[Security Solution][Platform] - Fixing exceptions export format

[yctercero]

Summary

Fixes exceptions export route. It is formatting exports weirdly with extra charachters. Adds integration tests for export of exception list.

Existing export

"{\"_version\":\"WzIxMjU1LDNd\",\"created_at\":\"2021-10-13T03:35:46.040Z\",\"created_by\":\"ytercero\",\"description\":\"test new\",\"id\":\"a6a3ef80-2bd6-11ec-8555-95b02ad6ae04\",\"immutable\":false,\"list_id\":\"15007788-8227-4b29-bec0-417cb9bd2192\",\"name\":\"test new\",\"namespace_type\":\"single\",\"os_types\":[],\"tags\":[],\"tie_breaker_id\":\"2b368e6a-f469-4a3b-8bca-6dd4bf8b82c9\",\"type\":\"detection\",\"updated_at\":\"2021-10-13T03:35:46.110Z\",\"updated_by\":\"ytercero\",\"version\":1}\n" "{\"_version\":\"WzIxMjU5LDNd\",\"comments\":[],\"created_at\":\"2021-10-13T03:36:01.327Z\",\"created_by\":\"ytercero\",\"description\":\"test new - exception list item\",\"entries\":[{\"field\":\"host.name\",\"operator\":\"included\",\"type\":\"match\",\"value\":\"DESKTOP-QBBSCUT\"}],\"id\":\"afc08bf0-2bd6-11ec-8555-95b02ad6ae04\",\"item_id\":\"f0dd9782-5a5a-43f9-ab9c-cb8c2b6fc4e5\",\"list_id\":\"15007788-8227-4b29-bec0-417cb9bd2192\",\"name\":\"test new - exception list item\",\"namespace_type\":\"single\",\"os_types\":[],\"tags\":[],\"tie_breaker_id\":\"d6eb9a6d-e3e1-4038-b476-f17cf3902e16\",\"type\":\"simple\",\"updated_at\":\"2021-10-13T03:36:01.396Z\",\"updated_by\":\"ytercero\"}\n" {"exception_list_items_details":"{\"exported_count\":1}\n"}

Fixed export

{"_version":"WzU0MjIzLDNd","created_at":"2021-10-13T03:35:46.040Z","created_by":"ytercero","description":"test new","id":"a6a3ef80-2bd6-11ec-8555-95b02ad6ae04","immutable":false,"list_id":"15007788-8227-4b29-bec0-417cb9bd2192","name":"test new","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"2b368e6a-f469-4a3b-8bca-6dd4bf8b82c9","type":"detection","updated_at":"2021-10-13T03:35:46.110Z","updated_by":"ytercero","version":1} {"_version":"WzU0MjI1LDNd","comments":[],"created_at":"2021-10-13T03:36:01.327Z","created_by":"ytercero","description":"test new - exception list item","entries":[{"field":"host.name","operator":"included","type":"match","value":"DESKTOP-QBBSCUT"}],"id":"afc08bf0-2bd6-11ec-8555-95b02ad6ae04","item_id":"f0dd9782-5a5a-43f9-ab9c-cb8c2b6fc4e5","list_id":"15007788-8227-4b29-bec0-417cb9bd2192","name":"test new - exception list item","namespace_type":"single","os_types":[],"tags":[],"tie_breaker_id":"d6eb9a6d-e3e1-4038-b476-f17cf3902e16","type":"simple","updated_at":"2021-10-13T03:36:01.396Z","updated_by":"ytercero"} {"exported_list_items_count":1}

Testing

To test, create a rule with and add an exception item to your rule. Navigate to the exceptions tab and hit export:

Checklist

• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• This was checked for cross-browser compatibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately

Not sure this is a breaking change, but happy to add tag if needed.

[yctercero]

Moved this to package as it's used in multiple plugins and exactly the same.

[rylnd]

LGTM! Integration tests look great 👍

[kibanamachine]

💛 Build succeeded, but was flaky

• continuous-integration/kibana-ci/pull-request

• Commit: 10a0b6f

• Storybooks Preview

• Flaky suites:

  • xpack-kibana-ciGroup6

---

Test Failures

Kibana Pipeline / general / X-Pack API Integration Tests.x-pack/test/api_integration/apis/search/session·ts.apis search search session touched time updates when you poll on an search

