedTransactions =
+          config['xpack.apm.searchAggregatedTransactions'] !==
+          SearchAggregatedTransactionSetting.never;
+
+        const index = searchAggregatedTransactions
+          ? indices['apm_oss.metricsIndices']
+          : indices['apm_oss.transactionIndices'];
+
         const searchParams = {
-          index: indices['apm_oss.transactionIndices'],
-          size: 1,
+          index,
+          size: 0,
           body: {
             query: {
               bool: {
@@ -116,7 +129,9 @@ export function registerTransactionErrorRateAlertType({
                       },
                     },
                   },
-                  { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
+                  ...getDocumentTypeFilterForAggregatedTransactions(
+                    searchAggregatedTransactions
+                  ),
                   {
                     terms: {
                       [EVENT_OUTCOME]: [

x-pack/plugins/cases/public/components/case_view/index.tsx

@@ -105,7 +105,6 @@ export const CaseComponent = React.memo<CaseComponentProps>(
     const [initLoadingData, setInitLoadingData] = useState(true);
     const init = useRef(true);
     const timelineUi = useTimelineContext()?.ui;
-    const alertConsumers = useTimelineContext()?.alertConsumers;
 
     const {
       caseUserActions,
@@ -487,9 +486,7 @@ export const CaseComponent = React.memo<CaseComponentProps>(
             </EuiFlexGroup>
           </ContentWrapper>
         </WhitePageWrapper>
-        {timelineUi?.renderTimelineDetailsPanel
-          ? timelineUi.renderTimelineDetailsPanel({ alertConsumers })
-          : null}
+        {timelineUi?.renderTimelineDetailsPanel ? timelineUi.renderTimelineDetailsPanel() : null}
       </>
     );
   }

x-pack/plugins/cases/public/components/timeline_context/index.tsx

@@ -7,7 +7,6 @@
 
 import React, { useState } from 'react';
 import { EuiMarkdownEditorUiPlugin, EuiMarkdownAstNodePosition } from '@elastic/eui';
-import { AlertConsumers } from '@kbn/rule-data-utils';
 import { Plugin } from 'unified';
 /**
  * @description - manage the plugins, hooks, and ui components needed to enable timeline functionality within the cases plugin
@@ -29,7 +28,6 @@ interface TimelineProcessingPluginRendererProps {
 }
 
 export interface CasesTimelineIntegration {
-  alertConsumers?: AlertConsumers[];
   editor_plugins: {
     parsingPlugin: Plugin;
     processingPluginRenderer: React.FC<
@@ -45,11 +43,7 @@ export interface CasesTimelineIntegration {
   };
   ui?: {
     renderInvestigateInTimelineActionComponent?: (alertIds: string[]) => JSX.Element;
-    renderTimelineDetailsPanel?: ({
-      alertConsumers,
-    }: {
-      alertConsumers?: AlertConsumers[];
-    }) => JSX.Element;
+    renderTimelineDetailsPanel?: () => JSX.Element;
   };
 }
 

x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx

@@ -7,7 +7,6 @@
 
 import React, { useCallback, useRef, useState } from 'react';
 import { useDispatch } from 'react-redux';
-import { AlertConsumers } from '@kbn/rule-data-utils';
 
 import {
   getCaseDetailsUrl,
@@ -34,7 +33,6 @@ import { SpyRoute } from '../../../common/utils/route/spy_routes';
 import * as timelineMarkdownPlugin from '../../../common/components/markdown_editor/plugins/timeline';
 import { CaseDetailsRefreshContext } from '../../../common/components/endpoint/host_isolation/endpoint_host_isolation_cases_context';
 import { getEndpointDetailsPath } from '../../../management/common/routing';
-import { EntityType } from '../../../timelines/containers/details';
 
 interface Props {
   caseId: string;
@@ -55,17 +53,13 @@ export interface CaseProps extends Props {
   updateCase: (newCase: Case) => void;
 }
 
