Skip to content

Commit 3ab8e45

Browse files
lgestclgestc
authored
fixed field data sourcing (#177472)
## Summary This fixes: SDH issue **882** #173627 ### Before the fix Note how the field actually displays an alias instead of the value. This is due some fallback behavior I think. ![highlighted_before](https://github.com/elastic/kibana/assets/11671118/c66ef18f-d0f9-4964-b69f-94bba6d31c60) ### After the fix ![highlighted_after](https://github.com/elastic/kibana/assets/11671118/ee730392-7617-4654-87bc-a8addb7342e2) The missing bit was the actual value to display as it was not passed down correctly from the parent conext ### How to test this? 1. create custom index and populate it with data ``` PUT test POST test/_doc { "user.id": "888", "@timestamp": "2024-02-21T15:20:10.084Z" } ``` 2. create threshold rule looking like this: ![image](https://github.com/elastic/kibana/assets/11671118/07089ba8-e0b9-40f1-8372-15cb8a94e043) 3. actual value that triggered the alert should be rendered in the highlighted fields panel in the flyout
1 parent 3ef768a commit 3ab8e45

5 files changed

Lines changed: 93 additions & 18 deletions

File tree

‎x-pack/plugins/security_solution/public/flyout/document_details/shared/hooks/use_highlighted_fields.test.tsx‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,10 @@
77

88
import { renderHook } from '@testing-library/react-hooks';
99

10-
import { mockDataFormattedForFieldBrowser } from '../mocks/mock_data_formatted_for_field_browser';
10+
import {
11+
mockDataFormattedForFieldBrowser,
12+
mockDataFormattedForFieldBrowserWithOverridenField,
13+
} from '../mocks/mock_data_formatted_for_field_browser';
1114
import { useHighlightedFields } from './use_highlighted_fields';
1215
import { SENTINEL_ONE_AGENT_ID_FIELD } from '../../../../common/utils/sentinelone_alert_check';
1316

@@ -23,6 +26,25 @@ describe('useHighlightedFields', () => {
2326
});
2427
});
2528

29+
it('should return overriden field value when it is present', () => {
30+
const hookResult = renderHook(() =>
31+
useHighlightedFields({
32+
dataFormattedForFieldBrowser: mockDataFormattedForFieldBrowserWithOverridenField,
33+
})
34+
);
35+
36+
// NOTE: overrideField is constructed based on specific field from the result set
37+
expect(hookResult.result.current).toMatchObject({
38+
'kibana.alert.threshold_result.terms.field': {
39+
overrideField: {
40+
field: 'kibana.alert.threshold_result.terms.value',
41+
values: ['overriden value'], // missing value in the override
42+
},
43+
values: ['original value'],
44+
},
45+
});
46+
});
47+
2648
it('should omit endpoint agent id field if data is not s1 alert', () => {
2749
const hookResult = renderHook(() =>
2850
useHighlightedFields({

‎x-pack/plugins/security_solution/public/flyout/document_details/shared/hooks/use_highlighted_fields.ts‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ export interface UseHighlightedFieldsResult {
3434
/**
3535
* If the field has a custom override
3636
*/
37-
overrideField?: string;
37+
overrideField?: { field: string; values: string[] };
3838
/**
3939
* Values for the field
4040
*/
@@ -114,7 +114,13 @@ export const useHighlightedFields = ({
114114
return {
115115
...acc,
116116
[field.id]: {
117-
...(field.overrideField && { overrideField: field.overrideField }),
117+
...(field.overrideField && {
118+
overrideField: {
119+
field: field.overrideField,
120+
values:
121+
find({ field: field.overrideField }, dataFormattedForFieldBrowser)?.values ?? [],
122+
},
123+
}),
118124
values: fieldValues,
119125
},
120126
};

‎x-pack/plugins/security_solution/public/flyout/document_details/shared/mocks/mock_data_formatted_for_field_browser.ts‎

Lines changed: 34 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,15 @@
77

88
import type { TimelineEventsDetailsItem } from '@kbn/timelines-plugin/common';
99

10-
/**
11-
* Mock an array of fields for an alert
12-
*/
13-
export const mockDataFormattedForFieldBrowser: TimelineEventsDetailsItem[] = [
10+
export const ruleTypeField: TimelineEventsDetailsItem = {
11+
category: 'kibana',
12+
field: 'kibana.alert.rule.type',
13+
values: ['query'],
14+
originalValue: ['query'],
15+
isObjectArray: false,
16+
};
17+
18+
export const baseFields: TimelineEventsDetailsItem[] = [
1419
{
1520
category: 'base',
1621
field: '@timestamp',
@@ -60,13 +65,6 @@ export const mockDataFormattedForFieldBrowser: TimelineEventsDetailsItem[] = [
6065
originalValue: ['rule-parameters-index'],
6166
isObjectArray: false,
6267
},
63-
{
64-
category: 'kibana',
65-
field: 'kibana.alert.rule.type',
66-
values: ['query'],
67-
originalValue: ['query'],
68-
isObjectArray: false,
69-
},
7068
{
7169
category: 'kibana',
7270
field: 'kibana.alert.rule.uuid',
@@ -89,3 +87,28 @@ export const mockDataFormattedForFieldBrowser: TimelineEventsDetailsItem[] = [
8987
isObjectArray: false,
9088
},
9189
];
90+
91+
/**
92+
* Mock an array of fields for an alert
93+
*/
94+
export const mockDataFormattedForFieldBrowser: TimelineEventsDetailsItem[] = [
95+
ruleTypeField,
96+
...baseFields,
97+
];
98+
99+
export const mockDataFormattedForFieldBrowserWithOverridenField = [
100+
{ ...ruleTypeField, values: ['threshold'], originalValue: ['threshold'] },
101+
{
102+
category: 'base',
103+
field: 'kibana.alert.threshold_result.terms.field',
104+
values: ['original value'],
105+
isObjectArray: false,
106+
},
107+
{
108+
category: 'base',
109+
field: 'kibana.alert.threshold_result.terms.value',
110+
values: ['overriden value'],
111+
isObjectArray: false,
112+
},
113+
...baseFields,
114+
];

‎x-pack/plugins/security_solution/public/flyout/document_details/shared/utils/highlighted_fields_helpers.test.ts‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,10 @@ describe('convertHighlightedFieldsToTableRow', () => {
3333
]);
3434
});
3535

36-
it('should convert take override name over default name', () => {
36+
it('should convert take override name over default name and use original values if not present in the override', () => {
3737
const highlightedFields = {
3838
'host.name': {
39-
overrideField: 'host.name-override',
39+
overrideField: { field: 'host.name-override', values: [] },
4040
values: ['host-1'],
4141
},
4242
};
@@ -53,6 +53,27 @@ describe('convertHighlightedFieldsToTableRow', () => {
5353
},
5454
]);
5555
});
56+
57+
it('should convert take override name over default name and use provided values', () => {
58+
const highlightedFields = {
59+
'host.name': {
60+
overrideField: { field: 'host.name-override', values: ['value override!'] },
61+
values: ['host-1'],
62+
},
63+
};
64+
expect(convertHighlightedFieldsToTableRow(highlightedFields, scopeId, isPreview)).toEqual([
65+
{
66+
field: 'host.name-override',
67+
description: {
68+
field: 'host.name-override',
69+
originalField: 'host.name',
70+
values: ['value override!'],
71+
scopeId: 'scopeId',
72+
isPreview,
73+
},
74+
},
75+
]);
76+
});
5677
});
5778

5879
describe('convertHighlightedFieldsToPrevalenceFilters', () => {

‎x-pack/plugins/security_solution/public/flyout/document_details/shared/utils/highlighted_fields_helpers.ts‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,12 @@ export const convertHighlightedFieldsToTableRow = (
2121
): HighlightedFieldsTableRow[] => {
2222
const fieldNames = Object.keys(highlightedFields);
2323
return fieldNames.map((fieldName) => {
24-
const values = highlightedFields[fieldName].values;
25-
const overrideFieldName = highlightedFields[fieldName].overrideField;
24+
const overrideFieldName = highlightedFields[fieldName].overrideField?.field;
25+
const overrideFieldValues = highlightedFields[fieldName].overrideField?.values;
2626
const field = overrideFieldName ? overrideFieldName : fieldName;
27+
const values = overrideFieldValues?.length
28+
? overrideFieldValues
29+
: highlightedFields[fieldName].values;
2730

2831
return {
2932
field,

0 commit comments

Comments
 (0)