[Security Solution] Add a rule management filters internal endpoint

x-pack/plugins/alerting/server/rules_client.mock.ts

@@ -12,7 +12,7 @@ export type RulesClientMock = jest.Mocked<Schema>;
 
 const createRulesClientMock = () => {
   const mocked: RulesClientMock = {
-    aggregate: jest.fn(),
+    aggregate: jest.fn().mockReturnValue({ alertExecutionStatus: {}, ruleLastRunOutcome: {} }),
     create: jest.fn(),
     get: jest.fn(),
     resolve: jest.fn(),

x-pack/plugins/alerting/server/rules_client/methods/aggregate.ts

@@ -22,6 +22,7 @@ export interface AggregateOptions extends IndexType {
     id: string;
   };
   filter?: string | KueryNode;
+  maxTags?: number;
 }
 
 interface IndexType {
@@ -79,7 +80,9 @@ export interface RuleAggregation {
 
 export async function aggregate(
   context: RulesClientContext,
-  { options: { fields, filter, ...options } = {} }: { options?: AggregateOptions } = {}
+  {
+    options: { fields, filter, maxTags = 50, ...options } = {},
+  }: { options?: AggregateOptions } = {}
 ): Promise<AggregateResult> {
   let authorizationTuple;
   try {
@@ -123,7 +126,7 @@ export async function aggregate(
         terms: { field: 'alert.attributes.muteAll' },
       },
       tags: {
-        terms: { field: 'alert.attributes.tags', order: { _key: 'asc' }, size: 50 },
+        terms: { field: 'alert.attributes.tags', order: { _key: 'asc' }, size: maxTags },
       },
       snoozed: {
         nested: {

x-pack/plugins/alerting/server/rules_client/tests/aggregate.test.ts

@@ -310,4 +310,38 @@ describe('aggregate()', () => {
       })
     );
   });
+
+  describe('tags number limit', () => {
+    test('sets to default (50) if it is not provided', async () => {
+      const rulesClient = new RulesClient(rulesClientParams);
+
+      await rulesClient.aggregate();
+
+      expect(unsecuredSavedObjectsClient.find.mock.calls[0]).toMatchObject([
+        {
+          aggs: {
+            tags: {
+              terms: { size: 50 },
+            },
+          },
+        },
+      ]);
+    });
+
+    test('sets to the provided value', async () => {
+      const rulesClient = new RulesClient(rulesClientParams);
+
+      await rulesClient.aggregate({ options: { maxTags: 1000 } });
+
+      expect(unsecuredSavedObjectsClient.find.mock.calls[0]).toMatchObject([
+        {
+          aggs: {
+            tags: {
+              terms: { size: 1000 },
+            },
+          },
+        },
+      ]);
+    });
+  });
 });

x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/filters/response_schema.test.ts

