assignees (optional)
- Query Parameter — Filters the returned cases by assignees. Valid values are
none or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API. default: null defaultSearchOperator (optional)
+ Query Parameter — Filters the returned cases by assignees. Valid values are
none or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API. default: null category (optional)
+
+ Query Parameter — Filters the returned cases by category. Limited to 100 categories. default: null
defaultSearchOperator (optional)
Query Parameter — The default operator to use for the simple_query_string. default: OR
from (optional)
diff --git a/x-pack/plugins/cases/common/constants/index.ts b/x-pack/plugins/cases/common/constants/index.ts
index 0407315328dfb..33473a9c80bfd 100644
--- a/x-pack/plugins/cases/common/constants/index.ts
+++ b/x-pack/plugins/cases/common/constants/index.ts
@@ -104,6 +104,7 @@ export const MAX_DOCS_PER_PAGE = 10000 as const;
export const MAX_BULK_GET_ATTACHMENTS = MAX_DOCS_PER_PAGE;
export const MAX_CONCURRENT_SEARCHES = 10 as const;
export const MAX_BULK_GET_CASES = 1000 as const;
+export const MAX_CATEGORY_FILTER_LENGTH = 100 as const;
/**
* Validation
diff --git a/x-pack/plugins/cases/docs/openapi/bundled.json b/x-pack/plugins/cases/docs/openapi/bundled.json
index aee1e1aa751a5..92dcfe5779306 100644
--- a/x-pack/plugins/cases/docs/openapi/bundled.json
+++ b/x-pack/plugins/cases/docs/openapi/bundled.json
@@ -236,6 +236,25 @@
]
}
},
+ {
+ "name": "category",
+ "in": "query",
+ "description": "Filters the returned cases by category. Limited to 100 categories.",
+ "schema": {
+ "oneOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "array",
+ "items": {
+ "type": "string"
+ }
+ }
+ ]
+ },
+ "example": "my-category"
+ },
{
"name": "defaultSearchOperator",
"in": "query",
diff --git a/x-pack/plugins/cases/docs/openapi/bundled.yaml b/x-pack/plugins/cases/docs/openapi/bundled.yaml
index 8b93529b76b7e..3d53916c89df8 100644
--- a/x-pack/plugins/cases/docs/openapi/bundled.yaml
+++ b/x-pack/plugins/cases/docs/openapi/bundled.yaml
@@ -140,6 +140,16 @@ paths:
- type: array
items:
type: string
+ - name: category
+ in: query
+ description: Filters the returned cases by category. Limited to 100 categories.
+ schema:
+ oneOf:
+ - type: string
+ - type: array
+ items:
+ type: string
+ example: my-category
- name: defaultSearchOperator
in: query
description: The default operator to use for the simple_query_string.
diff --git a/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@_find.yaml b/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@_find.yaml
index 4ddd52db231f2..e04fbfe020c9f 100644
--- a/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@_find.yaml
+++ b/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@_find.yaml
@@ -18,6 +18,16 @@ get:
- type: array
items:
type: string
+ - name: category
+ in: query
+ description: Filters the returned cases by category. Limited to 100 categories.
+ schema:
+ oneOf:
+ - type: string
+ - type: array
+ items:
+ type: string
+ example: my-category
- name: defaultSearchOperator
in: query
description: The default operator to use for the simple_query_string.
diff --git a/x-pack/plugins/cases/server/client/cases/find.test.ts b/x-pack/plugins/cases/server/client/cases/find.test.ts
index 1e5afd2c87b36..968f111b58516 100644
--- a/x-pack/plugins/cases/server/client/cases/find.test.ts
+++ b/x-pack/plugins/cases/server/client/cases/find.test.ts
@@ -8,6 +8,7 @@ import { v1 as uuidv1 } from 'uuid';
import type { Case } from '../../../common/api';
+import { MAX_CATEGORY_FILTER_LENGTH } from '../../../common/constants';
import { flattenCaseSavedObject } from '../../common/utils';
import { mockCases } from '../../mocks';
import { createCasesClientMockArgs, createCasesClientMockFindRequest } from '../mocks';
@@ -103,5 +104,15 @@ describe('find', () => {
'Error: Invalid value "foobar" supplied to "searchFields"'
);
});
+
+ it(`throws an error when the category array has ${MAX_CATEGORY_FILTER_LENGTH} items`, async () => {
+ const category = Array(MAX_CATEGORY_FILTER_LENGTH + 1).fill('foobar');
+
+ const findRequest = createCasesClientMockFindRequest({ category });
+
+ await expect(find(findRequest, clientArgs)).rejects.toThrow(
+ `Error: Too many categories provided. The maximum allowed is ${MAX_CATEGORY_FILTER_LENGTH}`
+ );
+ });
});
});
diff --git a/x-pack/plugins/cases/server/client/cases/find.ts b/x-pack/plugins/cases/server/client/cases/find.ts
index 8e9e68f79d66b..aa2bb36768207 100644
--- a/x-pack/plugins/cases/server/client/cases/find.ts
+++ b/x-pack/plugins/cases/server/client/cases/find.ts
@@ -8,6 +8,7 @@
import { isEmpty } from 'lodash';
import Boom from '@hapi/boom';
+import { MAX_CATEGORY_FILTER_LENGTH } from '../../../common/constants';
import type { CasesFindResponse, CasesFindRequest } from '../../../common/api';
import {
CasesFindRequestRt,
@@ -24,6 +25,16 @@ import { LICENSING_CASE_ASSIGNMENT_FEATURE } from '../../common/constants';
import type { CasesFindQueryParams } from '../types';
import { decodeOrThrow } from '../../../common/api/runtime_types';
+/**
+ * Throws an error if the user tries to filter by more than MAX_CATEGORY_FILTER_LENGTH categories.
+ */
+function throwIfCategoryParamTooLong(category?: string[] | string) {
+ if (Array.isArray(category) && category.length > MAX_CATEGORY_FILTER_LENGTH)
+ throw Boom.badRequest(
+ `Too many categories provided. The maximum allowed is ${MAX_CATEGORY_FILTER_LENGTH}`
+ );
+}
+
/**
* Retrieves a case and optionally its comments.
*
@@ -44,8 +55,7 @@ export const find = async (
try {
const queryParams = decodeWithExcessOrThrow(CasesFindRequestRt)(params);
- const { filter: authorizationFilter, ensureSavedObjectsAreAuthorized } =
- await authorization.getAuthorizationFilter(Operations.findCases);
+ throwIfCategoryParamTooLong(queryParams.category);
/**
* Assign users to a case is only available to Platinum+
@@ -63,6 +73,9 @@ export const find = async (
licensingService.notifyUsage(LICENSING_CASE_ASSIGNMENT_FEATURE);
}
+ const { filter: authorizationFilter, ensureSavedObjectsAreAuthorized } =
+ await authorization.getAuthorizationFilter(Operations.findCases);
+
const queryArgs: CasesFindQueryParams = {
tags: queryParams.tags,
reporters: queryParams.reporters,
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/find_cases.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/find_cases.ts
index 60b1e789ec775..00bdaa5b25f0b 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/find_cases.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/find_cases.ts
@@ -8,7 +8,7 @@
import { v1 as uuidv1 } from 'uuid';
import expect from '@kbn/expect';
-import { CASES_URL } from '@kbn/cases-plugin/common/constants';
+import { CASES_URL, MAX_CATEGORY_FILTER_LENGTH } from '@kbn/cases-plugin/common/constants';
import { Case, CaseSeverity, CaseStatuses, CommentType } from '@kbn/cases-plugin/common/api';
import { ALERTING_CASES_SAVED_OBJECT_INDEX } from '@kbn/core-saved-objects-server';
import { FtrProviderContext } from '../../../../common/ftr_provider_context';
@@ -349,6 +349,12 @@ export default ({ getService }: FtrProviderContext): void => {
});
});
+ it('unhappy path - 400s when more than the maximum category fields are supplied', async () => {
+ const category = Array(MAX_CATEGORY_FILTER_LENGTH + 1).fill('foobar');
+
+ await findCases({ supertest, query: { category }, expectedHttpCode: 400 });
+ });
+
describe('search and searchField', () => {
beforeEach(async () => {
await createCase(supertest, postCaseReq);
From 7ea54fa678580ffc46a90e512cbbbb4459949ac9 Mon Sep 17 00:00:00 2001
From: Marta Bondyra <4283304+mbondyra@users.noreply.github.com>
Date: Wed, 21 Jun 2023 09:18:48 +0200
Subject: [PATCH 04/31] [Lens] fix inconsistent annotation icon styles
(#159542)
## Summary
Fixes https://github.com/elastic/kibana/issues/159540
Fixed by:
1. To fix the fill, I made the triangle and circle svgs consistent with
the ones from EUI. Now they work with fill and not with stroke. Thanks
to that we could remove `canFill` property.
2. To fix rotation for triangle, I added `!important` to transform when
adding `xyAnnotationIcon_rotate90`. Btw this class was added to path and
to svg, that's why before rotation was 45deg (because added to two
elements). I fixed it too.
+
+
);
};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_kpi.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_kpi.tsx
index 2f0aa0460c754..9e393a6507fc6 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_kpi.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_kpi.tsx
@@ -8,7 +8,7 @@
import React, { useEffect, useState, useMemo, useRef } from 'react';
import { i18n } from '@kbn/i18n';
import datemath from '@kbn/datemath';
-import { EuiFlexGroup, EuiFlexItem, EuiStat, EuiSpacer } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiStat } from '@elastic/eui';
import { IExecutionKPIResult } from '@kbn/alerting-plugin/common';
import {
ComponentOpts as RuleApis,
@@ -130,12 +130,7 @@ export const RuleEventLogListKPI = (props: RuleEventLogListKPIProps) => {
const isLoadingData = useMemo(() => isLoading || !kpi, [isLoading, kpi]);
const getStatDescription = (element: React.ReactNode) => {
- return (
- <>
- {element}
-
- {props.dataSectionExtra}
-
- )}
+ }
+ );
+ }}
+ />
+
+ {props.dataSectionExtra}
+
+ )}
+
-
-
- {i18n.translate(
- 'xpack.lens.xyChart.annotations.saveAnnotationGroupToLibrary.confirmButton',
- { defaultMessage: 'Save group' }
- )}
-
-
- }
- options={
- savedObjectsTagging ? (
-
+
+
+ {i18n.translate(
+ 'xpack.lens.xyChart.annotations.saveAnnotationGroupToLibrary.confirmButton',
+ { defaultMessage: 'Save group' }
+ )}
+
+
+ }
+ options={
+ savedObjectsTagging ? (
+
-
+
1) || false}
- fields={derivedIndexPattern.fields}
+ fields={derivedIndexPattern.fields as any}
remove={removeExpression}
addExpression={addExpression}
key={idx} // idx's don't usually make good key's but here the index has semantic meaning
@@ -308,17 +370,16 @@ export function Expressions(props: Props) {
expression={e || {}}
dataView={derivedIndexPattern}
>
+ {/* Preview */}
- {(metadata && (
+ {(metadata && derivedIndexPattern && (
-
(Expressions)('default');
diff --git a/x-pack/plugins/observability/public/pages/threshold/components/expression_chart.test.tsx b/x-pack/plugins/observability/public/components/threshold/components/expression_chart.test.tsx
similarity index 83%
rename from x-pack/plugins/observability/public/pages/threshold/components/expression_chart.test.tsx
rename to x-pack/plugins/observability/public/components/threshold/components/expression_chart.test.tsx
index 88d57b8688972..c4314aeb6b665 100644
--- a/x-pack/plugins/observability/public/pages/threshold/components/expression_chart.test.tsx
+++ b/x-pack/plugins/observability/public/components/threshold/components/expression_chart.test.tsx
@@ -14,11 +14,7 @@ import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
import { coreMock as mockCoreMock } from '@kbn/core/public/mocks';
import { MetricExpression } from '../types';
import { ExpressionChart } from './expression_chart';
-import {
- Aggregators,
- Comparator,
- MetricsSourceConfiguration,
-} from '../../../../common/threshold_rule/types';
+import { Aggregators, Comparator } from '../../../../common/threshold_rule/types';
const mockStartServices = mockCoreMock.createStart();
@@ -57,24 +53,10 @@ describe('ExpressionChart', () => {
fields: [],
};
- const source: MetricsSourceConfiguration = {
- id: 'default',
- origin: 'fallback',
- configuration: {
- name: 'default',
- description: 'The default configuration',
- metricAlias: 'metricbeat-*',
- inventoryDefaultView: 'host',
- metricsExplorerDefaultView: 'host',
- anomalyThreshold: 20,
- },
- };
-
const wrapper = mountWithIntl(
({
- withSourceProvider: () => jest.fn,
- useSourceContext: () => ({
- source: { id: 'default' },
- createDerivedIndexPattern: () => ({ fields: [], title: 'metricbeat-*' }),
- }),
-}));
-
describe('ExpressionRow', () => {
async function setup(expression: MetricExpression) {
const wrapper = mountWithIntl(
diff --git a/x-pack/plugins/observability/public/pages/threshold/components/expression_row.tsx b/x-pack/plugins/observability/public/components/threshold/components/expression_row.tsx
similarity index 92%
rename from x-pack/plugins/observability/public/pages/threshold/components/expression_row.tsx
rename to x-pack/plugins/observability/public/components/threshold/components/expression_row.tsx
index 08844ec7a9fd7..4bca96a8da3f6 100644
--- a/x-pack/plugins/observability/public/pages/threshold/components/expression_row.tsx
+++ b/x-pack/plugins/observability/public/components/threshold/components/expression_row.tsx
@@ -144,20 +144,6 @@ export const ExpressionRow: React.FC = (props) => {
name: f.name,
}));
- // for v8.9 we want to show only the Custom Equation. Use EuiExpression instead of WhenExpression */
- // const updateAggType = useCallback(
- // (at: string) => {
- // setRuleParams(expressionId, {
- // ...expression,
- // aggType: at as MetricExpression['aggType'],
- // metric: ['custom', 'count'].includes(at) ? undefined : expression.metric,
- // customMetrics: at === 'custom' ? expression.customMetrics : undefined,
- // equation: at === 'custom' ? expression.equation : undefined,
- // label: at === 'custom' ? expression.label : undefined,
- // });
- // },
- // [expressionId, expression, setRuleParams]
- // );
return (
<>
@@ -177,12 +163,6 @@ export const ExpressionRow: React.FC = (props) => {
- {/* for v8.9 we want to show only the Custom Equation. Use EuiExpression instead of WhenExpression */}
- {/* {
diff --git a/x-pack/plugins/observability/public/pages/threshold/hooks/use_metrics_explorer_data.test.tsx b/x-pack/plugins/observability/public/components/threshold/hooks/use_metrics_explorer_data.test.tsx
similarity index 94%
rename from x-pack/plugins/observability/public/pages/threshold/hooks/use_metrics_explorer_data.test.tsx
rename to x-pack/plugins/observability/public/components/threshold/hooks/use_metrics_explorer_data.test.tsx
index d2c8955e00913..20a7e6213aefa 100644
--- a/x-pack/plugins/observability/public/pages/threshold/hooks/use_metrics_explorer_data.test.tsx
+++ b/x-pack/plugins/observability/public/components/threshold/hooks/use_metrics_explorer_data.test.tsx
@@ -17,13 +17,11 @@ import {
MetricsExplorerTimestampsRT,
} from './use_metrics_explorer_options';
import { DataViewBase } from '@kbn/es-query';
-import { MetricsSourceConfigurationProperties } from '../../../../common/threshold_rule/types';
import {
createSeries,
derivedIndexPattern,
options,
resp,
- source,
timestamps,
} from '../../../utils/metrics_explorer';
@@ -54,20 +52,12 @@ const renderUseMetricsExplorerDataHook = () => {
return renderHook(
(props: {
options: MetricsExplorerOptions;
- source: MetricsSourceConfigurationProperties | undefined;
derivedIndexPattern: DataViewBase;
timestamps: MetricsExplorerTimestampsRT;
- }) =>
- useMetricsExplorerData(
- props.options,
- props.source,
- props.derivedIndexPattern,
- props.timestamps
- ),
+ }) => useMetricsExplorerData(props.options, props.derivedIndexPattern, props.timestamps),
{
initialProps: {
options,
- source,
derivedIndexPattern,
timestamps,
},
@@ -163,7 +153,6 @@ describe('useMetricsExplorerData Hook', () => {
aggregation: 'count',
metrics: [{ aggregation: 'count' }],
},
- source,
derivedIndexPattern,
timestamps,
});
@@ -187,7 +176,6 @@ describe('useMetricsExplorerData Hook', () => {
mockedFetch.mockResolvedValue(resp as any);
rerender({
options,
- source,
derivedIndexPattern,
timestamps: { fromTimestamp: 1678378092225, toTimestamp: 1678381693477, interval: '>=10s' },
});
diff --git a/x-pack/plugins/observability/public/pages/threshold/hooks/use_metrics_explorer_data.ts b/x-pack/plugins/observability/public/components/threshold/hooks/use_metrics_explorer_data.ts
similarity index 90%
rename from x-pack/plugins/observability/public/pages/threshold/hooks/use_metrics_explorer_data.ts
rename to x-pack/plugins/observability/public/components/threshold/hooks/use_metrics_explorer_data.ts
index 206e8fe3818f1..eeb4d52d70c36 100644
--- a/x-pack/plugins/observability/public/pages/threshold/hooks/use_metrics_explorer_data.ts
+++ b/x-pack/plugins/observability/public/components/threshold/hooks/use_metrics_explorer_data.ts
@@ -9,7 +9,6 @@ import { DataViewBase } from '@kbn/es-query';
import { useInfiniteQuery } from '@tanstack/react-query';
import { useKibana } from '@kbn/kibana-react-plugin/public';
-import { MetricsSourceConfigurationProperties } from '../../../../common/threshold_rule/types';
import {
MetricsExplorerResponse,
metricsExplorerResponseRT,
@@ -24,7 +23,6 @@ import { decodeOrThrow } from '../helpers/runtime_types';
export function useMetricsExplorerData(
options: MetricsExplorerOptions,
- source: MetricsSourceConfigurationProperties | undefined,
derivedIndexPattern: DataViewBase,
{ fromTimestamp, toTimestamp, interval }: MetricsExplorerTimestampsRT,
enabled = true
@@ -35,7 +33,7 @@ export function useMetricsExplorerData(
MetricsExplorerResponse,
Error
>({
- queryKey: ['metricExplorer', options, fromTimestamp, toTimestamp],
+ queryKey: ['metricExplorer', options, fromTimestamp, toTimestamp, derivedIndexPattern.title],
queryFn: async ({ signal, pageParam = { afterKey: null } }) => {
if (!fromTimestamp || !toTimestamp) {
throw new Error('Unable to parse timerange');
@@ -43,8 +41,8 @@ export function useMetricsExplorerData(
if (!http) {
throw new Error('HTTP service is unavailable');
}
- if (!source) {
- throw new Error('Source is unavailable');
+ if (!derivedIndexPattern.title) {
+ throw new Error('Data view is unavailable');
}
const { afterKey } = pageParam;
@@ -57,7 +55,7 @@ export function useMetricsExplorerData(
groupBy: options.groupBy,
afterKey,
limit: options.limit,
- indexPattern: source.metricAlias,
+ indexPattern: derivedIndexPattern.title,
filterQuery:
(options.filterQuery &&
convertKueryToElasticSearchQuery(options.filterQuery, derivedIndexPattern)) ||
@@ -74,7 +72,7 @@ export function useMetricsExplorerData(
return decodeOrThrow(metricsExplorerResponseRT)(response);
},
getNextPageParam: (lastPage) => lastPage.pageInfo,
- enabled: enabled && !!fromTimestamp && !!toTimestamp && !!http && !!source,
+ enabled: enabled && !!fromTimestamp && !!toTimestamp && !!http && !!derivedIndexPattern.title,
refetchOnWindowFocus: false,
});
diff --git a/x-pack/plugins/observability/public/pages/threshold/hooks/use_metrics_explorer_options.test.tsx b/x-pack/plugins/observability/public/components/threshold/hooks/use_metrics_explorer_options.test.tsx
similarity index 100%
rename from x-pack/plugins/observability/public/pages/threshold/hooks/use_metrics_explorer_options.test.tsx
rename to x-pack/plugins/observability/public/components/threshold/hooks/use_metrics_explorer_options.test.tsx
diff --git a/x-pack/plugins/observability/public/pages/threshold/hooks/use_metrics_explorer_options.ts b/x-pack/plugins/observability/public/components/threshold/hooks/use_metrics_explorer_options.ts
similarity index 100%
rename from x-pack/plugins/observability/public/pages/threshold/hooks/use_metrics_explorer_options.ts
rename to x-pack/plugins/observability/public/components/threshold/hooks/use_metrics_explorer_options.ts
diff --git a/x-pack/plugins/observability/public/pages/threshold/hooks/use_tracked_promise.ts b/x-pack/plugins/observability/public/components/threshold/hooks/use_tracked_promise.ts
similarity index 100%
rename from x-pack/plugins/observability/public/pages/threshold/hooks/use_tracked_promise.ts
rename to x-pack/plugins/observability/public/components/threshold/hooks/use_tracked_promise.ts
diff --git a/x-pack/plugins/observability/public/pages/threshold/i18n_strings.ts b/x-pack/plugins/observability/public/components/threshold/i18n_strings.ts
similarity index 100%
rename from x-pack/plugins/observability/public/pages/threshold/i18n_strings.ts
rename to x-pack/plugins/observability/public/components/threshold/i18n_strings.ts
diff --git a/x-pack/plugins/observability/public/pages/threshold/lib/generate_unique_key.test.ts b/x-pack/plugins/observability/public/components/threshold/lib/generate_unique_key.test.ts
similarity index 100%
rename from x-pack/plugins/observability/public/pages/threshold/lib/generate_unique_key.test.ts
rename to x-pack/plugins/observability/public/components/threshold/lib/generate_unique_key.test.ts
diff --git a/x-pack/plugins/observability/public/pages/threshold/lib/generate_unique_key.ts b/x-pack/plugins/observability/public/components/threshold/lib/generate_unique_key.ts
similarity index 100%
rename from x-pack/plugins/observability/public/pages/threshold/lib/generate_unique_key.ts
rename to x-pack/plugins/observability/public/components/threshold/lib/generate_unique_key.ts
diff --git a/x-pack/plugins/observability/public/pages/threshold/lib/transform_metrics_explorer_data.ts b/x-pack/plugins/observability/public/components/threshold/lib/transform_metrics_explorer_data.ts
similarity index 100%
rename from x-pack/plugins/observability/public/pages/threshold/lib/transform_metrics_explorer_data.ts
rename to x-pack/plugins/observability/public/components/threshold/lib/transform_metrics_explorer_data.ts
diff --git a/x-pack/plugins/observability/public/pages/threshold/mocks/metric_threshold_rule.ts b/x-pack/plugins/observability/public/components/threshold/mocks/metric_threshold_rule.ts
similarity index 100%
rename from x-pack/plugins/observability/public/pages/threshold/mocks/metric_threshold_rule.ts
rename to x-pack/plugins/observability/public/components/threshold/mocks/metric_threshold_rule.ts
diff --git a/x-pack/plugins/observability/public/pages/threshold/rule_data_formatters.ts b/x-pack/plugins/observability/public/components/threshold/rule_data_formatters.ts
similarity index 100%
rename from x-pack/plugins/observability/public/pages/threshold/rule_data_formatters.ts
rename to x-pack/plugins/observability/public/components/threshold/rule_data_formatters.ts
diff --git a/x-pack/plugins/observability/public/pages/threshold/types.ts b/x-pack/plugins/observability/public/components/threshold/types.ts
similarity index 95%
rename from x-pack/plugins/observability/public/pages/threshold/types.ts
rename to x-pack/plugins/observability/public/components/threshold/types.ts
index 6317b87ba2767..8aa3eea9ccbf3 100644
--- a/x-pack/plugins/observability/public/pages/threshold/types.ts
+++ b/x-pack/plugins/observability/public/components/threshold/types.ts
@@ -7,8 +7,8 @@
import * as rt from 'io-ts';
import { CasesUiStart } from '@kbn/cases-plugin/public';
import { ChartsPluginStart } from '@kbn/charts-plugin/public';
-import { DataPublicPluginStart } from '@kbn/data-plugin/public';
-import { DataViewsPublicPluginStart } from '@kbn/data-views-plugin/public';
+import { DataPublicPluginStart, SerializedSearchSourceFields } from '@kbn/data-plugin/public';
+import { DataView, DataViewsPublicPluginStart } from '@kbn/data-views-plugin/public';
import { DiscoverStart } from '@kbn/discover-plugin/public';
import { EmbeddableStart } from '@kbn/embeddable-plugin/public';
import { IStorageWrapper } from '@kbn/kibana-utils-plugin/public';
@@ -38,6 +38,7 @@ import { ObservabilityPublicStart } from '../../plugin';
import { MetricsExplorerOptions } from './hooks/use_metrics_explorer_options';
export interface AlertContextMeta {
+ adHocDataViewList: DataView[];
currentOptions?: Partial;
series?: MetricsExplorerSeries;
}
@@ -94,6 +95,7 @@ export interface AlertParams {
filterQueryText?: string;
alertOnNoData?: boolean;
alertOnGroupDisappear?: boolean;
+ searchConfiguration: SerializedSearchSourceFields;
shouldDropPartialBuckets?: boolean;
}
diff --git a/x-pack/plugins/observability/public/pages/threshold/helpers/source.tsx b/x-pack/plugins/observability/public/pages/threshold/helpers/source.tsx
deleted file mode 100644
index bf1ad0134ea8f..0000000000000
--- a/x-pack/plugins/observability/public/pages/threshold/helpers/source.tsx
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import createContainer from 'constate';
-import React, { useEffect, useState } from 'react';
-import { useKibana } from '@kbn/kibana-react-plugin/public';
-import { IHttpFetchError } from '@kbn/core-http-browser';
-import {
- MetricsSourceConfiguration,
- MetricsSourceConfigurationResponse,
- PartialMetricsSourceConfigurationProperties,
-} from '../../../../common/threshold_rule/types';
-import { MissingHttpClientException } from './source_errors';
-import { useTrackedPromise } from '../hooks/use_tracked_promise';
-import { useSourceNotifier } from './notifications';
-
-export const pickIndexPattern = (
- source: MetricsSourceConfiguration | undefined,
- type: 'metrics'
-) => {
- if (!source) {
- return 'unknown-index';
- }
- if (type === 'metrics') {
- return source.configuration.metricAlias;
- }
- return `${source.configuration.metricAlias}`;
-};
-
-export const useSource = ({ sourceId }: { sourceId: string }) => {
- const { services } = useKibana();
-
- const notify = useSourceNotifier();
-
- const fetchService = services.http;
- const API_URL = `/api/metrics/source/${sourceId}`;
-
- const [source, setSource] = useState(undefined);
-
- const [loadSourceRequest, loadSource] = useTrackedPromise(
- {
- cancelPreviousOn: 'resolution',
- createPromise: () => {
- if (!fetchService) {
- throw new MissingHttpClientException();
- }
-
- return fetchService.fetch(API_URL, { method: 'GET' });
- },
- onResolve: (response) => {
- if (response) {
- setSource(response.source);
- }
- },
- },
- [fetchService, sourceId]
- );
-
- const [createSourceConfigurationRequest, createSourceConfiguration] = useTrackedPromise(
- {
- createPromise: async (sourceProperties: PartialMetricsSourceConfigurationProperties) => {
- if (!fetchService) {
- throw new MissingHttpClientException();
- }
-
- return await fetchService.patch(API_URL, {
- method: 'PATCH',
- body: JSON.stringify(sourceProperties),
- });
- },
- onResolve: (response) => {
- if (response) {
- notify.updateSuccess();
- setSource(response.source);
- }
- },
- onReject: (error) => {
- notify.updateFailure((error as IHttpFetchError<{ message: string }>).body?.message);
- },
- },
- [fetchService, sourceId]
- );
-
- useEffect(() => {
- loadSource();
- }, [loadSource, sourceId]);
-
- const createDerivedIndexPattern = () => {
- return {
- fields: source?.status ? source.status.indexFields : [],
- title: pickIndexPattern(source, 'metrics'),
- };
- };
-
- const hasFailedLoadingSource = loadSourceRequest.state === 'rejected';
- const isUninitialized = loadSourceRequest.state === 'uninitialized';
- const isLoadingSource = loadSourceRequest.state === 'pending';
- const isLoading = isLoadingSource || createSourceConfigurationRequest.state === 'pending';
-
- const sourceExists = source ? !!source.version : undefined;
-
- const metricIndicesExist = Boolean(source?.status?.metricIndicesExist);
-
- const version = source?.version;
-
- return {
- createSourceConfiguration,
- createDerivedIndexPattern,
- isLoading,
- isLoadingSource,
- isUninitialized,
- hasFailedLoadingSource,
- loadSource,
- loadSourceRequest,
- loadSourceFailureMessage: hasFailedLoadingSource ? `${loadSourceRequest.value}` : undefined,
- metricIndicesExist,
- source,
- sourceExists,
- sourceId,
- updateSourceConfiguration: createSourceConfiguration,
- version,
- };
-};
-
-export const [SourceProvider, useSourceContext] = createContainer(useSource);
-
-export const withSourceProvider =
- (Component: React.FunctionComponent) =>
- (sourceId = 'default') => {
- // eslint-disable-next-line react/function-component-definition
- return function ComponentWithSourceProvider(props: ComponentProps) {
- return (
-
-
- );
- };
- };
diff --git a/x-pack/plugins/observability/public/plugin.mock.tsx b/x-pack/plugins/observability/public/plugin.mock.tsx
index 1a42c2ed98aa8..aa847fd198cf4 100644
--- a/x-pack/plugins/observability/public/plugin.mock.tsx
+++ b/x-pack/plugins/observability/public/plugin.mock.tsx
@@ -71,6 +71,33 @@ const data = {
timefilter: jest.fn(),
},
},
+ search: {
+ searchSource: jest.fn(),
+ },
+ };
+ },
+};
+
+const dataViewEditor = {
+ createStart() {
+ return {
+ userPermissions: {
+ editDataView: jest.fn(),
+ },
+ };
+ },
+};
+
+const dataViews = {
+ createStart() {
+ return {
+ getIds: jest.fn().mockImplementation(() => []),
+ get: jest.fn(),
+ create: jest.fn().mockImplementation(() => ({
+ fields: {
+ getByName: jest.fn(),
+ },
+ })),
};
},
};
@@ -81,6 +108,8 @@ export const observabilityPublicPluginsStartMock = {
cases: mockCasesContract(),
triggersActionsUi: triggersActionsUiStartMock.createStart(),
data: data.createStart(),
+ dataViews: dataViews.createStart(),
+ dataViewEditor: dataViewEditor.createStart(),
lens: null,
discover: null,
};
diff --git a/x-pack/plugins/observability/public/plugin.ts b/x-pack/plugins/observability/public/plugin.ts
index fd6300eff8caa..d87a95e0f7284 100644
--- a/x-pack/plugins/observability/public/plugin.ts
+++ b/x-pack/plugins/observability/public/plugin.ts
@@ -8,6 +8,7 @@
import { i18n } from '@kbn/i18n';
import { BehaviorSubject, from } from 'rxjs';
import { map } from 'rxjs/operators';
+import { DataViewEditorStart } from '@kbn/data-view-editor-plugin/public';
import { SharePluginSetup, SharePluginStart } from '@kbn/share-plugin/public';
import {
AppDeepLink,
@@ -103,6 +104,7 @@ export interface ObservabilityPublicPluginsStart {
charts: ChartsPluginStart;
data: DataPublicPluginStart;
dataViews: DataViewsPublicPluginStart;
+ dataViewEditor: DataViewEditorStart;
discover: DiscoverStart;
embeddable: EmbeddableStart;
exploratoryView: ExploratoryViewPublicStart;
diff --git a/x-pack/plugins/observability/public/rules/register_observability_rule_types.ts b/x-pack/plugins/observability/public/rules/register_observability_rule_types.ts
index 552473b36ded4..e6e5412cc046e 100644
--- a/x-pack/plugins/observability/public/rules/register_observability_rule_types.ts
+++ b/x-pack/plugins/observability/public/rules/register_observability_rule_types.ts
@@ -4,6 +4,7 @@
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
+
import { lazy } from 'react';
import { i18n } from '@kbn/i18n';
import { ALERT_REASON } from '@kbn/rule-data-utils';
@@ -16,8 +17,8 @@ import {
SLO_BURN_RATE_RULE_TYPE_ID,
} from '../../common/constants';
import { validateBurnRateRule } from '../components/burn_rate_rule_editor/validation';
-import { validateMetricThreshold } from '../pages/threshold/components/validation';
-import { formatReason } from '../pages/threshold/rule_data_formatters';
+import { validateMetricThreshold } from '../components/threshold/components/validation';
+import { formatReason } from '../components/threshold/rule_data_formatters';
const sloBurnRateDefaultActionMessage = i18n.translate(
'xpack.observability.slo.rules.burnRate.defaultActionMessage',
@@ -91,7 +92,7 @@ export const registerObservabilityRuleTypes = (
documentationUrl(docLinks) {
return `${docLinks.links.observability.threshold}`;
},
- ruleParamsExpression: lazy(() => import('../pages/threshold/components/expression')),
+ ruleParamsExpression: lazy(() => import('../components/threshold/components/expression')),
validate: validateMetricThreshold,
defaultActionMessage: i18n.translate(
'xpack.observability.threshold.rule.alerting.threshold.defaultActionMessage',
@@ -106,7 +107,7 @@ export const registerObservabilityRuleTypes = (
requiresAppContext: false,
format: formatReason,
alertDetailsAppSection: lazy(
- () => import('../pages/threshold/components/alert_details_app_section')
+ () => import('../components/threshold/components/alert_details_app_section')
),
});
}
diff --git a/x-pack/plugins/observability/public/utils/metrics_explorer.ts b/x-pack/plugins/observability/public/utils/metrics_explorer.ts
index ba8168a6f939e..fbbeb8a4f1937 100644
--- a/x-pack/plugins/observability/public/utils/metrics_explorer.ts
+++ b/x-pack/plugins/observability/public/utils/metrics_explorer.ts
@@ -16,7 +16,7 @@ import {
MetricsExplorerTimeOptions,
MetricsExplorerTimestampsRT,
MetricsExplorerYAxisMode,
-} from '../pages/threshold/hooks/use_metrics_explorer_options';
+} from '../components/threshold/hooks/use_metrics_explorer_options';
export const options: MetricsExplorerOptions = {
limit: 3,
diff --git a/x-pack/plugins/observability/server/lib/rules/threshold/register_threshold_rule_type.ts b/x-pack/plugins/observability/server/lib/rules/threshold/register_threshold_rule_type.ts
index 420bf33e77802..543492e6719f2 100644
--- a/x-pack/plugins/observability/server/lib/rules/threshold/register_threshold_rule_type.ts
+++ b/x-pack/plugins/observability/server/lib/rules/threshold/register_threshold_rule_type.ts
@@ -6,6 +6,7 @@
*/
import { schema } from '@kbn/config-schema';
+import { extractReferences, injectReferences } from '@kbn/data-plugin/common';
import { i18n } from '@kbn/i18n';
import { IRuleTypeAlerts } from '@kbn/alerting-plugin/server';
import { IBasePath, Logger } from '@kbn/core/server';
@@ -16,10 +17,11 @@ import {
IRuleDataClient,
} from '@kbn/rule-registry-plugin/server';
import { LicenseType } from '@kbn/licensing-plugin/server';
-import { THRESHOLD_RULE_REGISTRATION_CONTEXT } from '../../../common/constants';
+import { EsQueryRuleParamsExtractedParams } from '@kbn/stack-alerts-plugin/server/rule_types/es_query/rule_type_params';
import { observabilityFeatureId } from '../../../../common';
