[Security Solution] Switches remaining rule types to use new Rule Preview API

x-pack/plugins/rule_registry/server/config.ts

@@ -31,4 +31,3 @@ export const config: PluginConfigDescriptor = {
 export type RuleRegistryPluginConfig = TypeOf<typeof config.schema>;
 
 export const INDEX_PREFIX = '.alerts' as const;
-export const INDEX_PREFIX_FOR_BACKING_INDICES = '.internal.alerts' as const;

x-pack/plugins/rule_registry/server/rule_data_plugin_service/index_info.ts

@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import { INDEX_PREFIX, INDEX_PREFIX_FOR_BACKING_INDICES } from '../config';
+import { INDEX_PREFIX } from '../config';
 import { IndexOptions } from './index_options';
-import { joinWithDash } from './utils';
+import { joinWithDash, joinWith } from './utils';
 
 interface ConstructorOptions {
   indexOptions: IndexOptions;
@@ -23,16 +23,18 @@ interface ConstructorOptions {
 export class IndexInfo {
   constructor(options: ConstructorOptions) {
     const { indexOptions, kibanaVersion } = options;
-    const { registrationContext, dataset } = indexOptions;
+    const { registrationContext, dataset, additionalPrefix } = indexOptions;
 
     this.indexOptions = indexOptions;
     this.kibanaVersion = kibanaVersion;
-    this.baseName = joinWithDash(INDEX_PREFIX, `${registrationContext}.${dataset}`);
+    this.baseName = additionalPrefix
+      ? joinWith('')(
+          additionalPrefix,
+          joinWithDash(INDEX_PREFIX, `${registrationContext}.${dataset}`)
+        )
+      : joinWithDash(INDEX_PREFIX, `${registrationContext}.${dataset}`);
     this.basePattern = joinWithDash(this.baseName, '*');
-    this.baseNameForBackingIndices = joinWithDash(
-      INDEX_PREFIX_FOR_BACKING_INDICES,
-      `${registrationContext}.${dataset}`
-    );
+    this.baseNameForBackingIndices = joinWith('')(`.internal`, this.baseName);
   }
 
   /**

x-pack/plugins/rule_registry/server/rule_data_plugin_service/index_options.ts

@@ -95,6 +95,15 @@ export interface IndexOptions {
    * @example '.siem-signals', undefined
    */
   secondaryAlias?: string;
+
+  /**
+   * Optional prefix name that will be prepended to indices in addition to
+   * primary dataset and context naming convention.
+   *
+   * Currently only set to `.preview` for preview rule execution, able to be expanded
+   * later with more reason
+   */
+  additionalPrefix?: '.preview';
 }
 
 /**

x-pack/plugins/security_solution/common/constants.ts

@@ -40,7 +40,7 @@ export const DEFAULT_APP_TIME_RANGE = 'securitySolution:timeDefaults' as const;
 export const DEFAULT_APP_REFRESH_INTERVAL = 'securitySolution:refreshIntervalDefaults' as const;
 export const DEFAULT_ALERTS_INDEX = '.alerts-security.alerts' as const;
 export const DEFAULT_SIGNALS_INDEX = '.siem-signals' as const;
-export const DEFAULT_PREVIEW_INDEX = '.siem-preview-signals' as const;
+export const DEFAULT_PREVIEW_INDEX = '.preview.alerts-security.alerts' as const;
 export const DEFAULT_LISTS_INDEX = '.lists' as const;
 export const DEFAULT_ITEMS_INDEX = '.items' as const;
 // The DEFAULT_MAX_SIGNALS value exists also in `x-pack/plugins/cases/common/constants.ts`

x-pack/plugins/security_solution/common/detection_engine/schemas/request/rule_schemas.ts

@@ -367,6 +367,7 @@ export const previewRulesSchema = t.intersection([
   createTypeSpecific,
   t.type({ invocationCount: t.number }),
 ]);
+export type PreviewRulesSchema = t.TypeOf<typeof previewRulesSchema>;
 
 type UpdateSchema<T> = SharedUpdateSchema & T;
 export type EqlUpdateSchema = UpdateSchema<t.TypeOf<typeof eqlCreateParams>>;

x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts

@@ -104,9 +104,9 @@ export const DEFINE_INDEX_INPUT =
 
 export const EQL_TYPE = '[data-test-subj="eqlRuleType"]';
 
