Skip to content

Commit 2dba15e

Browse files
ycterceroMadameSheemaelasticmachine
committed
[SIEM][Detections Engine] - Add rule markdown field to rule create, detail, and edit flows (#60108)
* add rule note markdown field to rule creation, rule details, and rule edit flows Co-authored-by: Gloria Hornero <snootchie.boochies@gmail.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
1 parent b2592e1 commit 2dba15e

File tree

28 files changed

+3166
-297
lines changed

28 files changed

+3166
-297
lines changed

‎x-pack/legacy/plugins/siem/cypress/integration/signal_detection_rules.spec.ts‎

Lines changed: 53 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -7,30 +7,30 @@
77
import { newRule } from '../objects/rule';
88

99
import {
10-
ABOUT_DESCRIPTION,
11-
ABOUT_EXPECTED_URLS,
1210
ABOUT_FALSE_POSITIVES,
1311
ABOUT_MITRE,
1412
ABOUT_RISK,
15-
ABOUT_RULE_DESCRIPTION,
1613
ABOUT_SEVERITY,
14+
ABOUT_STEP,
1715
ABOUT_TAGS,
1816
ABOUT_TIMELINE,
17+
ABOUT_URLS,
1918
DEFINITION_CUSTOM_QUERY,
20-
DEFINITION_DESCRIPTION,
2119
DEFINITION_INDEX_PATTERNS,
20+
DEFINITION_STEP,
2221
RULE_NAME_HEADER,
23-
SCHEDULE_DESCRIPTION,
2422
SCHEDULE_LOOPBACK,
2523
SCHEDULE_RUNS,
24+
SCHEDULE_STEP,
25+
ABOUT_RULE_DESCRIPTION,
2626
} from '../screens/rule_details';
2727
import {
2828
CUSTOM_RULES_BTN,
2929
ELASTIC_RULES_BTN,
3030
RISK_SCORE,
3131
RULE_NAME,
32-
RULES_TABLE,
3332
RULES_ROW,
33+
RULES_TABLE,
3434
SEVERITY,
3535
} from '../screens/signal_detection_rules';
3636

