add wildcard entry type

refs elastic/security-team/issues/543
refs #97623 (review)

x-pack/plugins/lists/common/schemas/common/schemas.ts

@@ -287,6 +287,7 @@ export enum OperatorTypeEnum {
   NESTED = 'nested',
   MATCH = 'match',
   MATCH_ANY = 'match_any',
+  WILDCARD = 'wildcard',
   EXISTS = 'exists',
   LIST = 'list',
 }

x-pack/plugins/lists/common/schemas/types/entries.ts

@@ -12,12 +12,27 @@ import { entriesMatch } from './entry_match';
 import { entriesExists } from './entry_exists';
 import { entriesList } from './entry_list';
 import { entriesNested } from './entry_nested';
+import { entriesMatchWildcardCaseless } from './entry_match_wildcard_caseless';
 
-export const entry = t.union([entriesMatch, entriesMatchAny, entriesList, entriesExists]);
+export const entry = t.union([
+  entriesMatch,
+  entriesMatchAny,
+  entriesList,
+  entriesExists,
+  entriesNested,
+  entriesMatchWildcardCaseless,
+]);
 export type Entry = t.TypeOf<typeof entry>;
 
 export const entriesArray = t.array(
-  t.union([entriesMatch, entriesMatchAny, entriesList, entriesExists, entriesNested])
+  t.union([
+    entriesMatch,
+    entriesMatchAny,
+    entriesList,
+    entriesExists,
+    entriesNested,
+    entriesMatchWildcardCaseless,
+  ])
 );
 export type EntriesArray = t.TypeOf<typeof entriesArray>;
 

x-pack/plugins/lists/common/schemas/types/entry_match_wildcard_caseless.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../shared_imports';
+import { operator } from '../common/schemas';
+
+export const entriesMatchWildcardCaseless = t.exact(
+  t.type({
+    field: NonEmptyString,
+    operator,
+    type: t.keyof({ wildcard: null }),
+    value: NonEmptyString,
+  })
+);
+export type EntriesMatchWildcardCaseless = t.TypeOf<typeof entriesMatchWildcardCaseless>;

x-pack/plugins/lists/common/schemas/types/index.ts

@@ -15,6 +15,7 @@ export * from './default_namespace';
 export * from './entries';
 export * from './entry_match';
 export * from './entry_match_any';
+export * from './entry_match_wildcard_caseless';
 export * from './entry_list';
 export * from './entry_exists';
 export * from './entry_nested';

x-pack/plugins/lists/common/shared_exports.ts

@@ -20,6 +20,7 @@ export {
   EntryExists,
   EntryMatch,
   EntryMatchAny,
+  EntriesMatchWildcardCaseless,
   EntryNested,
   EntryList,
   EntriesArray,
@@ -39,6 +40,7 @@ export {
   nestedEntryItem,
   entriesMatch,
   entriesMatchAny,
+  entriesMatchWildcardCaseless,
   entriesExists,
   entriesList,
   namespaceType,

x-pack/plugins/lists/public/exceptions/components/builder/types.ts

@@ -9,6 +9,7 @@ import { IFieldType } from '../../../../../../../src/plugins/data/common';
 import { OperatorOption } from '../autocomplete/types';
 import {
   CreateExceptionListItemSchema,
+  EntriesMatchWildcardCaseless,
   Entry,
   EntryExists,
   EntryMatch,
@@ -34,7 +35,7 @@ export interface EmptyEntry {
   id: string;
   field: string | undefined;
   operator: OperatorEnum;
-  type: OperatorTypeEnum.MATCH | OperatorTypeEnum.MATCH_ANY;
+  type: OperatorTypeEnum.MATCH | OperatorTypeEnum.MATCH_ANY | OperatorTypeEnum.WILDCARD;
   value: string | string[] | undefined;
 }
 
@@ -53,6 +54,7 @@ export interface EmptyNestedEntry {
   entries: Array<
     | (EntryMatch & { id?: string })
     | (EntryMatchAny & { id?: string })
+    | (EntriesMatchWildcardCaseless & { id?: string })
     | (EntryExists & { id?: string })
   >;
 }
@@ -69,6 +71,7 @@ export type BuilderEntryNested = Omit<EntryNested, 'entries'> & {
   entries: Array<
     | (EntryMatch & { id?: string })
     | (EntryMatchAny & { id?: string })
+    | (EntriesMatchWildcardCaseless & { id?: string })
     | (EntryExists & { id?: string })
   >;
 };