Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.12] [Security Solution] "Data view" selector is shown in "Edit filter" view on the Rule Editing page (#174026) (#174922) #175433

Merged
merged 4 commits into from
Jan 25, 2024
Merged

[8.12] [Security Solution] "Data view" selector is shown in "Edit filter" view on the Rule Editing page (#174026) (#174922) #175433

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b428e11
[Security Solution] "Data view" selector is shown in "Edit filter" vi…
e40pud Jan 24, 2024
532178b
[Security Solution] Fix broken tests in 8.12 (#174026)
e40pud Jan 25, 2024
6558a3b
Merge branch '8.12' into backport/8.12/pr-174922
e40pud Jan 25, 2024
9a4702d
Fix broken tests
e40pud Jan 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions x-pack/plugins/security_solution/public/common/components/query_bar/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ export const QueryBar = memo<QueryBarComponentProps>(
}) => {
const { data } = useKibana().services;
const [dataView, setDataView] = useState<DataView>();
const [searchBarFilters, setSearchBarFilters] = useState<Filter[]>(filters);
const onQuerySubmit = useCallback(
(payload: { dateRange: TimeRange; query?: Query | AggregateQuery }) => {
if (payload.query != null && !deepEqual(payload.query, filterQuery)) {
Expand Down Expand Up @@ -126,8 +127,16 @@ export const QueryBar = memo<QueryBarComponentProps>(
setDataView(indexPattern);
} else if (!isEsql) {
const createDataView = async () => {
dv = await data.dataViews.create({ title: indexPattern.title });
dv = await data.dataViews.create({ id: indexPattern.title, title: indexPattern.title });
setDataView(dv);

/**
* We update filters and set new data view id to make sure that SearchBar does not show data view picker
* More details in https://github.com/elastic/kibana/issues/174026
*/
const updatedFilters = [...filters];
updatedFilters.forEach((filter) => (filter.meta.index = indexPattern.title));
setSearchBarFilters(updatedFilters);
};
createDataView();
}
Expand All @@ -136,7 +145,7 @@ export const QueryBar = memo<QueryBarComponentProps>(
data.dataViews.clearInstanceCache(dv?.id);
}
};
}, [data.dataViews, indexPattern, isEsql]);
}, [data.dataViews, filters, indexPattern, isEsql]);

const timeHistory = useMemo(() => new TimeHistory(new Storage(localStorage)), []);
const arrDataView = useMemo(() => (dataView != null ? [dataView] : []), [dataView]);
Expand All @@ -145,7 +154,7 @@ export const QueryBar = memo<QueryBarComponentProps>(
showSubmitButton={false}
dateRangeFrom={dateRangeFrom}
dateRangeTo={dateRangeTo}
filters={filters}
filters={searchBarFilters}
indexPatterns={arrDataView}
isLoading={isLoading}
isRefreshPaused={isRefreshPaused}
Expand Down
176 changes: 119 additions & 57 deletions ...cypress/cypress/e2e/detection_response/detection_engine/rule_edit/custom_query_rule.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@
* 2.0.
*/

import {
ADD_FILTER_FORM_FIELD_SELECTED_VALUE,
ADD_FILTER_FORM_OPERATOR_FIELD_SELECTED_VALUE,
GLOBAL_SEARCH_BAR_EDIT_FILTER_MENU_ITEM,
GLOBAL_SEARCH_BAR_FILTER_ITEM,
} from '../../../../screens/search_bar';
import { getExistingRule, getEditedRule } from '../../../../objects/rule';

import {
Expand Down Expand Up @@ -63,81 +69,137 @@ describe('Custom query rules', { tags: ['@ess', '@serverless', '@brokenInServerl
deleteConnectors();
deleteAlertsAndRules();
login();
createRule(getExistingRule({ rule_id: 'rule1', enabled: true })).then((createdRule) => {
visitEditRulePage(createdRule.body.id);
});
});

it('Allows a rule to be edited', () => {
const existingRule = getExistingRule();
context('Basics', () => {
beforeEach(() => {
createRule(getExistingRule({ rule_id: 'rule1', enabled: true })).then((createdRule) => {
visitEditRulePage(createdRule.body.id);
});
});

it('Allows a rule to be edited', () => {
const existingRule = getExistingRule();

// expect define step to populate
cy.get(CUSTOM_QUERY_INPUT).should('have.value', existingRule.query);

// expect define step to populate
cy.get(CUSTOM_QUERY_INPUT).should('have.value', existingRule.query);
cy.get(DEFINE_INDEX_INPUT).should('have.text', existingRule.index?.join(''));

cy.get(DEFINE_INDEX_INPUT).should('have.text', existingRule.index?.join(''));
goToAboutStepTab();

goToAboutStepTab();
// expect about step to populate
cy.get(RULE_NAME_INPUT).invoke('val').should('eql', existingRule.name);
cy.get(RULE_DESCRIPTION_INPUT).should('have.text', existingRule.description);
cy.get(TAGS_FIELD).should('have.text', existingRule.tags?.join(''));
cy.get(SEVERITY_DROPDOWN).should('have.text', 'High');
cy.get(DEFAULT_RISK_SCORE_INPUT).invoke('val').should('eql', `${existingRule.risk_score}`);

