Skip to content

Commit

Permalink
[8.x] [Rules migration] ES|QL query editing and validation in transla…
Browse files Browse the repository at this point in the history
…tion tab in the flyout (#11381) (#203601) (#204078)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Rules migration] ES|QL query editing and validation in translation
tab in the flyout (#11381)
(#203601)](#203601)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Ievgen
Sorokopud","email":"ievgen.sorokopud@elastic.co"},"sourceCommit":{"committedDate":"2024-12-12T16:22:38Z","message":"[Rules
migration] ES|QL query editing and validation in translation tab in the
flyout (#11381) (#203601)\n\n## Summary\r\n\r\n[Internal
link](https://github.com/elastic/security-team/issues/10820)\r\nto the
feature details\r\n\r\nThese changes add a possibility to edit, validate
and save custom\r\nmigration rules:\r\n* There are new `edit`, `save`
and `cancel` buttons in the translation\r\ntab of the details flyout for
the non-installed custom rules\r\n* There is a new ES|QL query editing
component in the translation tab\r\nwhich allows edit and validate the
ES|QL query\r\n* On saving the ES|QL query the custom migration rule
will be updated\r\nand based on the ES|QL validation a new
`translation_result` might be\r\nset: `full` if query is valid,
`partial` if query has syntax errors,\r\n`untraslated` if query is an
empty string.\r\n\r\n## Screen
recording\r\n\r\n\r\nhttps://github.com/user-attachments/assets/59cfc56f-3de8-4f7a-a2f9-79cb3fdee1c7\r\n\r\n###
Other changes\r\n\r\nNext fixes and adjustments were also implemented as
part of this PR:\r\n* `Error` status in migration rules table to
indicate whether the rule\r\ntranslation has been failed\r\n* Callouts
inside the translation tab in details flyout\r\n* Updated `Fully
translated` status title into `Translated`\r\n\r\n### Known
issue\r\n\r\nThere is an issue with the autocompletion menu of the ES|QL
query editor\r\ncomponent. It is being shifted. It could be because we
are using this\r\ncomponent within the flyout and we might need to ask
help from the team\r\nwhich takes care of
it.","sha":"668f776583a60d35283a119fa007f7af9d1c57da","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Threat
Hunting","Team: SecuritySolution","backport:prev-minor"],"title":"[Rules
migration] ES|QL query editing and validation in translation tab in the
flyout
(#11381)","number":203601,"url":"https://github.com/elastic/kibana/pull/203601","mergeCommit":{"message":"[Rules
migration] ES|QL query editing and validation in translation tab in the
flyout (#11381) (#203601)\n\n## Summary\r\n\r\n[Internal
link](https://github.com/elastic/security-team/issues/10820)\r\nto the
feature details\r\n\r\nThese changes add a possibility to edit, validate
and save custom\r\nmigration rules:\r\n* There are new `edit`, `save`
and `cancel` buttons in the translation\r\ntab of the details flyout for
the non-installed custom rules\r\n* There is a new ES|QL query editing
component in the translation tab\r\nwhich allows edit and validate the
ES|QL query\r\n* On saving the ES|QL query the custom migration rule
will be updated\r\nand based on the ES|QL validation a new
`translation_result` might be\r\nset: `full` if query is valid,
`partial` if query has syntax errors,\r\n`untraslated` if query is an
empty string.\r\n\r\n## Screen
recording\r\n\r\n\r\nhttps://github.com/user-attachments/assets/59cfc56f-3de8-4f7a-a2f9-79cb3fdee1c7\r\n\r\n###
Other changes\r\n\r\nNext fixes and adjustments were also implemented as
part of this PR:\r\n* `Error` status in migration rules table to
indicate whether the rule\r\ntranslation has been failed\r\n* Callouts
inside the translation tab in details flyout\r\n* Updated `Fully
translated` status title into `Translated`\r\n\r\n### Known
issue\r\n\r\nThere is an issue with the autocompletion menu of the ES|QL
query editor\r\ncomponent. It is being shifted. It could be because we
are using this\r\ncomponent within the flyout and we might need to ask
help from the team\r\nwhich takes care of
it.","sha":"668f776583a60d35283a119fa007f7af9d1c57da"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/203601","number":203601,"mergeCommit":{"message":"[Rules
migration] ES|QL query editing and validation in translation tab in the
flyout (#11381) (#203601)\n\n## Summary\r\n\r\n[Internal
link](https://github.com/elastic/security-team/issues/10820)\r\nto the
feature details\r\n\r\nThese changes add a possibility to edit, validate
and save custom\r\nmigration rules:\r\n* There are new `edit`, `save`
and `cancel` buttons in the translation\r\ntab of the details flyout for
the non-installed custom rules\r\n* There is a new ES|QL query editing
component in the translation tab\r\nwhich allows edit and validate the
ES|QL query\r\n* On saving the ES|QL query the custom migration rule
will be updated\r\nand based on the ES|QL validation a new
`translation_result` might be\r\nset: `full` if query is valid,
`partial` if query has syntax errors,\r\n`untraslated` if query is an
empty string.\r\n\r\n## Screen
recording\r\n\r\n\r\nhttps://github.com/user-attachments/assets/59cfc56f-3de8-4f7a-a2f9-79cb3fdee1c7\r\n\r\n###
Other changes\r\n\r\nNext fixes and adjustments were also implemented as
part of this PR:\r\n* `Error` status in migration rules table to
indicate whether the rule\r\ntranslation has been failed\r\n* Callouts
inside the translation tab in details flyout\r\n* Updated `Fully
translated` status title into `Translated`\r\n\r\n### Known
issue\r\n\r\nThere is an issue with the autocompletion menu of the ES|QL
query editor\r\ncomponent. It is being shifted. It could be because we
are using this\r\ncomponent within the flyout and we might need to ask
help from the team\r\nwhich takes care of
it.","sha":"668f776583a60d35283a119fa007f7af9d1c57da"}}]}] BACKPORT-->

Co-authored-by: Ievgen Sorokopud <ievgen.sorokopud@elastic.co>
  • Loading branch information
kibanamachine and e40pud authored Dec 12, 2024
1 parent 0cf814f commit 71a52ef
Show file tree
Hide file tree
Showing 27 changed files with 706 additions and 175 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,8 @@
import { z } from '@kbn/zod';
import { ArrayFromString } from '@kbn/zod-helpers';

import { NonEmptyString } from '../../../../api/model/primitives.gen';
import {
ElasticRulePartial,
RuleMigrationTranslationResult,
RuleMigrationComments,
UpdateRuleMigrationData,
RuleMigrationTaskStats,
OriginalRule,
RuleMigration,
Expand All @@ -31,6 +28,7 @@ import {
RuleMigrationResourceType,
RuleMigrationResource,
} from '../../rule_migration.gen';
import { NonEmptyString } from '../../../../api/model/primitives.gen';
import { ConnectorId, LangSmithOptions } from '../../common.gen';

export type CreateRuleMigrationRequestParams = z.infer<typeof CreateRuleMigrationRequestParams>;
Expand Down Expand Up @@ -62,6 +60,7 @@ export const GetRuleMigrationRequestQuery = z.object({
sort_field: NonEmptyString.optional(),
sort_direction: z.enum(['asc', 'desc']).optional(),
search_term: z.string().optional(),
ids: ArrayFromString(NonEmptyString).optional(),
});
export type GetRuleMigrationRequestQueryInput = z.input<typeof GetRuleMigrationRequestQuery>;

Expand Down Expand Up @@ -251,26 +250,7 @@ export const StopRuleMigrationResponse = z.object({
});

export type UpdateRuleMigrationRequestBody = z.infer<typeof UpdateRuleMigrationRequestBody>;
export const UpdateRuleMigrationRequestBody = z.array(
z.object({
/**
* The rule migration id
*/
id: NonEmptyString,
/**
* The migrated elastic rule attributes to update.
*/
elastic_rule: ElasticRulePartial.optional(),
/**
* The rule translation result.
*/
translation_result: RuleMigrationTranslationResult.optional(),
/**
* The comments for the migration including a summary from the LLM in markdown.
*/
comments: RuleMigrationComments.optional(),
})
);
export const UpdateRuleMigrationRequestBody = z.array(UpdateRuleMigrationData);
export type UpdateRuleMigrationRequestBodyInput = z.input<typeof UpdateRuleMigrationRequestBody>;

export type UpdateRuleMigrationResponse = z.infer<typeof UpdateRuleMigrationResponse>;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,22 +20,7 @@ paths:
schema:
type: array
items:
type: object
required:
- id
properties:
id:
description: The rule migration id
$ref: '../../../../../common/api/model/primitives.schema.yaml#/components/schemas/NonEmptyString'
elastic_rule:
description: The migrated elastic rule attributes to update.
$ref: '../../rule_migration.schema.yaml#/components/schemas/ElasticRulePartial'
translation_result:
description: The rule translation result.
$ref: '../../rule_migration.schema.yaml#/components/schemas/RuleMigrationTranslationResult'
comments:
description: The comments for the migration including a summary from the LLM in markdown.
$ref: '../../rule_migration.schema.yaml#/components/schemas/RuleMigrationComments'
$ref: '../../rule_migration.schema.yaml#/components/schemas/UpdateRuleMigrationData'
responses:
200:
description: Indicates rules migrations have been updated correctly.
Expand Down Expand Up @@ -151,6 +136,14 @@ paths:
required: false
schema:
type: string
- name: ids
in: query
required: false
schema:
type: array
items:
description: The rule migration id
$ref: '../../../../../common/api/model/primitives.schema.yaml#/components/schemas/NonEmptyString'

responses:
200:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -303,6 +303,29 @@ export const RuleMigrationTranslationStats = z.object({
}),
});

/**
* The rule migration data object for rule update operation
*/
export type UpdateRuleMigrationData = z.infer<typeof UpdateRuleMigrationData>;
export const UpdateRuleMigrationData = z.object({
/**
* The rule migration id
*/
id: NonEmptyString,
/**
* The migrated elastic rule attributes to update.
*/
elastic_rule: ElasticRulePartial.optional(),
/**
* The rule translation result.
*/
translation_result: RuleMigrationTranslationResult.optional(),
/**
* The comments for the migration including a summary from the LLM in markdown.
*/
comments: RuleMigrationComments.optional(),
});

/**
* The type of the rule migration resource.
*/
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,25 @@ components:
items:
type: string

UpdateRuleMigrationData:
type: object
description: The rule migration data object for rule update operation
required:
- id
properties:
id:
description: The rule migration id
$ref: '../../../common/api/model/primitives.schema.yaml#/components/schemas/NonEmptyString'
elastic_rule:
description: The migrated elastic rule attributes to update.
$ref: '#/components/schemas/ElasticRulePartial'
translation_result:
description: The rule translation result.
$ref: '#/components/schemas/RuleMigrationTranslationResult'
comments:
description: The comments for the migration including a summary from the LLM in markdown.
$ref: '#/components/schemas/RuleMigrationComments'

## Rule migration resources

RuleMigrationResourceType:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@

import { replaceParams } from '@kbn/openapi-common/shared';

import type { UpdateRuleMigrationData } from '../../../../common/siem_migrations/model/rule_migration.gen';
import type { LangSmithOptions } from '../../../../common/siem_migrations/model/common.gen';
import { KibanaServices } from '../../../common/lib/kibana';

Expand Down Expand Up @@ -37,6 +38,7 @@ import type {
UpsertRuleMigrationResourcesRequestBody,
UpsertRuleMigrationResourcesResponse,
GetRuleMigrationPrebuiltRulesResponse,
UpdateRuleMigrationResponse,
} from '../../../../common/siem_migrations/model/api/rules/rule_migration.gen';

export interface GetRuleMigrationStatsParams {
Expand Down Expand Up @@ -168,6 +170,8 @@ export interface GetRuleMigrationParams {
sortDirection?: 'asc' | 'desc';
/** Optional search term to filter documents */
searchTerm?: string;
/** Optional rules ids to filter documents */
ids?: string[];
/** Optional AbortSignal for cancelling request */
signal?: AbortSignal;
}
Expand All @@ -179,6 +183,7 @@ export const getRuleMigrations = async ({
sortField,
sortDirection,
searchTerm,
ids,
signal,
}: GetRuleMigrationParams): Promise<GetRuleMigrationResponse> => {
return KibanaServices.get().http.get<GetRuleMigrationResponse>(
Expand All @@ -191,6 +196,7 @@ export const getRuleMigrations = async ({
sort_field: sortField,
sort_direction: sortDirection,
search_term: searchTerm,
ids,
},
signal,
}
Expand Down Expand Up @@ -272,3 +278,21 @@ export const getRuleMigrationsPrebuiltRules = async ({
{ version: '1', signal }
);
};

export interface UpdateRulesParams {
/** The list of migration rules data to update */
rulesToUpdate: UpdateRuleMigrationData[];
/** Optional AbortSignal for cancelling request */
signal?: AbortSignal;
}
/** Updates provided migration rules. */
export const updateMigrationRules = async ({
rulesToUpdate,
signal,
}: UpdateRulesParams): Promise<UpdateRuleMigrationResponse> => {
return KibanaServices.get().http.put<UpdateRuleMigrationResponse>(SIEM_RULE_MIGRATIONS_PATH, {
version: '1',
body: JSON.stringify(rulesToUpdate),
signal,
});
};
Loading

0 comments on commit 71a52ef

Please sign in to comment.