From bcc5f8447a29b7a42d471ff846732156e105e05b Mon Sep 17 00:00:00 2001 From: Edgar Santos Date: Fri, 7 Mar 2025 14:57:20 +0100 Subject: [PATCH 1/3] [Security Solution][Detection Engine] fixes rule preview works for from's invalid state (#173930) --- .../components/rule_preview/helpers.test.ts | 131 +++++++++++++++++- .../components/rule_preview/helpers.ts | 13 +- .../pages/rule_creation/index.tsx | 9 +- .../pages/rule_editing/index.tsx | 3 +- 4 files changed, 148 insertions(+), 8 deletions(-) diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts index f20b7cd4f7007..15c937ae73f7f 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts @@ -7,7 +7,8 @@ import moment from 'moment'; import { DataSourceType } from '../../../../detections/pages/detection_engine/rules/types'; -import { isNoisy, getTimeframeOptions, getIsRulePreviewDisabled } from './helpers'; +import { isNoisy, getTimeframeOptions, getIsRulePreviewDisabled, isEveryThresholdFieldValid } from './helpers'; +import { FieldsMap } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib'; describe('query_preview/helpers', () => { const timeframeEnd = moment(); @@ -90,6 +91,7 @@ describe('query_preview/helpers', () => { ruleType: 'threat_match', isQueryBarValid: true, isThreatQueryBarValid: true, + isThresholdValid: false, index: [], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -109,6 +111,7 @@ describe('query_preview/helpers', () => { ruleType: 'threat_match', isQueryBarValid: false, isThreatQueryBarValid: true, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -128,6 +131,7 @@ describe('query_preview/helpers', () => { ruleType: 'threat_match', isQueryBarValid: true, isThreatQueryBarValid: false, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -147,6 +151,7 @@ describe('query_preview/helpers', () => { ruleType: 'threat_match', isQueryBarValid: true, isThreatQueryBarValid: true, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -166,6 +171,7 @@ describe('query_preview/helpers', () => { ruleType: 'threat_match', isQueryBarValid: true, isThreatQueryBarValid: true, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -183,6 +189,7 @@ describe('query_preview/helpers', () => { ruleType: 'threat_match', isQueryBarValid: true, isThreatQueryBarValid: true, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -200,6 +207,7 @@ describe('query_preview/helpers', () => { ruleType: 'eql', isQueryBarValid: true, isThreatQueryBarValid: true, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -217,6 +225,7 @@ describe('query_preview/helpers', () => { ruleType: 'new_terms', isQueryBarValid: true, isThreatQueryBarValid: true, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -234,6 +243,7 @@ describe('query_preview/helpers', () => { ruleType: 'threat_match', isQueryBarValid: true, isThreatQueryBarValid: true, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -253,6 +263,7 @@ describe('query_preview/helpers', () => { ruleType: 'eql', isQueryBarValid: true, isThreatQueryBarValid: true, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -274,6 +285,7 @@ describe('query_preview/helpers', () => { ruleType: 'eql', isQueryBarValid: true, isThreatQueryBarValid: false, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -304,6 +316,7 @@ describe('query_preview/helpers', () => { ruleType: 'eql', isQueryBarValid: true, isThreatQueryBarValid: false, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -325,6 +338,7 @@ describe('query_preview/helpers', () => { ruleType: 'eql', isQueryBarValid: true, isThreatQueryBarValid: false, + isThresholdValid: false, index: ['test-*'], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -347,6 +361,7 @@ describe('query_preview/helpers', () => { ruleType: 'machine_learning', isQueryBarValid: true, isThreatQueryBarValid: true, + isThresholdValid: false, index: [], dataViewId: undefined, dataSourceType: DataSourceType.IndexPatterns, @@ -358,6 +373,90 @@ describe('query_preview/helpers', () => { }); expect(isDisabled).toEqual(false); }); + + test('disabled for ML rule when machine learning job id is empty', () => { + const isDisabled = getIsRulePreviewDisabled({ + ruleType: 'machine_learning', + isQueryBarValid: true, + isThreatQueryBarValid: true, + isThresholdValid: false, + index: [], + dataViewId: undefined, + dataSourceType: DataSourceType.IndexPatterns, + threatIndex: [], + threatMapping: [], + machineLearningJobId: [], + queryBar: { filters: [], query: { query: '', language: '' }, saved_id: null }, + newTermsFields: [], + }); + expect(isDisabled).toEqual(true); + }); + + test('enabled when threshold rule with non empty query', () => { + const isDisabled = getIsRulePreviewDisabled({ + ruleType: 'eql', + isQueryBarValid: true, + isThreatQueryBarValid: false, + isThresholdValid: true, + index: ['test-*'], + dataViewId: undefined, + dataSourceType: DataSourceType.IndexPatterns, + threatIndex: [], + threatMapping: [], + machineLearningJobId: [], + queryBar: { + filters: [], + query: { query: 'any where true', language: 'eql' }, + saved_id: null, + }, + newTermsFields: [], + }); + expect(isDisabled).toEqual(false); + }); + + test('disabled when threshold rule with empty query', () => { + const isDisabled = getIsRulePreviewDisabled({ + ruleType: 'eql', + isQueryBarValid: true, + isThreatQueryBarValid: false, + isThresholdValid: true, + index: ['test-*'], + dataViewId: undefined, + dataSourceType: DataSourceType.IndexPatterns, + threatIndex: [], + threatMapping: [], + machineLearningJobId: [], + queryBar: { + filters: [], + query: { query: '', language: 'eql' }, + saved_id: null, + }, + newTermsFields: [], + }); + expect(isDisabled).toEqual(true); + }); + + test('disabled when threshold rule with invalid threshold', () => { + const isDisabled = getIsRulePreviewDisabled({ + ruleType: 'eql', + isQueryBarValid: true, + isThreatQueryBarValid: false, + isThresholdValid: false, + index: ['test-*'], + dataViewId: undefined, + dataSourceType: DataSourceType.IndexPatterns, + threatIndex: [], + threatMapping: [], + machineLearningJobId: [], + queryBar: { + filters: [], + query: { query: 'any where true', language: 'eql' }, + saved_id: null, + }, + newTermsFields: [], + }); + expect(isDisabled).toEqual(true); + }); }); describe('getTimeframeOptions', () => { @@ -386,4 +485,34 @@ describe('query_preview/helpers', () => { expect(options).toEqual([{ value: 'h', text: 'Last hour' }]); }); }); + + describe('isEveryThresholdFieldValud', () => { + const fieldLabels = [ + 'threshold.field', + 'threshold.value', + 'threshold.cardinality.field', + 'threshold.cardinality.value', + ] + const allFieldsValid = fieldLabels.reduce((acc, label) => { + acc[label] = { isValid: true }; + return acc; + }, {} as Record) as unknown as FieldsMap; + + test('returns true if all fields are valid', () => { + const isValid = isEveryThresholdFieldValid(allFieldsValid); + + expect(isValid).toEqual(true); + }); + + + test.each(fieldLabels)('returns false if a field is invalid', (fieldLabel) => { + const fields = { + ...allFieldsValid, + // Override the field that should be invalid for this test case + [fieldLabel]: { isValid: false }, + } as unknown as FieldsMap; + + expect(isEveryThresholdFieldValid(fields)).toEqual(false); + }); + }) }); diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.ts b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.ts index 476bc66d9123e..821846e946c03 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.ts +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.ts @@ -14,6 +14,7 @@ import type { FieldValueQueryBar } from '../query_bar_field'; import type { TimeframePreviewOptions } from '../../../../detections/pages/detection_engine/rules/types'; import { DataSourceType } from '../../../../detections/pages/detection_engine/rules/types'; import { MAX_NUMBER_OF_NEW_TERMS_FIELDS } from '../../../../../common/constants'; +import { FieldsMap } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib'; /** * Determines whether or not to display noise warning. @@ -96,10 +97,17 @@ const isThreatMatchPreviewDisabled = ({ return false; }; +export const isEveryThresholdFieldValid = (fields: FieldsMap): boolean => + fields['threshold.field']?.isValid && + fields['threshold.value']?.isValid && + fields['threshold.cardinality.field']?.isValid && + fields['threshold.cardinality.value']?.isValid + export const getIsRulePreviewDisabled = ({ ruleType, isQueryBarValid, isThreatQueryBarValid, + isThresholdValid, index, dataViewId, dataSourceType, @@ -112,6 +120,7 @@ export const getIsRulePreviewDisabled = ({ ruleType: Type; isQueryBarValid: boolean; isThreatQueryBarValid: boolean; + isThresholdValid: boolean; index: string[]; dataViewId: string | undefined; dataSourceType: DataSourceType; @@ -125,7 +134,7 @@ export const getIsRulePreviewDisabled = ({ return isEsqlPreviewDisabled({ isQueryBarValid, queryBar }); } if (ruleType === 'machine_learning') { - return !machineLearningJobId ?? machineLearningJobId?.length === 0; + return machineLearningJobId === undefined || machineLearningJobId.length === 0; } if ( !isQueryBarValid || @@ -145,7 +154,7 @@ export const getIsRulePreviewDisabled = ({ return isEmpty(queryBar.query.query); } if (ruleType === 'query' || ruleType === 'threshold') { - return isEmpty(queryBar.query.query) && isEmpty(queryBar.filters); + return isEmpty(queryBar.query.query) && isEmpty(queryBar.filters) || (ruleType === 'threshold' && !isThresholdValid); } if (ruleType === 'new_terms') { return isNewTermsPreviewDisabled(newTermsFields); diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx index 05fbad5ecdeea..965cf45b71af1 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx @@ -78,7 +78,7 @@ import { } from '../../../../../common/constants'; import { useKibana, useUiSetting$ } from '../../../../common/lib/kibana'; import { RulePreview } from '../../components/rule_preview'; -import { getIsRulePreviewDisabled } from '../../components/rule_preview/helpers'; +import { getIsRulePreviewDisabled, isEveryThresholdFieldValid } from '../../components/rule_preview/helpers'; import { useStartMlJobs } from '../../../rule_management/logic/use_start_ml_jobs'; import { VALIDATION_WARNING_CODE_FIELD_NAME_MAP } from '../../../rule_creation/constants/validation_warning_codes'; import { extractValidationMessages } from '../../../rule_creation/logic/extract_validation_messages'; @@ -86,7 +86,7 @@ import { NextStep } from '../../components/next_step'; import { useRuleForms, useRuleIndexPattern } from '../form'; import { CustomHeaderPageMemo } from '..'; -const MyEuiPanel = styled(EuiPanel)<{ +const MyEuiPanel = styled(EuiPanel) <{ zindex?: number; }>` position: relative; @@ -227,6 +227,7 @@ const CreateRulePageComponent: React.FC = () => { defineStepFormFields.threatIndex?.isValid && defineStepFormFields.threatQueryBar?.isValid && defineStepFormFields.threatMapping?.isValid, + isThresholdValid: isEveryThresholdFieldValid(defineStepFormFields), index: memoizedIndex, dataViewId: defineStepData.dataViewId, dataSourceType: defineStepData.dataSourceType, @@ -490,8 +491,8 @@ const CreateRulePageComponent: React.FC = () => { activeStep === RuleStep.scheduleRule ? 'active' : scheduleStepForm.isValid - ? 'valid' - : 'passive'; + ? 'valid' + : 'passive'; const scheduleRuleButton = useMemo( () => , [scheduleRuleButtonType] diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx index 6643ad2328168..523ab5f6dd948 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx @@ -27,7 +27,7 @@ import { useConfirmValidationErrorsModal } from '../../../../common/hooks/use_co import { useAppToasts } from '../../../../common/hooks/use_app_toasts'; import { isEsqlRule } from '../../../../../common/detection_engine/utils'; import { RulePreview } from '../../components/rule_preview'; -import { getIsRulePreviewDisabled } from '../../components/rule_preview/helpers'; +import { getIsRulePreviewDisabled, isEveryThresholdFieldValid } from '../../components/rule_preview/helpers'; import type { RuleResponse, RuleUpdateProps, @@ -162,6 +162,7 @@ const EditRulePageComponent: FC<{ rule: RuleResponse }> = ({ rule }) => { defineStepFormFields.threatIndex?.isValid && defineStepFormFields.threatQueryBar?.isValid && defineStepFormFields.threatMapping?.isValid, + isThresholdValid: isEveryThresholdFieldValid(defineStepFormFields), index: memoizedIndex, dataViewId: defineStepData.dataViewId, dataSourceType: defineStepData.dataSourceType, From 4d6b24340e47b5b40f2f4ca6d428fb4a7ad4cc9b Mon Sep 17 00:00:00 2001 From: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Date: Fri, 7 Mar 2025 14:29:27 +0000 Subject: [PATCH 2/3] [CI] Auto-commit changed files from 'node scripts/eslint --no-cache --fix' --- .../components/rule_preview/helpers.test.ts | 14 +++++++++----- .../components/rule_preview/helpers.ts | 9 ++++++--- .../rule_creation_ui/pages/rule_creation/index.tsx | 11 +++++++---- .../rule_creation_ui/pages/rule_editing/index.tsx | 5 ++++- 4 files changed, 26 insertions(+), 13 deletions(-) diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts index 15c937ae73f7f..c6882bd55900a 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts @@ -7,8 +7,13 @@ import moment from 'moment'; import { DataSourceType } from '../../../../detections/pages/detection_engine/rules/types'; -import { isNoisy, getTimeframeOptions, getIsRulePreviewDisabled, isEveryThresholdFieldValid } from './helpers'; -import { FieldsMap } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib'; +import { + isNoisy, + getTimeframeOptions, + getIsRulePreviewDisabled, + isEveryThresholdFieldValid, +} from './helpers'; +import type { FieldsMap } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib'; describe('query_preview/helpers', () => { const timeframeEnd = moment(); @@ -492,7 +497,7 @@ describe('query_preview/helpers', () => { 'threshold.value', 'threshold.cardinality.field', 'threshold.cardinality.value', - ] + ]; const allFieldsValid = fieldLabels.reduce((acc, label) => { acc[label] = { isValid: true }; return acc; @@ -504,7 +509,6 @@ describe('query_preview/helpers', () => { expect(isValid).toEqual(true); }); - test.each(fieldLabels)('returns false if a field is invalid', (fieldLabel) => { const fields = { ...allFieldsValid, @@ -514,5 +518,5 @@ describe('query_preview/helpers', () => { expect(isEveryThresholdFieldValid(fields)).toEqual(false); }); - }) + }); }); diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.ts b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.ts index 821846e946c03..934116431faa7 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.ts +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.ts @@ -8,13 +8,13 @@ import { isEmpty } from 'lodash'; import type { EuiSelectOption } from '@elastic/eui'; import type { Type, ThreatMapping } from '@kbn/securitysolution-io-ts-alerting-types'; +import type { FieldsMap } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib'; import * as i18n from './translations'; import type { FieldValueQueryBar } from '../query_bar_field'; import type { TimeframePreviewOptions } from '../../../../detections/pages/detection_engine/rules/types'; import { DataSourceType } from '../../../../detections/pages/detection_engine/rules/types'; import { MAX_NUMBER_OF_NEW_TERMS_FIELDS } from '../../../../../common/constants'; -import { FieldsMap } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib'; /** * Determines whether or not to display noise warning. @@ -101,7 +101,7 @@ export const isEveryThresholdFieldValid = (fields: FieldsMap): boolean => fields['threshold.field']?.isValid && fields['threshold.value']?.isValid && fields['threshold.cardinality.field']?.isValid && - fields['threshold.cardinality.value']?.isValid + fields['threshold.cardinality.value']?.isValid; export const getIsRulePreviewDisabled = ({ ruleType, @@ -154,7 +154,10 @@ export const getIsRulePreviewDisabled = ({ return isEmpty(queryBar.query.query); } if (ruleType === 'query' || ruleType === 'threshold') { - return isEmpty(queryBar.query.query) && isEmpty(queryBar.filters) || (ruleType === 'threshold' && !isThresholdValid); + return ( + (isEmpty(queryBar.query.query) && isEmpty(queryBar.filters)) || + (ruleType === 'threshold' && !isThresholdValid) + ); } if (ruleType === 'new_terms') { return isNewTermsPreviewDisabled(newTermsFields); diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx index 965cf45b71af1..cec9a644ab712 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx @@ -78,7 +78,10 @@ import { } from '../../../../../common/constants'; import { useKibana, useUiSetting$ } from '../../../../common/lib/kibana'; import { RulePreview } from '../../components/rule_preview'; -import { getIsRulePreviewDisabled, isEveryThresholdFieldValid } from '../../components/rule_preview/helpers'; +import { + getIsRulePreviewDisabled, + isEveryThresholdFieldValid, +} from '../../components/rule_preview/helpers'; import { useStartMlJobs } from '../../../rule_management/logic/use_start_ml_jobs'; import { VALIDATION_WARNING_CODE_FIELD_NAME_MAP } from '../../../rule_creation/constants/validation_warning_codes'; import { extractValidationMessages } from '../../../rule_creation/logic/extract_validation_messages'; @@ -86,7 +89,7 @@ import { NextStep } from '../../components/next_step'; import { useRuleForms, useRuleIndexPattern } from '../form'; import { CustomHeaderPageMemo } from '..'; -const MyEuiPanel = styled(EuiPanel) <{ +const MyEuiPanel = styled(EuiPanel)<{ zindex?: number; }>` position: relative; @@ -491,8 +494,8 @@ const CreateRulePageComponent: React.FC = () => { activeStep === RuleStep.scheduleRule ? 'active' : scheduleStepForm.isValid - ? 'valid' - : 'passive'; + ? 'valid' + : 'passive'; const scheduleRuleButton = useMemo( () => , [scheduleRuleButtonType] diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx index 523ab5f6dd948..7d40f5245a597 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx @@ -27,7 +27,10 @@ import { useConfirmValidationErrorsModal } from '../../../../common/hooks/use_co import { useAppToasts } from '../../../../common/hooks/use_app_toasts'; import { isEsqlRule } from '../../../../../common/detection_engine/utils'; import { RulePreview } from '../../components/rule_preview'; -import { getIsRulePreviewDisabled, isEveryThresholdFieldValid } from '../../components/rule_preview/helpers'; +import { + getIsRulePreviewDisabled, + isEveryThresholdFieldValid, +} from '../../components/rule_preview/helpers'; import type { RuleResponse, RuleUpdateProps, From d0c7839dbc1ff48f126ab3720cc6576b3e2b8404 Mon Sep 17 00:00:00 2001 From: Edgar Santos Date: Fri, 7 Mar 2025 16:54:49 +0100 Subject: [PATCH 3/3] fix unit tests --- .../components/rule_preview/helpers.test.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts index c6882bd55900a..3c52a31393f3a 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/helpers.test.ts @@ -399,7 +399,7 @@ describe('query_preview/helpers', () => { test('enabled when threshold rule with non empty query', () => { const isDisabled = getIsRulePreviewDisabled({ - ruleType: 'eql', + ruleType: 'threshold', isQueryBarValid: true, isThreatQueryBarValid: false, isThresholdValid: true, @@ -421,7 +421,7 @@ describe('query_preview/helpers', () => { test('disabled when threshold rule with empty query', () => { const isDisabled = getIsRulePreviewDisabled({ - ruleType: 'eql', + ruleType: 'threshold', isQueryBarValid: true, isThreatQueryBarValid: false, isThresholdValid: true, @@ -443,7 +443,7 @@ describe('query_preview/helpers', () => { test('disabled when threshold rule with invalid threshold', () => { const isDisabled = getIsRulePreviewDisabled({ - ruleType: 'eql', + ruleType: 'threshold', isQueryBarValid: true, isThreatQueryBarValid: false, isThresholdValid: false,