Merge branch 'main' into remove_empty_kibana_2

.buildkite/scripts/common/env.sh

@@ -26,10 +26,22 @@ export KIBANA_BASE_BRANCH="$KIBANA_PKG_BRANCH"
 KIBANA_PKG_VERSION="$(jq -r .version "$KIBANA_DIR/package.json")"
 export KIBANA_PKG_VERSION
 
-export GECKODRIVER_CDNURL="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache"
-export CHROMEDRIVER_CDNURL="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache"
-export RE2_DOWNLOAD_MIRROR="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache"
-export CYPRESS_DOWNLOAD_MIRROR="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/cypress"
+BUILDKITE_AGENT_GCP_REGION=""
+if [[ "$(curl -is metadata.google.internal || true)" ]]; then
+  # projects/1003139005402/zones/us-central1-a -> us-central1-a -> us-central1
+  BUILDKITE_AGENT_GCP_REGION=$(curl -sH Metadata-Flavor:Google http://metadata.google.internal/computeMetadata/v1/instance/zone | rev | cut -d'/' -f1 | cut -c3- | rev)
+fi
+export BUILDKITE_AGENT_GCP_REGION
+
+CI_PROXY_CACHE_SUFFIX=""
+if [[ "$BUILDKITE_AGENT_GCP_REGION" ]]; then
+  CI_PROXY_CACHE_SUFFIX="/region/$BUILDKITE_AGENT_GCP_REGION"
+fi
+
+export GECKODRIVER_CDNURL="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache$CI_PROXY_CACHE_SUFFIX"
+export CHROMEDRIVER_CDNURL="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache$CI_PROXY_CACHE_SUFFIX"
+export RE2_DOWNLOAD_MIRROR="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache$CI_PROXY_CACHE_SUFFIX"
+export CYPRESS_DOWNLOAD_MIRROR="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache$CI_PROXY_CACHE_SUFFIX/cypress"
 
 export NODE_OPTIONS="--max-old-space-size=4096"
 

.buildkite/scripts/common/setup_bazel.sh

@@ -16,12 +16,7 @@ BAZEL_CACHE_MODE=${BAZEL_CACHE_MODE:-gcs}
 if [[ "$BAZEL_CACHE_MODE" == "gcs" ]]; then
   echo "[bazel] enabling caching with GCS buckets"
 
-  BAZEL_REGION="us-central1"
-  if [[ "$(curl -is metadata.google.internal || true)" ]]; then
-    # projects/1003139005402/zones/us-central1-a -> us-central1-a -> us-central1
-    BAZEL_REGION=$(curl -sH Metadata-Flavor:Google http://metadata.google.internal/computeMetadata/v1/instance/zone | rev | cut -d'/' -f1 | cut -c3- | rev)
-  fi
-
+  BAZEL_REGION="${BUILDKITE_AGENT_GCP_REGION:-us-central1}"
   BAZEL_BUCKET="kibana-ci-bazel_$BAZEL_REGION"
 
   echo "[bazel] using GCS bucket: $BAZEL_BUCKET"

x-pack/plugins/graph/public/components/field_manager/field_picker.tsx

@@ -63,7 +63,7 @@ export function FieldPicker({
           aria-disabled={!hasFields}
           onClick={() => {
             if (hasFields) {
-              setOpen(true);
+              setOpen(!open);
             }
           }}
           onClickAriaLabel={badgeDescription}

x-pack/plugins/security_solution/cypress/integration/detection_rules/export_rule.spec.ts

@@ -21,12 +21,16 @@ import {
   bulkExportRules,
   selectAllRules,
 } from '../../tasks/alerts_detection_rules';
+import { createExceptionList, deleteExceptionList } from '../../tasks/api_calls/exceptions';
+import { getExceptionList } from '../../objects/exception';
 import { createCustomRule } from '../../tasks/api_calls/rules';
 import { cleanKibana, deleteAlertsAndRules } from '../../tasks/common';
 import { login, visitWithoutDateRange } from '../../tasks/login';
 
 import { DETECTIONS_RULE_MANAGEMENT_URL } from '../../urls/navigation';
 
+const exceptionList = getExceptionList();
+
 describe('Export rules', () => {
   before(() => {
     cleanKibana();
@@ -86,4 +90,48 @@ describe('Export rules', () => {
       `Successfully exported ${expectedNumberCustomRulesToBeExported} of ${totalNumberOfRules} rules. Prebuilt rules were excluded from the resulting file.`
     );
   });
+
+  context('rules with exceptions', () => {
+    beforeEach(() => {
+      deleteExceptionList(exceptionList.list_id, exceptionList.namespace_type);
+      // create rule with exceptions
+      createExceptionList(exceptionList, exceptionList.list_id).then((response) =>
+        createCustomRule(
+          {
+            ...getNewRule(),
+            name: 'rule with exceptions',
+            exceptionLists: [
+              {
+                id: response.body.id,
+                list_id: exceptionList.list_id,
+                type: exceptionList.type,
+                namespace_type: exceptionList.namespace_type,
+              },
+            ],
+          },
+          '2'
+        )
+      );
+    });
+
+    it('exports custom rules with exceptions', function () {
+      // one rule with exception, one without it
+      const expectedNumberCustomRulesToBeExported = 2;
+
+      loadPrebuiltDetectionRulesFromHeaderBtn();
+
+      selectAllRules();
+      bulkExportRules();
+
+      // should display correct number of custom rules when one of them has exceptions
+      cy.get(MODAL_CONFIRMATION_BTN)
+        .should('have.text', `Export ${expectedNumberCustomRulesToBeExported} custom rules`)
+        .click();
+
+      cy.get(TOASTER_BODY).should(
+        'contain',
+        `Successfully exported ${expectedNumberCustomRulesToBeExported}`
+      );
+    });
+  });
 });

x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/bulk_actions/utils/dry_run_result.ts

