[Detection Engine][Rules] - Adds custom highlighted fields option

packages/kbn-rule-data-utils/src/technical_field_names.ts

@@ -92,6 +92,8 @@ const ALERT_EVALUATION_VALUES = `${ALERT_NAMESPACE}.evaluation.values` as const;
 // Fields pertaining to the rule associated with the alert
 const ALERT_RULE_EXCEPTIONS_LIST = `${ALERT_RULE_NAMESPACE}.exceptions_list` as const;
 const ALERT_RULE_NAMESPACE_FIELD = `${ALERT_RULE_NAMESPACE}.namespace` as const;
+const ALERT_RULE_CUSTOM_HIGHLIGHTED_FIELDS =
+  `${ALERT_RULE_NAMESPACE}.custom_highlighted_fields` as const;
 
 // Fields pertaining to the threat tactic associated with the rule
 const ALERT_THREAT_FRAMEWORK = `${ALERT_RULE_THREAT_NAMESPACE}.framework` as const;
@@ -161,6 +163,7 @@ const fields = {
   ALERT_RULE_TYPE_ID,
   ALERT_RULE_UPDATED_AT,
   ALERT_RULE_UPDATED_BY,
+  ALERT_RULE_CUSTOM_HIGHLIGHTED_FIELDS,
   ALERT_RULE_VERSION,
   ALERT_START,
   ALERT_TIME_RANGE,
@@ -198,6 +201,7 @@ export {
   ALERT_BUILDING_BLOCK_TYPE,
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
+  ALERT_RULE_CUSTOM_HIGHLIGHTED_FIELDS,
   ALERT_CONTEXT,
   ALERT_EVALUATION_VALUES,
   ALERT_RULE_EXCEPTIONS_LIST,

packages/kbn-securitysolution-ecs/src/rule/index.ts

@@ -11,6 +11,7 @@ export interface RuleEcs {
   rule_id?: string[];
   name?: string[];
   false_positives?: string[];
+  custom_highlighted_fields?: string[];
   saved_id?: string[];
   timeline_id?: string[];
   timeline_title?: string[];

packages/kbn-securitysolution-utils/src/transform_data_to_ndjson/index.test.ts

@@ -20,6 +20,7 @@ const getRulesSchemaMock = (anchorDate: string = ANCHOR_DATE) => ({
   enabled: true,
   false_positives: ['false positive 1', 'false positive 2'],
   from: 'now-6m',
+  custom_highlighted_fields: ['custom.field1', 'custom.field2'],
   immutable: false,
   name: 'Query with a rule id',
   query: 'user.name: root or user.name: admin',

x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/common_attributes.ts

@@ -55,6 +55,9 @@ export const RuleAuthorArray = t.array(t.string); // should be non-empty strings
 export type RuleFalsePositiveArray = t.TypeOf<typeof RuleFalsePositiveArray>;
 export const RuleFalsePositiveArray = t.array(t.string); // should be non-empty strings?
 
+export type RuleCustomHighlightedFieldArray = t.TypeOf<typeof RuleCustomHighlightedFieldArray>;
+export const RuleCustomHighlightedFieldArray = t.array(t.string); // should be non-empty strings?
+
 export type RuleReferenceArray = t.TypeOf<typeof RuleReferenceArray>;
 export const RuleReferenceArray = t.array(t.string); // should be non-empty strings?
 

x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/rule_response_schema.mock.ts

@@ -27,6 +27,7 @@ const getResponseBaseParams = (anchorDate: string = ANCHOR_DATE): SharedResponse
   description: 'some description',
   enabled: true,
   false_positives: ['false positive 1', 'false positive 2'],
+  custom_highlighted_fields: ['fiel.foo', 'field.bar'],
   from: 'now-6m',
   immutable: false,
   name: 'Query with a rule id',
@@ -77,6 +78,7 @@ export const getRulesSchemaMock = (anchorDate: string = ANCHOR_DATE): QueryRule
   saved_id: undefined,
   response_actions: undefined,
   alert_suppression: undefined,
+  custom_highlighted_fields: undefined,
 });
 
 export const getSavedQuerySchemaMock = (anchorDate: string = ANCHOR_DATE): SavedQueryRule => ({

x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/rule_response_schema.test.ts

