[Security Solution][Detections] EQL Validation

x-pack/plugins/security_solution/common/constants.ts

@@ -115,6 +115,7 @@ export const DETECTION_ENGINE_PREPACKAGED_URL = `${DETECTION_ENGINE_RULES_URL}/p
 export const DETECTION_ENGINE_PRIVILEGES_URL = `${DETECTION_ENGINE_URL}/privileges`;
 export const DETECTION_ENGINE_INDEX_URL = `${DETECTION_ENGINE_URL}/index`;
 export const DETECTION_ENGINE_TAGS_URL = `${DETECTION_ENGINE_URL}/tags`;
+export const DETECTION_ENGINE_EQL_VALIDATION_URL = `${DETECTION_ENGINE_URL}/validate_eql`;
 export const DETECTION_ENGINE_RULES_STATUS_URL = `${DETECTION_ENGINE_RULES_URL}/_find_statuses`;
 export const DETECTION_ENGINE_PREPACKAGED_RULES_STATUS_URL = `${DETECTION_ENGINE_RULES_URL}/prepackaged/_status`;
 

x-pack/plugins/security_solution/common/detection_engine/schemas/request/eql_validation_schema.mock.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EqlValidationSchema } from './eql_validation_schema';
+
+export const getEqlValidationSchemaMock = (): EqlValidationSchema => ({
+  index: ['index-123'],
+  query: 'process where process.name == "regsvr32.exe"',
+});

x-pack/plugins/security_solution/common/detection_engine/schemas/request/eql_validation_schema.test.ts

@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { exactCheck } from '../../../exact_check';
+import { foldLeftRight, getPaths } from '../../../test_utils';
+import { eqlValidationSchema, EqlValidationSchema } from './eql_validation_schema';
+import { getEqlValidationSchemaMock } from './eql_validation_schema.mock';
+
+describe('EQL validation schema', () => {
+  it('requires a value for index', () => {
+    const payload = {
+      ...getEqlValidationSchemaMock(),
+      index: undefined,
+    };
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "index"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  it('requires a value for query', () => {
+    const payload = {
+      ...getEqlValidationSchemaMock(),
+      query: undefined,
+    };
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "query"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  it('validates a payload with index and query', () => {
+    const payload = getEqlValidationSchemaMock();
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+    const expected: EqlValidationSchema = {
+      index: ['index-123'],
+      query: 'process where process.name == "regsvr32.exe"',
+    };
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(expected);
+  });
+});

x-pack/plugins/security_solution/common/detection_engine/schemas/request/eql_validation_schema.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+
+import { index, query } from '../common/schemas';
+
+export const eqlValidationSchema = t.exact(
+  t.type({
+    index,
+    query,
+  })
+);
+
+export type EqlValidationSchema = t.TypeOf<typeof eqlValidationSchema>;

x-pack/plugins/security_solution/common/detection_engine/schemas/response/eql_validation_schema.mock.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EqlValidationSchema } from './eql_validation_schema';
+
+export const getEqlValidationResponseMock = (): EqlValidationSchema => ({
+  valid: false,
+  errors: ['line 3:52: token recognition error at: '],
+});
+
+export const getValidEqlValidationResponseMock = (): EqlValidationSchema => ({
+  valid: true,
+  errors: [],
+});

x-pack/plugins/security_solution/common/detection_engine/schemas/response/eql_validation_schema.test.ts

@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { exactCheck } from '../../../exact_check';
+import { foldLeftRight, getPaths } from '../../../test_utils';
+import { getEqlValidationResponseMock } from './eql_validation_schema.mock';
+import { eqlValidationSchema } from './eql_validation_schema';
+
+describe('EQL validation response schema', () => {
+  it('validates a typical response', () => {
+    const payload = getEqlValidationResponseMock();
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getEqlValidationResponseMock());
+  });
+
+  it('invalidates a response with extra properties', () => {
+    const payload = { ...getEqlValidationResponseMock(), extra: 'nope' };
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extra"']);
+    expect(message.schema).toEqual({});
+  });
+
+  it('invalidates a response with missing properties', () => {
+    const payload = { ...getEqlValidationResponseMock(), valid: undefined };
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "valid"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  it('invalidates a response with properties of the wrong type', () => {
+    const payload = { ...getEqlValidationResponseMock(), errors: 'should be an array' };
+    const decoded = eqlValidationSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "should be an array" supplied to "errors"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+});

x-pack/plugins/security_solution/common/detection_engine/schemas/response/eql_validation_schema.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+
+export const eqlValidationSchema = t.exact(
+  t.type({
+    valid: t.boolean,
+    errors: t.array(t.string),
+  })
+);
+
+export type EqlValidationSchema = t.TypeOf<typeof eqlValidationSchema>;

