[8.14] [SecuritySolution] Add "exist filter" when value count is filtered in Lens cell action (#181151)

packages/kbn-cell-actions/src/actions/filter/add_filter.ts

@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { FilterManager } from '@kbn/data-plugin/public';
+import type { DefaultActionsSupportedValue } from '../types';
+import { createExistsFilter, createFilter } from './create_filter';
+
+interface AddFilterParams {
+  filterManager: FilterManager;
+  key: string;
+  value: DefaultActionsSupportedValue;
+  negate: boolean;
+  dataViewId?: string;
+}
+
+export const addFilter = ({ filterManager, key, value, negate, dataViewId }: AddFilterParams) => {
+  filterManager.addFilters(createFilter({ key, value, negate, dataViewId }));
+};
+
+interface AddExistsFilterParams {
+  filterManager: FilterManager;
+  key: string;
+  negate: boolean;
+  dataViewId?: string;
+}
+export const addExistsFilter = ({
+  filterManager,
+  key,
+  negate,
+  dataViewId,
+}: AddExistsFilterParams) => {
+  filterManager.addFilters(createExistsFilter({ key, negate, dataViewId }));
+};
+
+export const isEmptyFilterValue = (value: Array<string | number | boolean>) =>
+  value.length === 0 || value.every((v) => v === '');

packages/kbn-cell-actions/src/actions/filter/create_filter.ts

@@ -15,10 +15,7 @@ import {
 } from '@kbn/es-query';
 import { DefaultActionsSupportedValue } from '../types';
 
-export const isEmptyFilterValue = (value: Array<string | number | boolean>) =>
-  value.length === 0 || value.every((v) => v === '');
-
-const createExistsFilter = ({
+export const createExistsFilter = ({
   key,
   negate,
   dataViewId,

packages/kbn-cell-actions/src/actions/filter/filter_in.ts

@@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n';
 import type { FilterManager, KBN_FIELD_TYPES } from '@kbn/data-plugin/public';
 import { NotificationsStart } from '@kbn/core-notifications-browser';
 
-import { createFilter, isEmptyFilterValue } from './create_filter';
+import { addFilter, isEmptyFilterValue } from './add_filter';
 import { FILTER_CELL_ACTION_TYPE } from '../../constants';
 import { createCellActionFactory } from '../factory';
 import {
@@ -77,12 +77,12 @@ export const addFilterIn = ({
   dataViewId?: string;
 }) => {
   if (filterManager != null) {
-    const filter = createFilter({
+    addFilter({
+      filterManager,
       key: fieldName,
       value,
       negate: isEmptyFilterValue(value),
       dataViewId,
     });
-    filterManager.addFilters(filter);
   }
 };

packages/kbn-cell-actions/src/actions/filter/filter_out.ts

@@ -8,7 +8,8 @@
 import { i18n } from '@kbn/i18n';
 import type { FilterManager, KBN_FIELD_TYPES } from '@kbn/data-plugin/public';
 import { NotificationsStart } from '@kbn/core-notifications-browser';
-import { createFilter, isEmptyFilterValue } from './create_filter';
+import { addFilter, isEmptyFilterValue } from './add_filter';
+
 import { FILTER_CELL_ACTION_TYPE } from '../../constants';
 import { createCellActionFactory } from '../factory';
 import {
@@ -81,12 +82,12 @@ export const addFilterOut = ({
   dataViewId?: string;
 }) => {
   if (filterManager != null) {
-    const filter = createFilter({
+    addFilter({
+      filterManager,
       key: fieldName,
       value,
       negate: !isEmptyFilterValue(value),
       dataViewId,
     });
-    filterManager.addFilters(filter);
   }
 };

packages/kbn-cell-actions/src/actions/filter/index.ts

@@ -8,3 +8,4 @@
 
 export { createFilterInActionFactory, addFilterIn } from './filter_in';
 export { createFilterOutActionFactory, addFilterOut } from './filter_out';
+export { addExistsFilter } from './add_filter';

packages/kbn-cell-actions/src/index.ts

@@ -34,6 +34,7 @@ export {
   createFilterOutActionFactory,
   addFilterIn,
   addFilterOut,
+  addExistsFilter,
 } from './actions/filter';
 
