Skip to content

Commit 24c253e

Browse files
ycterceroyctercero
authored
[SIEM][Detections Engine] - Update rule.lists to be rule.exceptions_list (#63717)
### Summary [63717] This PR updates the rules lists param to be `exceptions_list`. This is done in an attempt to make the terminology less confusing as lists will generally be referring to the big lists values. It should also make it more clear that the `exceptions_list` logic is being applied as a double not.
1 parent 38217b6 commit 24c253e

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+141
-141
lines changed

‎x-pack/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -448,7 +448,7 @@ export const getResult = (): RuleAlertType => ({
448448
references: ['http://www.example.com', 'https://ww.example.com'],
449449
note: '# Investigative notes',
450450
version: 1,
451-
lists: [
451+
exceptions_list: [
452452
{
453453
field: 'source.ip',
454454
values_operator: 'included',

‎x-pack/plugins/siem/server/lib/detection_engine/routes/__mocks__/utils.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ export const getOutputRuleAlertForRest = (): Omit<
138138
],
139139
},
140140
],
141-
lists: [
141+
exceptions_list: [
142142
{
143143
field: 'source.ip',
144144
values_operator: 'included',

‎x-pack/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
8686
timeline_id: timelineId,
8787
timeline_title: timelineTitle,
8888
version,
89-
lists,
89+
exceptions_list,
9090
} = payloadRule;
9191
const ruleIdOrUuid = ruleId ?? uuid.v4();
9292
try {
@@ -143,7 +143,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
143143
references,
144144
note,
145145
version,
146-
lists,
146+
exceptions_list,
147147
actions: throttle === 'rule' ? actions : [], // Only enable actions if throttle is set to rule, otherwise we are a notification and should not enable it,
148148
});
149149

‎x-pack/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ export const createRulesRoute = (router: IRouter): void => {
6666
type,
6767
references,
6868
note,
69-
lists,
69+
exceptions_list,
7070
} = request.body;
7171
const siemResponse = buildSiemResponse(response);
7272

@@ -131,7 +131,7 @@ export const createRulesRoute = (router: IRouter): void => {
131131
references,
132132
note,
133133
version: 1,
134-
lists,
134+
exceptions_list,
135135
actions: throttle === 'rule' ? actions : [], // Only enable actions if throttle is rule, otherwise we are a notification and should not enable it,
136136
});
137137

‎x-pack/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ export const importRulesRoute = (router: IRouter, config: ConfigType) => {
138138
timeline_id: timelineId,
139139
timeline_title: timelineTitle,
140140
version,
141-
lists,
141+
exceptions_list,
142142
} = parsedRule;
143143

144144
try {
@@ -195,7 +195,7 @@ export const importRulesRoute = (router: IRouter, config: ConfigType) => {
195195
references,
196196
note,
197197
version,
198-
lists,
198+
exceptions_list,
199199
actions: [], // Actions are not imported nor exported at this time
200200
});
201201
resolve({ rule_id: ruleId, status_code: 200 });
@@ -232,7 +232,7 @@ export const importRulesRoute = (router: IRouter, config: ConfigType) => {
232232
references,
233233
note,
234234
version,
235-
lists,
235+
exceptions_list,
236236
anomalyThreshold,
237237
machineLearningJobId,
238238
});

‎x-pack/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
8181
references,
8282
note,
8383
version,
84-
lists,
84+
exceptions_list,
8585
} = payloadRule;
8686
const finalIndex = outputIndex ?? siemClient.signalsIndex;
8787
const idOrRuleIdOrUnknown = id ?? ruleId ?? '(unknown id)';
@@ -121,7 +121,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
121121
references,
122122
note,
123123
version,
124-
lists,
124+
exceptions_list,
125125
actions,
126126
});
127127
if (rule != null) {

‎x-pack/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ export const updateRulesRoute = (router: IRouter) => {
6767
references,
6868
note,
6969
version,
70-
lists,
70+
exceptions_list,
7171
} = request.body;
7272
const siemResponse = buildSiemResponse(response);
7373

@@ -117,7 +117,7 @@ export const updateRulesRoute = (router: IRouter) => {
117117
references,
118118
note,
119119
version,
120-
lists,
120+
exceptions_list,
121121
actions: throttle === 'rule' ? actions : [], // Only enable actions if throttle is rule, otherwise we are a notification and should not enable it
122122
});
123123

‎x-pack/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ export const transformAlertToRule = (
148148
last_failure_message: ruleStatus?.attributes.lastFailureMessage,
149149
last_success_message: ruleStatus?.attributes.lastSuccessMessage,
150150
// TODO: (LIST-FEATURE) Remove hasListsFeature() check once we have lists available for a release
151-
lists: hasListsFeature() ? alert.params.lists : null,
151+
exceptions_list: hasListsFeature() ? alert.params.exceptions_list : null,
152152
});
153153
};
154154