@@ -232,4 +232,37 @@ describe('Rule response schema', () => {
       expect(message.schema).toEqual({});
     });
   });
+
+  describe('custom_highlighted_fields', () => {
+    test('it should validate rule with "custom_highlighted_fields"', () => {
+      const payload = getRulesSchemaMock();
+      payload.custom_highlighted_fields = ['foo', 'bar'];
+
+      const decoded = RuleResponse.decode(payload);
+      const checked = exactCheck(payload, decoded);
+      const message = pipe(checked, foldLeftRight);
+      const expected = { ...getRulesSchemaMock(), custom_highlighted_fields: ['foo', 'bar'] };
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(expected);
+    });
+
+    test('it should NOT validate a string for "custom_highlighted_fields"', () => {
+      const payload: Omit<RuleResponse, 'custom_highlighted_fields'> & {
+        custom_highlighted_fields: string;
+      } = {
+        ...getRulesSchemaMock(),
+        custom_highlighted_fields: 'foo',
+      };
+
+      const decoded = RuleResponse.decode(payload);
+      const checked = exactCheck(payload, decoded);
+      const message = pipe(checked, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([
+        'Invalid value "foo" supplied to "custom_highlighted_fields"',
+      ]);
+      expect(message.schema).toEqual({});
+    });
+  });
 });

x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/rule_schemas.ts

@@ -53,6 +53,7 @@ import {
   RelatedIntegrationArray,
   RequiredFieldArray,
   RuleAuthorArray,
+  RuleCustomHighlightedFieldArray,
   RuleDescription,
   RuleFalsePositiveArray,
   RuleFilterArray,
@@ -116,6 +117,7 @@ export const baseSchema = buildRuleSchemas({
     output_index: AlertsIndex,
     namespace: AlertsIndexNamespace,
     meta: RuleMetadata,
+    custom_highlighted_fields: RuleCustomHighlightedFieldArray,
     // Throttle
     throttle: RuleActionThrottle,
   },

x-pack/plugins/security_solution/common/endpoint/data_generators/endpoint_rule_alert_generator.ts

@@ -219,6 +219,7 @@ export class EndpointRuleAlertGenerator extends BaseDataGenerator {
         'kibana.alert.rule.consumer': 'siem',
         'kibana.alert.rule.created_at': '2022-10-26T21:02:00.237Z',
         'kibana.alert.rule.created_by': 'some_user',
+        'kibana.alert.rule.custom_highlighted_fields': [],
         'kibana.alert.rule.description':
           'Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.',
         'kibana.alert.rule.enabled': true,

x-pack/plugins/security_solution/common/field_maps/8.10.0/index.ts

@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RulesFieldMap810 } from './rules';
+import { rulesFieldMap810 } from './rules';
+export type { RulesFieldMap810 };
+export { rulesFieldMap810 };

x-pack/plugins/security_solution/common/field_maps/8.10.0/rules.ts

@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { rulesFieldMap } from '../8.0.0';
+
+export const rulesFieldMap810 = {
+  ...rulesFieldMap,
+  'kibana.alert.rule.custom_highlighted_fields': {
+    type: 'keyword',
+    array: true,
+    required: false,
+  },
+} as const;
+
+export type RulesFieldMap810 = typeof rulesFieldMap810;

x-pack/plugins/security_solution/common/field_maps/field_names.ts

@@ -27,6 +27,8 @@ export const ALERT_ORIGINAL_EVENT_MODULE = `${ALERT_ORIGINAL_EVENT}.module` as c
 export const ALERT_RULE_ACTIONS = `${ALERT_RULE_NAMESPACE}.actions` as const;
 export const ALERT_RULE_EXCEPTIONS_LIST = `${ALERT_RULE_NAMESPACE}.exceptions_list` as const;
 export const ALERT_RULE_FALSE_POSITIVES = `${ALERT_RULE_NAMESPACE}.false_positives` as const;
+export const ALERT_RULE_CUSTOM_HIGHLIGHTED_FIELDS =
+  `${ALERT_RULE_NAMESPACE}.custom_highlighted_fields` as const;
 export const ALERT_RULE_IMMUTABLE = `${ALERT_RULE_NAMESPACE}.immutable` as const;
 export const ALERT_RULE_MAX_SIGNALS = `${ALERT_RULE_NAMESPACE}.max_signals` as const;
 export const ALERT_RULE_META = `${ALERT_RULE_NAMESPACE}.meta` as const;