clean up

x-pack/examples/triggers_actions_ui_example/public/components/rules_list_notify_badge_sandbox.tsx

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useState } from 'react';
+import React from 'react';
 import {
   TriggersAndActionsUIPublicPluginStart,
   RuleTableItem,
@@ -48,21 +48,12 @@ const mockRule: RuleTableItem = {
 };
 
 export const RulesListNotifyBadgeSandbox = ({ triggersActionsUi }: SandboxProps) => {
-  const [isOpen, setIsOpen] = useState<boolean>(false);
-  const [isLoading, setIsLoading] = useState<boolean>(false);
-
   return (
     <div style={{ flex: 1 }}>
       {triggersActionsUi.getRulesListNotifyBadge({
         rule: mockRule,
-        isOpen,
-        isLoading,
-        onClick: () => setIsOpen(!isOpen),
-        onClose: () => setIsOpen(false),
-        onLoading: setIsLoading,
+        isLoading: false,
         onRuleChanged: () => Promise.resolve(),
-        snoozeRule: () => Promise.resolve(),
-        unsnoozeRule: () => Promise.resolve(),
       })}
     </div>
   );

x-pack/plugins/security_solution/common/detection_engine/rule_schema/model/rule_snooze_schemas.ts

@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IsoDateString } from '@kbn/securitysolution-io-ts-types';
+import * as t from 'io-ts';
+
+const RRuleRecord = t.intersection([
+  t.type({
+    dtstart: IsoDateString,
+    tzid: t.string,
+  }),
+  t.partial({
+    freq: t.union([
+      t.literal(0),
+      t.literal(1),
+      t.literal(2),
+      t.literal(3),
+      t.literal(4),
+      t.literal(5),
+      t.literal(6),
+    ]),
+    until: t.string,
+    count: t.number,
+    interval: t.number,
+    wkst: t.union([
+      t.literal('MO'),
+      t.literal('TU'),
+      t.literal('WE'),
+      t.literal('TH'),
+      t.literal('FR'),
+      t.literal('SA'),
+      t.literal('SU'),
+    ]),
+    byweekday: t.array(t.union([t.string, t.number])),
+    bymonth: t.array(t.number),
+    bysetpos: t.array(t.number),
+    bymonthday: t.array(t.number),
+    byyearday: t.array(t.number),
+    byweekno: t.array(t.number),
+    byhour: t.array(t.number),
+    byminute: t.array(t.number),
+    bysecond: t.array(t.number),
+  }),
+]);
+
+export const RuleSnoozeSchedule = t.intersection([
+  t.type({
+    duration: t.number,
+    rRule: RRuleRecord,
+  }),
+  t.partial({
+    id: t.string,
+    skipRecurrences: t.array(t.string),
+  }),
+]);

x-pack/plugins/security_solution/common/endpoint/constants.ts

@@ -78,8 +78,10 @@ export const GET_FILE_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/get_file`;
 export const ENDPOINT_ACTION_LOG_ROUTE = `${BASE_ENDPOINT_ROUTE}/action_log/{agent_id}`;
 export const ACTION_STATUS_ROUTE = `${BASE_ENDPOINT_ROUTE}/action_status`;
 export const ACTION_DETAILS_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/{action_id}`;
-export const ACTION_AGENT_FILE_INFO_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/{action_id}/{agent_id}/file`;
-export const ACTION_AGENT_FILE_DOWNLOAD_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/{action_id}/{agent_id}/file/download`;
+export const ACTION_AGENT_FILE_INFO_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/{action_id}/file/{file_id}`;
+export const ACTION_AGENT_FILE_DOWNLOAD_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/{action_id}/file/{file_id}/download`;
+
+// FIXME:PT `const` below seem like a duplicate. Delete it
 export const ENDPOINTS_ACTION_LIST_ROUTE = `${BASE_ENDPOINT_ROUTE}/action`;
 
 export const failedFleetActionErrorCode = '424';

x-pack/plugins/security_solution/common/endpoint/schema/actions.ts

@@ -132,7 +132,7 @@ export type ResponseActionGetFileRequestBody = TypeOf<typeof EndpointActionGetFi
 export const EndpointActionFileDownloadSchema = {
   params: schema.object({
     action_id: schema.string({ minLength: 1 }),
-    agent_id: schema.string({ minLength: 1 }),
+    file_id: schema.string({ minLength: 1 }),
   }),
 };
 