‎x-pack/plugins/siem/server/lib/detection_engine/routes/rules/validate.test.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ export const ruleOutput: RulesSchema = {
7171
},
7272
},
7373
],
74-
lists: [
74+
exceptions_list: [
7575
{
7676
field: 'source.ip',
7777
values_operator: 'included',

‎x-pack/plugins/siem/server/lib/detection_engine/routes/schemas/add_prepackaged_rules_schema.test.ts‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1542,8 +1542,8 @@ describe('add prepackaged rules schema', () => {
15421542
// on demand. Since they are per module, we have a an issue where the ENV variables do not take effect. It is better we change all the
15431543
// schema's to be function calls to avoid global side effects or just wait until the feature is available. If you want to test this early,
15441544
// you can remove the .skip and set your env variable of export ELASTIC_XPACK_SIEM_LISTS_FEATURE=true locally
1545-
describe.skip('lists', () => {
1546-
test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, note, and lists] does validate', () => {
1545+
describe.skip('exceptions_list', () => {
1546+
test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, note, and exceptions_list] does validate', () => {
15471547
expect(
15481548
addPrepackagedRulesSchema.validate<Partial<PrepackagedRules>>({
15491549
rule_id: 'rule-1',
@@ -1558,7 +1558,7 @@ describe('add prepackaged rules schema', () => {
15581558
risk_score: 50,
15591559
note: '# some markdown',
15601560
version: 1,
1561-
lists: [
1561+
exceptions_list: [
15621562
{
15631563
field: 'source.ip',
15641564
values_operator: 'included',
@@ -1594,7 +1594,7 @@ describe('add prepackaged rules schema', () => {
15941594
).toBeFalsy();
15951595
});
15961596

1597-
test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, note, and empty lists] does validate', () => {
1597+
test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, note, and empty exceptions_list] does validate', () => {
15981598
expect(
15991599
addPrepackagedRulesSchema.validate<Partial<PrepackagedRules>>({
16001600
rule_id: 'rule-1',
@@ -1608,15 +1608,15 @@ describe('add prepackaged rules schema', () => {
16081608
type: 'query',
16091609
risk_score: 50,
16101610
note: '# some markdown',
1611-
lists: [],
1611+
exceptions_list: [],
16121612
version: 1,
16131613
}).error
16141614
).toBeFalsy();
16151615
});
16161616

1617-
test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, note, and invalid lists] does NOT validate', () => {
1617+
test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, note, and invalid exceptions_list] does NOT validate', () => {
16181618
expect(
1619-
addPrepackagedRulesSchema.validate<Partial<Omit<PrepackagedRules, 'lists'>>>({
1619+
addPrepackagedRulesSchema.validate<Partial<Omit<PrepackagedRules, 'exceptions_list'>>>({
16201620
rule_id: 'rule-1',
16211621
description: 'some description',
16221622
from: 'now-5m',
@@ -1628,17 +1628,17 @@ describe('add prepackaged rules schema', () => {
16281628
type: 'query',
16291629
risk_score: 50,
16301630
note: '# some markdown',
1631-
lists: [{ invalid_value: 'invalid value' }],
1631+
exceptions_list: [{ invalid_value: 'invalid value' }],
16321632
version: 1,
16331633
}).error.message
16341634
).toEqual(
1635-
'child "lists" fails because ["lists" at position 0 fails because [child "field" fails because ["field" is required]]]'
1635+
'child "exceptions_list" fails because ["exceptions_list" at position 0 fails because [child "field" fails because ["field" is required]]]'
16361636
);
16371637
});
16381638

1639-
test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, note, and non-existent lists] does validate with empty lists', () => {
1639+
test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, note, and non-existent exceptions_list] does validate with empty exceptions_list', () => {
16401640
expect(
1641-
addPrepackagedRulesSchema.validate<Partial<Omit<PrepackagedRules, 'lists'>>>({
1641+
addPrepackagedRulesSchema.validate<Partial<Omit<PrepackagedRules, 'exceptions_list'>>>({
16421642
rule_id: 'rule-1',
16431643
description: 'some description',
16441644
from: 'now-5m',
@@ -1651,7 +1651,7 @@ describe('add prepackaged rules schema', () => {
16511651
risk_score: 50,
16521652
note: '# some markdown',
16531653
version: 1,
1654-
}).value.lists
1654+
}).value.exceptions_list
16551655
).toEqual([]);
16561656
});
16571657
});

0 commit comments

Comments
 (0)