Skip to content

Commit 43495d8

Browse files
Fixes bug where the same index was being passed in (#79949)
## Summary If you had two different index patterns for threat and your query I was previously sending the same pattern in for both which was causing drop down boxes for threat match to null things out. Now, I set the two different indexes correctly. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
1 parent 7732a21 commit 43495d8

File tree

3 files changed

+70
-9
lines changed

3 files changed

+70
-9
lines changed

x-pack/plugins/security_solution/public/common/components/threat_match/helpers.test.tsx

Lines changed: 63 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ describe('Helpers', () => {
6767
type: 'mapping',
6868
value: 'some os',
6969
};
70-
const output = getFormattedEntry(payloadIndexPattern, payloadItem, 0);
70+
const output = getFormattedEntry(payloadIndexPattern, payloadIndexPattern, payloadItem, 0);
7171
const expected: FormattedEntry = {
7272
entryIndex: 0,
7373
field: {
@@ -88,10 +88,10 @@ describe('Helpers', () => {
8888
});
8989

9090
describe('#getFormattedEntries', () => {
91-
test('it returns formatted entry with fields undefined if it unable to find a matching index pattern field', () => {
92-
const payloadIndexPattern: IndexPattern = getMockIndexPattern();
91+
test('it returns formatted entry with field and value undefined if it unable to find a matching index pattern field', () => {
92+
const payloadIndexPattern = getMockIndexPattern();
9393
const payloadItems: Entry[] = [{ field: 'field.one', type: 'mapping', value: 'field.one' }];
94-
const output = getFormattedEntries(payloadIndexPattern, payloadItems);
94+
const output = getFormattedEntries(payloadIndexPattern, payloadIndexPattern, payloadItems);
9595
const expected: FormattedEntry[] = [
9696
{
9797
entryIndex: 0,
@@ -103,13 +103,71 @@ describe('Helpers', () => {
103103
expect(output).toEqual(expected);
104104
});
105105

106+
test('it returns "undefined" value if cannot match a pattern field', () => {
107+
const payloadIndexPattern = getMockIndexPattern();
108+
const payloadItems: Entry[] = [{ field: 'machine.os', type: 'mapping', value: 'yolo' }];
109+
const output = getFormattedEntries(payloadIndexPattern, payloadIndexPattern, payloadItems);
110+
const expected: FormattedEntry[] = [
111+
{
112+
entryIndex: 0,
113+
field: {
114+
name: 'machine.os',
115+
type: 'string',
116+
esTypes: ['text'],
117+
count: 0,
118+
scripted: false,
119+
searchable: true,
120+
aggregatable: true,
121+
readFromDocValues: false,
122+
},
123+
value: undefined,
124+
type: 'mapping',
125+
},
126+
];
127+
expect(output).toEqual(expected);
128+
});
129+
130+
test('it returns value and field when they match two independent index patterns', () => {
131+
const payloadIndexPattern = getMockIndexPattern();
132+
const threatIndexPattern = getMockIndexPattern();
133+
const payloadItems: Entry[] = [{ field: 'machine.os', type: 'mapping', value: 'machine.os' }];
134+
const output = getFormattedEntries(payloadIndexPattern, threatIndexPattern, payloadItems);
135+
const expected: FormattedEntry[] = [
136+
{
137+
entryIndex: 0,
138+
field: {
139+
name: 'machine.os',
140+
type: 'string',
141+
esTypes: ['text'],
142+
count: 0,
143+
scripted: false,
144+
searchable: true,
145+
aggregatable: true,
146+
readFromDocValues: false,
147+
},
148+
value: {
149+
name: 'machine.os',
150+
type: 'string',
151+
esTypes: ['text'],
152+
count: 0,
153+
scripted: false,
154+
searchable: true,
155+
aggregatable: true,
156+
readFromDocValues: false,
157+
},
158+
type: 'mapping',
159+
},
160+
];
161+
expect(output).toEqual(expected);
162+
});
163+
106164
test('it returns formatted entries', () => {
107165
const payloadIndexPattern: IndexPattern = getMockIndexPattern();
108166
const payloadItems: Entry[] = [
109167
{ field: 'machine.os', type: 'mapping', value: 'machine.os' },
110168
{ field: 'ip', type: 'mapping', value: 'ip' },
111169
];
112-
const output = getFormattedEntries(payloadIndexPattern, payloadItems);
170+
const output = getFormattedEntries(payloadIndexPattern, payloadIndexPattern, payloadItems);
113171
const expected: FormattedEntry[] = [
114172
{
115173
field: {

x-pack/plugins/security_solution/public/common/components/threat_match/helpers.tsx

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,16 @@ import { Entry, FormattedEntry, ThreatMapEntries, EmptyEntry } from './types';
2222
*/
2323
export const getFormattedEntry = (
2424
indexPattern: IndexPattern,
25+
threatIndexPatterns: IndexPattern,
2526
item: Entry,
2627
itemIndex: number
2728
): FormattedEntry => {
2829
const { fields } = indexPattern;
30+
const { fields: threatFields } = threatIndexPatterns;
2931
const field = item.field;
3032
const threatField = item.value;
3133
const [foundField] = fields.filter(({ name }) => field != null && field === name);
32-
const [threatFoundField] = fields.filter(
34+
const [threatFoundField] = threatFields.filter(
3335
({ name }) => threatField != null && threatField === name
3436
);
3537
return {
@@ -48,10 +50,11 @@ export const getFormattedEntry = (
4850
*/
4951
export const getFormattedEntries = (
5052
indexPattern: IndexPattern,
53+
threatIndexPatterns: IndexPattern,
5154
entries: Entry[]
5255
): FormattedEntry[] => {
5356
return entries.reduce<FormattedEntry[]>((acc, item, index) => {
54-
const newItemEntry = getFormattedEntry(indexPattern, item, index);
57+
const newItemEntry = getFormattedEntry(indexPattern, threatIndexPatterns, item, index);
5558
return [...acc, newItemEntry];
5659
}, []);
5760
};

x-pack/plugins/security_solution/public/common/components/threat_match/list_item.tsx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,9 @@ export const ListItemComponent = React.memo<ListItemProps>(
7272
const entries = useMemo(
7373
(): FormattedEntry[] =>
7474
indexPattern != null && listItem.entries.length > 0
75-
? getFormattedEntries(indexPattern, listItem.entries)
75+
? getFormattedEntries(indexPattern, threatIndexPatterns, listItem.entries)
7676
: [],
77-
[listItem.entries, indexPattern]
77+
[listItem.entries, indexPattern, threatIndexPatterns]
7878
);
7979
return (
8080
<EuiFlexItem>

0 commit comments

Comments
 (0)