@@ -144,7 +144,7 @@ export type EndpointActionFileDownloadParams = TypeOf<
 export const EndpointActionFileInfoSchema = {
   params: schema.object({
     action_id: schema.string({ minLength: 1 }),
-    agent_id: schema.string({ minLength: 1 }),
+    file_id: schema.string({ minLength: 1 }),
   }),
 };
 

x-pack/plugins/security_solution/common/endpoint/types/actions.ts

@@ -6,7 +6,7 @@
  */
 
 import type { TypeOf } from '@kbn/config-schema';
-import type { FileJSON } from '@kbn/files-plugin/common';
+import type { FileJSON, BaseFileMetadata, FileCompression } from '@kbn/files-plugin/common';
 import type {
   ActionStatusRequestSchema,
   NoParametersRequestSchema,
@@ -368,10 +368,60 @@ export interface ActionListApiResponse {
   total: number;
 }
 
+/**
+ * File upload metadata information. Stored by endpoint/fleet-server when a file is uploaded to ES in connection with
+ * a response action
+ */
+export interface FileUploadMetadata {
+  action_id: string;
+  agent_id: string;
+  src: string; // The agent name. `endpoint` for security solution files
+  upload_id: string;
+  upload_start: number;
+  contents: Array<
+    Partial<{
+      accessed: string; // ISO date
+      created: string; // ISO date
+      directory: string;
+      file_extension: string;
+      file_name: string;
+      gid: number;
+      inode: number;
+      mode: string;
+      mountpoint: string;
+      mtime: string;
+      path: string;
+      sha256: string;
+      size: number;
+      target_path: string;
+      type: string;
+      uid: number;
+    }>
+  >;
+  file: Pick<
+    Required<BaseFileMetadata>,
+    'name' | 'size' | 'Status' | 'ChunkSize' | 'mime_type' | 'extension'
+  > &
+    Omit<BaseFileMetadata, 'name' | 'size' | 'Status' | 'ChunkSize' | 'mime_type' | 'extension'> & {
+      compression: FileCompression;
+      attributes: string[];
+      type: string;
+    };
+  host: {
+    hostname: string;
+  };
+  transithash: {
+    sha256: string;
+  };
+}
+
 export type UploadedFileInfo = Pick<
   FileJSON,
   'name' | 'id' | 'mimeType' | 'size' | 'status' | 'created'
->;
+> & {
+  actionId: string;
+  agentId: string;
+};
 
 export interface ActionFileInfoApiResponse {
   data: UploadedFileInfo;

x-pack/plugins/security_solution/cypress/e2e/hosts/host_risk_tab.cy.ts

@@ -10,7 +10,7 @@ import { esArchiverLoad, esArchiverUnload } from '../../tasks/es_archiver';
 import {
   navigateToHostRiskDetailTab,
   openRiskTableFilterAndSelectTheCriticalOption,
-  removeCritialFilter,
+  removeCriticalFilter,
   selectFiveItemsPerPageOption,
 } from '../../tasks/host_risk';
 import {
@@ -51,7 +51,7 @@ describe('risk tab', () => {
 
     cy.get(HOST_BY_RISK_TABLE_CELL).eq(3).should('not.have.text', 'siem-kibana');
 
-    removeCritialFilter();
+    removeCriticalFilter();
   });
 
   it('should be able to change items count per page', () => {

x-pack/plugins/security_solution/cypress/screens/hosts/all_hosts.ts

@@ -7,4 +7,4 @@
 
 export const ALL_HOSTS_TABLE = '[data-test-subj="table-allHosts-loading-false"]';
 
-export const HOSTS_NAMES = '[data-test-subj="render-content-host.name"] a.euiLink';
+export const HOSTS_NAMES = '[data-test-subj="cellActions-renderContent-host.name"] a.euiLink';

x-pack/plugins/security_solution/cypress/screens/hosts/host_risk.ts

@@ -27,4 +27,5 @@ export const HOST_BY_RISK_TABLE_PERPAGE_OPTIONS =
 export const HOST_BY_RISK_TABLE_NEXT_PAGE_BUTTON =
   '[data-test-subj="numberedPagination"] [data-test-subj="pagination-button-next"]';
 
