[SIEM] Create ML Rules

x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/types.ts

@@ -6,26 +6,35 @@
 
 import * as t from 'io-ts';
 
+export const RuleTypeSchema = t.keyof({
+  query: null,
+  saved_query: null,
+  machine_learning: null,
+});
+export type RuleType = t.TypeOf<typeof RuleTypeSchema>;
+
 export const NewRuleSchema = t.intersection([
   t.type({
     description: t.string,
     enabled: t.boolean,
-    filters: t.array(t.unknown),
-    index: t.array(t.string),
     interval: t.string,
-    language: t.string,
     name: t.string,
-    query: t.string,
     risk_score: t.number,
     severity: t.string,
-    type: t.union([t.literal('query'), t.literal('saved_query')]),
+    type: RuleTypeSchema,
   }),
   t.partial({
+    anomaly_threshold: t.number,
     created_by: t.string,
     false_positives: t.array(t.string),
+    filters: t.array(t.unknown),
     from: t.string,
     id: t.string,
+    index: t.array(t.string),
+    language: t.string,
+    machine_learning_job_id: t.string,
     max_signals: t.number,
+    query: t.string,
     references: t.array(t.string),
     rule_id: t.string,
     saved_id: t.string,
@@ -56,32 +65,34 @@ export const RuleSchema = t.intersection([
     description: t.string,
     enabled: t.boolean,
     false_positives: t.array(t.string),
-    filters: t.array(t.unknown),
     from: t.string,
     id: t.string,
-    index: t.array(t.string),
     interval: t.string,
     immutable: t.boolean,
-    language: t.string,
     name: t.string,
     max_signals: t.number,
-    query: t.string,
     references: t.array(t.string),
     risk_score: t.number,
     rule_id: t.string,
     severity: t.string,
     tags: t.array(t.string),
-    type: t.string,
+    type: RuleTypeSchema,
     to: t.string,
     threat: t.array(t.unknown),
     updated_at: t.string,
     updated_by: t.string,
   }),
   t.partial({
+    anomaly_threshold: t.number,
+    filters: t.array(t.unknown),
+    index: t.array(t.string),
+    language: t.string,
     last_failure_at: t.string,
     last_failure_message: t.string,
     meta: MetaRule,
+    machine_learning_job_id: t.string,
     output_index: t.string,
+    query: t.string,
     saved_id: t.string,
     status: t.string,
     status_date: t.string,

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/__mocks__/mock.ts

@@ -181,6 +181,9 @@ export const mockAboutStepRule = (isNew = false): AboutStepRule => ({
 
 export const mockDefineStepRule = (isNew = false): DefineStepRule => ({
   isNew,
+  ruleType: 'query',
+  anomalyThreshold: 50,
+  machineLearningJobId: '',
   index: ['filebeat-'],
   queryBar: mockQueryBar,
 });

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/anomaly_threshold_slider/index.tsx

@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useCallback } from 'react';
+import { EuiFlexGrid, EuiFlexItem, EuiRange, EuiFormRow } from '@elastic/eui';
+
+import { FieldHook } from '../../../../../shared_imports';
+
+interface AnomalyThresholdSliderProps {
+  field: FieldHook;
+}
+type Event = React.ChangeEvent<HTMLInputElement>;
+type EventArg = Event | React.MouseEvent<HTMLButtonElement>;
+
+export const AnomalyThresholdSlider: React.FC<AnomalyThresholdSliderProps> = ({ field }) => {
+  const threshold = field.value as number;
+  const onThresholdChange = useCallback(
+    (event: EventArg) => {
+      const thresholdValue = Number((event as Event).target.value);
+      field.setValue(thresholdValue);
+    },
+    [field]
+  );
+
+  return (
+    <EuiFormRow label={field.label} fullWidth>
+      <EuiFlexGrid columns={2}>
+        <EuiFlexItem>
+          <EuiRange
+            value={threshold}
+            onChange={onThresholdChange}
+            fullWidth
+            showInput
+            showRange
+            showTicks
+            tickInterval={25}
+          />
+        </EuiFlexItem>
+      </EuiFlexGrid>
+    </EuiFormRow>
+  );
+};