@@ -127,10 +127,25 @@ describe('Signal detection rules', () => {
127127

128128
goToRuleDetails();
129129

130-
cy.get(RULE_NAME_HEADER)
131-
.invoke('text')
132-
.should('eql', `${newRule.name} Beta`);
133-
130+
let expectedUrls = '';
131+
newRule.referenceUrls.forEach(url => {
132+
expectedUrls = expectedUrls + url;
133+
});
134+
let expectedFalsePositives = '';
135+
newRule.falsePositivesExamples.forEach(falsePositive => {
136+
expectedFalsePositives = expectedFalsePositives + falsePositive;
137+
});
138+
let expectedTags = '';
139+
newRule.tags.forEach(tag => {
140+
expectedTags = expectedTags + tag;
141+
});
142+
let expectedMitre = '';
143+
newRule.mitre.forEach(mitre => {
144+
expectedMitre = expectedMitre + mitre.tactic;
145+
mitre.techniques.forEach(technique => {
146+
expectedMitre = expectedMitre + technique;
147+
});
148+
});
134149
const expectedIndexPatterns = [
135150
'apm-*-transaction*',
136151
'auditbeat-*',
@@ -139,77 +154,60 @@ describe('Signal detection rules', () => {
139154
'packetbeat-*',
140155
'winlogbeat-*',
141156
];
142-
cy.get(DEFINITION_INDEX_PATTERNS).then(patterns => {
143-
cy.wrap(patterns).each((pattern, index) => {
144-
cy.wrap(pattern)
145-
.invoke('text')
146-
.should('eql', expectedIndexPatterns[index]);
147-
});
148-
});
149-
cy.get(DEFINITION_DESCRIPTION)
150-
.eq(DEFINITION_CUSTOM_QUERY)
157+
158+
cy.get(RULE_NAME_HEADER)
151159
.invoke('text')
152-
.should('eql', `${newRule.customQuery} `);
153-
cy.get(ABOUT_DESCRIPTION)
154-
.eq(ABOUT_RULE_DESCRIPTION)
160+
.should('eql', `${newRule.name} Beta`);
161+
162+
cy.get(ABOUT_RULE_DESCRIPTION)
155163
.invoke('text')
156164
.should('eql', newRule.description);
157-
cy.get(ABOUT_DESCRIPTION)
165+
cy.get(ABOUT_STEP)
158166
.eq(ABOUT_SEVERITY)
159167
.invoke('text')
160168
.should('eql', newRule.severity);
161-
cy.get(ABOUT_DESCRIPTION)
169+
cy.get(ABOUT_STEP)
162170
.eq(ABOUT_RISK)
163171
.invoke('text')
164172
.should('eql', newRule.riskScore);
165-
cy.get(ABOUT_DESCRIPTION)
173+
cy.get(ABOUT_STEP)
166174
.eq(ABOUT_TIMELINE)
167175
.invoke('text')
168176
.should('eql', 'Default blank timeline');
169-
170-
let expectedUrls = '';
171-
newRule.referenceUrls.forEach(url => {
172-
expectedUrls = expectedUrls + url;
173-
});
174-
cy.get(ABOUT_DESCRIPTION)
175-
.eq(ABOUT_EXPECTED_URLS)
177+
cy.get(ABOUT_STEP)
178+
.eq(ABOUT_URLS)
176179
.invoke('text')
177180
.should('eql', expectedUrls);
178-
179-
let expectedFalsePositives = '';
180-
newRule.falsePositivesExamples.forEach(falsePositive => {
181-
expectedFalsePositives = expectedFalsePositives + falsePositive;
182-
});
183-
cy.get(ABOUT_DESCRIPTION)
181+
cy.get(ABOUT_STEP)
184182
.eq(ABOUT_FALSE_POSITIVES)
185183
.invoke('text')
186184
.should('eql', expectedFalsePositives);
187-
188-
let expectedMitre = '';
189-
newRule.mitre.forEach(mitre => {
190-
expectedMitre = expectedMitre + mitre.tactic;
191-
mitre.techniques.forEach(technique => {
192-
expectedMitre = expectedMitre + technique;
193-
});
194-
});
195-
cy.get(ABOUT_DESCRIPTION)
185+
cy.get(ABOUT_STEP)
196186
.eq(ABOUT_MITRE)
197187
.invoke('text')
198188
.should('eql', expectedMitre);
199-
200-
let expectedTags = '';
201-
newRule.tags.forEach(tag => {
202-
expectedTags = expectedTags + tag;
203-
});
204-
cy.get(ABOUT_DESCRIPTION)
189+
cy.get(ABOUT_STEP)
205190
.eq(ABOUT_TAGS)
206191
.invoke('text')
207192
.should('eql', expectedTags);
208-
cy.get(SCHEDULE_DESCRIPTION)
193+
194+
cy.get(DEFINITION_INDEX_PATTERNS).then(patterns => {
195+
cy.wrap(patterns).each((pattern, index) => {
196+
cy.wrap(pattern)
197+
.invoke('text')
198+
.should('eql', expectedIndexPatterns[index]);
199+
});
200+
});
201+
cy.get(DEFINITION_STEP)
202+
.eq(DEFINITION_CUSTOM_QUERY)
203+
.invoke('text')
204+
.should('eql', `${newRule.customQuery} `);
205+
206+
cy.get(SCHEDULE_STEP)
209207
.eq(SCHEDULE_RUNS)
210208
.invoke('text')
211209
.should('eql', '5m');
212-
cy.get(SCHEDULE_DESCRIPTION)
210+
cy.get(SCHEDULE_STEP)
213211
.eq(SCHEDULE_LOOPBACK)
214212
.invoke('text')
215213
.should('eql', '1m');

