Skip to content

[9.2] [Security Solution] update the name of the Security solution default and Security solution alerts data views when needed (#238354) #238525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kibanamachine merged 1 commit into from
Oct 10, 2025
Merged

[9.2] [Security Solution] update the name of the Security solution default and Security solution alerts data views when needed (#238354) #238525

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
312 changes: 312 additions & 0 deletions .../plugins/security_solution/public/sourcerer/containers/create_sourcerer_data_view.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,312 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/

import { createSourcererDataView } from './create_sourcerer_data_view';
import { DEFAULT_TIME_FIELD } from '../../../common/constants';
import {
DEFAULT_SECURITY_ALERT_DATA_VIEW,
DEFAULT_SECURITY_DATA_VIEW,
} from '../../data_view_manager/components/data_view_picker/translations';
import type { DataViewsServicePublic } from '@kbn/data-views-plugin/public/types';

describe('createSourcererDataView', () => {
beforeEach(() => {
jest.clearAllMocks();
});

it('should return null if dataViewId is null', async () => {
const result = await createSourcererDataView({
body: { patternList: [] },
dataViewService: {} as unknown as jest.Mocked<DataViewsServicePublic>,
dataViewId: null,
});

expect(result).toEqual(undefined);
});

describe('default data view', () => {
it('should create new default data view if it does not exist', async () => {
const patternList = ['index1', 'index2'];

const mockCreateAndSave = jest.fn();
const dataViewService = {
getIdsWithTitle: jest.fn().mockReturnValue([]),
createAndSave: mockCreateAndSave.mockReturnValue({
id: 'siemDataViewId',
title: 'index1,index2',
}),
getExistingIndices: jest.fn().mockReturnValue(['index3', 'index4']),
} as unknown as jest.Mocked<DataViewsServicePublic>;

const result = await createSourcererDataView({
body: { patternList },
dataViewService,
dataViewId: 'dataViewId',
});

expect(mockCreateAndSave).toHaveBeenCalledWith(
{
allowNoIndex: true,
id: 'dataViewId',
title: patternList.join(),
timeFieldName: DEFAULT_TIME_FIELD,
name: DEFAULT_SECURITY_DATA_VIEW,
},
true
);
expect(result).toEqual({
defaultDataView: {
id: 'siemDataViewId',
patternList: ['index3', 'index4'],
title: 'index1,index2',
},
kibanaDataViews: [
{
id: 'siemDataViewId',
patternList: ['index1', 'index2'],
title: 'index1,index2',
},
],
alertDataView: {
id: '',
patternList: [],
title: '',
},
});
});

it('should update default data view if patterns are different', async () => {
const patternList = ['index1', 'index2'];

const mockUpdateSavedObject = jest.fn();
const dataViewService = {
getIdsWithTitle: jest.fn().mockReturnValue([
{
id: 'dataViewId',
title: 'dataViewTitle',
name: 'Security solution default',
},
]),
updateSavedObject: mockUpdateSavedObject,
getExistingIndices: jest.fn().mockReturnValue(['index3', 'index4']),
get: jest.fn().mockReturnValue({
id: 'dataViewId',
title: 'dataViewTitle',
}),
} as unknown as jest.Mocked<DataViewsServicePublic>;

const result = await createSourcererDataView({
body: { patternList },
dataViewService,
dataViewId: 'dataViewId',
});

expect(mockUpdateSavedObject).toHaveBeenCalledWith({
id: 'dataViewId',
title: 'index1,index2',
});
expect(result).toEqual({
defaultDataView: {
id: 'dataViewId',
patternList: ['index3', 'index4'],
title: 'index1,index2',
},
kibanaDataViews: [
{
id: 'dataViewId',
patternList: ['index3', 'index4'],
title: 'index1,index2',
},
],
alertDataView: {
id: '',
patternList: [],
title: '',
},
});
});

it('should update default data view if name is not Security solution default', async () => {
const patternList = ['index1', 'index2'];