import { Comparator } from '../../../../common/threshold_rule/types';
import { OBSERVABILITY_THRESHOLD_RULE_TYPE_ID } from '../../../../common/constants';
+import { THRESHOLD_RULE_REGISTRATION_CONTEXT } from '../../../common/constants';
import {
alertDetailUrlActionVariableDescription,
@@ -148,7 +150,6 @@ export function thresholdRuleType(
validate: validateIsStringElasticsearchJSONFilter,
})
),
- sourceId: schema.string(),
alertOnNoData: schema.maybe(schema.boolean()),
alertOnGroupDisappear: schema.maybe(schema.boolean()),
},
@@ -203,6 +204,21 @@ export function thresholdRuleType(
},
],
},
+ useSavedObjectReferences: {
+ // TODO revisit types https://github.com/elastic/kibana/issues/159714
+ extractReferences: (params: any) => {
+ const [searchConfiguration, references] = extractReferences(params.searchConfiguration);
+ const newParams = { ...params, searchConfiguration } as EsQueryRuleParamsExtractedParams;
+
+ return { params: newParams, references };
+ },
+ injectReferences: (params: any, references: any) => {
+ return {
+ ...params,
+ searchConfiguration: injectReferences(params.searchConfiguration, references),
+ };
+ },
+ },
producer: observabilityFeatureId,
getSummarizedAlerts: getSummarizedAlerts(),
alerts: MetricsRulesTypeAlertDefinition,
diff --git a/x-pack/plugins/observability/server/lib/rules/threshold/test_mocks.ts b/x-pack/plugins/observability/server/lib/rules/threshold/test_mocks.ts
deleted file mode 100644
index 3d3c7a17cd1dd..0000000000000
--- a/x-pack/plugins/observability/server/lib/rules/threshold/test_mocks.ts
+++ /dev/null
@@ -1,237 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-const bucketsA = (from: number) => [
- {
- doc_count: null,
- aggregatedValue: { value: null, values: [{ key: 95.0, value: null }] },
- from_as_string: new Date(from).toISOString(),
- },
- {
- doc_count: 2,
- aggregatedValue: { value: 0.5, values: [{ key: 95.0, value: 0.5 }] },
- from_as_string: new Date(from + 60000).toISOString(),
- },
- {
- doc_count: 2,
- aggregatedValue: { value: 0.5, values: [{ key: 95.0, value: 0.5 }] },
- from_as_string: new Date(from + 120000).toISOString(),
- },
- {
- doc_count: 2,
- aggregatedValue: { value: 0.5, values: [{ key: 95.0, value: 0.5 }] },
- from_as_string: new Date(from + 180000).toISOString(),
- },
- {
- doc_count: 3,
- aggregatedValue: { value: 1.0, values: [{ key: 95.0, value: 1.0 }] },
- from_as_string: new Date(from + 240000).toISOString(),
- },
- {
- doc_count: 1,
- aggregatedValue: { value: 1.0, values: [{ key: 95.0, value: 1.0 }] },
- from_as_string: new Date(from + 300000).toISOString(),
- },
-];
-
-const bucketsB = (from: number) => [
- {
- doc_count: 0,
- aggregatedValue: { value: null, values: [{ key: 99.0, value: null }] },
- from_as_string: new Date(from).toISOString(),
- },
- {
- doc_count: 4,
- aggregatedValue: { value: 2.5, values: [{ key: 99.0, value: 2.5 }] },
- from_as_string: new Date(from + 60000).toISOString(),
- },
- {
- doc_count: 4,
- aggregatedValue: { value: 2.5, values: [{ key: 99.0, value: 2.5 }] },
- from_as_string: new Date(from + 120000).toISOString(),
- },
- {
- doc_count: 4,
- aggregatedValue: { value: 2.5, values: [{ key: 99.0, value: 2.5 }] },
- from_as_string: new Date(from + 180000).toISOString(),
- },
- {
- doc_count: 5,
- aggregatedValue: { value: 3.5, values: [{ key: 99.0, value: 3.5 }] },
- from_as_string: new Date(from + 240000).toISOString(),
- },
- {
- doc_count: 1,
- aggregatedValue: { value: 3, values: [{ key: 99.0, value: 3 }] },
- from_as_string: new Date(from + 300000).toISOString(),
- },
-];
-
-const bucketsC = (from: number) => [
- {
- doc_count: 0,
- aggregatedValue: { value: null },
- from_as_string: new Date(from).toISOString(),
- },
- {
- doc_count: 2,
- aggregatedValue: { value: 0.5 },
- from_as_string: new Date(from + 60000).toISOString(),
- },
- {
- doc_count: 2,
- aggregatedValue: { value: 0.5 },
- from_as_string: new Date(from + 120000).toISOString(),
- },
- {
- doc_count: 2,
- aggregatedValue: { value: 0.5 },
- from_as_string: new Date(from + 180000).toISOString(),
- },
- {
- doc_count: 3,
- aggregatedValue: { value: 16 },
- from_as_string: new Date(from + 240000).toISOString(),
- },
- {
- doc_count: 1,
- aggregatedValue: { value: 3 },
- from_as_string: new Date(from + 300000).toISOString(),
- },
-];
-
-export const basicMetricResponse = () => ({
- hits: {
- total: {
- value: 1,
- },
- },
- aggregations: {
- aggregatedValue: { value: 1.0, values: [{ key: 95.0, value: 1.0 }] },
- },
-});
-
-export const alternateMetricResponse = () => ({
- hits: {
- total: {
- value: 1,
- },
- },
- aggregations: {
- aggregatedValue: { value: 3, values: [{ key: 99.0, value: 3 }] },
- },
-});
-
-export const emptyMetricResponse = {
- aggregations: {
- aggregatedIntervals: {
- buckets: [],
- },
- },
-};
-
-export const emptyRateResponse = (from: number) => ({
- aggregations: {
- aggregatedIntervals: {
- buckets: [
- {
- doc_count: 2,
- aggregatedValueMax: { value: null },
- from_as_string: new Date(from).toISOString(),
- },
- ],
- },
- },
-});
-
-export const basicCompositeResponse = (from: number) => ({
- aggregations: {
- groupings: {
- after_key: { groupBy0: 'foo' },
- buckets: [
- {
- key: {
- groupBy0: 'a',
- },
- aggregatedIntervals: {
- buckets: bucketsA(from),
- },
- doc_count: 1,
- },
- {
- key: {
- groupBy0: 'b',
- },
- aggregatedIntervals: {
- buckets: bucketsB(from),
- },
- doc_count: 1,
- },
- ],
- },
- },
- hits: {
- total: {
- value: 2,
- },
- },
-});
-
-export const alternateCompositeResponse = (from: number) => ({
- aggregations: {
- groupings: {
- after_key: { groupBy0: 'foo' },
- buckets: [
- {
- key: {
- groupBy0: 'a',
- },
- aggregatedIntervals: {
- buckets: bucketsB(from),
- },
- doc_count: 1,
- },
- {
- key: {
- groupBy0: 'b',
- },
- aggregatedIntervals: {
- buckets: bucketsA(from),
- },
- doc_count: 1,
- },
- {
- key: {
- groupBy0: 'c',
- },
- aggregatedIntervals: {
- buckets: bucketsC(from),
- },
- doc_count: 1,
- },
- ],
- },
- },
- hits: {
- total: {
- value: 3,
- },
- },
-});
-
-export const compositeEndResponse = {
- aggregations: {},
- hits: { total: { value: 0 } },
-};
-
-export const changedSourceIdResponse = (from: number) => ({
- aggregations: {
- aggregatedIntervals: {
- buckets: bucketsC(from),
- },
- },
-});
diff --git a/x-pack/plugins/observability/server/lib/rules/threshold/threshold_executor.ts b/x-pack/plugins/observability/server/lib/rules/threshold/threshold_executor.ts
index 25e7ef8fb7967..5e11aca243f14 100644
--- a/x-pack/plugins/observability/server/lib/rules/threshold/threshold_executor.ts
+++ b/x-pack/plugins/observability/server/lib/rules/threshold/threshold_executor.ts
@@ -120,7 +120,7 @@ export const createMetricThresholdExecutor = ({
});
// TODO: check if we need to use "savedObjectsClient"=> https://github.com/elastic/kibana/issues/159340
- const { alertWithLifecycle, getAlertUuid, getAlertByAlertUuid, dataViews } = services;
+ const { alertWithLifecycle, getAlertUuid, getAlertByAlertUuid, searchSourceClient } = services;
const alertFactory: MetricThresholdAlertFactory = (
id,
@@ -138,9 +138,8 @@ export const createMetricThresholdExecutor = ({
...flattenAdditionalContext(additionalContext),
},
});
- // TODO: check if we need to use "sourceId"
+
const { alertOnNoData, alertOnGroupDisappear: _alertOnGroupDisappear } = params as {
- sourceId?: string;
alertOnNoData: boolean;
alertOnGroupDisappear: boolean | undefined;
};
@@ -188,9 +187,9 @@ export const createMetricThresholdExecutor = ({
alertOnGroupDisappear && filterQueryIsSame && groupByIsSame && state.missingGroups
? state.missingGroups
: [];
- // TODO: check the DATA VIEW
- const defaultDataView = await dataViews.getDefaultDataView();
- const dataView = defaultDataView?.getIndexPattern();
+
+ const initialSearchSource = await searchSourceClient.create(params.searchConfiguration!);
+ const dataView = initialSearchSource.getField('index')!.getIndexPattern();
if (!dataView) {
throw new Error('No matched data view');
}
diff --git a/x-pack/plugins/observability/server/lib/rules/threshold/types.ts b/x-pack/plugins/observability/server/lib/rules/threshold/types.ts
index 0f3c10611076e..d98a59bd50b9b 100644
--- a/x-pack/plugins/observability/server/lib/rules/threshold/types.ts
+++ b/x-pack/plugins/observability/server/lib/rules/threshold/types.ts
@@ -37,7 +37,6 @@ export interface MetricAnomalyParams {
nodeType: rt.TypeOf;
metric: rt.TypeOf;
alertInterval?: string;
- sourceId?: string;
spaceId?: string;
threshold: Exclude;
influencerFilter: rt.TypeOf | undefined;
@@ -48,7 +47,6 @@ export interface MetricAnomalyParams {
interface BaseMetricExpressionParams {
timeSize: number;
timeUnit: TimeUnitChar;
- sourceId?: string;
threshold: number[];
comparator: Comparator;
warningComparator?: Comparator;
diff --git a/x-pack/plugins/observability/tsconfig.json b/x-pack/plugins/observability/tsconfig.json
index 77f668338ba35..09e809d69542b 100644
--- a/x-pack/plugins/observability/tsconfig.json
+++ b/x-pack/plugins/observability/tsconfig.json
@@ -77,7 +77,9 @@
"@kbn/safer-lodash-set",
"@kbn/core-http-server",
"@kbn/cloud-chat-plugin",
- "@kbn/cloud-plugin"
+ "@kbn/cloud-plugin",
+ "@kbn/stack-alerts-plugin",
+ "@kbn/data-view-editor-plugin"
],
"exclude": [
"target/**/*"
diff --git a/x-pack/plugins/stack_alerts/public/index.ts b/x-pack/plugins/stack_alerts/public/index.ts
index d043883d6e248..da63456eca347 100644
--- a/x-pack/plugins/stack_alerts/public/index.ts
+++ b/x-pack/plugins/stack_alerts/public/index.ts
@@ -7,4 +7,6 @@
import { StackAlertsPublicPlugin } from './plugin';
+export { DataViewSelectPopover } from './rule_types/components/data_view_select_popover';
+
export const plugin = () => new StackAlertsPublicPlugin();
diff --git a/x-pack/plugins/stack_alerts/public/rule_types/components/data_view_select_popover.test.tsx b/x-pack/plugins/stack_alerts/public/rule_types/components/data_view_select_popover.test.tsx
index 78969e3e5dd21..b6729d9ab6395 100644
--- a/x-pack/plugins/stack_alerts/public/rule_types/components/data_view_select_popover.test.tsx
+++ b/x-pack/plugins/stack_alerts/public/rule_types/components/data_view_select_popover.test.tsx
@@ -8,7 +8,6 @@
import React from 'react';
import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
import { DataViewSelectPopover, DataViewSelectPopoverProps } from './data_view_select_popover';
-import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
import { dataViewPluginMocks } from '@kbn/data-views-plugin/public/mocks';
import type { DataView } from '@kbn/data-views-plugin/public';
import { indexPatternEditorPluginMock as dataViewEditorPluginMock } from '@kbn/data-view-editor-plugin/public/mocks';
@@ -24,12 +23,6 @@ const selectedDataView = {
getName: () => 'kibana_sample_data_logs',
} as unknown as DataView;
-const props: DataViewSelectPopoverProps = {
- onSelectDataView: () => {},
- onChangeMetaData: () => {},
- dataView: selectedDataView,
-};
-
const dataViewIds = ['mock-data-logs-id', 'mock-ecommerce-id', 'mock-test-id', 'mock-ad-hoc-id'];
const dataViewOptions = [
@@ -80,15 +73,15 @@ const mount = () => {
Promise.resolve(dataViewOptions.find((current) => current.id === id))
);
const dataViewEditorMock = dataViewEditorPluginMock.createStartContract();
+ const props: DataViewSelectPopoverProps = {
+ dependencies: { dataViews: dataViewsMock, dataViewEditor: dataViewEditorMock },
+ onSelectDataView: () => {},
+ onChangeMetaData: () => {},
+ dataView: selectedDataView,
+ };
return {
- wrapper: mountWithIntl(
-
-
- ),
+ wrapper: mountWithIntl( = ({
+ dependencies: { dataViews, dataViewEditor },
metadata = { adHocDataViewList: [], isManagementPage: true },
dataView,
onSelectDataView,
onChangeMetaData,
}) => {
- const { dataViews, dataViewEditor } = useTriggerUiActionServices();
const [dataViewItems, setDataViewsItems] = useState([]);
const [dataViewPopoverOpen, setDataViewPopoverOpen] = useState(false);
diff --git a/x-pack/plugins/stack_alerts/public/rule_types/es_query/expression/search_source_expression_form.tsx b/x-pack/plugins/stack_alerts/public/rule_types/es_query/expression/search_source_expression_form.tsx
index f2a6ca3a84cee..1cc45801ffe65 100644
--- a/x-pack/plugins/stack_alerts/public/rule_types/es_query/expression/search_source_expression_form.tsx
+++ b/x-pack/plugins/stack_alerts/public/rule_types/es_query/expression/search_source_expression_form.tsx
@@ -78,6 +78,7 @@ const isSearchSourceParam = (action: LocalStateAction): action is SearchSourcePa
export const SearchSourceExpressionForm = (props: SearchSourceExpressionFormProps) => {
const services = useTriggerUiActionServices();
const unifiedSearch = services.unifiedSearch;
+ const { dataViews, dataViewEditor } = useTriggerUiActionServices();
const { searchSource, errors, initialSavedQuery, setParam, ruleParams } = props;
const [savedQuery, setSavedQuery] = useState();
@@ -117,7 +118,7 @@ export const SearchSourceExpressionForm = (props: SearchSourceExpressionFormProp
);
const { index: dataView, query, filter: filters } = ruleConfiguration;
- const dataViews = useMemo(() => (dataView ? [dataView] : []), [dataView]);
+ const indexPatterns = useMemo(() => (dataView ? [dataView] : []), [dataView]);
const [esFields, setEsFields] = useState(
dataView ? convertFieldSpecToFieldOption(dataView.fields.map((field) => field.toSpec())) : []
@@ -296,6 +297,7 @@ export const SearchSourceExpressionForm = (props: SearchSourceExpressionFormProp
Date: Wed, 21 Jun 2023 05:21:16 -0700
Subject: [PATCH 14/31] [Security Solution] [Fix] [Performance] Alert Page
Controls should query only from Alert Index. (#157286)
## Summary
Handles : #157217
|Before|After|
|---|---|
| | |
---
.../alerts/detection_page_filters.cy.ts | 79 +++++++++++++++++--
.../cypress/screens/common/filter_group.ts | 6 ++
.../detection_page_filters/index.test.tsx | 39 +++++----
.../detection_page_filters/index.tsx | 48 ++++++-----
.../detection_engine/detection_engine.tsx | 3 -
5 files changed, 131 insertions(+), 44 deletions(-)
diff --git a/x-pack/plugins/security_solution/cypress/e2e/investigations/alerts/detection_page_filters.cy.ts b/x-pack/plugins/security_solution/cypress/e2e/investigations/alerts/detection_page_filters.cy.ts
index 3c231fb657630..6e77002c945dd 100644
--- a/x-pack/plugins/security_solution/cypress/e2e/investigations/alerts/detection_page_filters.cy.ts
+++ b/x-pack/plugins/security_solution/cypress/e2e/investigations/alerts/detection_page_filters.cy.ts
@@ -10,12 +10,15 @@ import { getNewRule } from '../../../objects/rule';
import {
CONTROL_FRAMES,
CONTROL_FRAME_TITLE,
+ CONTROL_POPOVER,
FILTER_GROUP_CHANGED_BANNER,
- FILTER_GROUP_EDIT_CONTROL_PANEL_ITEMS,
+ OPTION_IGNORED,
OPTION_LIST_LABELS,
OPTION_LIST_VALUES,
OPTION_SELECTABLE,
+ OPTION_SELECTABLE_COUNT,
FILTER_GROUP_CONTROL_ACTION_EDIT,
+ FILTER_GROUP_EDIT_CONTROL_PANEL_ITEMS,
} from '../../../screens/common/filter_group';
import { createRule } from '../../../tasks/api_calls/rules';
import { cleanKibana } from '../../../tasks/common';
@@ -26,15 +29,17 @@ import { formatPageFilterSearchParam } from '../../../../common/utils/format_pag
import {
closePageFilterPopover,
markAcknowledgedFirstAlert,
+ openFirstAlert,
openPageFilterPopover,
resetFilters,
selectCountTable,
+ togglePageFilterPopover,
visitAlertsPageWithCustomFilters,
waitForAlerts,
waitForPageFilters,
} from '../../../tasks/alerts';
-import { ALERTS_COUNT } from '../../../screens/alerts';
-import { navigateFromHeaderTo } from '../../../tasks/security_header';
+import { ALERTS_COUNT, ALERTS_REFRESH_BTN } from '../../../screens/alerts';
+import { kqlSearch, navigateFromHeaderTo } from '../../../tasks/security_header';
import { ALERTS, CASES } from '../../../screens/security_header';
import {
addNewFilterGroupControlValues,
@@ -45,6 +50,9 @@ import {
editFilterGroupControls,
saveFilterGroupControls,
} from '../../../tasks/common/filter_group';
+import { TOASTER } from '../../../screens/alerts_detection_rules';
+import { setEndDate, setStartDate } from '../../../tasks/date_picker';
+import { fillAddFilterForm, openAddFilterPopover } from '../../../tasks/search_bar';
const customFilters = [
{
@@ -233,13 +241,21 @@ describe('Detections : Page Filters', () => {
markAcknowledgedFirstAlert();
waitForAlerts();
cy.get(OPTION_LIST_VALUES(0)).click();
- cy.get(OPTION_SELECTABLE(0, 'acknowledged')).should('be.visible');
+ cy.get(OPTION_SELECTABLE(0, 'acknowledged')).should('be.visible').trigger('click');
cy.get(ALERTS_COUNT)
.invoke('text')
.should((newAlertCount) => {
expect(newAlertCount.split(' ')[0]).eq(String(parseInt(originalAlertCount, 10) - 1));
});
});
+
+ // cleanup
+ // revert the changes so that data does not change for further tests.
