[7.10] [Security Solution][Exception Modal] Removes list operators in exception modal for EQL rules (#79871)

x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx

@@ -391,6 +391,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
                   data-test-subj="alert-exception-builder"
                   id-aria="alert-exception-builder"
                   onChange={handleBuilderOnChange}
+                  ruleType={maybeRule?.type}
                 />
 
                 <EuiSpacer />

x-pack/plugins/security_solution/public/common/components/exceptions/builder/entry_item.tsx

@@ -7,6 +7,8 @@ import React, { useCallback } from 'react';
 import { EuiFormRow, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import styled from 'styled-components';
 
+import { isEqlRule } from '../../../../../common/detection_engine/utils';
+import { Type } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { IFieldType, IIndexPattern } from '../../../../../../../../src/plugins/data/common';
 import { FieldComponent } from '../../autocomplete/field';
 import { OperatorComponent } from '../../autocomplete/operator';
@@ -42,6 +44,7 @@ interface EntryItemProps {
   onChange: (arg: BuilderEntry, i: number) => void;
   setErrorsExist: (arg: boolean) => void;
   onlyShowListOperators?: boolean;
+  ruleType?: Type;
 }
 
 export const BuilderEntryItem: React.FC<EntryItemProps> = ({
@@ -52,6 +55,7 @@ export const BuilderEntryItem: React.FC<EntryItemProps> = ({
   onChange,
   setErrorsExist,
   onlyShowListOperators = false,
+  ruleType,
 }): JSX.Element => {
   const handleError = useCallback(
     (err: boolean): void => {
@@ -145,7 +149,7 @@ export const BuilderEntryItem: React.FC<EntryItemProps> = ({
           entry,
           listType,
           entry.field != null && entry.field.type === 'boolean',
-          isFirst
+          isFirst && !isEqlRule(ruleType)
         );
     const comboBox = (
       <OperatorComponent

x-pack/plugins/security_solution/public/common/components/exceptions/builder/exception_item.tsx

@@ -8,6 +8,7 @@ import React, { useMemo, useCallback } from 'react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import styled from 'styled-components';
 
+import { Type } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
 import { getFormattedBuilderEntries, getUpdatedEntriesOnDelete } from './helpers';
 import { FormattedBuilderEntry, ExceptionsBuilderExceptionItem, BuilderEntry } from '../types';
@@ -43,6 +44,7 @@ interface BuilderExceptionListItemProps {
   onChangeExceptionItem: (item: ExceptionsBuilderExceptionItem, index: number) => void;
   setErrorsExist: (arg: boolean) => void;
   onlyShowListOperators?: boolean;
+  ruleType?: Type;
 }
 
 export const BuilderExceptionListItemComponent = React.memo<BuilderExceptionListItemProps>(
@@ -58,6 +60,7 @@ export const BuilderExceptionListItemComponent = React.memo<BuilderExceptionList
     onChangeExceptionItem,
     setErrorsExist,
     onlyShowListOperators = false,
+    ruleType,
   }) => {
     const handleEntryChange = useCallback(
       (entry: BuilderEntry, entryIndex: number): void => {
@@ -122,6 +125,7 @@ export const BuilderExceptionListItemComponent = React.memo<BuilderExceptionList
                         onChange={handleEntryChange}
                         setErrorsExist={setErrorsExist}
                         onlyShowListOperators={onlyShowListOperators}
+                        ruleType={ruleType}
                       />
                     </MyOverflowContainer>
                     <BuilderEntryDeleteButtonComponent

x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx

@@ -7,6 +7,7 @@ import React, { useCallback, useEffect, useReducer } from 'react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import styled from 'styled-components';
 
+import { Type } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { BuilderExceptionListItemComponent } from './exception_item';
 import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
 import {
@@ -72,6 +73,7 @@ interface ExceptionBuilderProps {
   isAndDisabled: boolean;
   isNestedDisabled: boolean;
   onChange: (arg: OnChangeProps) => void;
+  ruleType?: Type;
 }
 
 export const ExceptionBuilderComponent = ({
@@ -85,6 +87,7 @@ export const ExceptionBuilderComponent = ({
   isAndDisabled,
   isNestedDisabled,
   onChange,
+  ruleType,
 }: ExceptionBuilderProps) => {
   const [
     {
@@ -382,6 +385,7 @@ export const ExceptionBuilderComponent = ({
                 onChangeExceptionItem={handleExceptionItemChange}
                 onlyShowListOperators={containsValueListEntry(exceptions)}
                 setErrorsExist={setErrorsExist}
+                ruleType={ruleType}
               />
             </EuiFlexItem>
           </EuiFlexGroup>

x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx

@@ -307,6 +307,7 @@ export const EditExceptionModal = memo(function EditExceptionModal({
                 id-aria="edit-exception-modal-builder"
                 onChange={handleBuilderOnChange}
                 indexPatterns={indexPatterns}
+                ruleType={maybeRule?.type}
               />
 
               <EuiSpacer />