[Security Solution] Allow users to edit required_fields field for custom rules

packages/kbn-doc-links/src/get_doc_links.ts

@@ -479,6 +479,7 @@ export const getDocLinks = ({ kibanaBranch, buildFlavor }: GetDocLinkOptions): D
       },
       privileges: `${SECURITY_SOLUTION_DOCS}endpoint-management-req.html`,
       manageDetectionRules: `${SECURITY_SOLUTION_DOCS}rules-ui-management.html`,
+      createDetectionRules: `${SECURITY_SOLUTION_DOCS}rules-ui-create.html`,
       createEsqlRuleType: `${SECURITY_SOLUTION_DOCS}rules-ui-create.html#create-esql-rule`,
       ruleUiAdvancedParams: `${SECURITY_SOLUTION_DOCS}rules-ui-create.html#rule-ui-advanced-params`,
       entityAnalytics: {

packages/kbn-doc-links/src/types.ts

@@ -354,6 +354,7 @@ export interface DocLinks {
     };
     readonly privileges: string;
     readonly manageDetectionRules: string;
+    readonly createDetectionRules: string;
     readonly createEsqlRuleType: string;
     readonly ruleUiAdvancedParams: string;
     readonly entityAnalytics: {

x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/common_attributes.gen.ts

@@ -303,13 +303,40 @@ export const TimestampOverride = z.string();
 export type TimestampOverrideFallbackDisabled = z.infer<typeof TimestampOverrideFallbackDisabled>;
 export const TimestampOverrideFallbackDisabled = z.boolean();
 
+/**
+ * Describes an Elasticsearch field that is needed for the rule to function
+ */
 export type RequiredField = z.infer<typeof RequiredField>;
 export const RequiredField = z.object({
+  /**
+   * Name of an Elasticsearch field
+   */
   name: NonEmptyString,
+  /**
+   * Type of the Elasticsearch field
+   */
   type: NonEmptyString,
+  /**
+   * Whether the field is an ECS field
+   */
   ecs: z.boolean(),
 });
 
+/**
+ * Input parameters to create a RequiredField. Does not include the `ecs` field, because `ecs` is calculated on the backend based on the field name and type.
+ */
+export type RequiredFieldInput = z.infer<typeof RequiredFieldInput>;
+export const RequiredFieldInput = z.object({
+  /**
+   * Name of an Elasticsearch field
+   */
+  name: NonEmptyString,
+  /**
+   * Type of an Elasticsearch field
+   */
+  type: NonEmptyString,
+});
+
 export type RequiredFieldArray = z.infer<typeof RequiredFieldArray>;
 export const RequiredFieldArray = z.array(RequiredField);
 

x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/common_attributes.schema.yaml

@@ -315,18 +315,36 @@ components:
 
     RequiredField:
       type: object
+      description: Describes an Elasticsearch field that is needed for the rule to function
       properties:
         name:
           $ref: '../../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
+          description: Name of an Elasticsearch field
         type:
           $ref: '../../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
+          description: Type of the Elasticsearch field
         ecs:
           type: boolean
+          description: Whether the field is an ECS field
       required:
         - name
         - type
         - ecs
 
+    RequiredFieldInput:
+      type: object
+      description: Input parameters to create a RequiredField. Does not include the `ecs` field, because `ecs` is calculated on the backend based on the field name and type.
+      properties:
+        name:
+          $ref: '../../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
+          description: Name of an Elasticsearch field
+        type:
+          $ref: '../../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
+          description: Type of an Elasticsearch field
+      required:
+        - name
+        - type
+
     RequiredFieldArray:
       type: array
       items:

x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/rule_schemas.gen.ts

@@ -54,6 +54,7 @@ import {
   ThreatArray,
   SetupGuide,
   RelatedIntegrationArray,
+  RequiredFieldInput,
   RuleObjectId,
   RuleSignatureId,
   IsRuleImmutable,
@@ -137,6 +138,7 @@ export const BaseDefaultableFields = z.object({
   threat: ThreatArray.optional(),
   setup: SetupGuide.optional(),
   related_integrations: RelatedIntegrationArray.optional(),
+  required_fields: z.array(RequiredFieldInput).optional(),
 });
 
 export type BaseCreateProps = z.infer<typeof BaseCreateProps>;

x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/rule_schemas.schema.yaml

@@ -117,22 +117,32 @@ components:
         author:
           $ref: './common_attributes.schema.yaml#/components/schemas/RuleAuthorArray'
 
+        # False positive examples
         false_positives:
           $ref: './common_attributes.schema.yaml#/components/schemas/RuleFalsePositiveArray'
 
+        # Reference URLs
         references:
           $ref: './common_attributes.schema.yaml#/components/schemas/RuleReferenceArray'
 
+        # Max alerts per run
         max_signals:
           $ref: './common_attributes.schema.yaml#/components/schemas/MaxSignals'
         threat:
           $ref: './common_attributes.schema.yaml#/components/schemas/ThreatArray'
         setup:
           $ref: './common_attributes.schema.yaml#/components/schemas/SetupGuide'
 
