[Security Solution][RAC] - Update UI signal references

x-pack/plugins/security_solution/common/constants.ts

@@ -8,6 +8,7 @@
 import type { TransformConfigSchema } from './transforms/types';
 import { ENABLE_CASE_CONNECTOR } from '../../cases/common';
 import { metadataTransformPattern } from './endpoint/constants';
+import { ALERT_RULE_THREAT_TACTIC_NAME } from '../../timelines/common/alerts';
 
 export const APP_ID = 'securitySolution';
 export const SERVER_APP_ID = 'siem';
@@ -299,7 +300,7 @@ export const showAllOthersBucket: string[] = [
  'event.category',
  'event.dataset',
  'event.module',
- 'signal.rule.threat.tactic.name',
+ ALERT_RULE_THREAT_TACTIC_NAME,
  'source.ip',
  'destination.ip',
  'user.name',

x-pack/plugins/security_solution/common/ecs/ecs_fields/index.ts

@@ -5,6 +5,44 @@
  * 2.0.
  */
 
+import {
+ ALERT_RULE_CREATED_AT,
+ ALERT_RULE_CREATED_BY,
+ ALERT_RULE_DESCRIPTION,
+ ALERT_RULE_ENABLED,
+ ALERT_RULE_FROM,
+ ALERT_RULE_UUID,
+ ALERT_RULE_NAME,
+ ALERT_RULE_NOTE,
+ ALERT_RULE_REFERENCES,
+ ALERT_RULE_RISK_SCORE,
+ ALERT_RULE_RULE_ID,
+ ALERT_RULE_SEVERITY,
+ ALERT_RULE_TAGS,
+ ALERT_RULE_TO,
+ ALERT_RULE_TYPE,
+ ALERT_RULE_UPDATED_AT,
+ ALERT_RULE_UPDATED_BY,
+ ALERT_RULE_VERSION,
+} from '@kbn/rule-data-utils';
+import {
+ ALERT_ORIGINAL_TIME,
+ ALERT_RULE_EXCEPTIONS_LIST,
+ ALERT_RULE_FALSE_POSITIVES,
+ ALERT_RULE_FILTERS,
+ ALERT_RULE_IMMUTABLE,
+ ALERT_RULE_INDEX,
+ ALERT_RULE_LANGUAGE,
+ ALERT_RULE_MAX_SIGNALS,
+ ALERT_RULE_OUTPUT_INDEX,
+ ALERT_RULE_QUERY,
+ ALERT_RULE_SAVED_ID,
+ ALERT_RULE_SIZE,
+ ALERT_RULE_THREAT,
+ ALERT_RULE_THRESHOLD,
+ ALERT_RULE_TIMELINE_ID,
+ ALERT_RULE_TIMELINE_TITLE,
+} from '../../../../timelines/common/alerts';
 import { extendMap } from './extend_map';
 
 export const auditdMap: Readonly<Record<string, string>> = {
@@ -290,41 +328,41 @@ export const systemFieldsMap: Readonly<Record<string, string>> = {
  'system.auth.ssh.method': 'system.auth.ssh.method',
 };
 