@@ -38,7 +38,7 @@ export const processDryRunResult = (response: BulkActionResponse | undefined): D
  */
 export const transformExportDetailsToDryRunResult = (details: ExportRulesDetails): DryRunResult => {
   return {
-    succeededRulesCount: details.exported_count,
+    succeededRulesCount: details.exported_rules_count,
     failedRulesCount: details.missing_rules_count,
     // if there are rules that can't be exported, it means they are immutable. So we can safely put error code as immutable
     ruleErrors: details.missing_rules.length

x-pack/plugins/security_solution/public/resolver/data_access_layer/factory.ts

@@ -89,7 +89,7 @@ export function dataAccessLayerFactory(
           indexPatterns,
         },
       };
-      if (category === 'alerts') {
+      if (category === 'alert') {
         return context.services.http.post('/api/endpoint/resolver/events', {
           query: commonFields.query,
           body: JSON.stringify({
@@ -193,7 +193,7 @@ export function dataAccessLayerFactory(
                 filter: [{ term: { 'event.id': eventID } }],
               },
             };
-      if (eventCategory.includes('alerts') === false) {
+      if (eventCategory.includes('alert') === false) {
         const response: ResolverPaginatedEvents = await context.services.http.post(
           '/api/endpoint/resolver/events',
           {

x-pack/plugins/security_solution/public/resolver/view/panels/event_detail.tsx

@@ -39,6 +39,7 @@ import type { SafeResolverEvent } from '../../../../common/endpoint/types';
 import { deepObjectEntries } from './deep_object_entries';
 import { useFormattedDate } from './use_formatted_date';
 import * as nodeDataModel from '../../models/node_data';
+import { expandDottedObject } from '../../../../common/utils/expand_dotted';
 
 const eventDetailRequestError = i18n.translate(
   'xpack.securitySolution.resolver.panel.eventDetail.requestError',
@@ -158,9 +159,10 @@ function EventDetailFields({ event }: { event: SafeResolverEvent }) {
       namespace: React.ReactNode;
       descriptions: Array<{ title: React.ReactNode; description: React.ReactNode }>;
     }> = [];
-    for (const [key, value] of Object.entries(event)) {
+    const expandedEventObject: object = expandDottedObject(event);
+    for (const [key, value] of Object.entries(expandedEventObject)) {
       // ignore these keys
-      if (key === 'agent' || key === 'ecs' || key === '@timestamp') {
+      if (key === 'agent' || key === 'ecs' || key === '@timestamp' || !value) {
         continue;
       }
 

x-pack/plugins/security_solution/public/resolver/view/panels/node_events_of_type.tsx

@@ -104,9 +104,10 @@ const NodeEventsListItem = memo(function ({
   nodeID: string;
   eventCategory: string;
 }) {
-  const timestamp = eventModel.eventTimestamp(event);
-  const eventID = eventModel.eventID(expandDottedObject(event));
-  const winlogRecordID = eventModel.winlogRecordID(event);
+  const expandedEvent = expandDottedObject(event);
+  const timestamp = eventModel.eventTimestamp(expandedEvent);
+  const eventID = eventModel.eventID(expandedEvent);
+  const winlogRecordID = eventModel.winlogRecordID(expandedEvent);
   const date =
     useFormattedDate(timestamp) ||
     i18n.translate('xpack.securitySolution.enpdoint.resolver.panelutils.noTimestampRetrieved', {
@@ -129,8 +130,8 @@ const NodeEventsListItem = memo(function ({
           <FormattedMessage
             id="xpack.securitySolution.endpoint.resolver.panel.relatedEventDetail.categoryAndType"
             values={{
-              category: eventModel.eventCategory(event).join(', '),
-              eventType: eventModel.eventType(event).join(', '),
+              category: eventModel.eventCategory(expandedEvent).join(', '),
+              eventType: eventModel.eventType(expandedEvent).join(', '),
             }}
             defaultMessage="{category} {eventType}"
           />
@@ -148,7 +149,7 @@ const NodeEventsListItem = memo(function ({
         data-test-subj="resolver:panel:node-events-in-category:event-link"
         {...linkProps}
       >
-        <DescriptiveName event={event} />
+        <DescriptiveName event={expandedEvent} />
       </EuiButtonEmpty>
     </>
   );

x-pack/plugins/security_solution/server/endpoint/routes/resolver/tree/queries/stats.ts

@@ -211,7 +211,7 @@ export class StatsQuery {
               [id]: {
                 total: alertCount + otherEvents.total,
                 byCategory: {
-                  alerts: alertCount,
+                  alert: alertCount,
                   ...otherEvents.byCategory,
                 },
               },
@@ -222,7 +222,7 @@ export class StatsQuery {
               [id]: {
                 total: alertCount,
                 byCategory: {
-                  alerts: alertCount,
+                  alert: alertCount,
                 },
               },
             };

x-pack/plugins/security_solution/server/lib/prebuilt_dev_tool_content/console_mappings.ts

@@ -7,4 +7,5 @@
 
 export const consoleMappings = {
   enable_host_risk_score: 'enable_host_risk_score.console',
+  enable_user_risk_score: 'enable_user_risk_score.console',
 };