 // Action factory

x-pack/plugins/security_solution/public/actions/filter/lens/create_action.test.ts

@@ -0,0 +1,190 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { addExistsFilter, addFilterIn, addFilterOut } from '@kbn/cell-actions';
+import { of } from 'rxjs';
+import type { CellValueContext } from '@kbn/embeddable-plugin/public';
+import type { CreateFilterLensActionParams } from './create_action';
+import { createFilterLensAction } from './create_action';
+import type { Trigger } from '@kbn/ui-actions-plugin/public';
+
+jest.mock('@kbn/cell-actions', () => ({
+  addFilterIn: jest.fn(),
+  addFilterOut: jest.fn(),
+  addExistsFilter: jest.fn(),
+}));
+
+jest.mock('../../../timelines/store', () => ({
+  timelineSelectors: {
+    getTimelineByIdSelector: jest.fn().mockReturnValue(() => ({})),
+  },
+}));
+
+describe('createFilterLensAction', () => {
+  const mockServices = {
+    timelineFilterManager: 'mockTimelineFilterManager',
+    data: { query: { filterManager: 'mockFilterManager' } },
+    application: { currentAppId$: of('appId') },
+    topValuesPopover: {
+      closePopover: jest.fn(),
+    },
+    notifications: {
+      toasts: {
+        addWarning: jest.fn(),
+      },
+    },
+  };
+  const mockStore = {
+    getState: jest.fn(),
+  };
+
+  const mockUserCountData = [
+    {
+      columnMeta: {
+        field: 'user.count',
+        sourceParams: {
+          type: 'value_count',
+          indexPatternId: 'indexPatternId',
+        },
+      },
+      value: [1],
+    },
+  ] as unknown as CellValueContext['data'];
+
+  const mockUserNameData = [
+    {
+      columnMeta: {
+        field: 'user.name',
+        sourceParams: {
+          type: 'string',
+          indexPatternId: 'indexPatternId',
+        },
+      },
+      value: 'elastic',
+    },
+  ] as unknown as CellValueContext['data'];
+
+  const mockTrigger = {
+    id: 'triggerId',
+    title: 'triggerTitle',
+    description: 'triggerDescription',
+  } as Trigger;
+
+  const params = {
+    id: 'embeddable_filterIn',
+    order: 0,
+    store: mockStore,
+    services: mockServices,
+  } as unknown as CreateFilterLensActionParams;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should create a "filter In" action with the field value', async () => {
+    const { execute } = createFilterLensAction(params);
+    await execute({
+      data: mockUserNameData,
+      trigger: mockTrigger,
+    });
+    expect(addFilterIn).toHaveBeenCalledWith({
+      filterManager: 'mockFilterManager',
+      fieldName: 'user.name',
+      value: ['elastic'],
+      dataViewId: 'indexPatternId',
+    });
+    expect(addFilterOut).not.toHaveBeenCalled();
+  });
+
+  it('should create a "filter Out" action with the field value', async () => {
+    const testParams = {
+      ...params,
+      id: 'embeddable_filterOut',
+      negate: true,
+    };
+    const { execute } = createFilterLensAction(testParams);
+    await execute({
+      data: mockUserNameData,
+      trigger: mockTrigger,
+    });
+    expect(addFilterIn).not.toHaveBeenCalled();
+    expect(addFilterOut).toHaveBeenCalledWith({
+      filterManager: 'mockFilterManager',
+      fieldName: 'user.name',
+      value: ['elastic'],
+      dataViewId: 'indexPatternId',
+    });
+  });
+
+  it('should create an "exists" filter when value type equals "value_count"', async () => {
+    const { execute } = createFilterLensAction(params);
+    await execute({
+      data: mockUserCountData,
+      trigger: mockTrigger,
+    });
+    expect(addExistsFilter).toHaveBeenCalledWith({
+      filterManager: 'mockFilterManager',
+      key: 'user.count',
+      negate: false,
+      dataViewId: 'indexPatternId',
+    });
+  });
+
+  it('should create an "Not exists" filter when value type equals "value_count"', async () => {
+    const testParams = {
+      ...params,
+      negate: true,
+    };
+    const { execute } = createFilterLensAction(testParams);
+    await execute({
+      data: mockUserCountData,
+      trigger: mockTrigger,
+    });
+    expect(addExistsFilter).toHaveBeenCalledWith({
+      filterManager: 'mockFilterManager',
+      key: 'user.count',
+      negate: true,
+      dataViewId: 'indexPatternId',
+    });
+    expect(addFilterIn).not.toHaveBeenCalled();
+  });
+
+  it('should show a warning toast when the value is not supported', async () => {
+    const { execute } = createFilterLensAction(params);
+    await execute({
+      data: [
+        {
+          columnMeta: {
+            field: 'user.name',
+            sourceParams: {
+              type: 'string',
+              indexPatternId: 'indexPatternId',
+            },
+          },
+          value: [[1], '1', 'foo'],
+        },
+      ] as unknown as CellValueContext['data'],
+      trigger: mockTrigger,
+    });
+    expect(mockServices.notifications.toasts.addWarning).toHaveBeenCalled();
+  });
+
+  it('should not create a filter when the field is missing', async () => {
+    const { execute } = createFilterLensAction(params);
+    await execute({
+      data: [
+        {
+          columnMeta: {},
+          value: 'elastic',
+        },
+      ] as unknown as CellValueContext['data'],
+      trigger: mockTrigger,
+    });
+    expect(addFilterIn).not.toHaveBeenCalled();
+    expect(addFilterOut).not.toHaveBeenCalled();
+  });
+});