+ // It would make sure that tests can run in any order.
+ cy.get(OPTION_SELECTABLE(0, 'open')).trigger('click');
+ togglePageFilterPopover(0);
+ openFirstAlert();
+ waitForAlerts();
});
it(`URL is updated when filters are updated`, () => {
@@ -256,14 +272,14 @@ describe('Detections : Page Filters', () => {
openPageFilterPopover(1);
cy.get(OPTION_SELECTABLE(1, 'high')).should('be.visible');
- cy.get(OPTION_SELECTABLE(1, 'high')).click({ force: true });
+ cy.get(OPTION_SELECTABLE(1, 'high')).click({});
closePageFilterPopover(1);
});
it(`Filters are restored from localstorage when user navigates back to the page.`, () => {
cy.get(OPTION_LIST_VALUES(1)).click();
cy.get(OPTION_SELECTABLE(1, 'high')).should('be.visible');
- cy.get(OPTION_SELECTABLE(1, 'high')).click({ force: true });
+ cy.get(OPTION_SELECTABLE(1, 'high')).click({});
// high should be scuccessfully selected.
cy.get(OPTION_LIST_VALUES(1)).contains('high');
@@ -311,6 +327,57 @@ describe('Detections : Page Filters', () => {
cy.get(FILTER_GROUP_CHANGED_BANNER).should('not.exist');
});
+ context('Impact of inputs', () => {
+ afterEach(() => {
+ resetFilters();
+ });
+ it('should recover from invalide kql Query result', () => {
+ // do an invalid search
+ //
+ kqlSearch('\\');
+ cy.get(ALERTS_REFRESH_BTN).trigger('click');
+ waitForPageFilters();
+ cy.get(TOASTER).should('contain.text', 'KQLSyntaxError');
+ togglePageFilterPopover(0);
+ cy.get(OPTION_SELECTABLE(0, 'open')).should('be.visible');
+ cy.get(OPTION_SELECTABLE(0, 'open')).should('contain.text', 'open');
+ cy.get(OPTION_SELECTABLE(0, 'open')).get(OPTION_SELECTABLE_COUNT).should('have.text', 2);
+ });
+
+ it('should take kqlQuery into account', () => {
+ kqlSearch('kibana.alert.workflow_status: "nothing"');
+ cy.get(ALERTS_REFRESH_BTN).trigger('click');
+ waitForPageFilters();
+ togglePageFilterPopover(0);
+ cy.get(CONTROL_POPOVER(0)).should('contain.text', 'No options found');
+ cy.get(OPTION_IGNORED(0, 'open')).should('be.visible');
+ });
+
+ it('should take filters into account', () => {
+ openAddFilterPopover();
+ fillAddFilterForm({
+ key: 'kibana.alert.workflow_status',
+ value: 'invalid',
+ });
+ waitForPageFilters();
+ togglePageFilterPopover(0);
+ cy.get(CONTROL_POPOVER(0)).should('contain.text', 'No options found');
+ cy.get(OPTION_IGNORED(0, 'open')).should('be.visible');
+ });
+ it('should take timeRange into account', () => {
+ const startDateWithZeroAlerts = 'Jan 1, 2002 @ 00:00:00.000';
+ const endDateWithZeroAlerts = 'Jan 1, 2010 @ 00:00:00.000';
+
+ setStartDate(startDateWithZeroAlerts);
+ setEndDate(endDateWithZeroAlerts);
+
+ cy.get(ALERTS_REFRESH_BTN).trigger('click');
+ waitForPageFilters();
+ togglePageFilterPopover(0);
+ cy.get(CONTROL_POPOVER(0)).should('contain.text', 'No options found');
+ cy.get(OPTION_IGNORED(0, 'open')).should('be.visible');
+ });
+ });
it('Number fields are not visible in field edit panel', () => {
const idx = 3;
const { FILTER_FIELD_TYPE, FIELD_TYPES } = FILTER_GROUP_EDIT_CONTROL_PANEL_ITEMS;
diff --git a/x-pack/plugins/security_solution/cypress/screens/common/filter_group.ts b/x-pack/plugins/security_solution/cypress/screens/common/filter_group.ts
index e33ed8ca11a3d..ab56bee03a34b 100644
--- a/x-pack/plugins/security_solution/cypress/screens/common/filter_group.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/common/filter_group.ts
@@ -36,6 +36,12 @@ export const OPTION_SELECTABLE = (popoverIndex: number, value: string) =>
export const OPTION_IGNORED = (popoverIndex: number, value: string) =>
`#control-popover-${popoverIndex} [data-test-subj="optionsList-control-ignored-selection-${value}"]`;
+export const OPTION_SELECTABLE_COUNT = getDataTestSubjectSelector(
+ 'optionsList-document-count-badge'
+);
+
+export const CONTROL_POPOVER = (popoverIdx: number) => `#control-popover-${popoverIdx}`;
+
export const DETECTION_PAGE_FILTER_GROUP_WRAPPER = '.filter-group__wrapper';
export const DETECTION_PAGE_FILTERS_LOADING = '.securityPageWrapper .controlFrame--controlLoading';
diff --git a/x-pack/plugins/security_solution/public/detections/components/detection_page_filters/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/detection_page_filters/index.test.tsx
index 1035f08bb902f..984e19a879637 100644
--- a/x-pack/plugins/security_solution/public/detections/components/detection_page_filters/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/detection_page_filters/index.test.tsx
@@ -33,6 +33,8 @@ const mockedDataViewServiceGetter = jest.fn(() => {
} as unknown as DataView);
});
+const mockDataViewCreator = jest.fn();
+
const getKibanaServiceWithMockedGetter = (
mockedDataViewGetter: DataViewsServicePublic['get'] = mockedDataViewServiceGetter
) => {
@@ -42,6 +44,7 @@ const getKibanaServiceWithMockedGetter = (
...basicKibanaServicesMock.dataViews,
clearInstanceCache: jest.fn(),
get: mockedDataViewGetter,
+ create: mockDataViewCreator,
},
};
};
@@ -55,7 +58,6 @@ const TestComponent = (props: Partial
, 'initialControls'>;
+type FilterItemSetProps = Omit<
+ ComponentProps,
+ 'initialControls' | 'dataViewId'
+>;
+
+const SECURITY_ALERT_DATA_VIEW = {
+ id: 'security_solution_alerts_dv',
+ name: 'Security Solution Alerts DataView',
+};
const FilterItemSetComponent = (props: FilterItemSetProps) => {
- const { dataViewId, onFilterChange, ...restFilterItemGroupProps } = props;
+ const { onFilterChange, ...restFilterItemGroupProps } = props;
+
+ const {
+ indexPattern: { title },
+ dataViewId,
+ } = useSourcererDataView(SourcererScopeName.detections);
const [loadingPageFilters, setLoadingPageFilters] = useState(true);
@@ -27,24 +42,21 @@ const FilterItemSetComponent = (props: FilterItemSetProps) => {
} = useKibana();
useEffect(() => {
- // this makes sure, that if fields are not present in existing copy of the
- // dataView, clear the cache before filter group is loaded. This is only
- // applicable to `alert` page as new alert mappings are added when first alert
- // is encountered
(async () => {
- const dataView = await dataViewService.get(dataViewId ?? '');
- if (!dataView) return;
- for (const filter of DEFAULT_DETECTION_PAGE_FILTERS) {
- const fieldExists = dataView.getFieldByName(filter.fieldName);
- if (!fieldExists) {
- dataViewService.clearInstanceCache(dataViewId ?? '');
- setLoadingPageFilters(false);
- return;
- }
- }
+ // creates an adhoc dataview if it does not already exists just for alert index
+ const { timeFieldName = '@timestamp' } = await dataViewService.get(dataViewId ?? '');
+ await dataViewService.create({
+ id: SECURITY_ALERT_DATA_VIEW.id,
+ name: SECURITY_ALERT_DATA_VIEW.name,
+ title,
+ allowNoIndex: true,
+ timeFieldName,
+ });
setLoadingPageFilters(false);
})();
- }, [dataViewId, dataViewService]);
+
+ return () => dataViewService.clearInstanceCache();
+ }, [title, dataViewService, dataViewId]);
const [initialFilterControls] = useState(DEFAULT_DETECTION_PAGE_FILTERS);
@@ -78,7 +90,7 @@ const FilterItemSetComponent = (props: FilterItemSetProps) => {
return (
= ({
const {
indexPattern,
runtimeMappings,
- dataViewId,
loading: isLoadingIndexPattern,
} = useSourcererDataView(SourcererScopeName.detections);
@@ -351,7 +350,6 @@ const DetectionEnginePageComponent: React.FC = ({
) : (
= ({
[
topLevelFilters,
arePageFiltersEnabled,
- dataViewId,
statusFilter,
onFilterGroupChangedCallback,
pageFiltersUpdateHandler,
From de3f8fca009f6c22bcaf3ab20d2beea8ffd7e549 Mon Sep 17 00:00:00 2001
From: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com>
Date: Wed, 21 Jun 2023 15:00:25 +0200
Subject: [PATCH 15/31] [Cases] Limit perPage param in findComments API
(#160042)
## Summary
This PR limits `perPage` param to 100 in `findComments` API.
### Checklist
- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---------
Co-authored-by: lcawl
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
.../cases/case-apis-passthru.asciidoc | 2 +-
.../plugins/cases/common/constants/index.ts | 1 +
.../plugins/cases/docs/openapi/bundled.json | 10 +++++++++-
.../plugins/cases/docs/openapi/bundled.yaml | 9 ++++++++-
...id}@api@cases@{caseid}@comments@_find.yaml | 9 ++++++++-
.../server/client/attachments/get.test.ts | 10 +++++++++-
.../client/attachments/validators.test.ts | 19 ++++++++++++++++---
.../server/client/attachments/validators.ts | 10 ++++++++--
.../tests/common/cases/delete_cases.ts | 10 +++++-----
.../tests/common/comments/find_comments.ts | 2 +-
10 files changed, 66 insertions(+), 16 deletions(-)
diff --git a/docs/api-generated/cases/case-apis-passthru.asciidoc b/docs/api-generated/cases/case-apis-passthru.asciidoc
index d0e7a67c50660..f007882af237c 100644
--- a/docs/api-generated/cases/case-apis-passthru.asciidoc
+++ b/docs/api-generated/cases/case-apis-passthru.asciidoc
@@ -556,7 +556,7 @@ Any modifications made to this file will be overwritten.
Query Parameter — The page number to return. default: 1 perPage (optional)
- Query Parameter — The number of items to return. default: 20 sortOrder (optional)
+ Query Parameter — The number of items to return. Limited to 100 items. default: 20 sortOrder (optional)
Query Parameter — Determines the sort order. default: desc
diff --git a/x-pack/plugins/cases/common/constants/index.ts b/x-pack/plugins/cases/common/constants/index.ts
index 33473a9c80bfd..1a49de004e73f 100644
--- a/x-pack/plugins/cases/common/constants/index.ts
+++ b/x-pack/plugins/cases/common/constants/index.ts
@@ -104,6 +104,7 @@ export const MAX_DOCS_PER_PAGE = 10000 as const;
export const MAX_BULK_GET_ATTACHMENTS = MAX_DOCS_PER_PAGE;
export const MAX_CONCURRENT_SEARCHES = 10 as const;
export const MAX_BULK_GET_CASES = 1000 as const;
+export const MAX_COMMENTS_PER_PAGE = 100 as const;
export const MAX_CATEGORY_FILTER_LENGTH = 100 as const;
/**
diff --git a/x-pack/plugins/cases/docs/openapi/bundled.json b/x-pack/plugins/cases/docs/openapi/bundled.json
index 92dcfe5779306..78ba5444f40aa 100644
--- a/x-pack/plugins/cases/docs/openapi/bundled.json
+++ b/x-pack/plugins/cases/docs/openapi/bundled.json
@@ -1852,7 +1852,15 @@
"$ref": "#/components/parameters/page_index"
},
{
- "$ref": "#/components/parameters/page_size"
+ "name": "perPage",
+ "in": "query",
+ "description": "The number of items to return. Limited to 100 items.",
+ "required": false,
+ "schema": {
+ "type": "integer",
+ "default": 20,
+ "maximum": 100
+ }
},
{
"$ref": "#/components/parameters/sort_order"
diff --git a/x-pack/plugins/cases/docs/openapi/bundled.yaml b/x-pack/plugins/cases/docs/openapi/bundled.yaml
index 3d53916c89df8..405cf4fb689f0 100644
--- a/x-pack/plugins/cases/docs/openapi/bundled.yaml
+++ b/x-pack/plugins/cases/docs/openapi/bundled.yaml
@@ -1156,7 +1156,14 @@ paths:
parameters:
- $ref: '#/components/parameters/case_id'
- $ref: '#/components/parameters/page_index'
- - $ref: '#/components/parameters/page_size'
+ - name: perPage
+ in: query
+ description: The number of items to return. Limited to 100 items.
+ required: false
+ schema:
+ type: integer
+ default: 20
+ maximum: 100
- $ref: '#/components/parameters/sort_order'
- $ref: '#/components/parameters/space_id'
responses:
diff --git a/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@comments@_find.yaml b/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@comments@_find.yaml
index b1dd32a659515..bb43f4dcc0b26 100644
--- a/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@comments@_find.yaml
+++ b/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@comments@_find.yaml
@@ -10,7 +10,14 @@ get:
parameters:
- $ref: '../components/parameters/case_id.yaml'
- $ref: '../components/parameters/page_index.yaml'
- - $ref: '../components/parameters/page_size.yaml'
+ - name: perPage
+ in: query
+ description: The number of items to return. Limited to 100 items.
