Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] expandable flyout - add investigate in timeline f… #165025

Merged
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
[Security Solution] expandable flyout - add investigate in timeline f…
…or alert count and document count prevalence details table columns
PhilippeOberti committed Aug 29, 2023
commit 158f98133dd3ecb0d828e716830e54f84f64462e
Original file line number Diff line number Diff line change
@@ -55,13 +55,14 @@ export const getDataProvider = (
field: string,
id: string,
value: string | string[],
operator: QueryOperator = IS_OPERATOR
operator: QueryOperator = IS_OPERATOR,
excluded: boolean = false
): DataProvider => ({
and: [],
enabled: true,
id: escapeDataProviderId(id),
name: field,
excluded: false,
excluded,
kqlQuery: '',
queryMatch: {
field,
@@ -75,9 +76,10 @@ export const getDataProviderAnd = (
field: string,
id: string,
value: string | string[],
operator: QueryOperator = IS_OPERATOR
operator: QueryOperator = IS_OPERATOR,
excluded: boolean = false
): DataProvidersAnd => {
const { and, ...dataProvider } = getDataProvider(field, id, value, operator);
const { and, ...dataProvider } = getDataProvider(field, id, value, operator, excluded);
return dataProvider;
};

Original file line number Diff line number Diff line change
@@ -15,9 +15,19 @@ import {
PREVALENCE_DETAILS_TABLE_TEST_ID,
} from './test_ids';
import { usePrevalence } from '../../shared/hooks/use_prevalence';
import { TestProviders } from '../../../common/mock';

jest.mock('../../shared/hooks/use_prevalence');

const mockDispatch = jest.fn();
jest.mock('react-redux', () => {
const original = jest.requireActual('react-redux');
return {
...original,
useDispatch: () => mockDispatch,
};
});

const panelContextValue = {
eventId: 'event id',
indexName: 'indexName',
@@ -53,9 +63,11 @@ describe('PrevalenceDetails', () => {
});

const { getByTestId } = render(
<LeftPanelContext.Provider value={panelContextValue}>
<PrevalenceDetails />
</LeftPanelContext.Provider>
<TestProviders>
<LeftPanelContext.Provider value={panelContextValue}>
<PrevalenceDetails />
</LeftPanelContext.Provider>
</TestProviders>
);

expect(getByTestId(PREVALENCE_DETAILS_TABLE_TEST_ID)).toBeInTheDocument();
Original file line number Diff line number Diff line change
@@ -17,6 +17,7 @@ import {
EuiSpacer,
EuiSuperDatePicker,
} from '@elastic/eui';
import { InvestigateInTimelineButton } from '../../../common/components/event_details/table/investigate_in_timeline_button';
import type { PrevalenceData } from '../../shared/hooks/use_prevalence';
import { usePrevalence } from '../../shared/hooks/use_prevalence';
import { ERROR_MESSAGE, ERROR_TITLE } from '../../shared/translations';
@@ -46,6 +47,12 @@ import {
PREVALENCE_DETAILS_TABLE_TEST_ID,
} from './test_ids';
import { useLeftPanelContext } from '../context';
import {
getDataProvider,
getDataProviderAnd,
} from '../../../common/components/event_details/table/use_action_cell_data_provider';
import { getEmptyTagValue } from '../../../common/components/empty_value';
import { IS_OPERATOR } from '../../../../common/types';

export const PREVALENCE_TAB_ID = 'prevalence-details';
const DEFAULT_FROM = 'now-30d';
@@ -63,25 +70,71 @@ const columns: Array<EuiBasicTableColumn<PrevalenceData>> = [
'data-test-subj': PREVALENCE_DETAILS_TABLE_VALUE_CELL_TEST_ID,
},
{
field: 'alertCount',
name: (
<EuiFlexGroup direction="column" gutterSize="none">
<EuiFlexItem>{PREVALENCE_TABLE_ALERT_COUNT_COLUMN_TITLE}</EuiFlexItem>
<EuiFlexItem>{PREVALENCE_TABLE_COUNT_COLUMN_TITLE}</EuiFlexItem>
</EuiFlexGroup>
),
'data-test-subj': PREVALENCE_DETAILS_TABLE_ALERT_COUNT_CELL_TEST_ID,
render: (data: PrevalenceData) => {
const dataProviders = [
getDataProvider(data.field, `timeline-indicator-${data.field}-${data.value}`, data.value),
];
return data.alertCount > 0 ? (
<InvestigateInTimelineButton
asEmptyButton={true}
dataProviders={dataProviders}
filters={[]}
>
<>{data.alertCount}</>
</InvestigateInTimelineButton>
) : (
getEmptyTagValue()
);
},
width: '10%',
},
{
field: 'docCount',
name: (
<EuiFlexGroup direction="column" gutterSize="none">
<EuiFlexItem>{PREVALENCE_TABLE_DOC_COUNT_COLUMN_TITLE}</EuiFlexItem>
<EuiFlexItem>{PREVALENCE_TABLE_COUNT_COLUMN_TITLE}</EuiFlexItem>
</EuiFlexGroup>
),
'data-test-subj': PREVALENCE_DETAILS_TABLE_DOC_COUNT_CELL_TEST_ID,
render: (data: PrevalenceData) => {
const dataProviders = [
{
...getDataProvider(
data.field,
`timeline-indicator-${data.field}-${data.value}`,
data.value
),
and: [
getDataProviderAnd(
'event.kind',
`timeline-indicator-event.kind-not-signal`,
'signal',
IS_OPERATOR,
true
),
],
},
];
return data.docCount > 0 ? (
<InvestigateInTimelineButton
asEmptyButton={true}
dataProviders={dataProviders}
filters={[]}
keepDataView // changing dataview from only detections to include non-alerts docs
>
<>{data.docCount}</>
</InvestigateInTimelineButton>
) : (
getEmptyTagValue()
);
},
width: '10%',
},
{
Original file line number Diff line number Diff line change
@@ -68,7 +68,7 @@ describe('Alert details expandable flyout left panel prevalence', () => {
);
cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_DOC_COUNT_CELL).should(
'contain.text',
0
'—'
);
cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_HOST_PREVALENCE_CELL).should(
'contain.text',