diff --git a/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts b/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts index dd88f117aec89..396271ad41a2e 100644 --- a/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts +++ b/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts @@ -12,17 +12,6 @@ export type ExperimentalFeatures = { [K in keyof typeof allowedExperimentalValue * This object is then used to validate and parse the value entered. */ export const allowedExperimentalValues = Object.freeze({ - /* - * Enables experimental feature flag for eql sequence alert suppression. - * - * Ticket: https://github.com/elastic/security-team/issues/9608 - * Owners: https://github.com/orgs/elastic/teams/security-detection-engine - * Added: on October 1st, 2024 in https://github.com/elastic/kibana/pull/189725 - * Turned: on (TBD) - * Expires: on (TBD) - */ - alertSuppressionForSequenceEqlRuleEnabled: true, - // FIXME:PT delete? excludePoliciesInFilterEnabled: false, diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx index 3f4492ef922fd..564b71944ff3e 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx @@ -56,7 +56,6 @@ import { isThresholdRule as getIsThresholdRule, isQueryRule, isEsqlRule, - isEqlSequenceQuery, isSuppressionRuleInGA, } from '../../../../../common/detection_engine/utils'; import { EqlQueryEdit } from '../../../rule_creation/components/eql_query_edit'; @@ -310,9 +309,7 @@ const StepDefineRuleComponent: FC = ({ * purpose and so are treated as if the field is always selected. */ const areSuppressionFieldsSelected = isThresholdRule || Boolean(alertSuppressionFields?.length); - const { isSuppressionEnabled: isAlertSuppressionEnabled } = useAlertSuppression( - isEqlSequenceQuery(queryBar?.query?.query as string) - ); + const { isSuppressionEnabled: isAlertSuppressionEnabled } = useAlertSuppression(ruleType); /** If we don't have ML field information, users can't meaningfully interact with suppression fields */ const areSuppressionFieldsDisabledByMlFields = diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/use_experimental_feature_fields_transform.ts b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/use_experimental_feature_fields_transform.ts index 63a539377f454..4b471dad3ca08 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/use_experimental_feature_fields_transform.ts +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/use_experimental_feature_fields_transform.ts @@ -7,14 +7,6 @@ import { useCallback } from 'react'; import type { DefineStepRule } from '../../../common/types'; -import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features'; -import { isEqlRule, isEqlSequenceQuery } from '../../../../../common/detection_engine/utils'; -import { - ALERT_SUPPRESSION_FIELDS_FIELD_NAME, - ALERT_SUPPRESSION_DURATION_TYPE_FIELD_NAME, - ALERT_SUPPRESSION_DURATION_FIELD_NAME, - ALERT_SUPPRESSION_MISSING_FIELDS_FIELD_NAME, -} from '../../../rule_creation/components/alert_suppression_edit'; /** * transforms DefineStepRule fields according to experimental feature flags @@ -22,30 +14,9 @@ import { export const useExperimentalFeatureFieldsTransform = >(): (( fields: T ) => T) => { - const isAlertSuppressionForSequenceEqlRuleEnabled = useIsExperimentalFeatureEnabled( - 'alertSuppressionForSequenceEqlRuleEnabled' - ); - const transformer = useCallback( - (fields: T) => { - const isSuppressionDisabled = - isEqlRule(fields.ruleType) && - isEqlSequenceQuery(fields.queryBar?.query?.query as string) && - !isAlertSuppressionForSequenceEqlRuleEnabled; - - // reset any alert suppression values hidden behind feature flag - if (isSuppressionDisabled) { - return { - ...fields, - [ALERT_SUPPRESSION_FIELDS_FIELD_NAME]: [], - [ALERT_SUPPRESSION_DURATION_TYPE_FIELD_NAME]: undefined, - [ALERT_SUPPRESSION_DURATION_FIELD_NAME]: undefined, - [ALERT_SUPPRESSION_MISSING_FIELDS_FIELD_NAME]: undefined, - }; - } - return fields; - }, - [isAlertSuppressionForSequenceEqlRuleEnabled] - ); + const transformer = useCallback((fields: T) => { + return fields; + }, []); return transformer; }; diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/rule_definition_section.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/rule_definition_section.tsx index 6559b10271a89..838424d0e0743 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/rule_definition_section.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/rule_definition_section.tsx @@ -913,7 +913,7 @@ export const RuleDefinitionSection = ({ ruleType: rule.type, }); - const { isSuppressionEnabled } = useAlertSuppression(); + const { isSuppressionEnabled } = useAlertSuppression(rule.type); const definitionSectionListItems = prepareDefinitionSectionListItems( rule, diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/logic/use_alert_suppression.test.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/logic/use_alert_suppression.test.tsx index 7877a86385cde..8be6aac300b81 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/logic/use_alert_suppression.test.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/logic/use_alert_suppression.test.tsx @@ -6,23 +6,40 @@ */ import { renderHook } from '@testing-library/react'; +import type { Type } from '@kbn/securitysolution-io-ts-alerting-types'; import * as useIsExperimentalFeatureEnabledMock from '../../../common/hooks/use_experimental_features'; import { useAlertSuppression } from './use_alert_suppression'; describe('useAlertSuppression', () => { - jest - .spyOn(useIsExperimentalFeatureEnabledMock, 'useIsExperimentalFeatureEnabled') - .mockReturnValue(false); - it(`should return the isSuppressionEnabled true if query for all rule types is not an eql sequence query`, () => { - const { result } = renderHook(() => useAlertSuppression()); - expect(result.current.isSuppressionEnabled).toBe(true); + ( + [ + 'new_terms', + 'threat_match', + 'saved_query', + 'query', + 'threshold', + 'eql', + 'esql', + 'machine_learning', + ] as Type[] + ).forEach((ruleType) => { + it(`should return the isSuppressionEnabled true for ${ruleType} rule type that exists in SUPPRESSIBLE_ALERT_RULES`, () => { + const { result } = renderHook(() => useAlertSuppression(ruleType)); + + expect(result.current.isSuppressionEnabled).toBe(true); + }); }); jest .spyOn(useIsExperimentalFeatureEnabledMock, 'useIsExperimentalFeatureEnabled') .mockReturnValue(false); it('should return isSuppressionEnabled false for eql sequence query when feature flag is disabled', () => { - const { result } = renderHook(() => useAlertSuppression(true)); + const { result } = renderHook(() => useAlertSuppression(undefined)); + expect(result.current.isSuppressionEnabled).toBe(false); + }); + + it('should return false if rule type is not a suppressible rule', () => { + const { result } = renderHook(() => useAlertSuppression('OTHER_RULE_TYPE' as Type)); expect(result.current.isSuppressionEnabled).toBe(false); }); }); diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/logic/use_alert_suppression.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/logic/use_alert_suppression.tsx index dae422a8e81c5..6e1b2a4d6163f 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/logic/use_alert_suppression.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/logic/use_alert_suppression.tsx @@ -5,24 +5,21 @@ * 2.0. */ import { useCallback } from 'react'; -import { useIsExperimentalFeatureEnabled } from '../../../common/hooks/use_experimental_features'; +import type { Type } from '@kbn/securitysolution-io-ts-alerting-types'; +import { isSuppressibleAlertRule } from '../../../../common/detection_engine/utils'; export interface UseAlertSuppressionReturn { isSuppressionEnabled: boolean; } -export const useAlertSuppression = (isEqlSequenceQuery = false): UseAlertSuppressionReturn => { - const isAlertSuppressionForSequenceEQLRuleEnabled = useIsExperimentalFeatureEnabled( - 'alertSuppressionForSequenceEqlRuleEnabled' - ); - +export const useAlertSuppression = (ruleType: Type | undefined): UseAlertSuppressionReturn => { const isSuppressionEnabledForRuleType = useCallback(() => { - if (isEqlSequenceQuery) { - return isAlertSuppressionForSequenceEQLRuleEnabled; + if (!ruleType) { + return false; } - return true; - }, [isAlertSuppressionForSequenceEQLRuleEnabled, isEqlSequenceQuery]); + return isSuppressibleAlertRule(ruleType); + }, [ruleType]); return { isSuppressionEnabled: isSuppressionEnabledForRuleType(), diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/eql/eql.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/eql/eql.ts index 00d167b58b85f..4777520c623a0 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/eql/eql.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/eql/eql.ts @@ -159,7 +159,6 @@ export const eqlExecutor = async ({ } else if (sequences) { if ( isAlertSuppressionActive && - experimentalFeatures.alertSuppressionForSequenceEqlRuleEnabled && alertSuppressionTypeGuard(completeRule.ruleParams.alertSuppression) ) { await bulkCreateSuppressedSequencesInMemory({ diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/rules/queries/sequence_eql_query.json b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/rules/queries/sequence_eql_query.json index 8c5531188379b..b3e631973b555 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/rules/queries/sequence_eql_query.json +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/rules/queries/sequence_eql_query.json @@ -6,7 +6,7 @@ "enabled": true, "index": ["auditbeat*", "packetbeat*"], "interval": "30s", - "query": "sequence with maxspan=10m [any where agent.type == \"auditbeat\"] [any where event.category == \"network_traffic\"]", + "query": "sequence with maxspan=10m [any where agent.type == \"auditbeat\"] [any where event.category == \"network\"]", "meta": { "anything_you_want_ui_related_or_otherwise": { "as_deep_structured_as_you_need": { diff --git a/x-pack/test/security_solution_api_integration/config/ess/config.base.ts b/x-pack/test/security_solution_api_integration/config/ess/config.base.ts index 40d0ba5871257..f26b37e7eeb30 100644 --- a/x-pack/test/security_solution_api_integration/config/ess/config.base.ts +++ b/x-pack/test/security_solution_api_integration/config/ess/config.base.ts @@ -88,7 +88,6 @@ export function createTestConfig(options: CreateTestConfigOptions, testFiles?: s 'previewTelemetryUrlEnabled', 'riskScoringPersistence', 'riskScoringRoutesEnabled', - 'alertSuppressionForSequenceEqlRuleEnabled', ])}`, `--plugin-path=${path.resolve( __dirname, diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/general_logic/trial_license_complete_tier/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/general_logic/trial_license_complete_tier/configs/serverless.config.ts index 987b9c5004add..db3ad04b3d1b9 100644 --- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/general_logic/trial_license_complete_tier/configs/serverless.config.ts +++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/general_logic/trial_license_complete_tier/configs/serverless.config.ts @@ -17,8 +17,5 @@ export default createTestConfig({ 'testing_ignored.constant', '/testing_regex*/', ])}`, // See tests within the file "ignore_fields.ts" which use these values in "alertIgnoreFields" - `--xpack.securitySolution.enableExperimental=${JSON.stringify([ - 'alertSuppressionForSequenceEqlRuleEnabled', - ])}`, ], }); diff --git a/x-pack/test/security_solution_cypress/config.ts b/x-pack/test/security_solution_cypress/config.ts index 6b10122213ca7..f02968945087d 100644 --- a/x-pack/test/security_solution_cypress/config.ts +++ b/x-pack/test/security_solution_cypress/config.ts @@ -44,9 +44,6 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) { // See https://github.com/elastic/kibana/pull/125396 for details '--xpack.alerting.rules.minimumScheduleInterval.value=1s', '--xpack.ruleRegistry.unsafe.legacyMultiTenancy.enabled=true', - `--xpack.securitySolution.enableExperimental=${JSON.stringify([ - 'alertSuppressionForSequenceEqlRuleEnabled', - ])}`, // mock cloud to enable the guided onboarding tour in e2e tests '--xpack.cloud.id=test', `--home.disableWelcomeScreen=true`, diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/alert_suppression/eql_sequence_rule.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/alert_suppression/eql_sequence_rule.cy.ts index ffc65fdddbf8b..e1aa965ae38cc 100644 --- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/alert_suppression/eql_sequence_rule.cy.ts +++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/alert_suppression/eql_sequence_rule.cy.ts @@ -39,11 +39,7 @@ describe( { tags: ['@ess', '@serverless'], env: { - kbnServerArgs: [ - `--xpack.securitySolution.enableExperimental=${JSON.stringify([ - 'alertSuppressionForSequenceEqlRuleEnabled', - ])}`, - ], + kbnServerArgs: [], }, }, () => {