+ required: false
+ schema:
+ type: integer
+ default: 20
+ maximum: 100
- $ref: '../components/parameters/sort_order.yaml'
- $ref: '../components/parameters/space_id.yaml'
responses:
diff --git a/x-pack/plugins/cases/server/client/attachments/get.test.ts b/x-pack/plugins/cases/server/client/attachments/get.test.ts
index 250cfa9f0b252..c2c3423b2388b 100644
--- a/x-pack/plugins/cases/server/client/attachments/get.test.ts
+++ b/x-pack/plugins/cases/server/client/attachments/get.test.ts
@@ -18,12 +18,20 @@ describe('get', () => {
it('Invalid total items results in error', async () => {
await expect(() =>
- findComment({ caseID: 'mock-id', findQueryParams: { page: 2, perPage: 9001 } }, clientArgs)
+ findComment({ caseID: 'mock-id', findQueryParams: { page: 209, perPage: 100 } }, clientArgs)
).rejects.toThrowErrorMatchingInlineSnapshot(
`"Failed to find comments case id: mock-id: Error: The number of documents is too high. Paginating through more than 10,000 documents is not possible."`
);
});
+ it('Invalid perPage items results in error', async () => {
+ await expect(() =>
+ findComment({ caseID: 'mock-id', findQueryParams: { page: 2, perPage: 9001 } }, clientArgs)
+ ).rejects.toThrowErrorMatchingInlineSnapshot(
+ `"Failed to find comments case id: mock-id: Error: The provided perPage value was too high. The maximum allowed perPage value is 100."`
+ );
+ });
+
it('throws with excess fields', async () => {
await expect(
findComment(
diff --git a/x-pack/plugins/cases/server/client/attachments/validators.test.ts b/x-pack/plugins/cases/server/client/attachments/validators.test.ts
index 4626fd13fba35..ce6c43a665a10 100644
--- a/x-pack/plugins/cases/server/client/attachments/validators.test.ts
+++ b/x-pack/plugins/cases/server/client/attachments/validators.test.ts
@@ -6,10 +6,13 @@
*/
import { validateFindCommentsPagination } from './validators';
+import { MAX_COMMENTS_PER_PAGE } from '../../../common/constants';
const ERROR_MSG =
'The number of documents is too high. Paginating through more than 10,000 documents is not possible.';
+const ERROR_MSG_PER_PAGE = `The provided perPage value was too high. The maximum allowed perPage value is ${MAX_COMMENTS_PER_PAGE}.`;
+
describe('validators', () => {
describe('validateFindCommentsPagination', () => {
it('does not throw if only page is undefined', () => {
@@ -20,20 +23,30 @@ describe('validators', () => {
expect(() => validateFindCommentsPagination({ page: 100 })).not.toThrowError();
});
+ it('does not throw if page and perPage are defined and valid', () => {
+ expect(() => validateFindCommentsPagination({ page: 2, perPage: 100 })).not.toThrowError();
+ });
+
it('returns if page and perPage are undefined', () => {
expect(() => validateFindCommentsPagination({})).not.toThrowError();
});
+ it('returns if perPage < 0', () => {
+ expect(() => validateFindCommentsPagination({ perPage: -1 })).not.toThrowError();
+ });
+
it('throws if page > 10k', () => {
expect(() => validateFindCommentsPagination({ page: 10001 })).toThrow(ERROR_MSG);
});
- it('throws if perPage > 10k', () => {
- expect(() => validateFindCommentsPagination({ perPage: 10001 })).toThrowError(ERROR_MSG);
+ it('throws if perPage > 100', () => {
+ expect(() =>
+ validateFindCommentsPagination({ perPage: MAX_COMMENTS_PER_PAGE + 1 })
+ ).toThrowError(ERROR_MSG_PER_PAGE);
});
it('throws if page * perPage > 10k', () => {
- expect(() => validateFindCommentsPagination({ page: 10, perPage: 1001 })).toThrow(ERROR_MSG);
+ expect(() => validateFindCommentsPagination({ page: 101, perPage: 100 })).toThrow(ERROR_MSG);
});
});
});
diff --git a/x-pack/plugins/cases/server/client/attachments/validators.ts b/x-pack/plugins/cases/server/client/attachments/validators.ts
index 770d9d8e88c0f..ea38fa71e702a 100644
--- a/x-pack/plugins/cases/server/client/attachments/validators.ts
+++ b/x-pack/plugins/cases/server/client/attachments/validators.ts
@@ -6,7 +6,7 @@
*/
import Boom from '@hapi/boom';
-import { MAX_DOCS_PER_PAGE } from '../../../common/constants';
+import { MAX_DOCS_PER_PAGE, MAX_COMMENTS_PER_PAGE } from '../../../common/constants';
import {
isCommentRequestTypeExternalReference,
isCommentRequestTypePersistableState,
@@ -51,7 +51,13 @@ export const validateFindCommentsPagination = (params?: FindCommentsQueryParams)
const pageAsNumber = params.page ?? 0;
const perPageAsNumber = params.perPage ?? 0;
- if (Math.max(pageAsNumber, perPageAsNumber, pageAsNumber * perPageAsNumber) > MAX_DOCS_PER_PAGE) {
+ if (perPageAsNumber > MAX_COMMENTS_PER_PAGE) {
+ throw Boom.badRequest(
+ `The provided perPage value was too high. The maximum allowed perPage value is ${MAX_COMMENTS_PER_PAGE}.`
+ );
+ }
+
+ if (Math.max(pageAsNumber, pageAsNumber * perPageAsNumber) > MAX_DOCS_PER_PAGE) {
throw Boom.badRequest(
'The number of documents is too high. Paginating through more than 10,000 documents is not possible.'
);
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts
index 267f5472e6ebb..6da8cfccf1352 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts
@@ -7,7 +7,7 @@
import expect from '@kbn/expect';
import type SuperTest from 'supertest';
-import { MAX_DOCS_PER_PAGE } from '@kbn/cases-plugin/common/constants';
+import { MAX_COMMENTS_PER_PAGE } from '@kbn/cases-plugin/common/constants';
import {
Alerts,
createCaseAttachAlertAndDeleteCase,
@@ -170,7 +170,7 @@ export default ({ getService }: FtrProviderContext): void => {
supertest: supertestWithoutAuth,
caseId: postedCase.id,
query: {
- perPage: MAX_DOCS_PER_PAGE,
+ perPage: MAX_COMMENTS_PER_PAGE,
},
}),
]);
@@ -210,14 +210,14 @@ export default ({ getService }: FtrProviderContext): void => {
supertest: supertestWithoutAuth,
caseId: postedCase1.id,
query: {
- perPage: MAX_DOCS_PER_PAGE,
+ perPage: MAX_COMMENTS_PER_PAGE,
},
}),
findAttachments({
supertest: supertestWithoutAuth,
caseId: postedCase2.id,
query: {
- perPage: MAX_DOCS_PER_PAGE,
+ perPage: MAX_COMMENTS_PER_PAGE,
},
}),
]);
@@ -457,7 +457,7 @@ export default ({ getService }: FtrProviderContext): void => {
supertest: supertestWithoutAuth,
caseId: postedCase.id,
query: {
- perPage: MAX_DOCS_PER_PAGE,
+ perPage: MAX_COMMENTS_PER_PAGE,
},
auth: { user: secAllUser, space: 'space1' },
}),
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/find_comments.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/find_comments.ts
index a218350ec95ca..761959db29f66 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/find_comments.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/find_comments.ts
@@ -114,7 +114,7 @@ export default ({ getService }: FtrProviderContext): void => {
{ name: 'field is wrong type', queryParams: { perPage: true } },
{ name: 'field is unknown', queryParams: { foo: 'bar' } },
{ name: 'page > 10k', queryParams: { page: 10001 } },
- { name: 'perPage > 10k', queryParams: { perPage: 10001 } },
+ { name: 'perPage > 100', queryParams: { perPage: 101 } },
{ name: 'page * perPage > 10k', queryParams: { page: 2, perPage: 9001 } },
]) {
it(`400s when ${errorScenario.name}`, async () => {
From dba2e9ba2c720e3b96dea4d301e2e2229361c94b Mon Sep 17 00:00:00 2001
From: Khristinin Nikita
Date: Wed, 21 Jun 2023 15:14:03 +0200
Subject: [PATCH 16/31] RiskScoreEndgineData client + install ds and other
resources for risk scoring (#158422)
## Risc score resources bootstrap
ES PR: https://github.com/elastic/elasticsearch/pull/96348
This PR introduces RiskEngineDataClient, which purpose to install
resources per namespace, including ilm policy, component template, index
template and datastream for risk score.
Some view demo/overview of the steps we do to initialise
RiskEngineDataClient and resources
https://github.com/elastic/kibana/assets/7609147/bf72bbb4-56f6-46be-9b89-c96e9f33b354
For default space, it installs indexes when the security_soluition
plugin is set up.
For other spaces, it initialises the resource when you call `getWriter`.
This data client was passed to `RequestContextFactory`
So in any request, it can be called like
```
const riskEngineDataClient = (await context.securitySolution).getRiskEngineDataClient();
const spaceId = (await context.securitySolution).getSpaceId();
const riskEngineDataClientWriter = riskEngineDataClient.getWriter({ namespace: spaceId });
```
### What is generated
1. ILM policy
`GET _ilm/policy/.risk-score-ilm-policy`
```
{
".risk-score-ilm-policy": {
"version": 1,
"modified_date": "2023-05-25T10:52:36.592Z",
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_age": "30d",
"max_primary_shard_size": "50gb"
}
}
}
},
"_meta": {
"managed": true
}
},
"in_use_by": {
"indices": [
".ds-risk-score.risk-score-default-2023.05.25-000001"
],
"data_streams": [
"risk-score.risk-score-default"
],
"composable_templates": [
".risk-score.risk-score-default-index-template"
]
}
}
}
```
2. Component template for risk score mappings
`GET _component_template/risk-score-mappings`
```
{
"component_templates": [
{
"name": "risk-score-mappings",
"component_template": {
"template": {
"settings": {},
"mappings": {
"dynamic": "strict",
"properties": {
"identifierField": {
"type": "keyword"
},
"otherScore": {
"type": "float"
},
"alertsScore": {
"type": "float"
},
"@timestamp": {
"type": "date"
},
"level": {
"type": "keyword"
},
"riskiestInputs": {
"type": "nested",
"properties": {
"index": {
"type": "keyword"
},
"id": {
"type": "keyword"
},
"riskScore": {
"type": "float"
}
}
},
"identifierValue": {
"type": "keyword"
},
"totalScore": {
"type": "float"
},
"totalScoreNormalized": {
"type": "float"
}
}
}
},
"_meta": {
"managed": true
}
}
}
]
}
```
3. Index template
`GET _index_template/.risk-score.risk-score-default-index-template`
```
{
"index_templates": [
{
"name": ".risk-score.risk-score-default-index-template",
"index_template": {
"index_patterns": [
"risk-score.risk-score-default"
],
"template": {
"settings": {
"index": {
"lifecycle": {
"name": ".risk-score-ilm-policy"
},
"mapping": {
"total_fields": {
"limit": "1000"
}
},
"hidden": "true",
"auto_expand_replicas": "0-1"
}
},
"mappings": {
"_meta": {
"managed": true,
"namespace": "default",
"kibana": {
"version": "8.9.0"
}
},
"dynamic": false
}
},
"composed_of": [
"risk-score-mappings"
],
"_meta": {
"managed": true,
"namespace": "default",
"kibana": {
"version": "8.9.0"
}
},
"data_stream": {
"hidden": true,
"allow_custom_routing": false
}
}
}
]
}
```
4. Data stream
`GET risk-score.risk-score-default` - where is `default` is space name
return
```
{
".ds-risk-score.risk-score-default-2023.05.25-000001": {
"aliases": {},
"mappings": {
"dynamic": "false",
"_meta": {
"namespace": "default",
"kibana": {
"version": "8.9.0"
},
"managed": true
},
"_data_stream_timestamp": {
"enabled": true
},
"properties": {
"@timestamp": {
"type": "date"
},
"alertsScore": {
"type": "float"
},
"identifierField": {
"type": "keyword"
},
"identifierValue": {
"type": "keyword"
},
"level": {
"type": "keyword"
},
"otherScore": {
"type": "float"
},
"riskiestInputs": {
"type": "nested",
"properties": {
"id": {
"type": "keyword"
},
"index": {
"type": "keyword"
},
"riskScore": {
"type": "float"
}
}
},
"totalScore": {
"type": "float"
},
"totalScoreNormalized": {
"type": "float"
}
}
},
"settings": {
"index": {
"lifecycle": {
"name": ".risk-engine-ilm-policy"
},
"routing": {
"allocation": {
"include": {
"_tier_preference": "data_hot"
}
}
},
"mapping": {
"total_fields": {
"limit": "1000"
}
},
"hidden": "true",
"number_of_shards": "1",
"auto_expand_replicas": "0-1",
"provided_name": ".ds-risk-score.risk-score-default-2023.05.25-000001",
"creation_date": "1685009904171",
"number_of_replicas": "0",
"uuid": "_5yc7wG4Sxy88zIVqxC7yg",
"version": {
"created": "8090099"
}
}
},
"data_stream": "risk-score.risk-score-default"
}
}
```
---------
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
.../common/experimental_features.ts | 5 +
.../routes/__mocks__/request_context.ts | 3 +
.../__mocks__/risk_engine_data_client_mock.ts | 16 ++
.../server/lib/risk_engine/configurations.ts | 97 ++++++++
.../risk_engine_data_client.test.ts | 218 ++++++++++++++++++
.../risk_engine/risk_engine_data_client.ts | 142 ++++++++++++
.../risk_engine/utils/create_datastream.ts | 206 +++++++++++++++++
.../utils/retry_transient_es_errors.test.ts | 95 ++++++++
.../utils/retry_transient_es_errors.ts | 58 +++++
.../security_solution/server/plugin.ts | 16 ++
.../server/request_context_factory.ts | 14 +-
.../plugins/security_solution/server/types.ts | 2 +
.../common/config.ts | 1 +
.../security_and_spaces/group10/index.ts | 1 +
.../group10/risk_engine_install_resources.ts | 150 ++++++++++++
15 files changed, 1023 insertions(+), 1 deletion(-)
create mode 100644 x-pack/plugins/security_solution/server/lib/risk_engine/__mocks__/risk_engine_data_client_mock.ts
create mode 100644 x-pack/plugins/security_solution/server/lib/risk_engine/configurations.ts
create mode 100644 x-pack/plugins/security_solution/server/lib/risk_engine/risk_engine_data_client.test.ts
create mode 100644 x-pack/plugins/security_solution/server/lib/risk_engine/risk_engine_data_client.ts
create mode 100644 x-pack/plugins/security_solution/server/lib/risk_engine/utils/create_datastream.ts
create mode 100644 x-pack/plugins/security_solution/server/lib/risk_engine/utils/retry_transient_es_errors.test.ts
create mode 100644 x-pack/plugins/security_solution/server/lib/risk_engine/utils/retry_transient_es_errors.ts
create mode 100644 x-pack/test/detection_engine_api_integration/security_and_spaces/group10/risk_engine_install_resources.ts
diff --git a/x-pack/plugins/security_solution/common/experimental_features.ts b/x-pack/plugins/security_solution/common/experimental_features.ts
index 079ad8434f445..dd00c9b3ab190 100644
--- a/x-pack/plugins/security_solution/common/experimental_features.ts
+++ b/x-pack/plugins/security_solution/common/experimental_features.ts
@@ -117,6 +117,11 @@ export const allowedExperimentalValues = Object.freeze({
*/
detectionsCoverageOverview: false,
+ /**
+ * Enable risk engine client and initialisation of datastream, component templates and mappings
+ */
+ riskScoringPersistence: false,
+
/**
* Enables experimental Entity Analytics HTTP endpoints
*/
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_context.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_context.ts
index 94e688a4db079..f45a57208e915 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_context.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_context.ts
@@ -34,6 +34,7 @@ import type {
import { getEndpointAuthzInitialStateMock } from '../../../../../common/endpoint/service/authz/mocks';
import type { EndpointAuthz } from '../../../../../common/endpoint/types/authz';
+import { riskEngineDataClientMock } from '../../../risk_engine/__mocks__/risk_engine_data_client_mock';
export const createMockClients = () => {
const core = coreMock.createRequestHandlerContext();
@@ -61,6 +62,7 @@ export const createMockClients = () => {
detectionEngineHealthClient: detectionEngineHealthClientMock.create(),
ruleExecutionLog: ruleExecutionLogMock.forRoutes.create(),
+ riskEngineDataClient: riskEngineDataClientMock.create(),
};
};
@@ -139,6 +141,7 @@ const createSecuritySolutionRequestContextMock = (
// TODO: Mock EndpointInternalFleetServicesInterface and return the mocked object.