-export const signalFieldsMap: Readonly<Record<string, string>> = {
- 'signal.original_time': 'signal.original_time',
- 'signal.rule.id': 'signal.rule.id',
- 'signal.rule.saved_id': 'signal.rule.saved_id',
- 'signal.rule.timeline_id': 'signal.rule.timeline_id',
- 'signal.rule.timeline_title': 'signal.rule.timeline_title',
- 'signal.rule.output_index': 'signal.rule.output_index',
- 'signal.rule.from': 'signal.rule.from',
- 'signal.rule.index': 'signal.rule.index',
- 'signal.rule.language': 'signal.rule.language',
- 'signal.rule.query': 'signal.rule.query',
- 'signal.rule.to': 'signal.rule.to',
- 'signal.rule.filters': 'signal.rule.filters',
- 'signal.rule.rule_id': 'signal.rule.rule_id',
- 'signal.rule.false_positives': 'signal.rule.false_positives',
- 'signal.rule.max_signals': 'signal.rule.max_signals',
- 'signal.rule.risk_score': 'signal.rule.risk_score',
- 'signal.rule.description': 'signal.rule.description',
- 'signal.rule.name': 'signal.rule.name',
- 'signal.rule.immutable': 'signal.rule.immutable',
- 'signal.rule.references': 'signal.rule.references',
- 'signal.rule.severity': 'signal.rule.severity',
- 'signal.rule.tags': 'signal.rule.tags',
- 'signal.rule.threat': 'signal.rule.threat',
- 'signal.rule.type': 'signal.rule.type',
- 'signal.rule.size': 'signal.rule.size',
- 'signal.rule.enabled': 'signal.rule.enabled',
- 'signal.rule.created_at': 'signal.rule.created_at',
- 'signal.rule.updated_at': 'signal.rule.updated_at',
- 'signal.rule.created_by': 'signal.rule.created_by',
- 'signal.rule.updated_by': 'signal.rule.updated_by',
- 'signal.rule.version': 'signal.rule.version',
- 'signal.rule.note': 'signal.rule.note',
- 'signal.rule.threshold': 'signal.rule.threshold',
- 'signal.rule.exceptions_list': 'signal.rule.exceptions_list',
+export const alertFieldsMap: Readonly<Record<string, string>> = {
+ [ALERT_ORIGINAL_TIME]: ALERT_ORIGINAL_TIME,
+ [ALERT_RULE_UUID]: ALERT_RULE_UUID,
+ [ALERT_RULE_SAVED_ID]: ALERT_RULE_SAVED_ID,
+ [ALERT_RULE_TIMELINE_ID]: ALERT_RULE_TIMELINE_ID,
+ [ALERT_RULE_TIMELINE_TITLE]: ALERT_RULE_TIMELINE_TITLE,
+ [ALERT_RULE_OUTPUT_INDEX]: ALERT_RULE_OUTPUT_INDEX,
+ [ALERT_RULE_FROM]: ALERT_RULE_FROM,
+ [ALERT_RULE_INDEX]: ALERT_RULE_INDEX,
+ [ALERT_RULE_LANGUAGE]: ALERT_RULE_LANGUAGE,
+ [ALERT_RULE_QUERY]: ALERT_RULE_QUERY,
+ [ALERT_RULE_TO]: ALERT_RULE_TO,
+ [ALERT_RULE_FILTERS]: ALERT_RULE_FILTERS,
+ [ALERT_RULE_RULE_ID]: ALERT_RULE_RULE_ID,
+ [ALERT_RULE_FALSE_POSITIVES]: ALERT_RULE_FALSE_POSITIVES,
+ [ALERT_RULE_MAX_SIGNALS]: ALERT_RULE_MAX_SIGNALS,
+ [ALERT_RULE_RISK_SCORE]: ALERT_RULE_RISK_SCORE,
+ [ALERT_RULE_DESCRIPTION]: ALERT_RULE_DESCRIPTION,
+ [ALERT_RULE_NAME]: ALERT_RULE_NAME,
+ [ALERT_RULE_IMMUTABLE]: ALERT_RULE_IMMUTABLE,
+ [ALERT_RULE_REFERENCES]: ALERT_RULE_REFERENCES,
+ [ALERT_RULE_SEVERITY]: ALERT_RULE_SEVERITY,
+ [ALERT_RULE_TAGS]: ALERT_RULE_TAGS,
+ [ALERT_RULE_THREAT]: ALERT_RULE_THREAT,
+ [ALERT_RULE_TYPE]: ALERT_RULE_TYPE,
+ [ALERT_RULE_SIZE]: ALERT_RULE_SIZE,
+ [ALERT_RULE_ENABLED]: ALERT_RULE_ENABLED,
+ [ALERT_RULE_CREATED_AT]: ALERT_RULE_CREATED_AT,
+ [ALERT_RULE_UPDATED_AT]: ALERT_RULE_UPDATED_AT,
+ [ALERT_RULE_CREATED_BY]: ALERT_RULE_CREATED_BY,
+ [ALERT_RULE_UPDATED_BY]: ALERT_RULE_UPDATED_BY,
+ [ALERT_RULE_VERSION]: ALERT_RULE_VERSION,
+ [ALERT_RULE_NOTE]: ALERT_RULE_NOTE,
+ [ALERT_RULE_THRESHOLD]: ALERT_RULE_THRESHOLD,
+ [ALERT_RULE_EXCEPTIONS_LIST]: ALERT_RULE_EXCEPTIONS_LIST,
 };
 
 export const ruleFieldsMap: Readonly<Record<string, string>> = {
@@ -336,6 +374,7 @@ export const eventFieldsMap: Readonly<Record<string, string>> = {
  '@timestamp': '@timestamp',
  message: 'message',
  ...{ ...agentFieldsMap },
+ ...{ ...alertFieldsMap },
  ...{ ...auditdMap },
  ...{ ...destinationFieldsMap },
  ...{ ...dnsFieldsMap },
@@ -346,7 +385,6 @@ export const eventFieldsMap: Readonly<Record<string, string>> = {
  ...{ ...hostFieldsMap },
  ...{ ...networkFieldsMap },
  ...{ ...ruleFieldsMap },
- ...{ ...signalFieldsMap },
  ...{ ...sourceFieldsMap },
  ...{ ...suricataFieldsMap },
  ...{ ...systemFieldsMap },

x-pack/plugins/security_solution/common/ecs/index.ts

@@ -15,6 +15,7 @@ import { EventEcs } from './event';
 import { FileEcs } from './file';
 import { GeoEcs } from './geo';
 import { HostEcs } from './host';
+import { KibanaEcs } from './kibana';
 import { NetworkEcs } from './network';
 import { RegistryEcs } from './registry';
 import { RuleEcs } from './rule';
@@ -45,6 +46,7 @@ export interface Ecs {
  event?: EventEcs;
  geo?: GeoEcs;
  host?: HostEcs;
+ kibana?: KibanaEcs;
  network?: NetworkEcs;
  registry?: RegistryEcs;
  rule?: RuleEcs;

