[Security Solution][Detections] EQL Validation

src/core/public/doc_links/doc_links_service.ts

@@ -119,6 +119,7 @@ export class DocLinksService {
           gettingStarted: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/index.html`,
         },
         query: {
+          eql: `${ELASTICSEARCH_DOCS}eql.html`,
           luceneQuerySyntax: `${ELASTICSEARCH_DOCS}query-dsl-query-string-query.html#query-string-syntax`,
           queryDsl: `${ELASTICSEARCH_DOCS}query-dsl.html`,
           kueryQuerySyntax: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/kuery-query.html`,
@@ -227,6 +228,7 @@ export interface DocLinksStart {
       readonly gettingStarted: string;
     };
     readonly query: {
+      readonly eql: string;
       readonly luceneQuerySyntax: string;
       readonly queryDsl: string;
       readonly kueryQuerySyntax: string;

x-pack/plugins/security_solution/common/constants.ts

@@ -117,6 +117,7 @@ export const DETECTION_ENGINE_PREPACKAGED_URL = `${DETECTION_ENGINE_RULES_URL}/p
 export const DETECTION_ENGINE_PRIVILEGES_URL = `${DETECTION_ENGINE_URL}/privileges`;
 export const DETECTION_ENGINE_INDEX_URL = `${DETECTION_ENGINE_URL}/index`;
 export const DETECTION_ENGINE_TAGS_URL = `${DETECTION_ENGINE_URL}/tags`;
+export const DETECTION_ENGINE_EQL_VALIDATION_URL = `${DETECTION_ENGINE_URL}/validate_eql`;
 export const DETECTION_ENGINE_RULES_STATUS_URL = `${DETECTION_ENGINE_RULES_URL}/_find_statuses`;
 export const DETECTION_ENGINE_PREPACKAGED_RULES_STATUS_URL = `${DETECTION_ENGINE_RULES_URL}/prepackaged/_status`;
 

x-pack/plugins/security_solution/common/detection_engine/schemas/request/eql_validation_schema.mock.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EqlValidationSchema } from './eql_validation_schema';
+
+export const getEqlValidationSchemaMock = (): EqlValidationSchema => ({
+  index: ['index-123'],
+  query: 'process where process.name == "regsvr32.exe"',
+});

x-pack/plugins/security_solution/common/detection_engine/schemas/request/eql_validation_schema.test.ts

@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { exactCheck } from '../../../exact_check';
+import { foldLeftRight, getPaths } from '../../../test_utils';
+import { eqlValidationSchema, EqlValidationSchema } from './eql_validation_schema';
+import { getEqlValidationSchemaMock } from './eql_validation_schema.mock';
+
+describe('EQL validation schema', () => {
+  it('requires a value for index', () => {
+    const payload = {
+      ...getEqlValidationSchemaMock(),
+      index: undefined,
+    };
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "index"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  it('requires a value for query', () => {
+    const payload = {
+      ...getEqlValidationSchemaMock(),
+      query: undefined,
+    };
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "query"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  it('validates a payload with index and query', () => {
+    const payload = getEqlValidationSchemaMock();
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    const expected: EqlValidationSchema = {
+      index: ['index-123'],
+      query: 'process where process.name == "regsvr32.exe"',
+    };
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(expected);
+  });
+});

x-pack/plugins/security_solution/common/detection_engine/schemas/request/eql_validation_schema.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+
+import { index, query } from '../common/schemas';
+
+export const eqlValidationSchema = t.exact(
+  t.type({
+    index,
+    query,
+  })
+);
+
+export type EqlValidationSchema = t.TypeOf<typeof eqlValidationSchema>;

x-pack/plugins/security_solution/common/detection_engine/schemas/response/eql_validation_schema.mock.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EqlValidationSchema } from './eql_validation_schema';
+
+export const getEqlValidationResponseMock = (): EqlValidationSchema => ({
+  valid: false,
+  errors: ['line 3:52: token recognition error at: '],
+});
+
+export const getValidEqlValidationResponseMock = (): EqlValidationSchema => ({
+  valid: true,
+  errors: [],
+});

x-pack/plugins/security_solution/common/detection_engine/schemas/response/eql_validation_schema.test.ts

