[TIP] Use search strategies in Threat Intelligence

x-pack/plugins/threat_intelligence/common/constants.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const THREAT_INTELLIGENCE_SEARCH_STRATEGY_NAME = 'threatIntelligenceSearchStrategy';
+
+export const BARCHART_AGGREGATION_NAME = 'barchartAggregation';
+
+/**
+ * Used inside custom search strategy
+ */
+export const enum FactoryQueryType {
+  IndicatorGrid = 'indicatorGrid',
+  Barchart = 'barchart',
+}

x-pack/plugins/threat_intelligence/kibana.json

@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "kibanaVersion": "kibana",
   "ui": true,
-  "server": false,
+  "server": true,
   "owner": {
     "name": "Protections Experience Team",
     "githubTeam": "protections-experience"

x-pack/plugins/threat_intelligence/public/common/utils/dates.test.ts

@@ -7,12 +7,7 @@
 
 import moment from 'moment-timezone';
 import { TimeRangeBounds } from '@kbn/data-plugin/common';
-import {
-  barChartTimeAxisLabelFormatter,
-  calculateBarchartColumnTimeInterval,
-  dateFormatter,
-  getDateDifferenceInDays,
-} from './dates';
+import { dateFormatter, getDateDifferenceInDays, barChartTimeAxisLabelFormatter } from './dates';
 import { EMPTY_VALUE } from '../constants';
 
 const mockValidStringDate = '1 Jan 2022 00:00:00 GMT';
@@ -88,32 +83,4 @@ describe('dates', () => {
       expect(typeof barChartTimeAxisLabelFormatter(dateRange)).toBe('function');
     });
   });
-
-  describe('calculateBarchartTimeInterval', () => {
-    it('should handle number dates', () => {
-      const from = moment(mockValidStringDate).valueOf();
-      const to = moment(mockValidStringDate).add(1, 'days').valueOf();
-
-      const interval = calculateBarchartColumnTimeInterval(from, to);
-      expect(interval).toContain('ms');
-      expect(parseInt(interval, 10) > 0).toBeTruthy();
-    });
-
-    it('should handle moment dates', () => {
-      const from = moment(mockValidStringDate);
-      const to = moment(mockValidStringDate).add(1, 'days');
-
-      const interval = calculateBarchartColumnTimeInterval(from, to);
-      expect(interval).toContain('ms');
-      expect(parseInt(interval, 10) > 0).toBeTruthy();
-    });
-
-    it('should handle dateTo older than dateFrom', () => {
-      const from = moment(mockValidStringDate).add(1, 'days');
-      const to = moment(mockValidStringDate);
-
-      const interval = calculateBarchartColumnTimeInterval(from, to);
-      expect(parseInt(interval, 10) > 0).toBeFalsy();
-    });
-  });
 });

x-pack/plugins/threat_intelligence/public/common/utils/dates.tsx

@@ -14,7 +14,6 @@ import { EMPTY_VALUE } from '../constants';
 moment.suppressDeprecationWarnings = true;
 
 export const FULL_DATE = 'MMMM Do YYYY @ HH:mm:ss';
-export const BARCHART_NUMBER_OF_COLUMNS = 16;
 
 /**
  * Converts a string or moment date to the 'MMMM Do YYYY @ HH:mm:ss' format.
@@ -62,20 +61,3 @@ export const barChartTimeAxisLabelFormatter = (dateRange: TimeRangeBounds): Tick
   const format = niceTimeFormatByDay(diff);
   return timeFormatter(format);
 };
-
-/**
- * Calculates the time interval in ms for a specific number of columns
- * @param dateFrom Min (older) date for the barchart
- * @param dateTo Max (newer) date for the barchart
- * @param numberOfColumns Desired number of columns (defaulted to {@link BARCHART_NUMBER_OF_COLUMNS})
- * @returns The interval in ms for a column (for example '100000ms')
- */
-export const calculateBarchartColumnTimeInterval = (
-  dateFrom: number | moment.Moment,
-  dateTo: number | moment.Moment,
-  numberOfColumns = BARCHART_NUMBER_OF_COLUMNS
-): string => {
-  const from: number = moment.isMoment(dateFrom) ? dateFrom.valueOf() : dateFrom;
-  const to: number = moment.isMoment(dateTo) ? dateTo.valueOf() : dateTo;
-  return `${Math.floor(moment(to).diff(moment(from)) / numberOfColumns)}ms`;
-};

x-pack/plugins/threat_intelligence/public/modules/indicators/components/barchart/field_selector/field_selector.stories.tsx

