Skip to content

Commit

Permalink
[Rules migration] ES|QL query editing and validation in translation t…
Browse files Browse the repository at this point in the history
…ab in the flyout (#11381) (#203601)

## Summary

[Internal link](elastic/security-team#10820)
to the feature details

These changes add a possibility to edit, validate and save custom
migration rules:
* There are new `edit`, `save` and `cancel` buttons in the translation
tab of the details flyout for the non-installed custom rules
* There is a new ES|QL query editing component in the translation tab
which allows edit and validate the ES|QL query
* On saving the ES|QL query the custom migration rule will be updated
and based on the ES|QL validation a new `translation_result` might be
set: `full` if query is valid, `partial` if query has syntax errors,
`untraslated` if query is an empty string.

## Screen recording

https://github.com/user-attachments/assets/59cfc56f-3de8-4f7a-a2f9-79cb3fdee1c7

### Other changes

Next fixes and adjustments were also implemented as part of this PR:
* `Error` status in migration rules table to indicate whether the rule
translation has been failed
* Callouts inside the translation tab in details flyout
* Updated `Fully translated` status title into `Translated`

### Known issue

There is an issue with the autocompletion menu of the ES|QL query editor
component. It is being shifted. It could be because we are using this
component within the flyout and we might need to ask help from the team
which takes care of it.

(cherry picked from commit 668f776)
  • Loading branch information
e40pud committed Dec 12, 2024
1 parent a6f369b commit fee9073
Show file tree
Hide file tree
Showing 27 changed files with 706 additions and 175 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,8 @@
import { z } from '@kbn/zod';
import { ArrayFromString } from '@kbn/zod-helpers';

import { NonEmptyString } from '../../../../api/model/primitives.gen';
import {
ElasticRulePartial,
RuleMigrationTranslationResult,
RuleMigrationComments,
UpdateRuleMigrationData,
RuleMigrationTaskStats,
OriginalRule,
RuleMigration,
Expand All @@ -31,6 +28,7 @@ import {
RuleMigrationResourceType,
RuleMigrationResource,
} from '../../rule_migration.gen';
import { NonEmptyString } from '../../../../api/model/primitives.gen';
import { ConnectorId, LangSmithOptions } from '../../common.gen';

export type CreateRuleMigrationRequestParams = z.infer<typeof CreateRuleMigrationRequestParams>;
Expand Down Expand Up @@ -62,6 +60,7 @@ export const GetRuleMigrationRequestQuery = z.object({
sort_field: NonEmptyString.optional(),
sort_direction: z.enum(['asc', 'desc']).optional(),
search_term: z.string().optional(),
ids: ArrayFromString(NonEmptyString).optional(),
});
export type GetRuleMigrationRequestQueryInput = z.input<typeof GetRuleMigrationRequestQuery>;

Expand Down Expand Up @@ -231,26 +230,7 @@ export const StopRuleMigrationResponse = z.object({
});

export type UpdateRuleMigrationRequestBody = z.infer<typeof UpdateRuleMigrationRequestBody>;
export const UpdateRuleMigrationRequestBody = z.array(
z.object({
/**
* The rule migration id
*/
id: NonEmptyString,
/**
* The migrated elastic rule attributes to update.
*/
elastic_rule: ElasticRulePartial.optional(),
/**
* The rule translation result.
*/
translation_result: RuleMigrationTranslationResult.optional(),
/**
* The comments for the migration including a summary from the LLM in markdown.
*/
comments: RuleMigrationComments.optional(),
})
);
export const UpdateRuleMigrationRequestBody = z.array(UpdateRuleMigrationData);
export type UpdateRuleMigrationRequestBodyInput = z.input<typeof UpdateRuleMigrationRequestBody>;

export type UpdateRuleMigrationResponse = z.infer<typeof UpdateRuleMigrationResponse>;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,22 +20,7 @@ paths:
schema:
type: array
items:
type: object
required:
- id
properties:
id:
description: The rule migration id
$ref: '../../../../../common/api/model/primitives.schema.yaml#/components/schemas/NonEmptyString'
elastic_rule:
description: The migrated elastic rule attributes to update.
$ref: '../../rule_migration.schema.yaml#/components/schemas/ElasticRulePartial'
translation_result:
description: The rule translation result.
$ref: '../../rule_migration.schema.yaml#/components/schemas/RuleMigrationTranslationResult'
comments:
description: The comments for the migration including a summary from the LLM in markdown.
$ref: '../../rule_migration.schema.yaml#/components/schemas/RuleMigrationComments'
$ref: '../../rule_migration.schema.yaml#/components/schemas/UpdateRuleMigrationData'
responses:
200:
description: Indicates rules migrations have been updated correctly.
Expand Down Expand Up @@ -151,6 +136,14 @@ paths:
required: false
schema:
type: string
- name: ids
in: query
required: false
schema:
type: array
items:
description: The rule migration id
$ref: '../../../../../common/api/model/primitives.schema.yaml#/components/schemas/NonEmptyString'

responses:
200:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -303,6 +303,29 @@ export const RuleMigrationTranslationStats = z.object({
}),
});

/**
* The rule migration data object for rule update operation
*/
export type UpdateRuleMigrationData = z.infer<typeof UpdateRuleMigrationData>;
export const UpdateRuleMigrationData = z.object({
/**
* The rule migration id
*/
id: NonEmptyString,
/**
* The migrated elastic rule attributes to update.
*/
elastic_rule: ElasticRulePartial.optional(),
/**
* The rule translation result.
*/
translation_result: RuleMigrationTranslationResult.optional(),
/**
* The comments for the migration including a summary from the LLM in markdown.
*/
comments: RuleMigrationComments.optional(),
});

/**
* The type of the rule migration resource.
*/
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,25 @@ components:
items:
type: string

UpdateRuleMigrationData:
type: object
description: The rule migration data object for rule update operation
required:
- id
properties:
id:
description: The rule migration id
$ref: '../../../common/api/model/primitives.schema.yaml#/components/schemas/NonEmptyString'
elastic_rule:
description: The migrated elastic rule attributes to update.
$ref: '#/components/schemas/ElasticRulePartial'
translation_result:
description: The rule translation result.
$ref: '#/components/schemas/RuleMigrationTranslationResult'
comments:
description: The comments for the migration including a summary from the LLM in markdown.
$ref: '#/components/schemas/RuleMigrationComments'

## Rule migration resources

RuleMigrationResourceType:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@

import { replaceParams } from '@kbn/openapi-common/shared';

import type { UpdateRuleMigrationData } from '../../../../common/siem_migrations/model/rule_migration.gen';
import type { LangSmithOptions } from '../../../../common/siem_migrations/model/common.gen';
import { KibanaServices } from '../../../common/lib/kibana';

Expand All @@ -32,6 +33,7 @@ import type {
StartRuleMigrationRequestBody,
GetRuleMigrationStatsResponse,
GetRuleMigrationPrebuiltRulesResponse,
UpdateRuleMigrationResponse,
} from '../../../../common/siem_migrations/model/api/rules/rule_migration.gen';

export interface GetRuleMigrationStatsParams {
Expand Down Expand Up @@ -126,6 +128,8 @@ export interface GetRuleMigrationParams {
sortDirection?: 'asc' | 'desc';
/** Optional search term to filter documents */
searchTerm?: string;
/** Optional rules ids to filter documents */
ids?: string[];
/** Optional AbortSignal for cancelling request */
signal?: AbortSignal;
}
Expand All @@ -137,6 +141,7 @@ export const getRuleMigrations = async ({
sortField,
sortDirection,
searchTerm,
ids,
signal,
}: GetRuleMigrationParams): Promise<GetRuleMigrationResponse> => {
return KibanaServices.get().http.get<GetRuleMigrationResponse>(
Expand All @@ -149,6 +154,7 @@ export const getRuleMigrations = async ({
sort_field: sortField,
sort_direction: sortDirection,
search_term: searchTerm,
ids,
},
signal,
}
Expand Down Expand Up @@ -230,3 +236,21 @@ export const getRuleMigrationsPrebuiltRules = async ({
{ version: '1', signal }
);
};

export interface UpdateRulesParams {
/** The list of migration rules data to update */
rulesToUpdate: UpdateRuleMigrationData[];
/** Optional AbortSignal for cancelling request */
signal?: AbortSignal;
}
/** Updates provided migration rules. */
export const updateMigrationRules = async ({
rulesToUpdate,
signal,
}: UpdateRulesParams): Promise<UpdateRuleMigrationResponse> => {
return KibanaServices.get().http.put<UpdateRuleMigrationResponse>(SIEM_RULE_MIGRATIONS_PATH, {
version: '1',
body: JSON.stringify(rulesToUpdate),
signal,
});
};
Loading

0 comments on commit fee9073

Please sign in to comment.