From 37135a56c396c4bc0a249224bc6a785c78bbf09e Mon Sep 17 00:00:00 2001
From: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
Date: Thu, 8 Oct 2020 15:07:14 -0600
Subject: [PATCH] [Security Solution][Exception Modal] Removes list operators
 in exception modal for EQL rules (#79871) (#80055)

---
 .../components/exceptions/add_exception_modal/index.tsx     | 1 +
 .../common/components/exceptions/builder/entry_item.tsx     | 6 +++++-
 .../common/components/exceptions/builder/exception_item.tsx | 4 ++++
 .../public/common/components/exceptions/builder/index.tsx   | 4 ++++
 .../components/exceptions/edit_exception_modal/index.tsx    | 1 +
 5 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
index 6c5e39b3e6aad1..b2f8426413b128 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
@@ -391,6 +391,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
                   data-test-subj="alert-exception-builder"
                   id-aria="alert-exception-builder"
                   onChange={handleBuilderOnChange}
+                  ruleType={maybeRule?.type}
                 />
 
                 <EuiSpacer />
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/entry_item.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/entry_item.tsx
index 8f00763f914111..8b5e0555b57b40 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/entry_item.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/entry_item.tsx
@@ -7,6 +7,8 @@ import React, { useCallback } from 'react';
 import { EuiFormRow, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import styled from 'styled-components';
 
+import { isEqlRule } from '../../../../../common/detection_engine/utils';
+import { Type } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { IFieldType, IIndexPattern } from '../../../../../../../../src/plugins/data/common';
 import { FieldComponent } from '../../autocomplete/field';
 import { OperatorComponent } from '../../autocomplete/operator';
@@ -42,6 +44,7 @@ interface EntryItemProps {
   onChange: (arg: BuilderEntry, i: number) => void;
   setErrorsExist: (arg: boolean) => void;
   onlyShowListOperators?: boolean;
+  ruleType?: Type;
 }
 
 export const BuilderEntryItem: React.FC<EntryItemProps> = ({
@@ -52,6 +55,7 @@ export const BuilderEntryItem: React.FC<EntryItemProps> = ({
   onChange,
   setErrorsExist,
   onlyShowListOperators = false,
+  ruleType,
 }): JSX.Element => {
   const handleError = useCallback(
     (err: boolean): void => {
@@ -145,7 +149,7 @@ export const BuilderEntryItem: React.FC<EntryItemProps> = ({
           entry,
           listType,
           entry.field != null && entry.field.type === 'boolean',
-          isFirst
+          isFirst && !isEqlRule(ruleType)
         );
     const comboBox = (
       <OperatorComponent
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/exception_item.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/exception_item.tsx
index 9d3b24c933bfc7..ac4aaed971d5ed 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/exception_item.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/exception_item.tsx
@@ -8,6 +8,7 @@ import React, { useMemo, useCallback } from 'react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import styled from 'styled-components';
 
+import { Type } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
 import { getFormattedBuilderEntries, getUpdatedEntriesOnDelete } from './helpers';
 import { FormattedBuilderEntry, ExceptionsBuilderExceptionItem, BuilderEntry } from '../types';
@@ -43,6 +44,7 @@ interface BuilderExceptionListItemProps {
   onChangeExceptionItem: (item: ExceptionsBuilderExceptionItem, index: number) => void;
   setErrorsExist: (arg: boolean) => void;
   onlyShowListOperators?: boolean;
+  ruleType?: Type;
 }
 
 export const BuilderExceptionListItemComponent = React.memo<BuilderExceptionListItemProps>(
@@ -58,6 +60,7 @@ export const BuilderExceptionListItemComponent = React.memo<BuilderExceptionList
     onChangeExceptionItem,
     setErrorsExist,
     onlyShowListOperators = false,
+    ruleType,
   }) => {
     const handleEntryChange = useCallback(
       (entry: BuilderEntry, entryIndex: number): void => {
@@ -122,6 +125,7 @@ export const BuilderExceptionListItemComponent = React.memo<BuilderExceptionList
                         onChange={handleEntryChange}
                         setErrorsExist={setErrorsExist}
                         onlyShowListOperators={onlyShowListOperators}
+                        ruleType={ruleType}
                       />
                     </MyOverflowContainer>
                     <BuilderEntryDeleteButtonComponent
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx
index 1edee7af029e4f..a8fd7cfac7fbd8 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx
@@ -7,6 +7,7 @@ import React, { useCallback, useEffect, useReducer } from 'react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import styled from 'styled-components';
 
+import { Type } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { BuilderExceptionListItemComponent } from './exception_item';
 import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
 import {
@@ -72,6 +73,7 @@ interface ExceptionBuilderProps {
   isAndDisabled: boolean;
   isNestedDisabled: boolean;
   onChange: (arg: OnChangeProps) => void;
+  ruleType?: Type;
 }
 
 export const ExceptionBuilderComponent = ({
@@ -85,6 +87,7 @@ export const ExceptionBuilderComponent = ({
   isAndDisabled,
   isNestedDisabled,
   onChange,
+  ruleType,
 }: ExceptionBuilderProps) => {
   const [
     {
@@ -382,6 +385,7 @@ export const ExceptionBuilderComponent = ({
                 onChangeExceptionItem={handleExceptionItemChange}
                 onlyShowListOperators={containsValueListEntry(exceptions)}
                 setErrorsExist={setErrorsExist}
+                ruleType={ruleType}
               />
             </EuiFlexItem>
           </EuiFlexGroup>
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
index 8842503d3f3b54..ab0c566aa55c63 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
@@ -307,6 +307,7 @@ export const EditExceptionModal = memo(function EditExceptionModal({
                 id-aria="edit-exception-modal-builder"
                 onChange={handleBuilderOnChange}
                 indexPatterns={indexPatterns}
+                ruleType={maybeRule?.type}
               />
 
               <EuiSpacer />