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/helpers.test.tsx

@@ -38,10 +38,7 @@ setupMock.uiSettings.get.mockImplementation(uiSettingsMock(true));
 const mockFilterManager = new FilterManager(setupMock.uiSettings);
 
 const mockQueryBar = {
-  query: {
-    query: 'test query',
-    language: 'kuery',
-  },
+  query: 'test query',
   filters: [
     {
       $state: {
@@ -93,10 +90,7 @@ describe('helpers', () => {
   describe('buildQueryBarDescription', () => {
     test('returns empty array if no filters, query or savedId exist', () => {
       const emptyMockQueryBar = {
-        query: {
-          query: '',
-          language: 'kuery',
-        },
+        query: '',
         filters: [],
         saved_id: '',
       };
@@ -113,10 +107,7 @@ describe('helpers', () => {
     test('returns expected array of ListItems when filters exists, but no indexPatterns passed in', () => {
       const mockQueryBarWithFilters = {
         ...mockQueryBar,
-        query: {
-          query: '',
-          language: 'kuery',
-        },
+        query: '',
         saved_id: '',
       };
       const result: ListItems[] = buildQueryBarDescription({
@@ -135,10 +126,7 @@ describe('helpers', () => {
     test('returns expected array of ListItems when filters AND indexPatterns exist', () => {
       const mockQueryBarWithFilters = {
         ...mockQueryBar,
-        query: {
-          query: '',
-          language: 'kuery',
-        },
+        query: '',
         saved_id: '',
       };
       const result: ListItems[] = buildQueryBarDescription({
@@ -171,16 +159,13 @@ describe('helpers', () => {
         savedId: mockQueryBarWithQuery.saved_id,
       });
       expect(result[0].title).toEqual(<>{i18n.QUERY_LABEL} </>);
-      expect(result[0].description).toEqual(<>{mockQueryBarWithQuery.query.query} </>);
+      expect(result[0].description).toEqual(<>{mockQueryBarWithQuery.query} </>);
     });
 
     test('returns expected array of ListItems when "savedId" exists', () => {
       const mockQueryBarWithSavedId = {
         ...mockQueryBar,
-        query: {
-          query: '',
-          language: 'kuery',
-        },
+        query: '',
         filters: [],
       };
       const result: ListItems[] = buildQueryBarDescription({

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/helpers.tsx

@@ -77,12 +77,12 @@ export const buildQueryBarDescription = ({
       },
     ];
   }
-  if (!isEmpty(query.query)) {
+  if (!isEmpty(query)) {
     items = [
       ...items,
       {
         title: <>{i18n.QUERY_LABEL} </>,
-        description: <>{query.query} </>,
+        description: <>{query} </>,
       },
     ];
   }

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/index.tsx

@@ -5,7 +5,7 @@
  */
 
 import { EuiDescriptionList, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import { isEmpty, chunk, get, pick } from 'lodash/fp';
+import { isEmpty, chunk, get, pick, isNumber } from 'lodash/fp';
 import React, { memo, useState } from 'react';
 import styled from 'styled-components';
 