@@ -0,0 +1,151 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { left } from 'fp-ts/lib/Either';
+import { exactCheck, foldLeftRight, getPaths } from '@kbn/securitysolution-io-ts-utils';
+
+import { RuleManagementFiltersResponse } from './response_schema';
+
+describe('Rule management filters response schema', () => {
+  test('it should validate an empty response with defaults', () => {
+    const payload: RuleManagementFiltersResponse = {
+      rules_summary: {
+        custom_count: 0,
+        prebuilt_installed_count: 0,
+      },
+      aggregated_fields: {
+        tags: [],
+      },
+    };
+    const decoded = RuleManagementFiltersResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = foldLeftRight(checked);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an non empty response with defaults', () => {
+    const payload: RuleManagementFiltersResponse = {
+      rules_summary: {
+        custom_count: 10,
+        prebuilt_installed_count: 20,
+      },
+      aggregated_fields: {
+        tags: ['a', 'b', 'c'],
+      },
+    };
+    const decoded = RuleManagementFiltersResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = foldLeftRight(checked);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should not validate an extra invalid field added', () => {
+    const payload: RuleManagementFiltersResponse & { invalid_field: string } = {
+      rules_summary: {
+        custom_count: 0,
+        prebuilt_installed_count: 0,
+      },
+      aggregated_fields: {
+        tags: [],
+      },
+      invalid_field: 'invalid',
+    };
+    const decoded = RuleManagementFiltersResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = foldLeftRight(checked);
+
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "invalid_field"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate an empty response with a negative "summary.prebuilt_installed_count" number', () => {
+    const payload: RuleManagementFiltersResponse = {
+      rules_summary: {
+        custom_count: 0,
+        prebuilt_installed_count: -1,
+      },
+      aggregated_fields: {
+        tags: [],
+      },
+    };
+    const decoded = RuleManagementFiltersResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = foldLeftRight(checked);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "-1" supplied to "rules_summary,prebuilt_installed_count"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate an empty response with a negative "summary.custom_count"', () => {
+    const payload: RuleManagementFiltersResponse = {
+      rules_summary: {
+        custom_count: -1,
+        prebuilt_installed_count: 0,
+      },
+      aggregated_fields: {
+        tags: [],
+      },
+    };
+    const decoded = RuleManagementFiltersResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = foldLeftRight(checked);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "-1" supplied to "rules_summary,custom_count"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate an empty prepackaged response if "summary.prebuilt_installed_count" is not there', () => {
+    const payload: RuleManagementFiltersResponse = {
+      rules_summary: {
+        custom_count: 0,
+        prebuilt_installed_count: 0,
+      },
+      aggregated_fields: {
+        tags: [],
+      },
+    };
+    // @ts-expect-error
+    delete payload.rules_summary.prebuilt_installed_count;
+    const decoded = RuleManagementFiltersResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = foldLeftRight(checked);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "rules_summary,prebuilt_installed_count"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate an empty response with wrong "aggregated_fields.tags"', () => {
+    const payload: RuleManagementFiltersResponse = {
+      rules_summary: {
+        custom_count: 0,
+        prebuilt_installed_count: 0,
+      },
+      aggregated_fields: {
+        // @ts-expect-error Passing an invalid value for the test
+        tags: [1],
+      },
+    };
+    const decoded = RuleManagementFiltersResponse.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = foldLeftRight(checked);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "1" supplied to "aggregated_fields,tags"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+});

x-pack/plugins/security_solution/common/detection_engine/rule_management/api/rules/filters/response_schema.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+import { PositiveInteger } from '@kbn/securitysolution-io-ts-types';
+
+export type RuleManagementFiltersResponse = t.TypeOf<typeof RuleManagementFiltersResponse>;
+export const RuleManagementFiltersResponse = t.exact(
+  t.type({
+    rules_summary: t.type({
+      custom_count: PositiveInteger,
+      prebuilt_installed_count: PositiveInteger,
+    }),
+    aggregated_fields: t.type({
+      tags: t.array(t.string),
+    }),
+  })
+);

x-pack/plugins/security_solution/common/detection_engine/rule_management/api/urls.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { INTERNAL_DETECTION_ENGINE_URL } from '../../../constants';
+
+export const RULE_MANAGEMENT_FILTERS_URL = `${INTERNAL_DETECTION_ENGINE_URL}/rules/_rule_management_filters`;

x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.test.ts

@@ -31,7 +31,6 @@ import {
   createPrepackagedRules,
   importRules,
   exportRules,
-  fetchTags,
   getPrePackagedRulesStatus,
   previewRule,
   findRuleExceptionReferences,
@@ -630,26 +629,6 @@ describe('Detections Rules API', () => {
     });
   });
 
-  describe('fetchTags', () => {
-    beforeEach(() => {
-      fetchMock.mockClear();
-      fetchMock.mockResolvedValue(['some', 'tags']);
-    });
-
-    test('check parameter url when fetching tags', async () => {
-      await fetchTags({ signal: abortCtrl.signal });
-      expect(fetchMock).toHaveBeenCalledWith('/api/detection_engine/tags', {
-        signal: abortCtrl.signal,
-        method: 'GET',
-      });
-    });
-
-    test('happy path', async () => {
-      const resp = await fetchTags({ signal: abortCtrl.signal });
-      expect(resp).toEqual(['some', 'tags']);
-    });
-  });
-
   describe('getPrePackagedRulesStatus', () => {
     const prePackagedRulesStatus = {
       rules_custom_installed: 33,

x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.ts

@@ -11,13 +11,14 @@ import type {
   ExceptionListItemSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
 