+        # Related integrations
         related_integrations:
           $ref: './common_attributes.schema.yaml#/components/schemas/RelatedIntegrationArray'
 
+        # Required fields
+        required_fields:
+          type: array
+          items:
+            $ref: './common_attributes.schema.yaml#/components/schemas/RequiredFieldInput'
+
     BaseCreateProps:
       x-inline: true
       allOf:

x-pack/plugins/security_solution/common/api/detection_engine/rule_management/import_rules/rule_to_import.ts

@@ -9,6 +9,7 @@ import * as z from 'zod';
 import {
   BaseCreateProps,
   ResponseFields,
+  RequiredFieldInput,
   RuleSignatureId,
   TypeSpecificCreateProps,
 } from '../../model/rule_schema';
@@ -29,5 +30,13 @@ export const RuleToImport = BaseCreateProps.and(TypeSpecificCreateProps).and(
   ResponseFields.partial().extend({
     rule_id: RuleSignatureId,
     immutable: z.literal(false).default(false),
+    /*
+      Overriding `required_fields` from ResponseFields because 
+      in ResponseFields `required_fields` has the output type, 
+      but for importing rules, we need to use the input type.
+      Otherwise importing rules without the "ecs" property in 
+      `required_fields` will fail. 
+    */
+    required_fields: z.array(RequiredFieldInput).optional(),
   })
 );

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/related_integrations/related_integration_field.tsx

@@ -24,7 +24,6 @@ import type { FieldHook } from '../../../../shared_imports';
 import type { Integration, RelatedIntegration } from '../../../../../common/api/detection_engine';
 import { useIntegrations } from '../../../../detections/components/rules/related_integrations/use_integrations';
 import { IntegrationStatusBadge } from './integration_status_badge';
-import { DEFAULT_RELATED_INTEGRATION } from './default_related_integration';
 import * as i18n from './translations';
 
 interface RelatedIntegrationItemFormProps {
@@ -95,16 +94,6 @@ export function RelatedIntegrationField({
   );
 
   const hasError = Boolean(packageErrorMessage) || Boolean(versionErrorMessage);
-  const isLastField = relatedIntegrations.length === 1;
-  const isLastEmptyField = isLastField && field.value.package === '';
-  const handleRemove = useCallback(() => {
-    if (isLastField) {
-      field.setValue(DEFAULT_RELATED_INTEGRATION);
-      return;
-    }
-
-    onRemove();
-  }, [onRemove, field, isLastField]);
 
   return (
     <EuiFormRow
@@ -145,8 +134,8 @@ export function RelatedIntegrationField({
         <EuiFlexItem grow={false}>
           <EuiButtonIcon
             color="danger"
-            onClick={handleRemove}
-            isDisabled={!integrations || isLastEmptyField}
+            onClick={onRemove}
+            isDisabled={!integrations}
             iconType="trash"
             aria-label={i18n.REMOVE_RELATED_INTEGRATION_BUTTON_ARIA_LABEL}
             data-test-subj="relatedIntegrationRemove"

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/related_integrations/related_integrations.test.tsx

@@ -28,7 +28,7 @@ jest.mock('../../../../common/lib/kibana', () => ({
       docLinks: {
         links: {
           securitySolution: {
-            ruleUiAdvancedParams: 'http://link-to-docs',
+            createDetectionRules: 'http://link-to-docs',
           },
         },
       },
@@ -669,82 +669,6 @@ describe('RelatedIntegrations form part', () => {
         });
       });
     });
-
-    describe('sticky last form row', () => {
-      it('does not remove the last item', async () => {
-        render(<TestForm />, { wrapper: createReactQueryWrapper() });
-
-        await addRelatedIntegrationRow();
-        await removeLastRelatedIntegrationRow();
-
-        expect(screen.getAllByTestId(RELATED_INTEGRATION_ROW)).toHaveLength(1);
-      });
-
-      it('disables remove button after clicking remove button on the last item', async () => {
-        render(<TestForm />, { wrapper: createReactQueryWrapper() });
-
-        await addRelatedIntegrationRow();
-        await removeLastRelatedIntegrationRow();
-
-        expect(screen.getByTestId(REMOVE_INTEGRATION_ROW_BUTTON_TEST_ID)).toBeDisabled();
-      });
-
-      it('clears selected integration when clicking remove the last form row button', async () => {
-        render(<TestForm />, { wrapper: createReactQueryWrapper() });
-
-        await addRelatedIntegrationRow();
-        await selectFirstEuiComboBoxOption({
-          comboBoxToggleButton: getLastByTestId(COMBO_BOX_TOGGLE_BUTTON_TEST_ID),
-        });
-        await removeLastRelatedIntegrationRow();
-
-        expect(screen.queryByTestId(COMBO_BOX_SELECTION_TEST_ID)).not.toBeInTheDocument();
-      });
-
-      it('submits an empty integration after clicking remove the last form row button', async () => {
-        const handleSubmit = jest.fn();
-
-        render(<TestForm onSubmit={handleSubmit} />, { wrapper: createReactQueryWrapper() });
-
-        await addRelatedIntegrationRow();
-        await selectFirstEuiComboBoxOption({
-          comboBoxToggleButton: getLastByTestId(COMBO_BOX_TOGGLE_BUTTON_TEST_ID),
-        });
-        await removeLastRelatedIntegrationRow();
-        await submitForm();
-        await waitFor(() => {
-          expect(handleSubmit).toHaveBeenCalled();
-        });
-
-        expect(handleSubmit).toHaveBeenCalledWith({
-          data: [{ package: '', version: '' }],
-          isValid: true,
-        });
-      });
-
-      it('submits an empty integration after previously saved integrations were removed', async () => {
-        const initialRelatedIntegrations: RelatedIntegration[] = [
-          { package: 'package-a', version: '^1.2.3' },
-        ];
-        const handleSubmit = jest.fn();
-
-        render(<TestForm initialState={initialRelatedIntegrations} onSubmit={handleSubmit} />, {
-          wrapper: createReactQueryWrapper(),
-        });
-
-        await waitForIntegrationsToBeLoaded();
-        await removeLastRelatedIntegrationRow();
-        await submitForm();
-        await waitFor(() => {
-          expect(handleSubmit).toHaveBeenCalled();
-        });
-
-        expect(handleSubmit).toHaveBeenCalledWith({
-          data: [{ package: '', version: '' }],
-          isValid: true,
-        });
-      });
-    });
   });
 });
 