-export const HOST_BY_RISK_TABLE_HOSTNAME_CELL = '[data-test-subj="render-content-host.name"]';
+export const HOST_BY_RISK_TABLE_HOSTNAME_CELL =
+  '[data-test-subj="cellActions-renderContent-host.name"]';

x-pack/plugins/security_solution/cypress/screens/hosts/uncommon_processes.ts

@@ -5,6 +5,6 @@
  * 2.0.
  */
 
-export const PROCESS_NAME_FIELD = '[data-test-subj="render-content-process.name"]';
+export const PROCESS_NAME_FIELD = '[data-test-subj="cellActions-renderContent-process.name"]';
 
 export const UNCOMMON_PROCESSES_TABLE = '[data-test-subj="table-uncommonProcesses-loading-false"]';

x-pack/plugins/security_solution/cypress/screens/network/flows.ts

@@ -9,19 +9,19 @@ export const IPS_TABLE_LOADED = '[data-test-subj="table-topNFlowSource-loading-f
 
 export const EXPAND_OVERFLOW_ITEMS = '[data-test-subj="overflow-button"]';
 
-export const FILTER_IN = '[data-test-subj="hover-actions-filter-for"]';
+export const FILTER_IN = '[data-test-subj="actionItem-security_filterIn"]';
 
-export const FILTER_OUT = '[data-test-subj="hover-actions-filter-out"]';
+export const FILTER_OUT = '[data-test-subj="actionItem-security_filterOut"]';
 
-export const ADD_TO_TIMELINE = '[data-test-subj="add-to-timeline"]';
+export const ADD_TO_TIMELINE = '[data-test-subj="actionItem-security_addToTimeline"]';
 
-export const SHOW_TOP_FIELD = '[data-test-subj="show-top-field"]';
+export const SHOW_TOP_FIELD = '[data-test-subj="actionItem-security_showTopN"]';
 
-export const COPY = '[data-test-subj="clipboard"]';
+export const COPY = '[data-test-subj="actionItem-security_copyToClipboard"]';
 
 export const TOP_N_CONTAINER = '[data-test-subj="topN-container"]';
 
-export const DESTINATION_DOMAIN = `[data-test-subj="more-container"] [data-test-subj="render-content-destination.domain"]`;
+export const DESTINATION_DOMAIN = `[data-test-subj="more-container"] [data-test-subj="cellActions-renderContent-destination.domain"]`;
 
 export const OVERFLOW_ITEM =
-  '[data-test-subj="more-container"] [data-test-subj="render-content-destination.domain"]';
+  '[data-test-subj="more-container"] [data-test-subj="cellActions-renderContent-destination.domain"]';

x-pack/plugins/security_solution/cypress/tasks/host_risk.ts

@@ -30,7 +30,7 @@ export const openRiskTableFilterAndSelectTheLowOption = () => {
   cy.get(HOST_BY_RISK_TABLE_FILTER_LOW).click();
 };
 
-export const removeCritialFilter = () => {
+export const removeCriticalFilter = () => {
   cy.get(HOST_BY_RISK_TABLE_FILTER_CRITICAL).click();
 };
 

x-pack/plugins/security_solution/public/actions/add_to_timeline/default/add_to_timeline.test.ts

@@ -12,7 +12,7 @@ import { Subject } from 'rxjs';
 import { TimelineId } from '../../../../common/types';
 import { addProvider } from '../../../timelines/store/timeline/actions';
 import { createAddToTimelineAction } from './add_to_timeline';
-import type { CellActionExecutionContext } from '@kbn/ui-actions-plugin/public';
+import type { CellActionExecutionContext } from '@kbn/cell-actions';
 import { GEO_FIELD_TYPE } from '../../../timelines/components/timeline/body/renderers/constants';
 
 jest.mock('../../../common/lib/kibana');

x-pack/plugins/security_solution/public/actions/add_to_timeline/default/add_to_timeline.tsx

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { CellActionExecutionContext } from '@kbn/ui-actions-plugin/public';
+import type { CellActionExecutionContext } from '@kbn/cell-actions';
 import { createAction } from '@kbn/ui-actions-plugin/public';
 import { addProvider } from '../../../timelines/store/timeline/actions';
 import { TimelineId } from '../../../../common/types';
@@ -58,8 +58,13 @@ export const createAddToTimelineAction = ({
       if (dataProviders.length > 0) {
         store.dispatch(addProvider({ id: TimelineId.active, providers: dataProviders }));
 
+        let messageValue = '';
+        if (field.value != null) {
+          messageValue = Array.isArray(field.value) ? field.value.join(', ') : field.value;
+        }
+
         notificationsService.toasts.addSuccess({
-          title: ADD_TO_TIMELINE_SUCCESS_TITLE(field.value),
+          title: ADD_TO_TIMELINE_SUCCESS_TITLE(messageValue),
         });
       } else {
         notificationsService.toasts.addWarning({

x-pack/plugins/security_solution/public/actions/copy_to_clipboard/default/copy_to_clipboard.test.ts