const mockUpdateSavedObject = jest.fn();
const dataViewService = {
getIdsWithTitle: jest.fn().mockReturnValue([
{
id: 'dataViewId',
title: 'index1,index2',
name: 'old name',
},
]),
updateSavedObject: mockUpdateSavedObject,
getExistingIndices: jest.fn().mockReturnValue(['index3', 'index4']),
get: jest.fn().mockReturnValue({
id: 'dataViewId',
title: 'dataViewTitle',
}),
} as unknown as jest.Mocked<DataViewsServicePublic>;

const result = await createSourcererDataView({
body: { patternList },
dataViewService,
dataViewId: 'dataViewId',
});

expect(mockUpdateSavedObject).toHaveBeenCalledWith({
id: 'dataViewId',
name: 'Security solution default',
title: 'dataViewTitle',
});
expect(result).toEqual({
defaultDataView: {
id: 'dataViewId',
patternList: ['index3', 'index4'],
title: 'index1,index2',
},
kibanaDataViews: [
{
id: 'dataViewId',
patternList: ['index3', 'index4'],
title: 'index1,index2',
},
],
alertDataView: {
id: '',
patternList: [],
title: '',
},
});
});
});

describe('alerts data view', () => {
it('should create new alerts data view if it does not exist', async () => {
const patternList = ['index1', 'index2'];

const mockCreateAndSave = jest.fn();
const dataViewService = {
getIdsWithTitle: jest.fn().mockReturnValue([
{
id: 'dataViewId',
title: 'dataViewTitle',
},
]),
createAndSave: mockCreateAndSave.mockReturnValue({
id: 'alertsDataViewId',
title: 'index1,index2',
}),
getExistingIndices: jest.fn(),
get: jest.fn().mockReturnValue({
id: 'dataViewId',
title: 'dataViewTitle',
}),
updateSavedObject: jest.fn(),
} as unknown as jest.Mocked<DataViewsServicePublic>;

const result = await createSourcererDataView({
body: { patternList },
dataViewService,
dataViewId: 'dataViewId',
alertDataViewId: 'alertDataViewId',
signalIndexName: 'signalIndexName',
});

expect(mockCreateAndSave).toHaveBeenCalledWith(
{
allowNoIndex: true,
id: 'alertDataViewId',
title: 'signalIndexName',
timeFieldName: DEFAULT_TIME_FIELD,
name: DEFAULT_SECURITY_ALERT_DATA_VIEW,
managed: true,
},
true
);
expect(result).toEqual({
defaultDataView: {
id: 'dataViewId',
patternList: undefined,
title: 'index1,index2',
},
kibanaDataViews: [
{
id: 'dataViewId',
patternList: undefined,
title: 'index1,index2',
},
],
alertDataView: {
id: 'alertsDataViewId',
patternList: ['index1', 'index2'],
title: 'index1,index2',
},
});
});

it('should update alerts data view if name is not Security solution alerts', async () => {
const patternList = ['index1', 'index2'];

const mockUpdateSavedObject = jest.fn();
const dataViewService = {
getIdsWithTitle: jest.fn().mockReturnValue([
{
id: 'dataViewId',
title: 'index1,index2',
},
{
id: 'alertsDataViewId',
title: 'index1,index2',
name: 'old name',
},
]),
updateSavedObject: mockUpdateSavedObject,
getExistingIndices: jest.fn(),
get: jest.fn().mockReturnValue({
id: 'alertsDataViewId',
title: 'alertsDataViewTitle',
}),
} as unknown as jest.Mocked<DataViewsServicePublic>;

const result = await createSourcererDataView({
body: { patternList },
dataViewService,
dataViewId: 'dataViewId',
alertDataViewId: 'alertsDataViewId',
});

expect(mockUpdateSavedObject).toHaveBeenCalledWith({
id: 'alertsDataViewId',
name: 'Security solution alerts',
title: 'alertsDataViewTitle',
});
expect(result).toEqual({
defaultDataView: {
id: 'dataViewId',
patternList: undefined,
title: 'index1,index2',
},
kibanaDataViews: [
{
id: 'dataViewId',
patternList: undefined,
title: 'index1,index2',
},
{
id: 'alertsDataViewId',
patternList: ['index1', 'index2'],
title: 'index1,index2',
},
],
alertDataView: {
id: 'alertsDataViewId',
patternList: [],
title: '',
},
});
});
});
});
34 changes: 27 additions & 7 deletions ...urity/plugins/security_solution/public/sourcerer/containers/create_sourcerer_data_view.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,15 +5,15 @@
* 2.0.
*/

import type { DataViewListItem, DataView as DataViewType } from '@kbn/data-views-plugin/common';
import type { DataView as DataViewType, DataViewListItem } from '@kbn/data-views-plugin/common';
import type { DataViewsServicePublic } from '@kbn/data-views-plugin/public/types';
import { transformError } from '@kbn/securitysolution-es-utils';
import { ensurePatternFormat } from '../../../common/utils/sourcerer';
import type { KibanaDataView } from '../store/model';
import { DEFAULT_TIME_FIELD } from '../../../common/constants';
import {
DEFAULT_SECURITY_DATA_VIEW,
DEFAULT_SECURITY_ALERT_DATA_VIEW,
DEFAULT_SECURITY_DATA_VIEW,
} from '../../data_view_manager/components/data_view_picker/translations';

export interface GetSourcererDataView {
Expand Down Expand Up @@ -46,8 +46,7 @@ export const createSourcererDataView = async ({
}
let allDataViews: DataViewListItem[] = await dataViewService.getIdsWithTitle();
const siemDataViewExist = allDataViews.find((dv) => dv.id === dataViewId);
const alertDataViewExist =
alertDataViewId && allDataViews.find((dv) => dv.id === alertDataViewId);
const alertDataViewExist = allDataViews.find((dv) => dv.id === alertDataViewId);

const { patternList } = body;
const patternListFormatted = ensurePatternFormat(patternList);
Expand Down Expand Up @@ -84,12 +83,25 @@ export const createSourcererDataView = async ({
} else {
let patterns = ensurePatternFormat(siemDataViewExist.title.split(','));
const siemDataViewTitle = siemDataViewExist ? patterns.join() : '';
if (patternListAsTitle !== siemDataViewTitle) {
patterns = patternListFormatted;
const arePatternsDifferent = patternListAsTitle !== siemDataViewTitle;
const isDefaultDataViewName = siemDataViewExist.name === DEFAULT_SECURITY_DATA_VIEW;

// Update the saved object if the pattern list is different or the name is incorrect
if (arePatternsDifferent || !isDefaultDataViewName) {
siemDataView = await dataViewService.get(dataViewId);
siemDataView.title = patternListAsTitle;

if (arePatternsDifferent) {
patterns = patternListFormatted;
siemDataView.title = patternListAsTitle;
}

if (!isDefaultDataViewName) {
siemDataView.name = DEFAULT_SECURITY_DATA_VIEW;
}

await dataViewService.updateSavedObject(siemDataView);
}

defaultDataView = {
id: dataViewId,
patternList: patterns,
Expand Down Expand Up @@ -128,6 +140,13 @@ export const createSourcererDataView = async ({
title: alertOnlyDataView.title,
};
} else {
// Update the saved object if the name is incorrect
if (alertDataViewId && alertDataViewExist?.name !== DEFAULT_SECURITY_ALERT_DATA_VIEW) {
siemDataView = await dataViewService.get(alertDataViewId);
siemDataView.name = DEFAULT_SECURITY_ALERT_DATA_VIEW;
await dataViewService.updateSavedObject(siemDataView);
}

alertDataView = {
id: alertDataViewId ?? '',
patternList: signalIndexName ? [signalIndexName] : [],
Expand All @@ -148,6 +167,7 @@ export const createSourcererDataView = async ({
...defaultDataView,
patternList: existingPatternList,
};

return {
defaultDataView,
kibanaDataViews: allDataViews.map((dv) =>
Expand Down