@@ -14,7 +14,6 @@ import {
   Filter,
   esFilters,
   FilterManager,
-  Query,
 } from '../../../../../../../../../../src/plugins/data/public';
 import { DEFAULT_TIMELINE_TITLE } from '../../../../../components/timeline/translations';
 import { useKibana } from '../../../../../lib/kibana';
@@ -133,14 +132,14 @@ export const addFilterStateIfNotThere = (filters: Filter[]): Filter[] => {
 export const getDescriptionItem = (
   field: string,
   label: string,
-  value: unknown,
+  data: unknown,
   filterManager: FilterManager,
   indexPatterns?: IIndexPattern
 ): ListItems[] => {
   if (field === 'queryBar') {
-    const filters = addFilterStateIfNotThere(get('queryBar.filters', value) ?? []);
-    const query = get('queryBar.query', value) as Query;
-    const savedId = get('queryBar.saved_id', value);
+    const filters = addFilterStateIfNotThere(get('queryBar.filters', data) ?? []);
+    const query = get('queryBar.query.query', data);
+    const savedId = get('queryBar.saved_id', data);
     return buildQueryBarDescription({
       field,
       filters,
@@ -150,43 +149,37 @@ export const getDescriptionItem = (
       indexPatterns,
     });
   } else if (field === 'threat') {
-    const threat: IMitreEnterpriseAttack[] = get(field, value).filter(
+    const threat: IMitreEnterpriseAttack[] = get(field, data).filter(
       (singleThreat: IMitreEnterpriseAttack) => singleThreat.tactic.name !== 'none'
     );
     return buildThreatDescription({ label, threat });
   } else if (field === 'references') {
-    const urls: string[] = get(field, value);
+    const urls: string[] = get(field, data);
     return buildUrlsDescription(label, urls);
   } else if (field === 'falsePositives') {
-    const values: string[] = get(field, value);
+    const values: string[] = get(field, data);
     return buildUnorderedListArrayDescription(label, field, values);
-  } else if (Array.isArray(get(field, value))) {
-    const values: string[] = get(field, value);
+  } else if (Array.isArray(get(field, data))) {
+    const values: string[] = get(field, data);
     return buildStringArrayDescription(label, field, values);
   } else if (field === 'severity') {
-    const val: string = get(field, value);
+    const val: string = get(field, data);
     return buildSeverityDescription(label, val);
-  } else if (field === 'riskScore') {
-    return [
-      {
-        title: label,
-        description: get(field, value),
-      },
-    ];
   } else if (field === 'timeline') {
-    const timeline = get(field, value) as FieldValueTimeline;
+    const timeline = get(field, data) as FieldValueTimeline;
     return [
       {
         title: label,
         description: timeline.title ?? DEFAULT_TIMELINE_TITLE,
       },
     ];
   } else if (field === 'note') {
-    const val: string = get(field, value);
+    const val: string = get(field, data);
     return buildNoteDescription(label, val);
   }
-  const description: string = get(field, value);
-  if (!isEmpty(description)) {
+
+  const description: string = get(field, data);
+  if (isNumber(description) || !isEmpty(description)) {
     return [
       {
         title: label,

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/types.ts

@@ -9,7 +9,6 @@ import {
   IIndexPattern,
   Filter,
   FilterManager,
-  Query,
 } from '../../../../../../../../../../src/plugins/data/public';
 import { IMitreEnterpriseAttack } from '../../types';
 
@@ -22,7 +21,7 @@ export interface BuildQueryBarDescription {
   field: string;
   filters: Filter[];
   filterManager: FilterManager;
-  query: Query;
+  query: string;
   savedId: string;
   indexPatterns?: IIndexPattern;
 }

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/ml_job_select/index.tsx

@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useCallback } from 'react';
+import { EuiFlexGroup, EuiFlexItem, EuiFormRow, EuiSuperSelect, EuiText } from '@elastic/eui';
+
+import { FieldHook, getFieldValidityAndErrorMessage } from '../../../../../shared_imports';
+import { useSiemJobs } from '../../../../../components/ml_popover/hooks/use_siem_jobs';
+
+const JobDisplay = ({ title, description }: { title: string; description: string }) => (
+  <>
+    <strong>{title}</strong>
+    <EuiText size="xs" color="subdued">
+      <p>{description}</p>
+    </EuiText>
+  </>
+);
+
+interface MlJobSelectProps {
+  field: FieldHook;
+}
+
+export const MlJobSelect: React.FC<MlJobSelectProps> = ({ field }) => {
+  const jobId = field.value as string;
+  const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
+  const [isLoading, siemJobs] = useSiemJobs(false);
+  const handleJobChange = useCallback(
+    (machineLearningJobId: string) => {
+      field.setValue(machineLearningJobId);
+    },
+    [field]
+  );
+
+  const options = siemJobs.map(job => ({
+    value: job.id,
+    inputDisplay: job.id,
+    dropdownDisplay: <JobDisplay title={job.id} description={job.description} />,
+  }));
+
+  return (
+    <EuiFormRow fullWidth label={field.label} isInvalid={isInvalid} error={errorMessage}>
+      <EuiFlexGroup>
+        <EuiFlexItem>
+          <EuiSuperSelect
+            hasDividers
+            isLoading={isLoading}
+            onChange={handleJobChange}
+            options={options}
+            valueOfSelected={jobId}
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiFormRow>
+  );
+};

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/query_bar/index.tsx

@@ -35,7 +35,7 @@ import * as i18n from './translations';
 export interface FieldValueQueryBar {
   filters: Filter[];
   query: Query;
-  saved_id: string | null;
+  saved_id?: string;
 }
 interface QueryBarDefineRuleProps {
   browserFields: BrowserFields;