throw new Error('Not implemented');
}),
+ getRiskEngineDataClient: jest.fn(() => clients.riskEngineDataClient),
};
};
diff --git a/x-pack/plugins/security_solution/server/lib/risk_engine/__mocks__/risk_engine_data_client_mock.ts b/x-pack/plugins/security_solution/server/lib/risk_engine/__mocks__/risk_engine_data_client_mock.ts
new file mode 100644
index 0000000000000..0e9f1fade7bb6
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/risk_engine/__mocks__/risk_engine_data_client_mock.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RiskEngineDataClient } from '../risk_engine_data_client';
+
+const createRiskEngineDataClientMock = () =>
+ ({
+ getWriter: jest.fn(),
+ initializeResources: jest.fn(),
+ } as unknown as jest.Mocked);
+
+export const riskEngineDataClientMock = { create: createRiskEngineDataClientMock };
diff --git a/x-pack/plugins/security_solution/server/lib/risk_engine/configurations.ts b/x-pack/plugins/security_solution/server/lib/risk_engine/configurations.ts
new file mode 100644
index 0000000000000..64b31b2c705a5
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/risk_engine/configurations.ts
@@ -0,0 +1,97 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { FieldMap } from '@kbn/alerts-as-data-utils';
+import type { IIndexPatternString } from './utils/create_datastream';
+
+export const ilmPolicy = {
+ _meta: {
+ managed: true,
+ },
+ phases: {
+ hot: {
+ actions: {
+ rollover: {
+ max_age: '30d',
+ max_primary_shard_size: '50gb',
+ },
+ },
+ },
+ },
+};
+
+export const riskFieldMap: FieldMap = {
+ '@timestamp': {
+ type: 'date',
+ array: false,
+ required: false,
+ },
+ identifierField: {
+ type: 'keyword',
+ array: false,
+ required: false,
+ },
+ identifierValue: {
+ type: 'keyword',
+ array: false,
+ required: false,
+ },
+ level: {
+ type: 'keyword',
+ array: false,
+ required: false,
+ },
+ totalScore: {
+ type: 'float',
+ array: false,
+ required: false,
+ },
+ totalScoreNormalized: {
+ type: 'float',
+ array: false,
+ required: false,
+ },
+ alertsScore: {
+ type: 'float',
+ array: false,
+ required: false,
+ },
+ otherScore: {
+ type: 'float',
+ array: false,
+ required: false,
+ },
+ riskiestInputs: {
+ type: 'nested',
+ required: false,
+ },
+ 'riskiestInputs.id': {
+ type: 'keyword',
+ array: false,
+ required: false,
+ },
+ 'riskiestInputs.index': {
+ type: 'keyword',
+ array: false,
+ required: false,
+ },
+ 'riskiestInputs.riskScore': {
+ type: 'float',
+ array: false,
+ required: false,
+ },
+} as const;
+
+export const ilmPolicyName = '.risk-score-ilm-policy';
+export const mappingComponentName = '.risk-score-mappings';
+export const totalFieldsLimit = 1000;
+
+const riskScoreBaseIndexName = 'risk-score';
+
+export const getIndexPattern = (namespace: string): IIndexPatternString => ({
+ template: `.${riskScoreBaseIndexName}.${riskScoreBaseIndexName}-${namespace}-index-template`,
+ alias: `${riskScoreBaseIndexName}.${riskScoreBaseIndexName}-${namespace}`,
+});
diff --git a/x-pack/plugins/security_solution/server/lib/risk_engine/risk_engine_data_client.test.ts b/x-pack/plugins/security_solution/server/lib/risk_engine/risk_engine_data_client.test.ts
new file mode 100644
index 0000000000000..391d89b2ebf8b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/risk_engine/risk_engine_data_client.test.ts
@@ -0,0 +1,218 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+ createOrUpdateComponentTemplate,
+ createOrUpdateIlmPolicy,
+ createOrUpdateIndexTemplate,
+} from '@kbn/alerting-plugin/server';
+import { loggingSystemMock, elasticsearchServiceMock } from '@kbn/core/server/mocks';
+import { RiskEngineDataClient } from './risk_engine_data_client';
+import { createDataStream } from './utils/create_datastream';
+
+jest.mock('@kbn/alerting-plugin/server', () => ({
+ createOrUpdateComponentTemplate: jest.fn(),
+ createOrUpdateIlmPolicy: jest.fn(),
+ createOrUpdateIndexTemplate: jest.fn(),
+}));
+
+jest.mock('./utils/create_datastream', () => ({
+ createDataStream: jest.fn(),
+}));
+
+describe('RiskEngineDataClient', () => {
+ let riskEngineDataClient: RiskEngineDataClient;
+ let logger: ReturnType;
+ const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+ const totalFieldsLimit = 1000;
+
+ beforeEach(() => {
+ logger = loggingSystemMock.createLogger();
+ const options = {
+ logger,
+ kibanaVersion: '8.9.0',
+ elasticsearchClientPromise: Promise.resolve(esClient),
+ };
+ riskEngineDataClient = new RiskEngineDataClient(options);
+ });
+
+ afterEach(() => {
+ jest.clearAllMocks();
+ });
+
+ describe('getWriter', () => {
+ it('should return a writer object', async () => {
+ const writer = await riskEngineDataClient.getWriter({ namespace: 'default' });
+ expect(writer).toBeDefined();
+ expect(typeof writer?.bulk).toBe('function');
+ });
+
+ it('should cache and return the same writer for the same namespace', async () => {
+ const writer1 = await riskEngineDataClient.getWriter({ namespace: 'default' });
+ const writer2 = await riskEngineDataClient.getWriter({ namespace: 'default' });
+ const writer3 = await riskEngineDataClient.getWriter({ namespace: 'space-1' });
+
+ expect(writer1).toEqual(writer2);
+ expect(writer2).not.toEqual(writer3);
+ });
+
+ it('should cache writer and not call initializeResources for a second tme', async () => {
+ const initializeResourcesSpy = jest.spyOn(riskEngineDataClient, 'initializeResources');
+ await riskEngineDataClient.getWriter({ namespace: 'default' });
+ await riskEngineDataClient.getWriter({ namespace: 'default' });
+ expect(initializeResourcesSpy).toHaveBeenCalledTimes(1);
+ });
+ });
+
+ describe('initializeResources succes', () => {
+ it('should initialize risk engine resources', async () => {
+ await riskEngineDataClient.initializeResources({ namespace: 'default' });
+
+ expect(createOrUpdateIlmPolicy).toHaveBeenCalledWith({
+ logger,
+ esClient,
+ name: '.risk-score-ilm-policy',
+ policy: {
+ _meta: {
+ managed: true,
+ },
+ phases: {
+ hot: {
+ actions: {
+ rollover: {
+ max_age: '30d',
+ max_primary_shard_size: '50gb',
+ },
+ },
+ },
+ },
+ },
+ });
+
+ expect(createOrUpdateComponentTemplate).toHaveBeenCalledWith({
+ logger,
+ esClient,
+ template: {
+ name: '.risk-score-mappings',
+ _meta: {
+ managed: true,
+ },
+ template: {
+ settings: {},
+ mappings: {
+ dynamic: 'strict',
+ properties: {
+ '@timestamp': {
+ type: 'date',
+ },
+ alertsScore: {
+ type: 'float',
+ },
+ identifierField: {
+ type: 'keyword',
+ },
+ identifierValue: {
+ type: 'keyword',
+ },
+ level: {
+ type: 'keyword',
+ },
+ otherScore: {
+ type: 'float',
+ },
+ riskiestInputs: {
+ properties: {
+ id: {
+ type: 'keyword',
+ },
+ index: {
+ type: 'keyword',
+ },
+ riskScore: {
+ type: 'float',
+ },
+ },
+ type: 'nested',
+ },
+ totalScore: {
+ type: 'float',
+ },
+ totalScoreNormalized: {
+ type: 'float',
+ },
+ },
+ },
+ },
+ },
+ totalFieldsLimit,
+ });
+
+ expect(createOrUpdateIndexTemplate).toHaveBeenCalledWith({
+ logger,
+ esClient,
+ template: {
+ name: '.risk-score.risk-score-default-index-template',
+ body: {
+ data_stream: { hidden: true },
+ index_patterns: ['risk-score.risk-score-default'],
+ composed_of: ['.risk-score-mappings'],
+ template: {
+ settings: {
+ auto_expand_replicas: '0-1',
+ hidden: true,
+ 'index.lifecycle': {
+ name: '.risk-score-ilm-policy',
+ },
+ 'index.mapping.total_fields.limit': totalFieldsLimit,
+ },
+ mappings: {
+ dynamic: false,
+ _meta: {
+ kibana: {
+ version: '8.9.0',
+ },
+ managed: true,
+ namespace: 'default',
+ },
+ },
+ },
+ _meta: {
+ kibana: {
+ version: '8.9.0',
+ },
+ managed: true,
+ namespace: 'default',
+ },
+ },
+ },
+ });
+
+ expect(createDataStream).toHaveBeenCalledWith({
+ logger,
+ esClient,
+ totalFieldsLimit,
+ indexPatterns: {
+ template: `.risk-score.risk-score-default-index-template`,
+ alias: `risk-score.risk-score-default`,
+ },
+ });
+ });
+ });
+
+ describe('initializeResources error', () => {
+ it('should handle errors during initialization', async () => {
+ const error = new Error('There error');
+ (createOrUpdateIlmPolicy as jest.Mock).mockRejectedValue(error);
+
+ await riskEngineDataClient.initializeResources({ namespace: 'default' });
+
+ expect(logger.error).toHaveBeenCalledWith(
+ `Error initializing risk engine resources: ${error.message}`
+ );
+ });
+ });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/risk_engine/risk_engine_data_client.ts b/x-pack/plugins/security_solution/server/lib/risk_engine/risk_engine_data_client.ts
new file mode 100644
index 0000000000000..9b77741bb164a
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/risk_engine/risk_engine_data_client.ts
@@ -0,0 +1,142 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { Metadata } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import type { ClusterPutComponentTemplateRequest } from '@elastic/elasticsearch/lib/api/types';
+import {
+ createOrUpdateComponentTemplate,
+ createOrUpdateIlmPolicy,
+ createOrUpdateIndexTemplate,
+} from '@kbn/alerting-plugin/server';
+import { mappingFromFieldMap } from '@kbn/alerting-plugin/common';
+import { DEFAULT_NAMESPACE_STRING } from '@kbn/core-saved-objects-utils-server';
+import type { Logger, ElasticsearchClient } from '@kbn/core/server';
+import {
+ riskFieldMap,
+ getIndexPattern,
+ totalFieldsLimit,
+ mappingComponentName,
+ ilmPolicyName,
+ ilmPolicy,
+} from './configurations';
+import { createDataStream } from './utils/create_datastream';
+
+interface InitializeRiskEngineResourcesOpts {
+ namespace?: string;
+}
+
+interface RiskEngineDataClientOpts {
+ logger: Logger;
+ kibanaVersion: string;
+ elasticsearchClientPromise: Promise;
+}
+
+interface Writer {
+ bulk: () => Promise;
+}
+
+export class RiskEngineDataClient {
+ private writerCache: Map = new Map();
+ constructor(private readonly options: RiskEngineDataClientOpts) {}
+
+ public async getWriter({ namespace }: { namespace: string }): Promise {
+ if (this.writerCache.get(namespace)) {
+ return this.writerCache.get(namespace) as Writer;
+ }
+
+ await this.initializeResources({ namespace });
+ return this.writerCache.get(namespace) as Writer;
+ }
+
+ private async initializeWriter(namespace: string): Promise {
+ const writer: Writer = {
+ bulk: async () => {},
+ };
+ this.writerCache.set(namespace, writer);
+ return writer;
+ }
+
+ public async initializeResources({
+ namespace = DEFAULT_NAMESPACE_STRING,
+ }: InitializeRiskEngineResourcesOpts) {
+ try {
+ const esClient = await this.options.elasticsearchClientPromise;
+
+ const indexPatterns = getIndexPattern(namespace);
+
+ const indexMetadata: Metadata = {
+ kibana: {
+ version: this.options.kibanaVersion,
+ },
+ managed: true,
+ namespace,
+ };
+
+ await Promise.all([
+ createOrUpdateIlmPolicy({
+ logger: this.options.logger,
+ esClient,
+ name: ilmPolicyName,
+ policy: ilmPolicy,
+ }),
+ createOrUpdateComponentTemplate({
+ logger: this.options.logger,
+ esClient,
+ template: {
+ name: mappingComponentName,
+ _meta: {
+ managed: true,
+ },
+ template: {
+ settings: {},
+ mappings: mappingFromFieldMap(riskFieldMap, 'strict'),
+ },
+ } as ClusterPutComponentTemplateRequest,
+ totalFieldsLimit,
+ }),
+ ]);
+
+ await createOrUpdateIndexTemplate({
+ logger: this.options.logger,
+ esClient,
+ template: {
+ name: indexPatterns.template,
+ body: {
+ data_stream: { hidden: true },
+ index_patterns: [indexPatterns.alias],
+ composed_of: [mappingComponentName],
+ template: {
+ settings: {
+ auto_expand_replicas: '0-1',
+ hidden: true,
+ 'index.lifecycle': {
+ name: ilmPolicyName,
+ },
+ 'index.mapping.total_fields.limit': totalFieldsLimit,
+ },
+ mappings: {
+ dynamic: false,
+ _meta: indexMetadata,
+ },
+ },
+ _meta: indexMetadata,
+ },
+ },
+ });
+
+ await createDataStream({
+ logger: this.options.logger,
+ esClient,
+ totalFieldsLimit,
+ indexPatterns,
+ });
+
+ this.initializeWriter(namespace);
+ } catch (error) {
+ this.options.logger.error(`Error initializing risk engine resources: ${error.message}`);
+ }
+ }
+}
diff --git a/x-pack/plugins/security_solution/server/lib/risk_engine/utils/create_datastream.ts b/x-pack/plugins/security_solution/server/lib/risk_engine/utils/create_datastream.ts
new file mode 100644
index 0000000000000..910ba5e887046
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/risk_engine/utils/create_datastream.ts
@@ -0,0 +1,206 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// This file is a copy of x-pack/plugins/alerting/server/alerts_service/lib/create_concrete_write_index.ts
+// original function create index instead of datastream, and their have plan to use datastream in the future
+// so we probably should remove this file and use the original when datastream will be supported
+
+import type { IndicesSimulateIndexTemplateResponse } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import type { Logger, ElasticsearchClient } from '@kbn/core/server';
+import { get } from 'lodash';
+import { retryTransientEsErrors } from './retry_transient_es_errors';
+
+export interface IIndexPatternString {
+ template: string;
+ alias: string;
+}
+
+interface ConcreteIndexInfo {
+ index: string;
+ alias: string;
+ isWriteIndex: boolean;
+}
+
+interface UpdateIndexMappingsOpts {
+ logger: Logger;
+ esClient: ElasticsearchClient;
+ totalFieldsLimit: number;
+ concreteIndices: ConcreteIndexInfo[];
+}
+
+interface UpdateIndexOpts {
+ logger: Logger;
+ esClient: ElasticsearchClient;
+ totalFieldsLimit: number;
+ concreteIndexInfo: ConcreteIndexInfo;
+}
+
+const updateTotalFieldLimitSetting = async ({
+ logger,
+ esClient,
+ totalFieldsLimit,
+ concreteIndexInfo,
+}: UpdateIndexOpts) => {
+ const { index, alias } = concreteIndexInfo;
+ try {
+ await retryTransientEsErrors(
+ () =>
+ esClient.indices.putSettings({
+ index,
+ body: { 'index.mapping.total_fields.limit': totalFieldsLimit },
+ }),
+ { logger }
+ );
+ return;
+ } catch (err) {
+ logger.error(
+ `Failed to PUT index.mapping.total_fields.limit settings for alias ${alias}: ${err.message}`
+ );
+ throw err;
+ }
+};
+
+// This will update the mappings of backing indices but *not* the settings. This
+// is due to the fact settings can be classed as dynamic and static, and static
+// updates will fail on an index that isn't closed. New settings *will* be applied as part
+// of the ILM policy rollovers. More info: https://github.com/elastic/kibana/pull/113389#issuecomment-940152654
+const updateUnderlyingMapping = async ({
+ logger,
+ esClient,
+ concreteIndexInfo,
+}: UpdateIndexOpts) => {
+ const { index, alias } = concreteIndexInfo;
+ let simulatedIndexMapping: IndicesSimulateIndexTemplateResponse;
+ try {
+ simulatedIndexMapping = await retryTransientEsErrors(
+ () => esClient.indices.simulateIndexTemplate({ name: index }),
+ { logger }
+ );
+ } catch (err) {
+ logger.error(
+ `Ignored PUT mappings for alias ${alias}; error generating simulated mappings: ${err.message}`
+ );
+ return;
+ }
+
+ const simulatedMapping = get(simulatedIndexMapping, ['template', 'mappings']);
+
+ if (simulatedMapping == null) {
+ logger.error(`Ignored PUT mappings for alias ${alias}; simulated mappings were empty`);
+ return;
+ }
+
+ try {
+ await retryTransientEsErrors(
+ () => esClient.indices.putMapping({ index, body: simulatedMapping }),
+ { logger }
+ );
+
+ return;
+ } catch (err) {
+ logger.error(`Failed to PUT mapping for alias ${alias}: ${err.message}`);
+ throw err;
+ }
+};
+/**
+ * Updates the underlying mapping for any existing concrete indices
+ */
+const updateIndexMappings = async ({
+ logger,
+ esClient,
+ totalFieldsLimit,
+ concreteIndices,
+}: UpdateIndexMappingsOpts) => {
+ logger.debug(`Updating underlying mappings for ${concreteIndices.length} indices.`);
+
+ // Update total field limit setting of found indices
+ // Other index setting changes are not updated at this time
+ await Promise.all(
+ concreteIndices.map((index) =>
+ updateTotalFieldLimitSetting({ logger, esClient, totalFieldsLimit, concreteIndexInfo: index })
+ )
+ );
+
+ // Update mappings of the found indices.