x-pack/plugins/security_solution/public/actions/filter/lens/create_action.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { addFilterIn, addFilterOut } from '@kbn/cell-actions';
+import { addExistsFilter, addFilterIn, addFilterOut } from '@kbn/cell-actions';
 import {
   isValueSupportedByDefaultActions,
   valueToArray,
@@ -31,19 +31,21 @@ function isDataColumnsValid(data?: CellValueContext['data']): boolean {
   );
 }
 
+export interface CreateFilterLensActionParams {
+  id: string;
+  order: number;
+  store: SecurityAppStore;
+  services: StartServices;
+  negate?: boolean;
+}
+
 export const createFilterLensAction = ({
   id,
   order,
   store,
   services,
   negate,
-}: {
-  id: string;
-  order: number;
-  store: SecurityAppStore;
-  services: StartServices;
-  negate?: boolean;
-}) => {
+}: CreateFilterLensActionParams) => {
   const { application, notifications, data: dataService, topValuesPopover } = services;
 
   let currentAppId: string | undefined;
@@ -72,6 +74,7 @@ export const createFilterLensAction = ({
       isInSecurityApp(currentAppId),
     execute: async ({ data }) => {
       const field = data[0]?.columnMeta?.field;
+      const isCounter = data[0]?.columnMeta?.sourceParams?.type === 'value_count';
       const rawValue = data[0]?.value;
       const mayBeDataViewId = data[0]?.columnMeta?.sourceParams?.indexPatternId;
       const dataViewId = typeof mayBeDataViewId === 'string' ? mayBeDataViewId : undefined;
@@ -87,15 +90,30 @@ export const createFilterLensAction = ({
 
       topValuesPopover.closePopover();
 
-      const addFilter = negate === true ? addFilterOut : addFilterIn;
-
       const timeline = getTimelineById(store.getState(), TimelineId.active);
       // timeline is open add the filter to timeline, otherwise add filter to global filters
       const filterManager = timeline?.show
         ? services.timelineFilterManager
         : dataService.query.filterManager;
 
-      addFilter({ filterManager, fieldName: field, value, dataViewId });
+      // If value type is value_count, we want to filter an `Exists` filter instead of a `Term` filter
+      if (isCounter) {
+        addExistsFilter({
+          filterManager,
+          key: field,
+          negate: !!negate,
+          dataViewId,
+        });
+        return;
+      }
+
+      const addFilter = negate === true ? addFilterOut : addFilterIn;
+      addFilter({
+        filterManager,
+        fieldName: field,
+        value,
+        dataViewId,
+      });
     },
   });
 };