@@ -8,7 +8,7 @@
 import React from 'react';
 import { Story } from '@storybook/react';
 import { DataView, DataViewField } from '@kbn/data-views-plugin/common';
-import { RawIndicatorFieldId } from '../../../types';
+import { RawIndicatorFieldId } from '../../../../../../common/types/indicator';
 import { IndicatorsFieldSelector } from '.';
 
 const mockIndexPattern: DataView = {

x-pack/plugins/threat_intelligence/public/modules/indicators/components/barchart/field_selector/field_selector.tsx

@@ -11,7 +11,7 @@ import { i18n } from '@kbn/i18n';
 import { DataViewField } from '@kbn/data-views-plugin/common';
 import { EuiComboBoxOptionOption } from '@elastic/eui/src/components/combo_box/types';
 import { SecuritySolutionDataViewBase } from '../../../../../types';
-import { RawIndicatorFieldId } from '../../../types';
+import { RawIndicatorFieldId } from '../../../../../../common/types/indicator';
 import { useStyles } from './styles';
 
 export const DROPDOWN_TEST_ID = 'tiIndicatorFieldSelectorDropdown';

x-pack/plugins/threat_intelligence/public/modules/indicators/components/barchart/wrapper.stories.tsx

@@ -14,10 +14,11 @@ import { DataView, DataViewField } from '@kbn/data-views-plugin/common';
 import { TimeRange } from '@kbn/es-query';
 import { DataPublicPluginStart } from '@kbn/data-plugin/public';
 import { IUiSettingsClient } from '@kbn/core/public';
+import { BARCHART_AGGREGATION_NAME } from '../../../../../common/constants';
 import { StoryProvidersComponent } from '../../../../common/mocks/story_providers';
 import { mockKibanaTimelinesService } from '../../../../common/mocks/mock_kibana_timelines_service';
 import { IndicatorsBarChartWrapper } from '.';
-import { Aggregation, AGGREGATION_NAME, ChartSeries } from '../../services';
+import { Aggregation, ChartSeries } from '../../services';
 
 export default {
   component: IndicatorsBarChartWrapper,
@@ -84,7 +85,7 @@ const dataServiceMock = {
       of({
         rawResponse: {
           aggregations: {
-            [AGGREGATION_NAME]: {
+            [BARCHART_AGGREGATION_NAME]: {
               buckets: [aggregation1, aggregation2],
             },
           },

x-pack/plugins/threat_intelligence/public/modules/indicators/components/barchart/wrapper.tsx

@@ -18,7 +18,7 @@ import { FormattedMessage } from '@kbn/i18n-react';
 import { TimeRange } from '@kbn/es-query';
 import { TimeRangeBounds } from '@kbn/data-plugin/common';
 import { SecuritySolutionDataViewBase } from '../../../../types';
-import { RawIndicatorFieldId } from '../../types';
+import { RawIndicatorFieldId } from '../../../../../common/types/indicator';
 import { IndicatorsFieldSelector } from './field_selector';
 import { IndicatorsBarChart } from './barchart';
 import { ChartSeries } from '../../services';

x-pack/plugins/threat_intelligence/public/modules/indicators/components/field_label/field_label.tsx

@@ -7,7 +7,7 @@
 
 import React, { VFC } from 'react';
 import { i18n } from '@kbn/i18n';
-import { RawIndicatorFieldId } from '../../types';
+import { RawIndicatorFieldId } from '../../../../../common/types/indicator';
 
 interface IndicatorFieldLabelProps {
   field: string;

x-pack/plugins/threat_intelligence/public/modules/indicators/components/field_value/field.stories.tsx

@@ -7,7 +7,7 @@
 
 import React from 'react';
 import { StoryProvidersComponent } from '../../../../common/mocks/story_providers';
-import { generateMockIndicator } from '../../types';
+import { generateMockIndicator } from '../../../../../common/types/indicator';
 import { IndicatorFieldValue } from '.';
 
 export default {

x-pack/plugins/threat_intelligence/public/modules/indicators/components/field_value/field.test.tsx