+ await Promise.all(
+ concreteIndices.map((index) =>
+ updateUnderlyingMapping({ logger, esClient, totalFieldsLimit, concreteIndexInfo: index })
+ )
+ );
+};
+
+interface CreateConcreteWriteIndexOpts {
+ logger: Logger;
+ esClient: ElasticsearchClient;
+ totalFieldsLimit: number;
+ indexPatterns: IIndexPatternString;
+}
+/**
+ * Create a data stream
+ */
+export const createDataStream = async ({
+ logger,
+ esClient,
+ indexPatterns,
+ totalFieldsLimit,
+}: CreateConcreteWriteIndexOpts) => {
+ logger.info(`Creating data stream - ${indexPatterns.alias}`);
+
+ // check if a datastream already exists
+ let dataStreams: ConcreteIndexInfo[] = [];
+ try {
+ // Specify both the index pattern for the backing indices and their aliases
+ // The alias prevents the request from finding other namespaces that could match the -* pattern
+ const response = await retryTransientEsErrors(
+ () => esClient.indices.getDataStream({ name: indexPatterns.alias, expand_wildcards: 'all' }),
+ { logger }
+ );
+
+ dataStreams = response.data_streams.map((dataStream) => ({
+ index: dataStream.name,
+ alias: dataStream.name,
+ isWriteIndex: true,
+ }));
+
+ logger.debug(
+ `Found ${dataStreams.length} concrete indices for ${indexPatterns.alias} - ${JSON.stringify(
+ dataStreams
+ )}`
+ );
+ } catch (error) {
+ // 404 is expected if no datastream have been created
+ if (error.statusCode !== 404) {
+ logger.error(
+ `Error fetching concrete indices for ${indexPatterns.alias} pattern - ${error.message}`
+ );
+ throw error;
+ }
+ }
+
+ const dataStreamsExist = dataStreams.length > 0;
+
+ // if a concrete write datastream already exists, update the underlying mapping
+ if (dataStreams.length > 0) {
+ await updateIndexMappings({ logger, esClient, totalFieldsLimit, concreteIndices: dataStreams });
+ }
+
+ // check if a concrete write datastream already exists
+ if (!dataStreamsExist) {
+ try {
+ await retryTransientEsErrors(
+ () =>
+ esClient.indices.createDataStream({
+ name: indexPatterns.alias,
+ }),
+ { logger }
+ );
+ } catch (error) {
+ logger.error(`Error creating datastream - ${error.message}`);
+ throw error;
+ }
+ }
+};
diff --git a/x-pack/plugins/security_solution/server/lib/risk_engine/utils/retry_transient_es_errors.test.ts b/x-pack/plugins/security_solution/server/lib/risk_engine/utils/retry_transient_es_errors.test.ts
new file mode 100644
index 0000000000000..2501c57776d80
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/risk_engine/utils/retry_transient_es_errors.test.ts
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { loggerMock } from '@kbn/logging-mocks';
+import { errors as EsErrors } from '@elastic/elasticsearch';
+
+import { retryTransientEsErrors } from './retry_transient_es_errors';
+
+const logger = loggerMock.create();
+const randomDelayMultiplier = 0.01;
+
+describe('retryTransientErrors', () => {
+ beforeEach(() => {
+ jest.resetAllMocks();
+ jest.spyOn(global.Math, 'random').mockReturnValue(randomDelayMultiplier);
+ });
+
+ it("doesn't retry if operation is successful", async () => {
+ const esCallMock = jest.fn().mockResolvedValue('success');
+ expect(await retryTransientEsErrors(esCallMock, { logger })).toEqual('success');
+ expect(esCallMock).toHaveBeenCalledTimes(1);
+ });
+
+ it('logs a warning message on retry', async () => {
+ const esCallMock = jest
+ .fn()
+ .mockRejectedValueOnce(new EsErrors.ConnectionError('foo'))
+ .mockResolvedValue('success');
+
+ await retryTransientEsErrors(esCallMock, { logger });
+ expect(logger.warn).toHaveBeenCalledTimes(1);
+ expect(logger.warn.mock.calls[0][0]).toMatch(
+ `Retrying Elasticsearch operation after [2s] due to error: ConnectionError: foo ConnectionError: foo`
+ );
+ });
+
+ it('retries with an exponential backoff', async () => {
+ let attempt = 0;
+ const esCallMock = jest.fn(async () => {
+ attempt++;
+ if (attempt < 4) {
+ throw new EsErrors.ConnectionError('foo');
+ } else {
+ return 'success';
+ }
+ });
+
+ expect(await retryTransientEsErrors(esCallMock, { logger })).toEqual('success');
+ expect(esCallMock).toHaveBeenCalledTimes(4);
+ expect(logger.warn).toHaveBeenCalledTimes(3);
+ expect(logger.warn.mock.calls[0][0]).toMatch(
+ `Retrying Elasticsearch operation after [2s] due to error: ConnectionError: foo ConnectionError: foo`
+ );
+ expect(logger.warn.mock.calls[1][0]).toMatch(
+ `Retrying Elasticsearch operation after [4s] due to error: ConnectionError: foo ConnectionError: foo`
+ );
+ expect(logger.warn.mock.calls[2][0]).toMatch(
+ `Retrying Elasticsearch operation after [8s] due to error: ConnectionError: foo ConnectionError: foo`
+ );
+ });
+
+ it('retries each supported error type', async () => {
+ const errors = [
+ new EsErrors.NoLivingConnectionsError('no living connection', {
+ warnings: [],
+ // eslint-disable-next-line @typescript-eslint/no-explicit-any
+ meta: {} as any,
+ }),
+ new EsErrors.ConnectionError('no connection'),
+ new EsErrors.TimeoutError('timeout'),
+ // eslint-disable-next-line @typescript-eslint/no-explicit-any
+ new EsErrors.ResponseError({ statusCode: 503, meta: {} as any, warnings: [] }),
+ // eslint-disable-next-line @typescript-eslint/no-explicit-any
+ new EsErrors.ResponseError({ statusCode: 408, meta: {} as any, warnings: [] }),
+ // eslint-disable-next-line @typescript-eslint/no-explicit-any
+ new EsErrors.ResponseError({ statusCode: 410, meta: {} as any, warnings: [] }),
+ ];
+
+ for (const error of errors) {
+ const esCallMock = jest.fn().mockRejectedValueOnce(error).mockResolvedValue('success');
+ expect(await retryTransientEsErrors(esCallMock, { logger })).toEqual('success');
+ expect(esCallMock).toHaveBeenCalledTimes(2);
+ }
+ });
+
+ it('does not retry unsupported errors', async () => {
+ const error = new Error('foo!');
+ const esCallMock = jest.fn().mockRejectedValueOnce(error).mockResolvedValue('success');
+ await expect(retryTransientEsErrors(esCallMock, { logger })).rejects.toThrow(error);
+ expect(esCallMock).toHaveBeenCalledTimes(1);
+ });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/risk_engine/utils/retry_transient_es_errors.ts b/x-pack/plugins/security_solution/server/lib/risk_engine/utils/retry_transient_es_errors.ts
new file mode 100644
index 0000000000000..7a3839ad3c5bc
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/risk_engine/utils/retry_transient_es_errors.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Logger } from '@kbn/core/server';
+import { errors as EsErrors } from '@elastic/elasticsearch';
+
+const MAX_ATTEMPTS = 3;
+
+const retryResponseStatuses = [
+ 503, // ServiceUnavailable
+ 408, // RequestTimeout
+ 410, // Gone
+];
+
+const isRetryableError = (e: Error) =>
+ e instanceof EsErrors.NoLivingConnectionsError ||
+ e instanceof EsErrors.ConnectionError ||
+ e instanceof EsErrors.TimeoutError ||
+ // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+ (e instanceof EsErrors.ResponseError && retryResponseStatuses.includes(e?.statusCode!));
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export const retryTransientEsErrors = async (
+ esCall: () => Promise,
+ {
+ logger,
+ attempt = 0,
+ }: {
+ logger: Logger;
+ attempt?: number;
+ }
+): Promise => {
+ try {
+ return await esCall();
+ } catch (e) {
+ if (attempt < MAX_ATTEMPTS && isRetryableError(e)) {
+ const retryCount = attempt + 1;
+ const retryDelaySec: number = Math.min(Math.pow(2, retryCount), 30); // 2s, 4s, 8s, 16s, 30s, 30s, 30s...
+
+ logger.warn(
+ `Retrying Elasticsearch operation after [${retryDelaySec}s] due to error: ${e.toString()} ${
+ e.stack
+ }`
+ );
+
+ // delay with some randomness
+ await delay(retryDelaySec * 1000 * Math.random());
+ return retryTransientEsErrors(esCall, { logger, attempt: retryCount });
+ }
+
+ throw e;
+ }
+};
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index a838c83a31e2b..b9dce72f64671 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -94,6 +94,8 @@ import {
ENDPOINT_FIELDS_SEARCH_STRATEGY,
ENDPOINT_SEARCH_STRATEGY,
} from '../common/endpoint/constants';
+import { RiskEngineDataClient } from './lib/risk_engine/risk_engine_data_client';
+
import { AppFeatures } from './lib/app_features';
export type { SetupPlugins, StartPlugins, PluginSetup, PluginStart } from './plugin_contract';
@@ -118,6 +120,7 @@ export class Plugin implements ISecuritySolutionPlugin {
private checkMetadataTransformsTask: CheckMetadataTransformsTask | undefined;
private telemetryUsageCounter?: UsageCounter;
private endpointContext: EndpointAppContext;
+ private riskEngineDataClient: RiskEngineDataClient | undefined;
constructor(context: PluginInitializerContext) {
const serverConfig = createConfig(context);
@@ -159,6 +162,18 @@ export class Plugin implements ISecuritySolutionPlugin {
this.ruleMonitoringService.setup(core, plugins);
+ this.riskEngineDataClient = new RiskEngineDataClient({
+ logger: this.logger,
+ kibanaVersion: this.pluginContext.env.packageInfo.version,
+ elasticsearchClientPromise: core
+ .getStartServices()
+ .then(([{ elasticsearch }]) => elasticsearch.client.asInternalUser),
+ });
+
+ if (experimentalFeatures.riskScoringPersistence) {
+ this.riskEngineDataClient.initializeResources({});
+ }
+
const requestContextFactory = new RequestContextFactory({
config,
logger,
@@ -168,6 +183,7 @@ export class Plugin implements ISecuritySolutionPlugin {
ruleMonitoringService: this.ruleMonitoringService,
kibanaVersion: pluginContext.env.packageInfo.version,
kibanaBranch: pluginContext.env.packageInfo.branch,
+ riskEngineDataClient: this.riskEngineDataClient,
});
const router = core.http.createRouter();
diff --git a/x-pack/plugins/security_solution/server/request_context_factory.ts b/x-pack/plugins/security_solution/server/request_context_factory.ts
index e56df95a10650..c5cf4b24750a4 100644
--- a/x-pack/plugins/security_solution/server/request_context_factory.ts
+++ b/x-pack/plugins/security_solution/server/request_context_factory.ts
@@ -25,6 +25,7 @@ import type {
import type { Immutable } from '../common/endpoint/types';
import type { EndpointAuthz } from '../common/endpoint/types/authz';
import type { EndpointAppContextService } from './endpoint/endpoint_app_context_services';
+import type { RiskEngineDataClient } from './lib/risk_engine/risk_engine_data_client';
export interface IRequestContextFactory {
create(
@@ -42,6 +43,7 @@ interface ConstructorOptions {
ruleMonitoringService: IRuleMonitoringService;
kibanaVersion: string;
kibanaBranch: string;
+ riskEngineDataClient: RiskEngineDataClient;
}
export class RequestContextFactory implements IRequestContextFactory {
@@ -56,7 +58,15 @@ export class RequestContextFactory implements IRequestContextFactory {
request: KibanaRequest
): Promise {
const { options, appClientFactory } = this;
- const { config, core, plugins, endpointAppContextService, ruleMonitoringService } = options;
+ const {
+ config,
+ core,
+ plugins,
+ endpointAppContextService,
+ ruleMonitoringService,
+ riskEngineDataClient,
+ } = options;
+
const { lists, ruleRegistry, security } = plugins;
const [, startPlugins] = await core.getStartServices();
@@ -128,6 +138,8 @@ export class RequestContextFactory implements IRequestContextFactory {
},
getInternalFleetServices: memoize(() => endpointAppContextService.getInternalFleetServices()),
+
+ getRiskEngineDataClient: () => riskEngineDataClient,
};
}
}
diff --git a/x-pack/plugins/security_solution/server/types.ts b/x-pack/plugins/security_solution/server/types.ts
index 64211998defc5..8326d13ad03a7 100644
--- a/x-pack/plugins/security_solution/server/types.ts
+++ b/x-pack/plugins/security_solution/server/types.ts
@@ -29,6 +29,7 @@ import type {
import type { FrameworkRequest } from './lib/framework';
import type { EndpointAuthz } from '../common/endpoint/types/authz';
import type { EndpointInternalFleetServicesInterface } from './endpoint/services/fleet';
+import type { RiskEngineDataClient } from './lib/risk_engine/risk_engine_data_client';
export { AppClient };
@@ -46,6 +47,7 @@ export interface SecuritySolutionApiRequestHandlerContext {
getRacClient: (req: KibanaRequest) => Promise;
getExceptionListClient: () => ExceptionListClient | null;
getInternalFleetServices: () => EndpointInternalFleetServicesInterface;
+ getRiskEngineDataClient: () => RiskEngineDataClient;
}
export type SecuritySolutionRequestHandlerContext = CustomRequestHandlerContext<{
diff --git a/x-pack/test/detection_engine_api_integration/common/config.ts b/x-pack/test/detection_engine_api_integration/common/config.ts
index 8454915db9a7d..c4c3c44f1c418 100644
--- a/x-pack/test/detection_engine_api_integration/common/config.ts
+++ b/x-pack/test/detection_engine_api_integration/common/config.ts
@@ -76,6 +76,7 @@ export function createTestConfig(options: CreateTestConfigOptions, testFiles?: s
'--xpack.ruleRegistry.unsafe.legacyMultiTenancy.enabled=true',
`--xpack.securitySolution.enableExperimental=${JSON.stringify([
'previewTelemetryUrlEnabled',
+ 'riskScoringPersistence',
'riskScoringRoutesEnabled',
])}`,
'--xpack.task_manager.poll_interval=1000',
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/index.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/index.ts
index c8501050fc25c..6841648145fd3 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/index.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/index.ts
@@ -37,6 +37,7 @@ export default ({ loadTestFile }: FtrProviderContext): void => {
loadTestFile(require.resolve('./throttle'));
loadTestFile(require.resolve('./ignore_fields'));
loadTestFile(require.resolve('./migrations'));
+ loadTestFile(require.resolve('./risk_engine_install_resources'));
loadTestFile(require.resolve('./risk_engine'));
loadTestFile(require.resolve('./set_alert_tags'));
});
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/risk_engine_install_resources.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/risk_engine_install_resources.ts
new file mode 100644
index 0000000000000..a7cae20fa8b34
--- /dev/null
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/risk_engine_install_resources.ts
@@ -0,0 +1,150 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../common/ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default ({ getService }: FtrProviderContext) => {
+ const es = getService('es');
+
+ describe('install risk engine resources', () => {
+ it('should install resources on startup', async () => {
+ const ilmPolicyName = '.risk-score-ilm-policy';
+ const componentTemplateName = '.risk-score-mappings';
+ const indexTemplateName = '.risk-score.risk-score-default-index-template';
+ const indexName = 'risk-score.risk-score-default';
+
+ const ilmPolicy = await es.ilm.getLifecycle({
+ name: ilmPolicyName,
+ });
+
+ expect(ilmPolicy[ilmPolicyName].policy).to.eql({
+ _meta: {
+ managed: true,
+ },
+ phases: {
+ hot: {
+ min_age: '0ms',
+ actions: {
+ rollover: {
+ max_age: '30d',
+ max_primary_shard_size: '50gb',
+ },
+ },
+ },
+ },
+ });
+
+ const { component_templates: componentTemplates1 } = await es.cluster.getComponentTemplate({
+ name: componentTemplateName,
+ });
+
+ expect(componentTemplates1.length).to.eql(1);
+ const componentTemplate = componentTemplates1[0];
+
+ expect(componentTemplate.name).to.eql(componentTemplateName);
+ expect(componentTemplate.component_template.template.mappings).to.eql({
+ dynamic: 'strict',
+ properties: {
+ '@timestamp': {
+ type: 'date',
+ },
+ alertsScore: {
+ type: 'float',
+ },
+ identifierField: {
+ type: 'keyword',
+ },
+ identifierValue: {
+ type: 'keyword',
+ },
+ level: {
+ type: 'keyword',
+ },
+ otherScore: {
+ type: 'float',
+ },
+ riskiestInputs: {
+ properties: {
+ id: {
+ type: 'keyword',
+ },
+ index: {
+ type: 'keyword',
+ },
+ riskScore: {
+ type: 'float',
+ },
+ },
+ type: 'nested',
+ },
+ totalScore: {
+ type: 'float',
+ },
+ totalScoreNormalized: {
+ type: 'float',
+ },
+ },
+ });
+
+ const { index_templates: indexTemplates } = await es.indices.getIndexTemplate({
+ name: indexTemplateName,
+ });
+ expect(indexTemplates.length).to.eql(1);
+ const indexTemplate = indexTemplates[0];
+ expect(indexTemplate.name).to.eql(indexTemplateName);
+ expect(indexTemplate.index_template.index_patterns).to.eql(['risk-score.risk-score-default']);
+ expect(indexTemplate.index_template.composed_of).to.eql(['.risk-score-mappings']);
+ expect(indexTemplate.index_template.template!.mappings?.dynamic).to.eql(false);
+ expect(indexTemplate.index_template.template!.mappings?._meta?.managed).to.eql(true);
+ expect(indexTemplate.index_template.template!.mappings?._meta?.namespace).to.eql('default');
+ expect(indexTemplate.index_template.template!.mappings?._meta?.kibana?.version).to.be.a(
+ 'string'
+ );
+ expect(indexTemplate.index_template.template!.settings).to.eql({
+ index: {
+ lifecycle: {
+ name: '.risk-score-ilm-policy',
+ },
+ mapping: {
+ total_fields: {
+ limit: '1000',
+ },
+ },
+ hidden: 'true',
+ auto_expand_replicas: '0-1',
+ },
+ });
+
+ const dsResponse = await es.indices.get({
+ index: indexName,
+ });
+
+ const dataStream = Object.values(dsResponse).find((ds) => ds.data_stream === indexName);
+
+ expect(dataStream?.mappings?._meta?.managed).to.eql(true);
+ expect(dataStream?.mappings?._meta?.namespace).to.eql('default');
+ expect(dataStream?.mappings?._meta?.kibana?.version).to.be.a('string');
+ expect(dataStream?.mappings?.dynamic).to.eql('false');
+
+ expect(dataStream?.settings?.index?.lifecycle).to.eql({
+ name: '.risk-score-ilm-policy',
+ });
+
+ expect(dataStream?.settings?.index?.mapping).to.eql({
+ total_fields: {
+ limit: '1000',
+ },
+ });
+
+ expect(dataStream?.settings?.index?.hidden).to.eql('true');
+ expect(dataStream?.settings?.index?.number_of_shards).to.eql(1);
+ expect(dataStream?.settings?.index?.auto_expand_replicas).to.eql('0-1');
+ });
+ });
+};
From bdf910ed50e1535ef99578a8a08b639835da3add Mon Sep 17 00:00:00 2001
From: James Gowdy
Date: Wed, 21 Jun 2023 14:15:59 +0100
Subject: [PATCH 17/31] [ML] Hiding pattern analysis button for non-time series
data (#160051)
The `Run pattern analysis` button should only be available for time
series data.