x-pack/plugins/security_solution/public/common/hooks/eql/api.ts

@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HttpStart } from '../../../../../../../src/core/public';
+import { DETECTION_ENGINE_EQL_VALIDATION_URL } from '../../../../common/constants';
+import { EqlValidationSchema as EqlValidationRequest } from '../../../../common/detection_engine/schemas/request/eql_validation_schema';
+import { EqlValidationSchema as EqlValidationResponse } from '../../../../common/detection_engine/schemas/response/eql_validation_schema';
+
+interface ApiParams {
+  http: HttpStart;
+  signal: AbortSignal;
+}
+
+export const validateEql = async ({
+  http,
+  query,
+  index,
+  signal,
+}: ApiParams & EqlValidationRequest) => {
+  return http.fetch<EqlValidationResponse>(DETECTION_ENGINE_EQL_VALIDATION_URL, {
+    method: 'POST',
+    body: JSON.stringify({
+      query,
+      index,
+    }),
+    signal,
+  });
+};

x-pack/plugins/security_solution/public/common/hooks/eql/use_eql_validation.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useAsync, withOptionalSignal } from '../../../shared_imports';
+import { validateEql } from './api';
+
+const validateEqlWithOptionalSignal = withOptionalSignal(validateEql);
+
+export const useEqlValidation = () => useAsync(validateEqlWithOptionalSignal);

x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_overview_link.tsx

@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import styled from 'styled-components';
+
+import { EuiLink, EuiText } from '@elastic/eui';
+import { EQL_OVERVIEW_LINK_TEXT } from './translations';
+
+const EQL_OVERVIEW_URL = 'https://eql.readthedocs.io/en/latest/query-guide/index.html';
+
+const InlineText = styled(EuiText)`
+  display: inline-block;
+`;
+
+export const EqlOverviewLink = () => (
+  <EuiLink external href={EQL_OVERVIEW_URL} target="_blank">
+    <InlineText size="xs">{EQL_OVERVIEW_LINK_TEXT}</InlineText>
+  </EuiLink>
+);

x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.test.tsx

@@ -7,27 +7,46 @@
 import React from 'react';
 import { shallow, mount } from 'enzyme';
 
-import { useFormFieldMock } from '../../../../common/mock';
+import { TestProviders, useFormFieldMock } from '../../../../common/mock';
+import { useEqlValidation } from '../../../../common/hooks/eql/use_eql_validation';
+import {
+  getEqlValidationResponseMock,
+  getValidEqlValidationResponseMock,
+} from '../../../../../common/detection_engine/schemas/response/eql_validation_schema.mock';
 import { mockQueryBar } from '../../../pages/detection_engine/rules/all/__mocks__/mock';
 import { EqlQueryBar, EqlQueryBarProps } from './eql_query_bar';
 
+jest.mock('../../../../common/lib/kibana');
+jest.mock('../../../../common/hooks/eql/use_eql_validation');
+
 describe('EqlQueryBar', () => {
   let mockField: EqlQueryBarProps['field'];
+  let mockIndex: string[];
 
   beforeEach(() => {
+    (useEqlValidation as jest.Mock).mockReturnValue({
+      result: getValidEqlValidationResponseMock(),
+    });
+    mockIndex = ['index-123*'];
     mockField = useFormFieldMock({
       value: mockQueryBar,
     });
   });
 
   it('renders correctly', () => {
-    const wrapper = shallow(<EqlQueryBar dataTestSubj="myQueryBar" field={mockField} />);
+    const wrapper = shallow(
+      <EqlQueryBar index={mockIndex} dataTestSubj="myQueryBar" field={mockField} />
+    );
 
     expect(wrapper.find('[data-test-subj="myQueryBar"]')).toHaveLength(1);
   });
 
   it('sets the field value on input change', () => {
-    const wrapper = mount(<EqlQueryBar dataTestSubj="myQueryBar" field={mockField} />);
+    const wrapper = mount(
+      <TestProviders>
+        <EqlQueryBar index={mockIndex} dataTestSubj="myQueryBar" field={mockField} />
+      </TestProviders>
+    );
 
     wrapper
       .find('[data-test-subj="eqlQueryBarTextInput"]')
@@ -44,4 +63,30 @@ describe('EqlQueryBar', () => {
 
     expect(mockField.setValue).toHaveBeenCalledWith(expected);
   });
+
+  it('does not render errors for a valid query', () => {
+    const wrapper = mount(
+      <TestProviders>
+        <EqlQueryBar index={mockIndex} dataTestSubj="myQueryBar" field={mockField} />
+      </TestProviders>
+    );
+
+    expect(wrapper.find('[data-test-subj="eql-validation-errors-popover"]').exists()).toEqual(
+      false
+    );
+  });
+
+  it('renders errors for an invalid query', () => {
+    (useEqlValidation as jest.Mock).mockReturnValue({
+      result: getEqlValidationResponseMock(),
+    });
+
+    const wrapper = mount(
+      <TestProviders>
+        <EqlQueryBar index={mockIndex} dataTestSubj="myQueryBar" field={mockField} />
+      </TestProviders>
+    );
+
+    expect(wrapper.find('[data-test-subj="eql-validation-errors-popover"]').exists()).toEqual(true);
+  });
 });