‎x-pack/legacy/plugins/siem/cypress/screens/rule_details.ts‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,35 +4,35 @@
44
* you may not use this file except in compliance with the Elastic License.
55
*/
66

7-
export const ABOUT_DESCRIPTION = '[data-test-subj="aboutRule"] .euiDescriptionList__description';
7+
export const ABOUT_FALSE_POSITIVES = 4;
88

9-
export const ABOUT_EXPECTED_URLS = 4;
9+
export const ABOUT_MITRE = 5;
1010

11-
export const ABOUT_FALSE_POSITIVES = 5;
11+
export const ABOUT_RULE_DESCRIPTION = '[data-test-subj=stepAboutRuleDetailsToggleDescriptionText]';
1212

13-
export const ABOUT_MITRE = 6;
13+
export const ABOUT_RISK = 1;
1414

15-
export const ABOUT_RULE_DESCRIPTION = 0;
15+
export const ABOUT_SEVERITY = 0;
1616

17-
export const ABOUT_RISK = 2;
17+
export const ABOUT_STEP = '[data-test-subj="aboutRule"] .euiDescriptionList__description';
1818

19-
export const ABOUT_SEVERITY = 1;
19+
export const ABOUT_TAGS = 6;
2020

21-
export const ABOUT_TAGS = 7;
21+
export const ABOUT_TIMELINE = 2;
2222

23-
export const ABOUT_TIMELINE = 3;
23+
export const ABOUT_URLS = 3;
2424

2525
export const DEFINITION_CUSTOM_QUERY = 1;
2626

27-
export const DEFINITION_DESCRIPTION =
28-
'[data-test-subj="definition"] .euiDescriptionList__description';
29-
3027
export const DEFINITION_INDEX_PATTERNS =
31-
'[data-test-subj="definition"] .euiDescriptionList__description .euiBadge__text';
28+
'[data-test-subj=definitionRule] [data-test-subj="listItemColumnStepRuleDescription"] .euiDescriptionList__description .euiBadge__text';
29+
30+
export const DEFINITION_STEP =
31+
'[data-test-subj=definitionRule] [data-test-subj="listItemColumnStepRuleDescription"] .euiDescriptionList__description';
3232

3333
export const RULE_NAME_HEADER = '[data-test-subj="header-page-title"]';
3434

35-
export const SCHEDULE_DESCRIPTION = '[data-test-subj="schedule"] .euiDescriptionList__description';
35+
export const SCHEDULE_STEP = '[data-test-subj="schedule"] .euiDescriptionList__description';
3636

3737
export const SCHEDULE_RUNS = 0;
3838

‎x-pack/legacy/plugins/siem/dev_tools/circular_deps/run_check_circular_deps_cli.js‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,16 @@ run(
1717
[resolve(__dirname, '../../public'), resolve(__dirname, '../../common')],
1818
{
1919
fileExtensions: ['ts', 'js', 'tsx'],
20+
excludeRegExp: [
21+
'test.ts$',
22+
'test.tsx$',
23+
'containers/detection_engine/rules/types.ts$',
24+
'core/public/chrome/chrome_service.tsx$',
25+
'src/core/server/types.ts$',
26+
'src/core/server/saved_objects/types.ts$',
27+
'src/core/public/overlays/banners/banners_service.tsx$',
28+
'src/core/public/saved_objects/saved_objects_client.ts$',
29+
],
2030
}
2131
);
2232

‎x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/types.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ export const NewRuleSchema = t.intersection([
3333
threat: t.array(t.unknown),
3434
to: t.string,
3535
updated_by: t.string,
36+
note: t.string,
3637
}),
3738
]);
3839

@@ -86,6 +87,7 @@ export const RuleSchema = t.intersection([
8687
status_date: t.string,
8788
timeline_id: t.string,
8889
timeline_title: t.string,
90+
note: t.string,
8991
version: t.number,
9092
}),
9193
]);

0 commit comments

Comments
 (0)