[SIEM][Detection Engine] - Update UI to read rule exceptions_list

x-pack/plugins/lists/public/exceptions/hooks/use_exception_list.test.tsx

@@ -41,7 +41,7 @@ describe('useExceptionList', () => {
         useExceptionList({
           filterOptions: { filter: '', tags: [] },
           http: mockKibanaHttpService,
-          lists: [{ id: 'myListId', namespaceType: 'single' }],
+          lists: [{ id: 'myListId', namespace_type: 'single' }],
           onError: onErrorMock,
           pagination: {
             page: 1,
@@ -76,7 +76,7 @@ describe('useExceptionList', () => {
         useExceptionList({
           filterOptions: { filter: '', tags: [] },
           http: mockKibanaHttpService,
-          lists: [{ id: 'myListId', namespaceType: 'single' }],
+          lists: [{ id: 'myListId', namespace_type: 'single' }],
           onError: onErrorMock,
           onSuccess: onSuccessMock,
           pagination: {
@@ -131,7 +131,7 @@ describe('useExceptionList', () => {
           initialProps: {
             filterOptions: { filter: '', tags: [] },
             http: mockKibanaHttpService,
-            lists: [{ id: 'myListId', namespaceType: 'single' }],
+            lists: [{ id: 'myListId', namespace_type: 'single' }],
             onError: onErrorMock,
             onSuccess: onSuccessMock,
             pagination: {
@@ -146,7 +146,7 @@ describe('useExceptionList', () => {
       rerender({
         filterOptions: { filter: '', tags: [] },
         http: mockKibanaHttpService,
-        lists: [{ id: 'newListId', namespaceType: 'single' }],
+        lists: [{ id: 'newListId', namespace_type: 'single' }],
         onError: onErrorMock,
         onSuccess: onSuccessMock,
         pagination: {
@@ -173,7 +173,7 @@ describe('useExceptionList', () => {
         useExceptionList({
           filterOptions: { filter: '', tags: [] },
           http: mockKibanaHttpService,
-          lists: [{ id: 'myListId', namespaceType: 'single' }],
+          lists: [{ id: 'myListId', namespace_type: 'single' }],
           onError: onErrorMock,
           pagination: {
             page: 1,
@@ -210,7 +210,7 @@ describe('useExceptionList', () => {
           useExceptionList({
             filterOptions: { filter: '', tags: [] },
             http: mockKibanaHttpService,
-            lists: [{ id: 'myListId', namespaceType: 'single' }],
+            lists: [{ id: 'myListId', namespace_type: 'single' }],
             onError: onErrorMock,
             pagination: {
               page: 1,
@@ -238,7 +238,7 @@ describe('useExceptionList', () => {
           useExceptionList({
             filterOptions: { filter: '', tags: [] },
             http: mockKibanaHttpService,
-            lists: [{ id: 'myListId', namespaceType: 'single' }],
+            lists: [{ id: 'myListId', namespace_type: 'single' }],
             onError: onErrorMock,
             pagination: {
               page: 1,

x-pack/plugins/lists/public/exceptions/hooks/use_exception_list.tsx

@@ -73,25 +73,25 @@ export const useExceptionList = ({
         let exceptions: ExceptionListItemSchema[] = [];
         let exceptionListsReturned: ExceptionList[] = [];
 
-        const fetchData = async ({ id, namespaceType }: ExceptionIdentifiers): Promise<void> => {
+        const fetchData = async ({ id, namespace_type }: ExceptionIdentifiers): Promise<void> => {
           try {
             setLoading(true);
 
             const {
               list_id,
-              namespace_type,
+              namespace_type: namespaceType,
               ...restOfExceptionList
             } = await fetchExceptionListById({
               http,
               id,
-              namespaceType,
+              namespaceType: namespace_type,
               signal: abortCtrl.signal,
             });
             const fetchListItemsResult = await fetchExceptionListItemsByListId({
               filterOptions,
               http,
               listId: list_id,
-              namespaceType: namespace_type,
+              namespaceType,
               pagination,
               signal: abortCtrl.signal,
             });
@@ -147,8 +147,8 @@ export const useExceptionList = ({
         // TODO: Workaround for now. Once api updated, we can pass in array of lists to fetch
         await Promise.all(
           lists.map(
-            ({ id, namespaceType }: ExceptionIdentifiers): Promise<void> =>
-              fetchData({ id, namespaceType })
+            ({ id, namespace_type }: ExceptionIdentifiers): Promise<void> =>
+              fetchData({ id, namespace_type })
           )
         );
 

x-pack/plugins/lists/public/exceptions/types.ts

@@ -59,7 +59,7 @@ export interface UseExceptionListProps {
 
 export interface ExceptionIdentifiers {
   id: string;
-  namespaceType: NamespaceType;
+  namespace_type: NamespaceType;
   type?: string;
 }
 

x-pack/plugins/security_solution/public/alerts/containers/detection_engine/rules/types.ts