+import type { RuleManagementFiltersResponse } from '../../../../common/detection_engine/rule_management/api/rules/filters/response_schema';
+import { RULE_MANAGEMENT_FILTERS_URL } from '../../../../common/detection_engine/rule_management/api/urls';
 import type { BulkActionsDryRunErrCode } from '../../../../common/constants';
 import {
   DETECTION_ENGINE_RULES_BULK_ACTION,
   DETECTION_ENGINE_RULES_PREVIEW,
   DETECTION_ENGINE_RULES_URL,
   DETECTION_ENGINE_RULES_URL_FIND,
-  DETECTION_ENGINE_TAGS_URL,
 } from '../../../../common/constants';
 
 import {
@@ -33,7 +34,6 @@ import type {
   BulkActionDuplicatePayload,
 } from '../../../../common/detection_engine/rule_management/api/rules/bulk_actions/request_schema';
 import { BulkActionType } from '../../../../common/detection_engine/rule_management/api/rules/bulk_actions/request_schema';
-
 import type {
   RuleResponse,
   PreviewResponse,
@@ -388,17 +388,19 @@ export const exportRules = async ({
   });
 };
 
-export type FetchTagsResponse = string[];
-
 /**
- * Fetch all unique Tags used by Rules
+ * Fetch rule filters related information like installed rules count, tags and etc
  *
  * @param signal to cancel request
  *
  * @throws An error if response is not OK
  */
-export const fetchTags = async ({ signal }: { signal?: AbortSignal }): Promise<FetchTagsResponse> =>
-  KibanaServices.get().http.fetch<FetchTagsResponse>(DETECTION_ENGINE_TAGS_URL, {
+export const fetchRuleManagementFilters = async ({
+  signal,
+}: {
+  signal?: AbortSignal;
+}): Promise<RuleManagementFiltersResponse> =>
+  KibanaServices.get().http.fetch<RuleManagementFiltersResponse>(RULE_MANAGEMENT_FILTERS_URL, {
     method: 'GET',
     signal,
   });

x-pack/plugins/security_solution/public/detection_engine/rule_management/api/hooks/use_bulk_action_mutation.ts

@@ -10,11 +10,11 @@ import type { IHttpFetchError } from '@kbn/core/public';
 import { BulkActionType } from '../../../../../common/detection_engine/rule_management/api/rules/bulk_actions/request_schema';
 import type { BulkActionErrorResponse, BulkActionResponse, PerformBulkActionProps } from '../api';
 import { performBulkAction } from '../api';
+import { DETECTION_ENGINE_RULES_BULK_ACTION } from '../../../../../common/constants';
 import { useInvalidateFetchPrebuiltRulesStatusQuery } from './use_fetch_prebuilt_rules_status_query';
 import { useInvalidateFindRulesQuery, useUpdateRulesCache } from './use_find_rules_query';
-import { useInvalidateFetchTagsQuery } from './use_fetch_tags_query';
 import { useInvalidateFetchRuleByIdQuery } from './use_fetch_rule_by_id_query';
-import { DETECTION_ENGINE_RULES_BULK_ACTION } from '../../../../../common/constants';
+import { useInvalidateFetchRuleManagementFiltersQuery } from './use_fetch_rule_management_filters_query';
 
 export const BULK_ACTION_MUTATION_KEY = ['POST', DETECTION_ENGINE_RULES_BULK_ACTION];
 
@@ -27,7 +27,7 @@ export const useBulkActionMutation = (
 ) => {
   const invalidateFindRulesQuery = useInvalidateFindRulesQuery();
   const invalidateFetchRuleByIdQuery = useInvalidateFetchRuleByIdQuery();
-  const invalidateFetchTagsQuery = useInvalidateFetchTagsQuery();
+  const invalidateFetchRuleManagementFilters = useInvalidateFetchRuleManagementFiltersQuery();
   const invalidateFetchPrebuiltRulesStatusQuery = useInvalidateFetchPrebuiltRulesStatusQuery();
   const updateRulesCache = useUpdateRulesCache();
 
@@ -66,12 +66,12 @@ export const useBulkActionMutation = (
         case BulkActionType.delete:
           invalidateFindRulesQuery();
           invalidateFetchRuleByIdQuery();
-          invalidateFetchTagsQuery();
+          invalidateFetchRuleManagementFilters();
           invalidateFetchPrebuiltRulesStatusQuery();
           break;
         case BulkActionType.duplicate:
           invalidateFindRulesQuery();
-          invalidateFetchPrebuiltRulesStatusQuery();
+          invalidateFetchRuleManagementFilters();
           break;
         case BulkActionType.edit:
           if (updatedRules) {
@@ -82,7 +82,7 @@ export const useBulkActionMutation = (
             invalidateFindRulesQuery();
           }
           invalidateFetchRuleByIdQuery();
-          invalidateFetchTagsQuery();
+          invalidateFetchRuleManagementFilters();
           break;
       }