@@ -778,11 +702,6 @@ function TestForm({ initialState, onSubmit }: TestFormProps): JSX.Element {
   );
 }
 
-function getLastByTestId(testId: string): HTMLElement {
-  // getAllByTestId throws an error when there are no `testId` elements found
-  return screen.getAllByTestId(testId).at(-1)!;
-}
-
 function waitForIntegrationsToBeLoaded(): Promise<void> {
   return waitForElementToBeRemoved(screen.queryAllByRole('progressbar'));
 }

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/related_integrations/related_integrations_help_info.tsx

@@ -40,7 +40,7 @@ export function RelatedIntegrationsHelpInfo(): JSX.Element {
           defaultMessage="Choose the {integrationsDocLink} this rule depends on, and correct if necessary each integration’s version constraint in {semverLink} format. Only tilde, caret, and plain versions are supported, such as ~1.2.3, ^1.2.3, or 1.2.3."
           values={{
             integrationsDocLink: (
-              <EuiLink href={docLinks.links.securitySolution.ruleUiAdvancedParams} target="_blank">
+              <EuiLink href={docLinks.links.securitySolution.createDetectionRules} target="_blank">
                 <FormattedMessage
                   id="xpack.securitySolution.detectionEngine.ruleDescription.relatedIntegrations.integrationsLink"
                   defaultMessage="integrations"

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/required_fields/index.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { RequiredFields } from './required_fields';

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/required_fields/make_validate_required_field.ts

@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RequiredFieldInput } from '../../../../../common/api/detection_engine/model/rule_schema/common_attributes.gen';
+import type { ERROR_CODE, FormData, ValidationFunc } from '../../../../shared_imports';
+import * as i18n from './translations';
+
+export function makeValidateRequiredField(parentFieldPath: string) {
+  return function validateRequiredField(
+    ...args: Parameters<ValidationFunc<FormData, string, RequiredFieldInput>>
+  ): ReturnType<ValidationFunc<{}, ERROR_CODE>> | undefined {
+    const [{ value, path, form }] = args;
+
+    const formData = form.getFormData();
+    const parentFieldData: RequiredFieldInput[] = formData[parentFieldPath];
+
+    const isFieldNameUsedMoreThanOnce =
+      parentFieldData.filter((field) => field.name === value.name).length > 1;
+
+    if (isFieldNameUsedMoreThanOnce) {
+      return {
+        code: 'ERR_FIELD_FORMAT',
+        path: `${path}.name`,
+        message: i18n.FIELD_NAME_USED_MORE_THAN_ONCE(value.name),
+      };
+    }
+
+    /* Allow empty rows. They are going to be removed before submission. */
+    if (value.name.trim().length === 0 && value.type.trim().length === 0) {
+      return;
+    }
+
+    if (value.name.trim().length === 0) {
+      return {
+        code: 'ERR_FIELD_MISSING',
+        path: `${path}.name`,
+        message: i18n.FIELD_NAME_REQUIRED,
+      };
+    }
+
+    if (value.type.trim().length === 0) {
+      return {
+        code: 'ERR_FIELD_MISSING',
+        path: `${path}.type`,
+        message: i18n.FIELD_TYPE_REQUIRED,
+      };
+    }
+  };
+}