-const ALERT_CONSUMER: AlertConsumers[] = [AlertConsumers.SIEM];
-
-const TimelineDetailsPanel = ({ alertConsumers }: { alertConsumers?: AlertConsumers[] }) => {
+const TimelineDetailsPanel = () => {
   const { browserFields, docValueFields } = useSourcererScope(SourcererScopeName.detections);
 
   return (
     <DetailsPanel
-      alertConsumers={alertConsumers}
       browserFields={browserFields}
       docValueFields={docValueFields}
-      entityType={EntityType.ALERTS}
       isFlyoutView
       timelineId={TimelineId.casePage}
     />
@@ -234,7 +228,6 @@ export const CaseView = React.memo(({ caseId, subCaseId, userCanCrud }: Props) =
         showAlertDetails,
         subCaseId,
         timelineIntegration: {
-          alertConsumers: ALERT_CONSUMER,
           editor_plugins: {
             parsingPlugin: timelineMarkdownPlugin.parser,
             processingPluginRenderer: timelineMarkdownPlugin.renderer,

x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx

@@ -11,7 +11,6 @@ import deepEqual from 'fast-deep-equal';
 import styled from 'styled-components';
 
 import { isEmpty } from 'lodash/fp';
-import { AlertConsumers } from '@kbn/rule-data-utils';
 import { inputsModel, inputsSelectors, State } from '../../store';
 import { inputsActions } from '../../store/actions';
 import { ControlColumnProps, RowRenderer, TimelineId } from '../../../../common/types/timeline';
@@ -32,7 +31,6 @@ import { useKibana } from '../../lib/kibana';
 import { defaultControlColumn } from '../../../timelines/components/timeline/body/control_columns';
 import { EventsViewer } from './events_viewer';
 import * as i18n from './translations';
-import { EntityType } from '../../../timelines/containers/details';
 
 const EMPTY_CONTROL_COLUMNS: ControlColumnProps[] = [];
 const leadingControlColumns: ControlColumnProps[] = [
@@ -71,8 +69,6 @@ export interface OwnProps {
 
 type Props = OwnProps & PropsFromRedux;
 
-const alertConsumers: AlertConsumers[] = [AlertConsumers.SIEM];
-
 /**
  * The stateful events viewer component is the highest level component that is utilized across the security_solution pages layer where
  * timeline is used BESIDES the flyout. The flyout makes use of the `EventsViewer` component which is a subcomponent here
@@ -213,9 +209,7 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
         </InspectButtonContainer>
       </FullScreenContainer>
       <DetailsPanel
-        alertConsumers={alertConsumers}
         browserFields={browserFields}
-        entityType={EntityType.ALERTS}
         docValueFields={docValueFields}
         isFlyoutView
         timelineId={id}

x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/activity_log_date_range_picker/index.tsx

@@ -20,9 +20,11 @@ const DatePickerWrapper = styled.div`
   background: white;
 `;
 const StickyFlexItem = styled(EuiFlexItem)`
+  max-width: 350px;
   position: sticky;
   top: ${(props) => props.theme.eui.euiSizeM};
   z-index: 1;
+  padding: ${(props) => `0 ${props.theme.eui.paddingSizes.m}`};
 `;
 
 export const DateRangePicker = memo(() => {

x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx

@@ -17,10 +17,9 @@ import {
 import React, { useState, useCallback, useMemo } from 'react';
 import styled from 'styled-components';
 import deepEqual from 'fast-deep-equal';
-import { AlertConsumers } from '@kbn/rule-data-utils';
 import { BrowserFields, DocValueFields } from '../../../../common/containers/source';
 import { ExpandableEvent, ExpandableEventTitle } from './expandable_event';
-import { EntityType, useTimelineEventsDetails } from '../../../containers/details';
+import { useTimelineEventsDetails } from '../../../containers/details';
 import { TimelineTabs } from '../../../../../common/types/timeline';
 import { HostIsolationPanel } from '../../../../detections/components/host_isolation';
 import { EndpointIsolateSuccess } from '../../../../common/components/endpoint/host_isolation';
@@ -50,10 +49,8 @@ const StyledEuiFlyoutBody = styled(EuiFlyoutBody)`
 `;
 
 interface EventDetailsPanelProps {
-  alertConsumers?: AlertConsumers[];
   browserFields: BrowserFields;
   docValueFields: DocValueFields[];
-  entityType?: EntityType;
   expandedEvent: {
     eventId: string;
     indexName: string;
@@ -68,20 +65,16 @@ interface EventDetailsPanelProps {
 }
 
 const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
-  alertConsumers,
   browserFields,
   docValueFields,
-  entityType,
   expandedEvent,
   handleOnEventClosed,
   isFlyoutView,
   tabType,
   timelineId,
 }) => {
   const [loading, detailsData] = useTimelineEventsDetails({
-    alertConsumers,
     docValueFields,
-    entityType,
     indexName: expandedEvent.indexName ?? '',
     eventId: expandedEvent.eventId ?? '',
     skip: !expandedEvent.eventId,