@@ -7,7 +7,7 @@
 
 import { KibanaServices } from '../../../common/lib/kibana';
 import { createCopyToClipboardAction } from './copy_to_clipboard';
-import type { CellActionExecutionContext } from '@kbn/ui-actions-plugin/public';
+import type { CellActionExecutionContext } from '@kbn/cell-actions';
 
 jest.mock('../../../common/lib/kibana');
 const mockSuccessToast = jest.fn();

x-pack/plugins/security_solution/public/actions/copy_to_clipboard/default/copy_to_clipboard.tsx

@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import { createAction } from '@kbn/ui-actions-plugin/public';
+import type { CellActionExecutionContext } from '@kbn/cell-actions';
 import copy from 'copy-to-clipboard';
-import type { CellActionExecutionContext } from '@kbn/ui-actions-plugin/public/cell_actions/components/cell_actions';
+import { createAction } from '@kbn/ui-actions-plugin/public';
 import { COPY_TO_CLIPBOARD, COPY_TO_CLIPBOARD_ICON, COPY_TO_CLIPBOARD_SUCCESS } from '../constants';
 import { KibanaServices } from '../../../common/lib/kibana';
 
@@ -24,7 +24,15 @@ export const createCopyToClipboardAction = ({ order }: { order?: number }) =>
     isCompatible: async (context) => context.field.name != null && context.field.value != null,
     execute: async ({ field }) => {
       const { notifications } = KibanaServices.get();
-      const text = `${field.name}: "${field.value}"`;
+
+      let textValue: undefined | string;
+      if (field.value != null) {
+        textValue = Array.isArray(field.value)
+          ? field.value.map((value) => `"${value}"`).join(', ')
+          : `"${field.value}"`;
+      }
+      const text = textValue ? `${field.name}: ${textValue}` : field.name;
+
       const isSuccess = copy(text, { debug: true });
 
       if (isSuccess) {

x-pack/plugins/security_solution/public/actions/filter/default/filter_in.test.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { CellActionExecutionContext } from '@kbn/ui-actions-plugin/public';
+import type { CellActionExecutionContext } from '@kbn/cell-actions';
 import { KibanaServices } from '../../../common/lib/kibana';
 import { createFilterInAction } from './filter_in';
 

x-pack/plugins/security_solution/public/actions/filter/default/filter_in.tsx

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { CellActionExecutionContext } from '@kbn/ui-actions-plugin/public';
+import type { CellActionExecutionContext } from '@kbn/cell-actions';
 import { createAction } from '@kbn/ui-actions-plugin/public';
 import { i18n } from '@kbn/i18n';
 import { createFilter } from '../helpers';
@@ -30,7 +30,7 @@ export const createFilterInAction = ({ order }: { order?: number }) =>
       const services = KibanaServices.get();
       const filterManager = services.data.query.filterManager;
 
-      const makeFilter = (currentVal: string | null | undefined) =>
+      const makeFilter = (currentVal: string | string[] | null | undefined) =>
         currentVal?.length === 0
           ? createFilter(field.name, undefined)
           : createFilter(field.name, currentVal);

x-pack/plugins/security_solution/public/actions/filter/default/filter_out.test.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { CellActionExecutionContext } from '@kbn/ui-actions-plugin/public';
+import type { CellActionExecutionContext } from '@kbn/cell-actions';
 import { KibanaServices } from '../../../common/lib/kibana';
 import { createFilterOutAction } from './filter_out';
 

x-pack/plugins/security_solution/public/actions/filter/default/filter_out.tsx

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { CellActionExecutionContext } from '@kbn/ui-actions-plugin/public';
+import type { CellActionExecutionContext } from '@kbn/cell-actions';
 import { createAction } from '@kbn/ui-actions-plugin/public';
 import { i18n } from '@kbn/i18n';
 import { createFilter } from '../helpers';
@@ -31,7 +31,7 @@ export const createFilterOutAction = ({ order }: { order?: number }) =>
       const services = KibanaServices.get();
       const filterManager = services.data.query.filterManager;
 
-      const makeFilter = (currentVal: string | null | undefined) =>
+      const makeFilter = (currentVal: string | string[] | null | undefined) =>
         currentVal == null || currentVal?.length === 0
           ? createFilter(field.name, null, false)
           : createFilter(field.name, currentVal, true);