Link to Jenkins

Standard Out

Failed Tests Reporter:
  - Test has not failed recently on tracked branches

[00:00:00]     │
[00:00:00]       └-: apis
[00:00:00]         └-> "before all" hook in "apis"
[00:00:00]         └-: search
[00:00:00]           └-> "before all" hook in "search"
[00:00:03]           └-: search session
[00:00:03]             └-> "before all" hook for "should fail to extend a nonexistent session"
[00:00:03]             └-> should fail to extend a nonexistent session
[00:00:03]               └-> "before each" hook: global before each for "should fail to extend a nonexistent session"
[00:00:03]               │ proc [kibana] [2021-10-14T02:08:51.554+00:00][ERROR][plugins.dataEnhanced.data_enhanced] [object Object]
[00:00:03]               └- ✓ pass  (71ms) "apis search search session should fail to extend a nonexistent session"
[00:00:03]             └-> should sync search ids into not persisted session
[00:00:03]               └-> "before each" hook: global before each for "should sync search ids into not persisted session"
[00:00:03]               │ debg Waiting up to 5000ms for searches persisted into session...
[00:00:03]               │ proc [kibana] [2021-10-14T02:08:51.689+00:00][ERROR][plugins.dataEnhanced.data_enhanced] [object Object]
[00:00:03]               │ debg --- retry.waitForWithTimeout error: expected 200 "OK", got 404 "Not Found"
[00:00:04]               │ proc [kibana] [2021-10-14T02:08:52.270+00:00][ERROR][plugins.dataEnhanced.data_enhanced] [object Object]
[00:00:04]               │ debg --- retry.waitForWithTimeout failed again with the same message...
[00:00:04]               │ info [o.e.c.m.MetadataMappingService] [node-01] [.kibana_8.0.0_001/-bVUJorbR_6ql_d2YB5rPQ] update_mapping [_doc]
[00:00:04]               └- ✓ pass  (1.2s) "apis search search session should sync search ids into not persisted session"
[00:00:04]             └-> should complete session when searches complete
[00:00:04]               └-> "before each" hook: global before each for "should complete session when searches complete"
[00:00:05]               │ debg Waiting up to 5000ms for searches persisted into session...
[00:00:05]               │ debg --- retry.waitForWithTimeout error: expected [] to contain 'FnZaeFlkVEN0VE42SWlsQ2FGWUtQTVEbRmNVTjBlX2JRb0tiUWdnMUd2RjhIZzoyMjQx'
[00:00:05]               │ debg --- retry.waitForWithTimeout failed again with the same message...
[00:00:08]               │ info [o.e.c.m.MetadataMappingService] [node-01] [.kibana_8.0.0_001/-bVUJorbR_6ql_d2YB5rPQ] update_mapping [_doc]
[00:00:16]               │ debg Waiting up to 5000ms for searches eventually complete and session gets into the complete state...
[00:00:16]               └- ✓ pass  (11.4s) "apis search search session should complete session when searches complete"
[00:00:16]             └-> touched time updates when you poll on an search
[00:00:16]               └-> "before each" hook: global before each for "touched time updates when you poll on an search"
[00:00:16]               │ debg Waiting up to 20000ms for search session created...
[00:00:16]               │ proc [kibana] [2021-10-14T02:09:04.308+00:00][ERROR][plugins.dataEnhanced.data_enhanced] [object Object]
[00:00:16]               │ proc [kibana] [2021-10-14T02:09:04.877+00:00][ERROR][plugins.dataEnhanced.data_enhanced] [object Object]
[00:00:20]               └- ✖ fail: apis search search session touched time updates when you poll on an search
[00:00:20]               │      Error: expected '2021-10-14T02:09:05.295Z' to be below 2021-10-14T02:09:05.295Z
[00:00:20]               │       at Assertion.assert (/dev/shm/workspace/parallel/21/kibana/node_modules/@kbn/expect/expect.js:100:11)
[00:00:20]               │       at Assertion.lessThan.Assertion.below (/dev/shm/workspace/parallel/21/kibana/node_modules/@kbn/expect/expect.js:336:8)
[00:00:20]               │       at Function.lessThan (/dev/shm/workspace/parallel/21/kibana/node_modules/@kbn/expect/expect.js:531:15)
[00:00:20]               │       at Context.<anonymous> (test/api_integration/apis/search/session.ts:438:65)
[00:00:20]               │       at runMicrotasks (<anonymous>)
[00:00:20]               │       at processTicksAndRejections (internal/process/task_queues.js:95:5)
[00:00:20]               │       at Object.apply (/dev/shm/workspace/parallel/21/kibana/node_modules/@kbn/test/target_node/functional_test_runner/lib/mocha/wrap_function.js:87:16)
[00:00:20]               │ 
[00:00:20]               │ 

Stack Trace

Error: expected '2021-10-14T02:09:05.295Z' to be below 2021-10-14T02:09:05.295Z
    at Assertion.assert (/dev/shm/workspace/parallel/21/kibana/node_modules/@kbn/expect/expect.js:100:11)
    at Assertion.lessThan.Assertion.below (/dev/shm/workspace/parallel/21/kibana/node_modules/@kbn/expect/expect.js:336:8)
    at Function.lessThan (/dev/shm/workspace/parallel/21/kibana/node_modules/@kbn/expect/expect.js:531:15)
    at Context.<anonymous> (test/api_integration/apis/search/session.ts:438:65)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (internal/process/task_queues.js:95:5)
    at Object.apply (/dev/shm/workspace/parallel/21/kibana/node_modules/@kbn/test/target_node/functional_test_runner/lib/mocha/wrap_function.js:87:16)

---

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
lists	320	321	+1
securitySolution	2749	2750	+1
total			+2

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/securitysolution-utils	2	4	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
lists	148.2KB	148.5KB	+397.0B
securitySolution	4.6MB	4.6MB	+406.0B
total			+803.0B

Unknown metric groups

API count

id	before	after	diff
@kbn/securitysolution-utils	4	6	+2

History

• 💔 Build #160694 failed c5e16e0

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @yctercero

[kibanamachine]

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.