@@ -8,7 +8,10 @@
 import React from 'react';
 import { render } from '@testing-library/react';
 import { IndicatorFieldValue } from '.';
-import { generateMockIndicator, generateMockIndicatorWithTlp } from '../../types';
+import {
+  generateMockIndicator,
+  generateMockIndicatorWithTlp,
+} from '../../../../../common/types/indicator';
 import { EMPTY_VALUE } from '../../../../common/constants';
 import { TestProvidersComponent } from '../../../../common/mocks/test_providers';
 

x-pack/plugins/threat_intelligence/public/modules/indicators/components/field_value/field_value.tsx

@@ -8,7 +8,7 @@
 import React, { VFC } from 'react';
 import { useFieldTypes } from '../../../../hooks';
 import { EMPTY_VALUE } from '../../../../common/constants';
-import { Indicator, RawIndicatorFieldId } from '../../types';
+import { Indicator, RawIndicatorFieldId } from '../../../../../common/types/indicator';
 import { DateFormatter } from '../../../../components/date_formatter';
 import { unwrapValue } from '../../utils';
 import { TLPBadge } from '../tlp_badge';

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/fields_table/fields_table.stories.tsx

@@ -8,7 +8,7 @@
 import React from 'react';
 import { mockIndicatorsFiltersContext } from '../../../../../common/mocks/mock_indicators_filters_context';
 import { IndicatorFieldsTable } from '.';
-import { generateMockIndicator } from '../../../types';
+import { generateMockIndicator } from '../../../../../../common/types/indicator';
 import { StoryProvidersComponent } from '../../../../../common/mocks/story_providers';
 import { IndicatorsFiltersContext } from '../../../containers/filters';
 

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/fields_table/fields_table.tsx

@@ -8,7 +8,7 @@
 import { EuiBasicTableColumn, EuiInMemoryTable, EuiInMemoryTableProps } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import React, { useMemo, VFC } from 'react';
-import { Indicator } from '../../../types';
+import { Indicator } from '../../../../../../common/types/indicator';
 import { IndicatorFieldValue } from '../../field_value';
 import { IndicatorValueActions } from '../indicator_value_actions';
 

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/flyout.stories.tsx

@@ -8,7 +8,7 @@
 import React from 'react';
 import { Story } from '@storybook/react';
 import { StoryProvidersComponent } from '../../../../common/mocks/story_providers';
-import { generateMockIndicator, Indicator } from '../../types';
+import { generateMockIndicator, Indicator } from '../../../../../common/types/indicator';
 import { IndicatorsFlyout } from '.';
 
 export default {

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/flyout.test.tsx

@@ -8,7 +8,7 @@
 import React from 'react';
 import { cleanup, render, screen } from '@testing-library/react';
 import { IndicatorsFlyout, SUBTITLE_TEST_ID, TITLE_TEST_ID } from '.';
-import { generateMockIndicator, Indicator } from '../../types';
+import { generateMockIndicator, Indicator } from '../../../../../common/types/indicator';
 import { TestProvidersComponent } from '../../../../common/mocks/test_providers';
 
 const mockIndicator = generateMockIndicator();

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/flyout.tsx

@@ -23,7 +23,7 @@ import {
 import { FormattedMessage } from '@kbn/i18n-react';
 import { InvestigateInTimelineButton } from '../../../timeline';
 import { DateFormatter } from '../../../../components/date_formatter/date_formatter';
-import { Indicator, RawIndicatorFieldId } from '../../types';
+import { Indicator, RawIndicatorFieldId } from '../../../../../common/types/indicator';
 import { IndicatorsFlyoutJson } from './json_tab';
 import { IndicatorsFlyoutTable } from './table_tab';
 import { unwrapValue } from '../../utils';

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/indicator_value_actions/indicator_value_actions.tsx

@@ -14,7 +14,7 @@ import {
   EuiToolTip,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { Indicator } from '../../../types';
+import { Indicator } from '../../../../../../common/types/indicator';
 import { FilterInButtonIcon, FilterOutButtonIcon } from '../../../../query_bar';
 import { AddToTimelineContextMenu } from '../../../../timeline';
 import { fieldAndValueValid, getIndicatorFieldAndValue } from '../../../utils';

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/json_tab/json_tab.stories.tsx