@@ -7,6 +7,10 @@
 import * as t from 'io-ts';
 
 import { RuleTypeSchema } from '../../../../../common/detection_engine/types';
+import {
+  listArray,
+  listArrayOrUndefined,
+} from '../../../../../common/detection_engine/schemas/types';
 
 /**
  * Params is an "record", since it is a type of AlertActionParams which is action templates.
@@ -53,6 +57,7 @@ export const NewRuleSchema = t.intersection([
     to: t.string,
     updated_by: t.string,
     note: t.string,
+    exceptions_list: listArrayOrUndefined,
   }),
 ]);
 
@@ -118,6 +123,7 @@ export const RuleSchema = t.intersection([
     timeline_title: t.string,
     note: t.string,
     version: t.number,
+    exceptions_list: listArray,
   }),
 ]);
 

x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx

@@ -422,7 +422,7 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
                           ExceptionListType.ENDPOINT,
                         ]}
                         commentsAccordionId={'ruleDetailsTabExceptions'}
-                        exceptionListsMeta={[]}
+                        exceptionListsMeta={rule?.exceptions_list ?? []}
                       />
                     )}
                     {ruleDetailTab === RuleDetailTabs.failures && <FailureHistory id={rule?.id} />}

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/exception_entries.tsx

@@ -48,6 +48,10 @@ const MyAndOrBadgeContainer = styled(EuiFlexItem)`
   padding-bottom: ${({ theme }) => theme.eui.euiSizeS};
 `;
 
+const MyActionButton = styled(EuiFlexItem)`
+  align-self: flex-end;
+`;
+
 interface ExceptionEntriesComponentProps {
   entries: FormattedEntry[];
   disableDelete: boolean;
@@ -126,7 +130,7 @@ const ExceptionEntriesComponent = ({
   return (
     <MyEntriesDetails grow={5}>
       <EuiFlexGroup direction="column" gutterSize="m">
-        <EuiFlexItem>
+        <EuiFlexItem grow={false}>
           <EuiFlexGroup direction="row" gutterSize="none">
             {entries.length > 1 && (
               <EuiHideFor sizes={['xs', 's']}>
@@ -150,9 +154,9 @@ const ExceptionEntriesComponent = ({
             </EuiFlexItem>
           </EuiFlexGroup>
         </EuiFlexItem>
-        <EuiFlexItem grow={false}>
+        <EuiFlexItem grow={1}>
           <EuiFlexGroup gutterSize="s" justifyContent="flexEnd">
-            <EuiFlexItem grow={false}>
+            <MyActionButton grow={false}>
               <MyEditButton
                 size="s"
                 color="primary"
@@ -162,8 +166,8 @@ const ExceptionEntriesComponent = ({
               >
                 {i18n.EDIT}
               </MyEditButton>
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
+            </MyActionButton>
+            <MyActionButton grow={false}>
               <MyRemoveButton
                 size="s"
                 color="danger"
@@ -173,7 +177,7 @@ const ExceptionEntriesComponent = ({
               >
                 {i18n.REMOVE}
               </MyRemoveButton>
-            </EuiFlexItem>
+            </MyActionButton>
           </EuiFlexGroup>
         </EuiFlexItem>
       </EuiFlexGroup>

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.stories.tsx

@@ -122,7 +122,7 @@ storiesOf('Components|ExceptionItem', module)
 
     return (
       <ExceptionItem
-        loadingItemIds={[{ id, namespaceType: namespace_type }]}
+        loadingItemIds={[{ id, namespace_type }]}
         commentsAccordionId={'accordion--comments'}
         exceptionItem={{ id, namespace_type, ...rest }}
         onDeleteException={action('onClick')}

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.test.tsx

@@ -76,7 +76,7 @@ describe('ExceptionItem', () => {
 
     expect(mockOnDeleteException).toHaveBeenCalledWith({
       id: '1',
-      namespaceType: 'single',
+      namespace_type: 'single',
     });
   });
 

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/exception_item/index.tsx

@@ -55,8 +55,8 @@ const ExceptionItemComponent = ({
   }, [exceptionItem.entries]);
 
   const handleDelete = useCallback((): void => {
-    onDeleteException({ id: exceptionItem.id, namespaceType: exceptionItem.namespace_type });
-  }, [onDeleteException, exceptionItem]);
+    onDeleteException({ id: exceptionItem.id, namespace_type: exceptionItem.namespace_type });
+  }, [onDeleteException, exceptionItem.id, exceptionItem.namespace_type]);
 
   const handleEdit = useCallback((): void => {
     onEditException(exceptionItem);
@@ -68,10 +68,10 @@ const ExceptionItemComponent = ({
 
   const formattedComments = useMemo((): EuiCommentProps[] => {
     return getFormattedComments(exceptionItem.comments);
-  }, [exceptionItem]);
+  }, [exceptionItem.comments]);
 
   const disableDelete = useMemo((): boolean => {
-    const foundItems = loadingItemIds.filter((t) => t.id === exceptionItem.id);
+    const foundItems = loadingItemIds.filter(({ id }) => id === exceptionItem.id);
     return foundItems.length > 0;
   }, [loadingItemIds, exceptionItem.id]);
 

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.test.tsx

@@ -66,7 +66,7 @@ describe('ExceptionsViewer', () => {
             {
               id: '5b543420',
               type: 'endpoint',
-              namespaceType: 'single',
+              namespace_type: 'single',
             },
           ]}
           availableListTypes={[ExceptionListType.DETECTION_ENGINE]}
@@ -114,7 +114,7 @@ describe('ExceptionsViewer', () => {
             {
               id: '5b543420',
               type: 'endpoint',
-              namespaceType: 'single',
+              namespace_type: 'single',
             },
           ]}
           availableListTypes={[ExceptionListType.DETECTION_ENGINE]}

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx

@@ -205,12 +205,12 @@ const ExceptionsViewerComponent = ({
   );
 
   const handleDeleteException = useCallback(
-    ({ id, namespaceType }: ExceptionIdentifiers) => {
-      setLoadingItemIds([{ id, namespaceType }]);
+    ({ id, namespace_type }: ExceptionIdentifiers) => {
+      setLoadingItemIds([{ id, namespace_type }]);
 
       deleteExceptionItem({
         id,
-        namespaceType,
+        namespaceType: namespace_type,
         onSuccess: () => {
           setLoadingItemIds(loadingItemIds.filter((t) => t.id !== id));
           handleFetchList();

x-pack/plugins/security_solution/public/graphql/introspection.json

@@ -4710,6 +4710,14 @@
             "type": { "kind": "SCALAR", "name": "ToStringArray", "ofType": null },
             "isDeprecated": false,
             "deprecationReason": null
+          },
+          {
+            "name": "exceptions_list",
+            "description": "",
+            "args": [],
+            "type": { "kind": "SCALAR", "name": "ToAny", "ofType": null },
+            "isDeprecated": false,
+            "deprecationReason": null
           }
         ],
         "inputFields": null,

x-pack/plugins/security_solution/public/graphql/types.ts

@@ -1032,6 +1032,8 @@ export interface RuleField {
   version?: Maybe<string[]>;
 
   note?: Maybe<string[]>;
+
+  exceptions_list?: Maybe<ToAny>;
 }
 
 export interface SuricataEcsFields {
@@ -4984,6 +4986,8 @@ export namespace GetTimelineQuery {
     filters: Maybe<ToAny>;
 
     note: Maybe<string[]>;
+
+    exceptions_list: Maybe<ToAny>;
   };
 
   export type Suricata = {

x-pack/plugins/security_solution/public/timelines/containers/index.gql_query.ts

@@ -207,6 +207,7 @@ export const timelineQuery = gql`
                   to
                   filters
                   note
+                  exceptions_list
                 }
               }
               suricata {

x-pack/plugins/security_solution/server/graphql/ecs/schema.gql.ts

@@ -411,6 +411,7 @@ export const ecsSchema = gql`
     updated_by: ToStringArray
     version: ToStringArray
     note: ToStringArray
+    exceptions_list: ToAny
   }
 
   type SignalField {

x-pack/plugins/security_solution/server/graphql/types.ts

@@ -1034,6 +1034,8 @@ export interface RuleField {
   version?: Maybe<string[] | string>;
 
   note?: Maybe<string[] | string>;
+
+  exceptions_list?: Maybe<ToAny>;
 }
 
 export interface SuricataEcsFields {
@@ -4856,6 +4858,8 @@ export namespace RuleFieldResolvers {
     version?: VersionResolver<Maybe<string[] | string>, TypeParent, TContext>;
 
     note?: NoteResolver<Maybe<string[] | string>, TypeParent, TContext>;
+
+    exceptions_list?: ExceptionsListResolver<Maybe<ToAny>, TypeParent, TContext>;
   }
 
   export type IdResolver<
@@ -5013,6 +5017,11 @@ export namespace RuleFieldResolvers {
     Parent = RuleField,
     TContext = SiemContext
   > = Resolver<R, Parent, TContext>;
+  export type ExceptionsListResolver<
+    R = Maybe<ToAny>,
+    Parent = RuleField,
+    TContext = SiemContext
+  > = Resolver<R, Parent, TContext>;
 }
 
 export namespace SuricataEcsFieldsResolvers {

x-pack/plugins/security_solution/server/lib/detection_engine/scripts/rules/queries/query_with_list.json

@@ -6,5 +6,5 @@
   "type": "query",
   "query": "host.name: *",
   "interval": "30s",
-  "exceptions_list": [{ "id": "endpoint_list", "namespace_type": "single" }]
+  "exceptions_list": [{ "id": "8b9058e0-b685-11ea-83bd-99c6441a63ec", "namespace_type": "single" }]
 }