x-pack/plugins/security_solution/common/ecs/kibana/index.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { RuleEcs } from '../rule';
+
+export interface KibanaEcs {
+ alert?: {
+ rule?: RuleEcs;
+ original_time?: string[];
+ status?: string[];
+ group?: {
+ id?: string[];
+ };
+ threshold_result?: unknown;
+ };
+}

x-pack/plugins/security_solution/common/utils/field_formatters.test.ts

@@ -5,9 +5,10 @@
  * 2.0.
  */
 
+import { eventDetailsFormattedFields, eventHit } from '@kbn/securitysolution-t-grid';
+import { ALERT_RULE_NAME, ALERT_WORKFLOW_STATUS } from '@kbn/rule-data-utils';
 import { EventHit, EventSource } from '../search_strategy';
 import { getDataFromFieldsHits, getDataFromSourceHits, getDataSafety } from './field_formatters';
-import { eventDetailsFormattedFields, eventHit } from '@kbn/securitysolution-t-grid';
 
 describe('Events Details Helpers', () => {
  const fields: EventHit['fields'] = eventHit.fields;
@@ -135,8 +136,8 @@ describe('Events Details Helpers', () => {
  it('#getDataFromSourceHits', () => {
  const _source: EventSource = {
  '@timestamp': '2021-02-24T00:41:06.527Z',
- 'signal.status': 'open',
- 'signal.rule.name': 'Rawr',
+ [ALERT_WORKFLOW_STATUS]: 'open',
+ [ALERT_RULE_NAME]: 'Rawr',
  'threat.indicator': [
  {
  provider: 'yourself',
@@ -161,15 +162,15 @@ describe('Events Details Helpers', () => {
  isObjectArray: false,
  },
  {
- category: 'signal',
- field: 'signal.status',
+ category: 'kibana',
+ field: ALERT_WORKFLOW_STATUS,
  values: ['open'],
  originalValue: ['open'],
  isObjectArray: false,
  },
  {
- category: 'signal',
- field: 'signal.rule.name',
+ category: 'kibana',
+ field: ALERT_RULE_NAME,
  values: ['Rawr'],
  originalValue: ['Rawr'],
  isObjectArray: false,

x-pack/plugins/security_solution/cypress/integration/detection_rules/override.spec.ts

@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { ALERT_RULE_RISK_SCORE } from '@kbn/rule-data-utils';
 import { formatMitreAttackDescription } from '../../helpers/rules';
 import {
  getIndexPatterns,
@@ -139,7 +140,7 @@ describe('Detection rules, override', () => {
  getDetails(RISK_SCORE_DETAILS).should('have.text', this.rule.riskScore);
  getDetails(RISK_SCORE_OVERRIDE_DETAILS).should(
  'have.text',
- `${this.rule.riskOverride}signal.rule.risk_score`
+ `${this.rule.riskOverride}${ALERT_RULE_RISK_SCORE}`
  );
  getDetails(RULE_NAME_OVERRIDE_DETAILS).should('have.text', this.rule.nameOverride);
  getDetails(REFERENCE_URLS_DETAILS).should((details) => {

x-pack/plugins/security_solution/cypress/screens/alerts.ts

@@ -19,13 +19,14 @@ export const ALERT_GRID_CELL = '[data-test-subj="dataGridRowCell"]';
 export const ALERT_ID = '[data-test-subj="draggable-content-_id"]';
 
 export const ALERT_RISK_SCORE_HEADER =
- '[data-test-subj="dataGridHeaderCell-signal.rule.risk_score"]';
+ '[data-test-subj="dataGridHeaderCell-kibana.alert.rule.risk_score"]';
 
-export const ALERT_RULE_NAME = '[data-test-subj="formatted-field-signal.rule.name"]';
+export const ALERT_RULE_NAME = '[data-test-subj="formatted-field-kibana.alert.rule.name"]';
 
-export const ALERT_RULE_RISK_SCORE = '[data-test-subj="formatted-field-signal.rule.risk_score"]';
+export const ALERT_RULE_RISK_SCORE =
+ '[data-test-subj="formatted-field-kibana.alert.rule.risk_score"]';
 
-export const ALERT_RULE_SEVERITY = '[data-test-subj="formatted-field-signal.rule.severity"]';
+export const ALERT_RULE_SEVERITY = '[data-test-subj="formatted-field-kibana.alert.rule.severity"]';
 
 export const ALERT_DATA_GRID = '[data-test-subj="dataGridWrapper"]';
 

x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.test.ts

@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { ALERT_RULE_NAME } from '@kbn/rule-data-utils';
 import { omit } from 'lodash/fp';
 import { DropResult } from 'react-beautiful-dnd';
 import { getTimelineIdFromColumnDroppableId } from '../../../../../timelines/public';
@@ -663,7 +664,7 @@ describe('helpers', () => {
  expect(
  allowTopN({
  browserField: undefined,
- fieldName: 'signal.rule.name',
+ fieldName: ALERT_RULE_NAME,
  })
  ).toBe(true);
  });