This PR adds an additional check using the dataview's `isTimeBased`
method.
---
.../categorize_trigger_utils.test.ts | 2 +-
.../field_categorize_button/categorize_trigger_utils.ts | 7 ++++++-
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/src/plugins/unified_field_list/public/components/field_categorize_button/categorize_trigger_utils.test.ts b/src/plugins/unified_field_list/public/components/field_categorize_button/categorize_trigger_utils.test.ts
index 79dacc2ed1fd0..a0efbaf8de869 100644
--- a/src/plugins/unified_field_list/public/components/field_categorize_button/categorize_trigger_utils.test.ts
+++ b/src/plugins/unified_field_list/public/components/field_categorize_button/categorize_trigger_utils.test.ts
@@ -51,7 +51,7 @@ const action: Action = {
execute: () => Promise.resolve(),
};
-const dataViewMock = { id: '1', toSpec: () => ({}) } as DataView;
+const dataViewMock = { id: '1', toSpec: () => ({}), isTimeBased: () => true } as DataView;
describe('categorize_trigger_utils', () => {
afterEach(() => {
diff --git a/src/plugins/unified_field_list/public/components/field_categorize_button/categorize_trigger_utils.ts b/src/plugins/unified_field_list/public/components/field_categorize_button/categorize_trigger_utils.ts
index 560671c10d1c1..371425d7e9d14 100644
--- a/src/plugins/unified_field_list/public/components/field_categorize_button/categorize_trigger_utils.ts
+++ b/src/plugins/unified_field_list/public/components/field_categorize_button/categorize_trigger_utils.ts
@@ -46,7 +46,12 @@ export async function canCategorize(
field: DataViewField,
dataView: DataView | undefined
): Promise {
- if (field.name === '_id' || !dataView?.id || !field.esTypes?.includes('text')) {
+ if (
+ field.name === '_id' ||
+ !dataView?.id ||
+ !dataView.isTimeBased() ||
+ !field.esTypes?.includes('text')
+ ) {
return false;
}
From 9f002b9a40194a43f4c45191827931cae78be102 Mon Sep 17 00:00:00 2001
From: Saarika Bhasi <55930906+saarikabhasi@users.noreply.github.com>
Date: Wed, 21 Jun 2023 09:20:19 -0400
Subject: [PATCH 18/31] [Enterprise Search] Search Application add tour in
preview page (#159845)
## Summary
* Adds tour near to configuration button when page loads
* Uses localStorage to save tour closed/open state
### Screen Recording
https://github.com/elastic/kibana/assets/55930906/4acb6142-9822-41c4-b88a-1da2d3bf0b28
---
.../engine_search_preview.tsx | 80 ++++++++++++++++---
1 file changed, 67 insertions(+), 13 deletions(-)
diff --git a/x-pack/plugins/enterprise_search/public/applications/applications/components/engine/engine_search_preview/engine_search_preview.tsx b/x-pack/plugins/enterprise_search/public/applications/applications/components/engine/engine_search_preview/engine_search_preview.tsx
index 428283df3cd86..cde84312d81f7 100644
--- a/x-pack/plugins/enterprise_search/public/applications/applications/components/engine/engine_search_preview/engine_search_preview.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/applications/components/engine/engine_search_preview/engine_search_preview.tsx
@@ -9,6 +9,8 @@ import React, { useState, useMemo } from 'react';
import { useActions, useValues } from 'kea';
+import useLocalStorage from 'react-use/lib/useLocalStorage';
+
import {
EuiButtonEmpty,
EuiContextMenuItem,
@@ -24,6 +26,7 @@ import {
EuiText,
EuiTextColor,
EuiTitle,
+ EuiTourStep,
} from '@elastic/eui';
import {
PagingInfo,
@@ -128,6 +131,11 @@ const ConfigurationPopover: React.FC = ({
const { engineData } = useValues(EngineViewLogic);
const { openDeleteEngineModal } = useActions(EngineViewLogic);
const { sendEnterpriseSearchTelemetry } = useActions(TelemetryLogic);
+ const [isTourClosed, setTourClosed] = useLocalStorage(
+ 'search-application-tour-closed',
+ false
+ );
+
return (
<>
= ({
closePopover={setCloseConfiguration}
button={
- {hasSchemaConflicts &&
- {i18n.translate(
- 'xpack.enterpriseSearch.content.engine.searchPreview.configuration.buttonTitle',
- {
- defaultMessage: 'Configuration',
+ {hasSchemaConflicts && (
+ <>
+
+
+ {!isTourClosed &&
+
+
+ {i18n.translate(
+ 'xpack.enterpriseSearch.content.searchApplication.searchPreview.configuration.tourContent',
+ {
+ defaultMessage:
+ 'Create your API key, learn about using language clients and find more resources in Connect.',
+ }
+ )}
+
+
Query Parameter — The page number to return. default: 1
perPage (optional)
- Query Parameter — The number of items to return. default: 20
sortOrder (optional)
+ Query Parameter — The number of items to return. Limited to 100 items. default: 20
sortOrder (optional)
Query Parameter — Determines the sort order. default: desc
diff --git a/x-pack/plugins/cases/common/constants/index.ts b/x-pack/plugins/cases/common/constants/index.ts
index 33473a9c80bfd..1a49de004e73f 100644
--- a/x-pack/plugins/cases/common/constants/index.ts
+++ b/x-pack/plugins/cases/common/constants/index.ts
@@ -104,6 +104,7 @@ export const MAX_DOCS_PER_PAGE = 10000 as const;
export const MAX_BULK_GET_ATTACHMENTS = MAX_DOCS_PER_PAGE;
export const MAX_CONCURRENT_SEARCHES = 10 as const;
export const MAX_BULK_GET_CASES = 1000 as const;
+export const MAX_COMMENTS_PER_PAGE = 100 as const;
export const MAX_CATEGORY_FILTER_LENGTH = 100 as const;
/**
diff --git a/x-pack/plugins/cases/docs/openapi/bundled.json b/x-pack/plugins/cases/docs/openapi/bundled.json
index 92dcfe5779306..78ba5444f40aa 100644
--- a/x-pack/plugins/cases/docs/openapi/bundled.json
+++ b/x-pack/plugins/cases/docs/openapi/bundled.json
@@ -1852,7 +1852,15 @@
"$ref": "#/components/parameters/page_index"
},
{
- "$ref": "#/components/parameters/page_size"
+ "name": "perPage",
+ "in": "query",
+ "description": "The number of items to return. Limited to 100 items.",
+ "required": false,
+ "schema": {
+ "type": "integer",
+ "default": 20,
+ "maximum": 100
+ }
},
{
"$ref": "#/components/parameters/sort_order"
diff --git a/x-pack/plugins/cases/docs/openapi/bundled.yaml b/x-pack/plugins/cases/docs/openapi/bundled.yaml
index 3d53916c89df8..405cf4fb689f0 100644
--- a/x-pack/plugins/cases/docs/openapi/bundled.yaml
+++ b/x-pack/plugins/cases/docs/openapi/bundled.yaml
@@ -1156,7 +1156,14 @@ paths:
parameters:
- $ref: '#/components/parameters/case_id'
- $ref: '#/components/parameters/page_index'
- - $ref: '#/components/parameters/page_size'
+ - name: perPage
+ in: query
+ description: The number of items to return. Limited to 100 items.
+ required: false
+ schema:
+ type: integer
+ default: 20
+ maximum: 100
- $ref: '#/components/parameters/sort_order'
- $ref: '#/components/parameters/space_id'
responses:
diff --git a/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@comments@_find.yaml b/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@comments@_find.yaml
index b1dd32a659515..bb43f4dcc0b26 100644
--- a/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@comments@_find.yaml
+++ b/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@comments@_find.yaml
@@ -10,7 +10,14 @@ get:
parameters:
- $ref: '../components/parameters/case_id.yaml'
- $ref: '../components/parameters/page_index.yaml'
- - $ref: '../components/parameters/page_size.yaml'
+ - name: perPage
+ in: query
+ description: The number of items to return. Limited to 100 items.
+ required: false
+ schema:
+ type: integer
+ default: 20
+ maximum: 100
- $ref: '../components/parameters/sort_order.yaml'
- $ref: '../components/parameters/space_id.yaml'
responses:
diff --git a/x-pack/plugins/cases/server/client/attachments/get.test.ts b/x-pack/plugins/cases/server/client/attachments/get.test.ts
index 250cfa9f0b252..c2c3423b2388b 100644
--- a/x-pack/plugins/cases/server/client/attachments/get.test.ts
+++ b/x-pack/plugins/cases/server/client/attachments/get.test.ts
@@ -18,12 +18,20 @@ describe('get', () => {
it('Invalid total items results in error', async () => {
await expect(() =>
- findComment({ caseID: 'mock-id', findQueryParams: { page: 2, perPage: 9001 } }, clientArgs)
+ findComment({ caseID: 'mock-id', findQueryParams: { page: 209, perPage: 100 } }, clientArgs)
).rejects.toThrowErrorMatchingInlineSnapshot(
`"Failed to find comments case id: mock-id: Error: The number of documents is too high. Paginating through more than 10,000 documents is not possible."`
);
});
+ it('Invalid perPage items results in error', async () => {
+ await expect(() =>
+ findComment({ caseID: 'mock-id', findQueryParams: { page: 2, perPage: 9001 } }, clientArgs)
+ ).rejects.toThrowErrorMatchingInlineSnapshot(
+ `"Failed to find comments case id: mock-id: Error: The provided perPage value was too high. The maximum allowed perPage value is 100."`
+ );
+ });
+
it('throws with excess fields', async () => {
await expect(
findComment(
diff --git a/x-pack/plugins/cases/server/client/attachments/validators.test.ts b/x-pack/plugins/cases/server/client/attachments/validators.test.ts
index 4626fd13fba35..ce6c43a665a10 100644
--- a/x-pack/plugins/cases/server/client/attachments/validators.test.ts
+++ b/x-pack/plugins/cases/server/client/attachments/validators.test.ts
@@ -6,10 +6,13 @@
*/
import { validateFindCommentsPagination } from './validators';
+import { MAX_COMMENTS_PER_PAGE } from '../../../common/constants';
const ERROR_MSG =
'The number of documents is too high. Paginating through more than 10,000 documents is not possible.';
+const ERROR_MSG_PER_PAGE = `The provided perPage value was too high. The maximum allowed perPage value is ${MAX_COMMENTS_PER_PAGE}.`;
+
describe('validators', () => {
describe('validateFindCommentsPagination', () => {
it('does not throw if only page is undefined', () => {
@@ -20,20 +23,30 @@ describe('validators', () => {
expect(() => validateFindCommentsPagination({ page: 100 })).not.toThrowError();
});
+ it('does not throw if page and perPage are defined and valid', () => {
+ expect(() => validateFindCommentsPagination({ page: 2, perPage: 100 })).not.toThrowError();
+ });
+
it('returns if page and perPage are undefined', () => {
expect(() => validateFindCommentsPagination({})).not.toThrowError();
});
+ it('returns if perPage < 0', () => {
+ expect(() => validateFindCommentsPagination({ perPage: -1 })).not.toThrowError();
+ });
+
it('throws if page > 10k', () => {
expect(() => validateFindCommentsPagination({ page: 10001 })).toThrow(ERROR_MSG);
});
- it('throws if perPage > 10k', () => {
- expect(() => validateFindCommentsPagination({ perPage: 10001 })).toThrowError(ERROR_MSG);
+ it('throws if perPage > 100', () => {
+ expect(() =>
+ validateFindCommentsPagination({ perPage: MAX_COMMENTS_PER_PAGE + 1 })
+ ).toThrowError(ERROR_MSG_PER_PAGE);
});
it('throws if page * perPage > 10k', () => {
- expect(() => validateFindCommentsPagination({ page: 10, perPage: 1001 })).toThrow(ERROR_MSG);
+ expect(() => validateFindCommentsPagination({ page: 101, perPage: 100 })).toThrow(ERROR_MSG);
});
});
});
diff --git a/x-pack/plugins/cases/server/client/attachments/validators.ts b/x-pack/plugins/cases/server/client/attachments/validators.ts
index 770d9d8e88c0f..ea38fa71e702a 100644
--- a/x-pack/plugins/cases/server/client/attachments/validators.ts
+++ b/x-pack/plugins/cases/server/client/attachments/validators.ts
@@ -6,7 +6,7 @@
*/
import Boom from '@hapi/boom';
-import { MAX_DOCS_PER_PAGE } from '../../../common/constants';
+import { MAX_DOCS_PER_PAGE, MAX_COMMENTS_PER_PAGE } from '../../../common/constants';
import {
isCommentRequestTypeExternalReference,
isCommentRequestTypePersistableState,
@@ -51,7 +51,13 @@ export const validateFindCommentsPagination = (params?: FindCommentsQueryParams)
const pageAsNumber = params.page ?? 0;
const perPageAsNumber = params.perPage ?? 0;
- if (Math.max(pageAsNumber, perPageAsNumber, pageAsNumber * perPageAsNumber) > MAX_DOCS_PER_PAGE) {
+ if (perPageAsNumber > MAX_COMMENTS_PER_PAGE) {
+ throw Boom.badRequest(
+ `The provided perPage value was too high. The maximum allowed perPage value is ${MAX_COMMENTS_PER_PAGE}.`
+ );
+ }
+
+ if (Math.max(pageAsNumber, pageAsNumber * perPageAsNumber) > MAX_DOCS_PER_PAGE) {
throw Boom.badRequest(
'The number of documents is too high. Paginating through more than 10,000 documents is not possible.'
);
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts
index 267f5472e6ebb..6da8cfccf1352 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts
@@ -7,7 +7,7 @@
import expect from '@kbn/expect';
import type SuperTest from 'supertest';
-import { MAX_DOCS_PER_PAGE } from '@kbn/cases-plugin/common/constants';
+import { MAX_COMMENTS_PER_PAGE } from '@kbn/cases-plugin/common/constants';
import {
Alerts,
createCaseAttachAlertAndDeleteCase,
@@ -170,7 +170,7 @@ export default ({ getService }: FtrProviderContext): void => {
supertest: supertestWithoutAuth,
caseId: postedCase.id,
query: {
- perPage: MAX_DOCS_PER_PAGE,
+ perPage: MAX_COMMENTS_PER_PAGE,
},
}),
]);
@@ -210,14 +210,14 @@ export default ({ getService }: FtrProviderContext): void => {
supertest: supertestWithoutAuth,
caseId: postedCase1.id,
query: {
- perPage: MAX_DOCS_PER_PAGE,
+ perPage: MAX_COMMENTS_PER_PAGE,
},
}),
findAttachments({
supertest: supertestWithoutAuth,
caseId: postedCase2.id,
query: {
- perPage: MAX_DOCS_PER_PAGE,
+ perPage: MAX_COMMENTS_PER_PAGE,
},
}),
]);
@@ -457,7 +457,7 @@ export default ({ getService }: FtrProviderContext): void => {
supertest: supertestWithoutAuth,
caseId: postedCase.id,
query: {
- perPage: MAX_DOCS_PER_PAGE,
+ perPage: MAX_COMMENTS_PER_PAGE,
},
auth: { user: secAllUser, space: 'space1' },
}),
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/find_comments.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/find_comments.ts
index a218350ec95ca..761959db29f66 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/find_comments.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/find_comments.ts
@@ -114,7 +114,7 @@ export default ({ getService }: FtrProviderContext): void => {
{ name: 'field is wrong type', queryParams: { perPage: true } },
{ name: 'field is unknown', queryParams: { foo: 'bar' } },
{ name: 'page > 10k', queryParams: { page: 10001 } },
- { name: 'perPage > 10k', queryParams: { perPage: 10001 } },
+ { name: 'perPage > 100', queryParams: { perPage: 101 } },
{ name: 'page * perPage > 10k', queryParams: { page: 2, perPage: 9001 } },
]) {
it(`400s when ${errorScenario.name}`, async () => {
From dba2e9ba2c720e3b96dea4d301e2e2229361c94b Mon Sep 17 00:00:00 2001
From: Khristinin Nikita + {i18n.translate( + 'xpack.enterpriseSearch.content.searchApplication.searchPreview.configuration.tourContent', + { + defaultMessage: + 'Create your API key, learn about using language clients and find more resources in Connect.', + } + )} +
+
-
{i18n.translate(
- 'xpack.enterpriseSearch.content.searchApplication.safeSearchApi.step3.copyEndpointDescription',
+ 'xpack.enterpriseSearch.content.searchApplication.searchApi.step3.copyEndpointDescription',
{
defaultMessage: "Here's the URL for your endpoint:",
}
@@ -197,16 +197,16 @@ export const SearchApplicationAPI = () => {
),
title: i18n.translate(
- 'xpack.enterpriseSearch.content.searchApplication.safeSearchApi.step3.title',
+ 'xpack.enterpriseSearch.content.searchApplication.searchApi.step3.title',
{
- defaultMessage: 'Copy your Safe Search endpoint',
+ defaultMessage: 'Copy your Search endpoint',
}
),
},
{
children: