Skip to content

Commit

Permalink
[Security Solution] [Detections] Update search after to use one singl…
Browse files Browse the repository at this point in the history 
…e date range filter (elastic#86921)

## Summary

Ref: elastic#86874



replaces `should` with a single lower bounded and upper bounded date range filter.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
  • Loading branch information
@dhurley14 @spong
dhurley14 authored and spong committed Jan 6, 2021
1 parent 37017f1 commit cb8b084
Show file tree
Hide file tree
Showing 2 changed files with 42 additions and 189 deletions.
198 changes: 36 additions & 162 deletions .../plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,33 +38,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
Expand Down Expand Up @@ -118,33 +97,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
Expand Down Expand Up @@ -199,33 +157,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
Expand Down Expand Up @@ -281,33 +218,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
Expand Down Expand Up @@ -362,33 +278,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
Expand Down Expand Up @@ -445,33 +340,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
Expand Down
33 changes: 6 additions & 27 deletions x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,33 +49,12 @@ export const buildEventsSearchQuery = ({

const rangeFilter: unknown[] = [
{
bool: {
should: [
{
range: {
[sortField]: {
gte: from,
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
[sortField]: {
lte: to,
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
[sortField]: {
lte: to,
gte: from,
format: 'strict_date_optional_time',
},
},
},
];
Expand Down

0 comments on commit cb8b084

Please sign in to comment.