[Security Solution] Move exceptions builder to lists plugin

x-pack/plugins/security_solution/common/detection_engine/build_exceptions_filter.ts → x-pack/plugins/lists/common/exceptions/build_exceptions_filter.ts

@@ -9,17 +9,18 @@ import { chunk } from 'lodash/fp';
 
 import { Filter } from '../../../../../src/plugins/data/common';
 import {
-  ExceptionListItemSchema,
   CreateExceptionListItemSchema,
+  EntryExists,
   EntryMatch,
   EntryMatchAny,
   EntryNested,
+  ExceptionListItemSchema,
+  entriesExists,
   entriesMatch,
   entriesMatchAny,
-  entriesExists,
   entriesNested,
-  EntryExists,
-} from '../../../lists/common';
+} from '../schemas';
+
 import { BooleanFilter, NestedFilter } from './types';
 import { hasLargeValueList } from './utils';
 
@@ -83,8 +84,8 @@ export const buildExceptionFilter = ({
   const exceptionFilter: Filter = {
     meta: {
       alias: null,
-      negate: excludeExceptions,
       disabled: false,
+      negate: excludeExceptions,
     },
     query: {
       bool: {
@@ -108,8 +109,8 @@ export const buildExceptionFilter = ({
       return {
         meta: {
           alias: null,
-          negate: false,
           disabled: false,
+          negate: false,
         },
         query: {
           bool: {
@@ -124,8 +125,8 @@ export const buildExceptionFilter = ({
     return {
       meta: {
         alias: null,
-        negate: excludeExceptions,
         disabled: false,
+        negate: excludeExceptions,
       },
       query: {
         bool: {
@@ -148,14 +149,14 @@ export const buildMatchClause = (entry: EntryMatch): BooleanFilter => {
   const { field, operator, value } = entry;
   const matchClause = {
     bool: {
+      minimum_should_match: 1,
       should: [
         {
           match_phrase: {
             [field]: value,
           },
         },
       ],
-      minimum_should_match: 1,
     },
   };
 
@@ -172,35 +173,35 @@ export const getBaseMatchAnyClause = (entry: EntryMatchAny): BooleanFilter => {
   if (value.length === 1) {
     return {
       bool: {
+        minimum_should_match: 1,
         should: [
           {
             match_phrase: {
               [field]: value[0],
             },
           },
         ],
-        minimum_should_match: 1,
       },
     };
   }
 
   return {
     bool: {
+      minimum_should_match: 1,
       should: value.map((val) => {
         return {
           bool: {
+            minimum_should_match: 1,
             should: [
               {
                 match_phrase: {
                   [field]: val,
                 },
               },
             ],
-            minimum_should_match: 1,
           },
         };
       }),
-      minimum_should_match: 1,
     },
   };
 };
@@ -220,14 +221,14 @@ export const buildExistsClause = (entry: EntryExists): BooleanFilter => {
   const { field, operator } = entry;
   const existsClause = {
     bool: {
+      minimum_should_match: 1,
       should: [
         {
           exists: {
             field,
           },
         },
       ],
-      minimum_should_match: 1,
     },
   };
 

x-pack/plugins/lists/common/exceptions/index.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './build_exceptions_filter';

x-pack/plugins/lists/common/exceptions/types.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export interface BooleanFilter {
+  bool: {
+    must?: unknown | unknown[];
+    must_not?: unknown | unknown[];
+    should?: unknown[];
+    filter?: unknown | unknown[];
+    minimum_should_match?: number;
+  };
+}
+
+export interface NestedFilter {
+  nested: {
+    path: string;
+    query: unknown | unknown[];
+    score_mode: string;
+  };
+}

x-pack/plugins/lists/common/exceptions/utils.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CreateExceptionListItemSchema, EntriesArray, ExceptionListItemSchema } from '../schemas';
+
+export const hasLargeValueItem = (
+  exceptionItems: Array<ExceptionListItemSchema | CreateExceptionListItemSchema>
+): boolean => {
+  return exceptionItems.some((exceptionItem) => hasLargeValueList(exceptionItem.entries));
+};
+
+export const hasLargeValueList = (entries: EntriesArray): boolean => {
+  const found = entries.filter(({ type }) => type === 'list');
+  return found.length > 0;
+};
+
+export const hasNestedEntry = (entries: EntriesArray): boolean => {
+  const found = entries.filter(({ type }) => type === 'nested');
+  return found.length > 0;
+};

x-pack/plugins/lists/common/shared_exports.ts

@@ -48,4 +48,6 @@ export {
   OsTypeArray,
 } from './schemas';
 
+export { buildExceptionFilter } from './exceptions';
+
 export { ENDPOINT_LIST_ID, ENDPOINT_TRUSTED_APPS_LIST_ID } from './constants';

x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts

@@ -16,7 +16,7 @@ import {
   CreateExceptionListItemSchema,
 } from '../../../lists/common/schemas';
 import { ESBoolQuery } from '../typed_json';
-import { buildExceptionFilter } from './build_exceptions_filter';
+import { buildExceptionFilter } from '../shared_imports';
 import { Query, Language, Index, TimestampOverrideOrUndefined } from './schemas/common/schemas';
 
 export const getQueryFilter = (

x-pack/plugins/security_solution/common/detection_engine/types.ts

@@ -56,21 +56,3 @@ export interface EqlSearchResponse<T> {
     events?: Array<BaseHit<T>>;
   };
 }
-
-export interface BooleanFilter {
-  bool: {
-    must?: unknown | unknown[];
-    must_not?: unknown | unknown[];
-    should?: unknown[];
-    filter?: unknown | unknown[];
-    minimum_should_match?: number;
-  };
-}
-
-export interface NestedFilter {
-  nested: {
-    path: string;
-    query: unknown | unknown[];
-    score_mode: string;
-  };
-}

x-pack/plugins/security_solution/common/shared_imports.ts

@@ -47,4 +47,5 @@ export {
   ENDPOINT_TRUSTED_APPS_LIST_ID,
   osTypeArray,
   OsTypeArray,
+  buildExceptionFilter,
 } from '../../lists/common';

x-pack/plugins/security_solution/server/lib/machine_learning/index.ts

@@ -7,7 +7,7 @@
 
 import { RequestParams } from '@elastic/elasticsearch';
 
-import { buildExceptionFilter } from '../../../common/detection_engine/build_exceptions_filter';
+import { buildExceptionFilter } from '../../../common/shared_imports';
 import { ExceptionListItemSchema } from '../../../../lists/common';
 import { AnomalyRecordDoc as Anomaly } from '../../../../ml/server';
 import { SearchResponse } from '../types';