-export const EQL_QUERY_INPUT = '[data-test-subj="eqlQueryBarTextInput"]';
+export const PREVIEW_HISTOGRAM = '[data-test-subj="preview-histogram-bar-chart"]';
 
-export const EQL_QUERY_PREVIEW_HISTOGRAM = '[data-test-subj="queryPreviewEqlHistogram"]';
+export const EQL_QUERY_INPUT = '[data-test-subj="eqlQueryBarTextInput"]';
 
 export const EQL_QUERY_VALIDATION_SPINNER = '[data-test-subj="eql-validation-loading"]';
 
@@ -170,7 +170,7 @@ export const RISK_OVERRIDE =
 
 export const RULES_CREATION_FORM = '[data-test-subj="stepDefineRule"]';
 
-export const RULES_CREATION_PREVIEW = '[data-test-subj="ruleCreationQueryPreview"]';
+export const RULES_CREATION_PREVIEW = '[data-test-subj="rule-preview"]';
 
 export const RULE_DESCRIPTION_INPUT =
   '[data-test-subj="detectionEngineStepAboutRuleDescription"] [data-test-subj="input"]';

x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts

@@ -33,7 +33,6 @@ import {
   DEFAULT_RISK_SCORE_INPUT,
   DEFINE_CONTINUE_BUTTON,
   EQL_QUERY_INPUT,
-  EQL_QUERY_PREVIEW_HISTOGRAM,
   EQL_QUERY_VALIDATION_SPINNER,
   EQL_TYPE,
   FALSE_POSITIVES_INPUT,
@@ -92,6 +91,7 @@ import {
   EMAIL_CONNECTOR_USER_INPUT,
   EMAIL_CONNECTOR_PASSWORD_INPUT,
   EMAIL_CONNECTOR_SERVICE_SELECTOR,
+  PREVIEW_HISTOGRAM,
 } from '../screens/create_new_rule';
 import { LOADING_INDICATOR } from '../screens/security_header';
 import { TOAST_ERROR } from '../screens/shared';
@@ -325,12 +325,12 @@ export const fillDefineEqlRuleAndContinue = (rule: CustomRule) => {
     .find(QUERY_PREVIEW_BUTTON)
     .should('not.be.disabled')
     .click({ force: true });
-  cy.get(EQL_QUERY_PREVIEW_HISTOGRAM)
+  cy.get(PREVIEW_HISTOGRAM)
     .invoke('text')
     .then((text) => {
       if (text !== 'Hits') {
         cy.get(RULES_CREATION_PREVIEW).find(QUERY_PREVIEW_BUTTON).click({ force: true });
-        cy.get(EQL_QUERY_PREVIEW_HISTOGRAM).should('contain.text', 'Hits');
+        cy.get(PREVIEW_HISTOGRAM).should('contain.text', 'Hits');
       }
     });
   cy.get(TOAST_ERROR).should('not.exist');

x-pack/plugins/security_solution/public/common/components/matrix_histogram/types.ts

@@ -15,7 +15,7 @@ import { MatrixHistogramType } from '../../../../common/search_strategy/security
 import { UpdateDateRange } from '../charts/common';
 import { GlobalTimeArgs } from '../../containers/use_global_time';
 import { DocValueFields } from '../../../../common/search_strategy';
-import { Threshold } from '../../../detections/components/rules/query_preview';
+import { FieldValueThreshold } from '../../../detections/components/rules/threshold_input';
 
 export type MatrixHistogramMappingTypes = Record<
   string,
@@ -77,7 +77,7 @@ export interface MatrixHistogramQueryProps {
   stackByField: string;
   startDate: string;
   histogramType: MatrixHistogramType;
-  threshold?: Threshold;
+  threshold?: FieldValueThreshold;
   skip?: boolean;
   isPtrIncluded?: boolean;
   includeMissingData?: boolean;