Fix incorrect tags after rule duplication (#104948)

elastic · Jul 9, 2021 · 0100528 · 0100528
1 parent b1f2f13
commit 0100528
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 2 deletions.
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/add_tags.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/add_tags.test.ts
@@ -33,8 +33,17 @@ describe('add_tags', () => {
     const tags2 = addTags(tags1, 'rule-1', false);
     expect(tags2).toEqual([
       'tag-1',
+      `${INTERNAL_RULE_ID_KEY}:rule-1`,
       `${INTERNAL_IMMUTABLE_KEY}:false`,
+    ]);
+  });
+
+  test('it should overwrite existing immutable tag if it exists', () => {
+    const tags1 = addTags(['tag-1', `${INTERNAL_IMMUTABLE_KEY}:true`], 'rule-1', false);
+    expect(tags1).toEqual([
+      'tag-1',
       `${INTERNAL_RULE_ID_KEY}:rule-1`,
+      `${INTERNAL_IMMUTABLE_KEY}:false`,
     ]);
   });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/add_tags.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/add_tags.ts
@@ -10,7 +10,9 @@ import { INTERNAL_RULE_ID_KEY, INTERNAL_IMMUTABLE_KEY } from '../../../../common
 export const addTags = (tags: string[], ruleId: string, immutable: boolean): string[] => {
   return Array.from(
     new Set([
-      ...tags.filter((tag) => !tag.startsWith(INTERNAL_RULE_ID_KEY)),
+      ...tags.filter(
+        (tag) => !(tag.startsWith(INTERNAL_RULE_ID_KEY) || tag.startsWith(INTERNAL_IMMUTABLE_KEY))
+      ),
       `${INTERNAL_RULE_ID_KEY}:${ruleId}`,
       `${INTERNAL_IMMUTABLE_KEY}:${immutable}`,
     ])

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/duplicate_rule.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/duplicate_rule.test.ts
@@ -123,8 +123,8 @@ describe('duplicateRule', () => {
         },
         "tags": Array [
           "test",
-          "__internal_immutable:false",
           "__internal_rule_id:newId",
+          "__internal_immutable:false",
         ],
         "throttle": null,
       }