@@ -7,7 +7,7 @@
 
 import React from 'react';
 import { Story } from '@storybook/react';
-import { generateMockIndicator, Indicator } from '../../../types';
+import { generateMockIndicator, Indicator } from '../../../../../../common/types/indicator';
 import { IndicatorsFlyoutJson } from '.';
 
 export default {

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/json_tab/json_tab.test.tsx

@@ -8,7 +8,7 @@
 import React from 'react';
 import { render } from '@testing-library/react';
 import { TestProvidersComponent } from '../../../../../common/mocks/test_providers';
-import { generateMockIndicator, Indicator } from '../../../types';
+import { generateMockIndicator, Indicator } from '../../../../../../common/types/indicator';
 import { CODE_BLOCK_TEST_ID, IndicatorsFlyoutJson } from '.';
 import { EMPTY_PROMPT_TEST_ID } from '../empty_prompt';
 

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/json_tab/json_tab.tsx

@@ -7,7 +7,7 @@
 
 import React, { VFC } from 'react';
 import { EuiCodeBlock } from '@elastic/eui';
-import { Indicator } from '../../../types';
+import { Indicator } from '../../../../../../common/types/indicator';
 import { IndicatorEmptyPrompt } from '../empty_prompt';
 
 export const CODE_BLOCK_TEST_ID = 'tiFlyoutJsonCodeBlock';

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/overview_tab/block/block.stories.tsx

@@ -8,7 +8,7 @@
 import React from 'react';
 import { IndicatorsFiltersContext } from '../../../../containers/filters';
 import { StoryProvidersComponent } from '../../../../../../common/mocks/story_providers';
-import { generateMockIndicator } from '../../../../types';
+import { generateMockIndicator } from '../../../../../../../common/types/indicator';
 import { IndicatorBlock } from '.';
 
 export default {

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/overview_tab/block/block.tsx

@@ -8,7 +8,7 @@
 import { EuiPanel, EuiSpacer, EuiText } from '@elastic/eui';
 import React, { VFC } from 'react';
 import { css, euiStyled } from '@kbn/kibana-react-plugin/common';
-import { Indicator } from '../../../../types';
+import { Indicator } from '../../../../../../../common/types/indicator';
 import { IndicatorFieldValue } from '../../../field_value';
 import { IndicatorFieldLabel } from '../../../field_label';
 import { IndicatorValueActions } from '../../indicator_value_actions';

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/overview_tab/highlighted_values_table/highlighted_values_table.tsx

@@ -6,7 +6,7 @@
  */
 
 import React, { useMemo, VFC } from 'react';
-import { Indicator, RawIndicatorFieldId } from '../../../../types';
+import { Indicator, RawIndicatorFieldId } from '../../../../../../../common/types/indicator';
 import { unwrapValue } from '../../../../utils';
 import { IndicatorFieldsTable } from '../../fields_table';
 

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/overview_tab/overview_tab.stories.tsx

@@ -8,7 +8,7 @@
 import React from 'react';
 import { Story } from '@storybook/react';
 import { StoryProvidersComponent } from '../../../../../common/mocks/story_providers';
-import { generateMockIndicator, Indicator } from '../../../types';
+import { generateMockIndicator, Indicator } from '../../../../../../common/types/indicator';
 import { IndicatorsFlyoutOverview } from '.';
 import { IndicatorsFiltersContext } from '../../../containers/filters';
 

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/overview_tab/overview_tab.test.tsx

@@ -8,7 +8,7 @@
 import { TestProvidersComponent } from '../../../../../common/mocks/test_providers';
 import { render, screen } from '@testing-library/react';
 import React from 'react';
-import { generateMockIndicator, Indicator } from '../../../types';
+import { generateMockIndicator, Indicator } from '../../../../../../common/types/indicator';
 import {
   IndicatorsFlyoutOverview,
   TI_FLYOUT_OVERVIEW_HIGH_LEVEL_BLOCKS,

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/overview_tab/overview_tab.tsx

@@ -17,7 +17,7 @@ import {
 import { FormattedMessage } from '@kbn/i18n-react';
 import React, { useMemo, VFC } from 'react';
 import { EMPTY_VALUE } from '../../../../../common/constants';
-import { Indicator, RawIndicatorFieldId } from '../../../types';
+import { Indicator, RawIndicatorFieldId } from '../../../../../../common/types/indicator';
 import { unwrapValue } from '../../../utils';
 import { IndicatorEmptyPrompt } from '../empty_prompt';
 import { IndicatorBlock } from './block';

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/table_tab/table_tab.stories.tsx

@@ -12,7 +12,7 @@ import { createKibanaReactContext } from '@kbn/kibana-react-plugin/public';
 import { mockIndicatorsFiltersContext } from '../../../../../common/mocks/mock_indicators_filters_context';
 import { mockUiSettingsService } from '../../../../../common/mocks/mock_kibana_ui_settings_service';
 import { mockKibanaTimelinesService } from '../../../../../common/mocks/mock_kibana_timelines_service';
-import { generateMockIndicator, Indicator } from '../../../types';
+import { generateMockIndicator, Indicator } from '../../../../../../common/types/indicator';
 import { IndicatorsFlyoutTable } from '.';
 import { IndicatorsFiltersContext } from '../../../containers/filters';
 

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/table_tab/table_tab.test.tsx

@@ -8,7 +8,11 @@
 import React from 'react';
 import { render } from '@testing-library/react';
 import { TestProvidersComponent } from '../../../../../common/mocks/test_providers';
-import { generateMockIndicator, Indicator, RawIndicatorFieldId } from '../../../types';
+import {
+  generateMockIndicator,
+  Indicator,
+  RawIndicatorFieldId,
+} from '../../../../../../common/types/indicator';
 import { IndicatorsFlyoutTable, TABLE_TEST_ID } from '.';
 import { unwrapValue } from '../../../utils';
 import { EMPTY_PROMPT_TEST_ID } from '../empty_prompt';

x-pack/plugins/threat_intelligence/public/modules/indicators/components/flyout/table_tab/table_tab.tsx

@@ -6,7 +6,7 @@
  */
 
 import React, { VFC } from 'react';
-import { Indicator } from '../../../types';
+import { Indicator } from '../../../../../../common/types/indicator';
 import { IndicatorEmptyPrompt } from '../empty_prompt';
 import { IndicatorFieldsTable } from '../fields_table';
 

x-pack/plugins/threat_intelligence/public/modules/indicators/components/table/components/actions_row_cell.tsx

@@ -8,7 +8,7 @@
 import React, { useContext, VFC } from 'react';
 import { EuiFlexGroup } from '@elastic/eui';
 import { InvestigateInTimelineButtonIcon } from '../../../../timeline';
-import { Indicator } from '../../../types';
+import { Indicator } from '../../../../../../common/types/indicator';
 import { OpenIndicatorFlyoutButton } from './open_flyout_button';
 import { IndicatorsTableContext } from '../contexts';
 

x-pack/plugins/threat_intelligence/public/modules/indicators/components/table/components/cell_actions.tsx

@@ -7,7 +7,7 @@
 
 import React, { VFC } from 'react';
 import { EuiDataGridColumnCellActionProps } from '@elastic/eui/src/components/datagrid/data_grid_types';
-import { Indicator } from '../../../types';
+import { Indicator } from '../../../../../../common/types/indicator';
 import { AddToTimelineCellAction } from '../../../../timeline';
 import { FilterInCellAction, FilterOutCellAction } from '../../../../query_bar';
 import { fieldAndValueValid, getIndicatorFieldAndValue } from '../../../utils';

x-pack/plugins/threat_intelligence/public/modules/indicators/components/table/components/cell_popover_renderer.tsx

@@ -16,7 +16,7 @@ import { CopyToClipboardButtonEmpty } from '../../copy_to_clipboard/copy_to_clip
 import { FilterInButtonEmpty, FilterOutButtonEmpty } from '../../../../query_bar';
 import { AddToTimelineButtonEmpty } from '../../../../timeline';
 import { fieldAndValueValid, getIndicatorFieldAndValue } from '../../../utils/field_value';
-import { Indicator } from '../../../types';
+import { Indicator } from '../../../../../../common/types/indicator';
 import { Pagination } from '../../../services/fetch_indicators';
 import { useStyles } from './styles';
 

x-pack/plugins/threat_intelligence/public/modules/indicators/components/table/components/cell_renderer.tsx

@@ -9,7 +9,7 @@ import { EuiDataGridCellValueElementProps } from '@elastic/eui';
 import React, { useContext, useEffect } from 'react';
 import { euiDarkVars as themeDark, euiLightVars as themeLight } from '@kbn/ui-theme';
 import { useKibana } from '../../../../../hooks';
-import { Indicator } from '../../../types';
+import { Indicator } from '../../../../../../common/types/indicator';
 import { IndicatorFieldValue } from '../../field_value';
 import { IndicatorsTableContext } from '../contexts';
 import { ActionsRowCell } from '.';