[Security Solution][Case] ServiceNow ITSM: Add category & subcategory fields

[cnasikas]

Summary

The PR adds two new fields for the ServiceNow ITSM connector. Specifically, category and subcategory. It also fixes a bug when changing categories and subcategories in ServiceNow SIR connector.

Create Case

ITSM.-.Create.Case.mov

Alerts & Detections

Meta: https://github.com/elastic/security-team/issues/477
Depends on: #88655

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
• Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
• This was checked for cross-browser compatibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[YulNaumenko]

Alerting related changes LGTM

[elasticmachine]

Pinging @elastic/uptime (Team:uptime)

[justinkambic]

LGTM

[justinkambic]

We'll want to update our UI to allow users to actually set these without using the API directly. I'm creating a follow-up issue.

elastic/uptime#300

[cnasikas]

@justinkambic FWIW, there is an API call (subaction) where you can get dynamically all available choices (impact, priority, severity, category, subcategory) for a specific instance. If you are interested to this please ping me on Slack!

Example: https://github.com/cnasikas/kibana/blob/itms_category/x-pack/plugins/security_solution/public/cases/components/connectors/servicenow/servicenow_itsm_case_fields.tsx

[cnasikas]

@elasticmachine merge upstream

[stephmilovic]

nit: I know the other tests here dont follow this and it passes as is without, but the correct way would be:

Suggested change

	test('it should set subcategory to null when changing category', async () => {
	await waitFor(() => {
	const select = wrapper.find(EuiSelect).filter(`[data-test-subj="categorySelect"]`)!;
	select.prop('onChange')!({
	target: {
	value: 'network',
	},
	} as React.ChangeEvent<HTMLSelectElement>);
	});
	wrapper.update();
	expect(onChange).toHaveBeenCalledWith({
	...fields,
	subcategory: null,
	category: 'network',
	});
	});
	test('it should set subcategory to null when changing category', async () => {
	const select = wrapper.find(EuiSelect).filter(`[data-test-subj="categorySelect"]`)!;
	select.prop('onChange')!({
	target: {
	value: 'network',
	},
	} as React.ChangeEvent<HTMLSelectElement>);
	wrapper.update();
	await waitFor(() => {
	expect(onChange).toHaveBeenCalledWith({
	...fields,
	subcategory: null,
	category: 'network',
	});
	});
	});

[stephmilovic]

the await waitFor should be surrounding the expect after the async change. it definitely does not always work this way, but alas we're using enzyme with react-testing-library

[stephmilovic]

I'd do a useCallback here since you have the incident value

[cnasikas]

There is no difference if we use the incident or not. The callback function will always be a new reference for the prop no matter what we do inside the function.

[stephmilovic]

Manual testing went perfectly. Just a few nits on the code, other than that LGTM. very clean, nicely done! 🎸

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 81cfa31

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	2180	2181	+1
triggersActionsUi	337	338	+1
total			+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	7.5MB	7.5MB	+3.8KB
triggersActionsUi	1.4MB	1.4MB	+3.4KB
uptime	909.2KB	909.2KB	+31.0B
total			+7.2KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	234.0KB	234.1KB	+105.0B

History

• 💚 Build #105562 succeeded 0a794b6
• 💔 Build #105515 failed b745780
• 💔 Build #105487 failed 8962df3
• 💔 Build #105382 failed ba6e698
• 💔 Build #105285 failed 8a9690d

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream