[Security Solution][Detections] Integrates installed integrations into interface

[spong]

Summary

Wires up the new Installed Integrations API added in #132667 to the new Related Integrations UI added in #131475.

Additional changes include (though not all necessary for this specific PR):

• Updates integrations badge icon to package on Rules Table
• Add Kibana Advanced Setting for disabling integrations badge on Rules Table
• Add loaders where necessary since there can now be API delay
• Separate description step components to specific files

Please see #131475 for screenshots and additional details.

Steps to test

In this initial implementation these new fields are only visible with Prebuilt Rules, and so there is limited API support and currently no UI for editing them. If a Prebuilt Rule is duplicated, these fields are emptied (set to '' or []). When a Rule is exported these fields are included (as empty values), and it is possible to edit the ndjson and re-import and then see these fields for the Custom Rule (but still not editable in the UI). This is expected behavior, and is actually a nice and easy way to test.

Here is a sample export you can paste into a test.ndjson file and import to test this feature. You can modify the package/version fields to test corner cases like if a package is installed but it's the wrong version.

{"id":"6cc39c80-da3a-11ec-9fce-65c1a0bee904","updated_at":"2022-05-23T01:48:23.422Z","updated_by":"elastic","created_at":"2022-05-23T01:48:20.940Z","created_by":"elastic","name":"Testing #131475, don't mind me...","tags":["Elastic","Endpoint Security"],"interval":"5m","enabled":false,"description":"Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.","risk_score":47,"severity":"medium","license":"Elastic License v2","output_index":".siem-signals-default","meta":{"from":"5m"},"rule_name_override":"message","timestamp_override":"event.ingested","author":["Elastic"],"false_positives":[],"from":"now-600s","rule_id":"2c66bf23-6ae9-4eb2-859e-446bea181ae9","max_signals":10000,"risk_score_mapping":[{"field":"event.risk_score","operator":"equals","value":""}],"severity_mapping":[{"field":"event.severity","operator":"equals","severity":"low","value":"21"},{"field":"event.severity","operator":"equals","severity":"medium","value":"47"},{"field":"event.severity","operator":"equals","severity":"high","value":"73"},{"field":"event.severity","operator":"equals","severity":"critical","value":"99"}],"threat":[],"to":"now","references":[],"version":7,"exceptions_list":[{"id":"endpoint_list","list_id":"endpoint_list","namespace_type":"agnostic","type":"endpoint"}],"immutable":false,"related_integrations":[{"package":"system","version":"1.6.4"},{"package":"aws","integration":"cloudtrail","version":"1.11.0"}],"required_fields":[{"ecs":true,"name":"event.code","type":"keyword"},{"ecs":true,"name":"message","type":"match_only_text"},{"ecs":false,"name":"winlog.event_data.AttributeLDAPDisplayName","type":"keyword"},{"ecs":false,"name":"winlog.event_data.AttributeValue","type":"keyword"},{"ecs":false,"name":"winlog.event_data.ShareName","type":"keyword"},{"ecs":false,"name":"winlog.event_data.RelativeTargetName","type":"keyword"},{"ecs":false,"name":"winlog.event_data.AccessList","type":"keyword"}],"setup":"## Config\\n\\nThe 'Audit Detailed File Share' audit policy must be configured (Success Failure).\\nSteps to implement the logging policy with with Advanced Audit Configuration:\\n\\n```\\nComputer Configuration > \\nPolicies > \\nWindows Settings > \\nSecurity Settings > \\nAdvanced Audit Policies Configuration > \\nAudit Policies > \\nObject Access > \\nAudit Detailed File Share (Success,Failure)\\n```\\n\\nThe 'Audit Directory Service Changes' audit policy must be configured (Success Failure).\\nSteps to implement the logging policy with with Advanced Audit Configuration:\\n\\n```\\nComputer Configuration > \\nPolicies > \\nWindows Settings > \\nSecurity Settings > \\nAdvanced Audit Policies Configuration > \\nAudit Policies > \\nDS Access > \\nAudit Directory Service Changes (Success,Failure)\\n```\\n","type":"query","language":"kuery","index":["logs-endpoint.alerts-*"],"query":"event.kind:alert and event.module:(endpoint and not endgame)\\n","filters":[],"throttle":"no_actions","actions":[]}
{"exported_count":1,"exported_rules_count":1,"missing_rules":[],"missing_rules_count":0,"exported_exception_list_count":0,"exported_exception_list_item_count":0,"missing_exception_list_item_count":0,"missing_exception_list_items":[],"missing_exception_lists":[],"missing_exception_lists_count":0}

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[andrew-goldstein]

approving snapshot update

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 4728ade
• Storybooks Preview
• Webpack Bundle Analyzer

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	5.1MB	5.1MB	+636.0B

History

• 💔 Build #47398 failed e0aa5db
• 💔 Build #47384 failed d4422b4

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @spong

[banderror]

Checked out, tested locally, and reviewed the changes. LGTM 👍

Found a few minor bugs.

On the Rule Management page package name is used instead of package title when the package has only 1 integration:

On the Rule Management page links use installed version instead of the target version:

Rule Details page doesn't have these issues.

The fact that it works differently on the 2 pages makes me think that we need to:

1. Use the exact same logic for processing related integrations and installed integrations everywhere.
2. Ideally use the exact same components to render them. Let's revisit the popover thing and use the same UI as on the Details page to render integrations in the popover.

Let's fix the rest of the minor bugs and clean up the implementation a little bit before the release.

🚀

[spong]

Per your review comment @banderror :

On the Rule Management page package name is used instead of package title when the package has only 1 integration

This is resolved in #133050 -- I had used the wrong variable so simple fix here. Note though, if there is no-match in installedIntegrations we just fall back to capitalize(i.package) from the Rule's RelatedIntegration object. We'll either need to start including package_title in the Rule data, or make another call to fleet for resolving the pretty name for the not-installed package.

On the Rule Management page links use installed version instead of the target version

So I updated the logic in #133050 to use the targetVersion for the link, however I think this has a corner case where the installed version could be off from the targetVersion and may result in Error loading integration details if the targetVersion isn't available. I tried testing a bit to see what happens when targetVersion/installedVersion/latestVersion all differ and things worked as expected, so perhaps this is only an issue if the package didn't exist in the first place, so we might be good here 👍

With regards to consolidating components/logic, I spoke with product/design today and they're on board with the following changes:

• Ok to use Rule Details UI within Rules Table popover content
• Slight update to copy in Rules Table popover (for better reading with re-using Rule Details installed/uninstalled badges)
• Sort integrations alphabetically
• Update left margins on version mis-match tooltip icon

These have all been addressed in #133050 🙂

Thanks for the review/feedback here @banderror!