// expect about step to populate
cy.get(RULE_NAME_INPUT).invoke('val').should('eql', existingRule.name);
cy.get(RULE_DESCRIPTION_INPUT).should('have.text', existingRule.description);
cy.get(TAGS_FIELD).should('have.text', existingRule.tags?.join(''));
cy.get(SEVERITY_DROPDOWN).should('have.text', 'High');
cy.get(DEFAULT_RISK_SCORE_INPUT).invoke('val').should('eql', `${existingRule.risk_score}`);
goToScheduleStepTab();

goToScheduleStepTab();
// expect schedule step to populate
const interval = existingRule.interval;
const intervalParts = interval != null && interval.match(/[0-9]+|[a-zA-Z]+/g);
if (intervalParts) {
const [amount, unit] = intervalParts;
cy.get(SCHEDULE_INTERVAL_AMOUNT_INPUT).invoke('val').should('eql', amount);
cy.get(SCHEDULE_INTERVAL_UNITS_INPUT).invoke('val').should('eql', unit);
} else {
throw new Error('Cannot assert scheduling info on a rule without an interval');
}

// expect schedule step to populate
const interval = existingRule.interval;
const intervalParts = interval != null && interval.match(/[0-9]+|[a-zA-Z]+/g);
if (intervalParts) {
const [amount, unit] = intervalParts;
cy.get(SCHEDULE_INTERVAL_AMOUNT_INPUT).invoke('val').should('eql', amount);
cy.get(SCHEDULE_INTERVAL_UNITS_INPUT).invoke('val').should('eql', unit);
} else {
throw new Error('Cannot assert scheduling info on a rule without an interval');
}
goToActionsStepTab();

goToActionsStepTab();
addEmailConnectorAndRuleAction('[email protected]', 'Subject');

addEmailConnectorAndRuleAction('[email protected]', 'Subject');
cy.get(ACTIONS_SUMMARY_BUTTON).should('have.text', 'Summary of alerts');
cy.get(ACTIONS_NOTIFY_WHEN_BUTTON).should('have.text', 'Per rule run');

cy.get(ACTIONS_SUMMARY_BUTTON).should('have.text', 'Summary of alerts');
cy.get(ACTIONS_NOTIFY_WHEN_BUTTON).should('have.text', 'Per rule run');
goToAboutStepTab();
cy.get(TAGS_CLEAR_BUTTON).click();
fillAboutRule(getEditedRule());

goToAboutStepTab();
cy.get(TAGS_CLEAR_BUTTON).click();
fillAboutRule(getEditedRule());
cy.intercept('GET', '/api/detection_engine/rules?id*').as('getRule');

cy.intercept('GET', '/api/detection_engine/rules?id*').as('getRule');
saveEditedRule();

saveEditedRule();
cy.wait('@getRule').then(({ response }) => {
cy.wrap(response?.statusCode).should('eql', 200);
// ensure that editing rule does not modify max_signals
cy.wrap(response?.body.max_signals).should('eql', existingRule.max_signals);
});

cy.wait('@getRule').then(({ response }) => {
cy.wrap(response?.statusCode).should('eql', 200);
// ensure that editing rule does not modify max_signals
cy.wrap(response?.body.max_signals).should('eql', existingRule.max_signals);
cy.get(RULE_NAME_HEADER).should('contain', `${getEditedRule().name}`);
cy.get(ABOUT_RULE_DESCRIPTION).should('have.text', getEditedRule().description);
cy.get(ABOUT_DETAILS).within(() => {
getDetails(SEVERITY_DETAILS).should('have.text', 'Medium');
getDetails(RISK_SCORE_DETAILS).should('have.text', `${getEditedRule().risk_score}`);
getDetails(TAGS_DETAILS).should('have.text', expectedEditedtags);
});
cy.get(INVESTIGATION_NOTES_TOGGLE).click();
cy.get(ABOUT_INVESTIGATION_NOTES).should('have.text', getEditedRule().note);
cy.get(DEFINITION_DETAILS).within(() => {
getDetails(INDEX_PATTERNS_DETAILS).should(
'have.text',
expectedEditedIndexPatterns?.join('')
);
getDetails(CUSTOM_QUERY_DETAILS).should('have.text', getEditedRule().query);
getDetails(RULE_TYPE_DETAILS).should('have.text', 'Query');
getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');
});
if (getEditedRule().interval) {
cy.get(SCHEDULE_DETAILS).within(() => {
getDetails(RUNS_EVERY_DETAILS).should('have.text', getEditedRule().interval);
});
}
});
});

