[8.0] [Security Solution] Enables telemetry for endpoint rules (#120225)

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/__mocks__/rule_type.ts

@@ -20,10 +20,11 @@ import { ConfigType } from '../../../../config';
 import { AlertAttributes } from '../../signals/types';
 import { createRuleMock } from './rule';
 import { listMock } from '../../../../../../lists/server/mocks';
-import { RuleParams } from '../../schemas/rule_schemas';
+import { QueryRuleParams, RuleParams } from '../../schemas/rule_schemas';
 // this is only used in tests
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { createDefaultAlertExecutorOptions } from '../../../../../../rule_registry/server/utils/rule_executor_test_utils';
+import { getCompleteRuleMock } from '../../schemas/rule_schemas.mock';
 
 export const createRuleTypeMocks = (
   ruleType: string = 'query',
@@ -88,9 +89,15 @@ export const createRuleTypeMocks = (
       lists: listMock.createSetup(),
       logger: loggerMock,
       ml: mlPluginServerMock.createSetupContract(),
-      ruleDataClient: ruleRegistryMocks.createRuleDataClient(
-        '.alerts-security.alerts'
-      ) as IRuleDataClient,
+      ruleDataClient: {
+        ...(ruleRegistryMocks.createRuleDataClient('.alerts-security.alerts') as IRuleDataClient),
+        getReader: jest.fn((_options?: { namespace?: string }) => ({
+          search: jest.fn().mockResolvedValue({
+            aggregations: undefined,
+          }),
+          getDynamicIndexPattern: jest.fn(),
+        })),
+      },
       eventLogService: eventLogServiceMock.create(),
     },
     services,
@@ -102,6 +109,9 @@ export const createRuleTypeMocks = (
           alertId: v4(),
           state: {},
         }),
+        runOpts: {
+          completeRule: getCompleteRuleMock(params as QueryRuleParams),
+        },
         services,
       });
     },

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/indicator_match/create_indicator_match_alert_type.ts

@@ -16,7 +16,7 @@ import { CreateRuleOptions, SecurityAlertType } from '../types';
 export const createIndicatorMatchAlertType = (
   createOptions: CreateRuleOptions
 ): SecurityAlertType<ThreatRuleParams, {}, {}, 'default'> => {
-  const { experimentalFeatures, logger, version } = createOptions;
+  const { eventsTelemetry, experimentalFeatures, logger, version } = createOptions;
   return {
     id: INDICATOR_RULE_TYPE_ID,
     name: 'Indicator Match Rule',
@@ -68,7 +68,7 @@ export const createIndicatorMatchAlertType = (
         bulkCreate,
         exceptionItems,
         experimentalFeatures,
-        eventsTelemetry: undefined,
+        eventsTelemetry,
         listClient,
         logger,
         completeRule,