@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { exactCheck } from '../../../exact_check';
+import { foldLeftRight, getPaths } from '../../../test_utils';
+import { getEqlValidationResponseMock } from './eql_validation_schema.mock';
+import { eqlValidationSchema } from './eql_validation_schema';
+
+describe('EQL validation response schema', () => {
+  it('validates a typical response', () => {
+    const payload = getEqlValidationResponseMock();
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getEqlValidationResponseMock());
+  });
+
+  it('invalidates a response with extra properties', () => {
+    const payload = { ...getEqlValidationResponseMock(), extra: 'nope' };
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extra"']);
+    expect(message.schema).toEqual({});
+  });
+
+  it('invalidates a response with missing properties', () => {
+    const payload = { ...getEqlValidationResponseMock(), valid: undefined };
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "valid"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  it('invalidates a response with properties of the wrong type', () => {
+    const payload = { ...getEqlValidationResponseMock(), errors: 'should be an array' };
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "should be an array" supplied to "errors"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+});

x-pack/plugins/security_solution/common/detection_engine/schemas/response/eql_validation_schema.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+
+export const eqlValidationSchema = t.exact(
+  t.type({
+    valid: t.boolean,
+    errors: t.array(t.string),
+  })
+);
+
+export type EqlValidationSchema = t.TypeOf<typeof eqlValidationSchema>;

x-pack/plugins/security_solution/public/common/hooks/eql/api.ts

@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HttpStart } from '../../../../../../../src/core/public';
+import { DETECTION_ENGINE_EQL_VALIDATION_URL } from '../../../../common/constants';
+import { EqlValidationSchema as EqlValidationRequest } from '../../../../common/detection_engine/schemas/request/eql_validation_schema';
+import { EqlValidationSchema as EqlValidationResponse } from '../../../../common/detection_engine/schemas/response/eql_validation_schema';
+
+interface ApiParams {
+  http: HttpStart;
+  signal: AbortSignal;
+}
+
+export const validateEql = async ({
+  http,
+  query,
+  index,
+  signal,
+}: ApiParams & EqlValidationRequest) => {
+  return http.fetch<EqlValidationResponse>(DETECTION_ENGINE_EQL_VALIDATION_URL, {
+    method: 'POST',
+    body: JSON.stringify({
+      query,
+      index,
+    }),
+    signal,
+  });
+};

x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_overview_link.tsx

@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import styled from 'styled-components';
+import { EuiLink, EuiText } from '@elastic/eui';
+
+import { useKibana } from '../../../../common/lib/kibana';
+import { EQL_OVERVIEW_LINK_TEXT } from './translations';
+
+const InlineText = styled(EuiText)`
+  display: inline-block;
+`;
+
+export const EqlOverviewLink = () => {
+  const overviewUrl = useKibana().services.docLinks.links.query.eql;
+
+  return (
+    <EuiLink external href={overviewUrl} target="_blank">
+      <InlineText size="xs">{EQL_OVERVIEW_LINK_TEXT}</InlineText>
+    </EuiLink>
+  );
+};

x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.test.tsx

@@ -7,9 +7,12 @@
 import React from 'react';
 import { shallow, mount } from 'enzyme';
 
-import { useFormFieldMock } from '../../../../common/mock';
+import { TestProviders, useFormFieldMock } from '../../../../common/mock';
 import { mockQueryBar } from '../../../pages/detection_engine/rules/all/__mocks__/mock';
 import { EqlQueryBar, EqlQueryBarProps } from './eql_query_bar';
+import { getEqlValidationError } from './validators.mock';
+
+jest.mock('../../../../common/lib/kibana');
 
 describe('EqlQueryBar', () => {
   let mockField: EqlQueryBarProps['field'];
@@ -27,7 +30,11 @@ describe('EqlQueryBar', () => {
   });
 
   it('sets the field value on input change', () => {
-    const wrapper = mount(<EqlQueryBar dataTestSubj="myQueryBar" field={mockField} />);
+    const wrapper = mount(
+      <TestProviders>
+        <EqlQueryBar dataTestSubj="myQueryBar" field={mockField} />
+      </TestProviders>
+    );
 
     wrapper
       .find('[data-test-subj="eqlQueryBarTextInput"]')
@@ -44,4 +51,30 @@ describe('EqlQueryBar', () => {
 
     expect(mockField.setValue).toHaveBeenCalledWith(expected);
   });
+
+  it('does not render errors for a valid query', () => {
+    const wrapper = mount(
+      <TestProviders>
+        <EqlQueryBar dataTestSubj="myQueryBar" field={mockField} />
+      </TestProviders>
+    );
+
+    expect(wrapper.find('[data-test-subj="eql-validation-errors-popover"]').exists()).toEqual(
+      false
+    );
+  });
+
+  it('renders errors for an invalid query', () => {
+    const invalidMockField = useFormFieldMock({
+      value: mockQueryBar,
+      errors: [getEqlValidationError()],
+    });
+    const wrapper = mount(
+      <TestProviders>
+        <EqlQueryBar dataTestSubj="myQueryBar" field={invalidMockField} />
+      </TestProviders>
+    );
+
+    expect(wrapper.find('[data-test-subj="eql-validation-errors-popover"]').exists()).toEqual(true);
+  });
 });