cy.get(RULE_NAME_HEADER).should('contain', `${getEditedRule().name}`);
cy.get(ABOUT_RULE_DESCRIPTION).should('have.text', getEditedRule().description);
cy.get(ABOUT_DETAILS).within(() => {
getDetails(SEVERITY_DETAILS).should('have.text', 'Medium');
getDetails(RISK_SCORE_DETAILS).should('have.text', `${getEditedRule().risk_score}`);
getDetails(TAGS_DETAILS).should('have.text', expectedEditedtags);
context('With filters', () => {
beforeEach(() => {
createRule(
getExistingRule({
rule_id: 'rule1',
enabled: true,
filters: [
{
meta: {
disabled: false,
negate: false,
alias: null,
index: expectedEditedIndexPatterns?.join(','),
key: 'host.name',
field: 'host.name',
type: 'exists',
value: 'exists',
},
query: {
exists: {
field: 'host.name',
},
},
$state: {
store: 'appState',
},
},
],
})
).then((createdRule) => {
visitEditRulePage(createdRule.body.id);
});
});
cy.get(INVESTIGATION_NOTES_TOGGLE).click();
cy.get(ABOUT_INVESTIGATION_NOTES).should('have.text', getEditedRule().note);
cy.get(DEFINITION_DETAILS).within(() => {
getDetails(INDEX_PATTERNS_DETAILS).should('have.text', expectedEditedIndexPatterns?.join(''));
getDetails(CUSTOM_QUERY_DETAILS).should('have.text', getEditedRule().query);
getDetails(RULE_TYPE_DETAILS).should('have.text', 'Query');
getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', 'None');

it('Filter properly stores index information', () => {
// Check that filter exists on rule edit page
cy.get(GLOBAL_SEARCH_BAR_FILTER_ITEM).should('have.text', 'host.name: exists');

// Edit the filter
cy.get(GLOBAL_SEARCH_BAR_FILTER_ITEM).click();
cy.get(GLOBAL_SEARCH_BAR_EDIT_FILTER_MENU_ITEM).click();

// Check that correct values are propagated in the filter editing dialog
cy.get(ADD_FILTER_FORM_FIELD_SELECTED_VALUE).should('contain.text', 'host.name');
cy.get(ADD_FILTER_FORM_OPERATOR_FIELD_SELECTED_VALUE).should('contain.text', 'exists');
});
if (getEditedRule().interval) {
cy.get(SCHEDULE_DETAILS).within(() => {
getDetails(RUNS_EVERY_DETAILS).should('have.text', getEditedRule().interval);
});
}
});
});
8 changes: 8 additions & 0 deletions x-pack/test/security_solution_cypress/cypress/screens/search_bar.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,18 @@ export const GET_LOCAL_SEARCH_BAR_SUBMIT_BUTTON = (localSearchBarSelector: strin
export const ADD_FILTER_FORM_FIELD_INPUT =
'[data-test-subj="filterFieldSuggestionList"] input[data-test-subj="comboBoxSearchInput"]';

export const ADD_FILTER_FORM_FIELD_SELECTED_VALUE =
'[data-test-subj="filterFieldSuggestionList"] [data-test-subj="euiComboBoxPill"]';

export const ADD_FILTER_FORM_FIELD_OPTION = (value: string) =>
`[data-test-subj="comboBoxOptionsList filterFieldSuggestionList-optionsList"] button[title="${value}"]`;

export const ADD_FILTER_FORM_OPERATOR_FIELD =
'[data-test-subj="filterOperatorList"] input[data-test-subj="comboBoxSearchInput"]';

export const ADD_FILTER_FORM_OPERATOR_FIELD_SELECTED_VALUE =
'[data-test-subj="filterOperatorList"] [data-test-subj="euiComboBoxPill"]';

export const ADD_FILTER_FORM_FILTER_VALUE_INPUT = '[data-test-subj="filterParams"] input';

export const ADD_FILTER_FORM_SAVE_BUTTON = '[data-test-subj="saveFilter"]';
Expand All @@ -38,6 +44,8 @@ export const GLOBAL_SEARCH_BAR_FILTER_ITEM_DELETE = '#popoverFor_filter0 button[

export const GLOBAL_SEARCH_BAR_PINNED_FILTER = '.globalFilterItem-isPinned';

export const GLOBAL_SEARCH_BAR_EDIT_FILTER_MENU_ITEM = '[data-test-subj="editFilter"]';

export const LOCAL_KQL_INPUT = `[data-test-subj="unifiedQueryInput"] textarea`;

export const GLOBAL_KQL_INPUT = `[data-test-subj="filters-global-container"] ${LOCAL_KQL_INPUT}`;
Expand Down
Loading