Add timestamp_override

x-pack/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/three_way_diff/final_edit/common_rule_field_edit.tsx

@@ -63,6 +63,12 @@ import {
   timelineTemplateSchema,
   timelineTemplateSerializer,
 } from './fields/timeline_template';
+import {
+  TimestampOverrideEdit,
+  timestampOverrideDeserializer,
+  timestampOverrideSerializer,
+  timestampOverrideSchema,
+} from './fields/timestamp_override';
 
 interface CommonRuleFieldEditProps {
   fieldName: UpgradeableCommonFields;
@@ -160,6 +166,15 @@ export function CommonRuleFieldEdit({ fieldName }: CommonRuleFieldEditProps) {
           deserializer={timelineTemplateDeserializer}
         />
       );
+    case 'timestamp_override':
+      return (
+        <FieldFormWrapper
+          component={TimestampOverrideEdit}
+          fieldFormSchema={timestampOverrideSchema}
+          serializer={timestampOverrideSerializer}
+          deserializer={timestampOverrideDeserializer}
+        />
+      );
     case 'threat':
       return (
         <FieldFormWrapper

x-pack/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/three_way_diff/final_edit/fields/timestamp_override.tsx

@@ -0,0 +1,91 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import type { FormSchema, FormData } from '../../../../../../../shared_imports';
+import { Field, UseField, useFormData } from '../../../../../../../shared_imports';
+import { schema } from '../../../../../../rule_creation_ui/components/step_about_rule/schema';
+import { AutocompleteField } from '../../../../../../rule_creation_ui/components/autocomplete_field';
+import { useDefaultIndexPattern } from '../../../use_default_index_pattern';
+import { getUseRuleIndexPatternParameters } from '../utils';
+import { useRuleIndexPattern } from '../../../../../../rule_creation_ui/pages/form';
+import type {
+  DiffableRule,
+  TimestampOverrideObject,
+} from '../../../../../../../../common/api/detection_engine';
+
+export const timestampOverrideSchema = {
+  timestampOverride: schema.timestampOverride,
+  timestampOverrideFallbackDisabled: schema.timestampOverrideFallbackDisabled,
+} as FormSchema<{
+  timestampOverride: string;
+  timestampOverrideFallbackDisabled: boolean | undefined;
+}>;
+
+interface TimestampOverrideEditProps {
+  finalDiffableRule: DiffableRule;
+}
+
+export function TimestampOverrideEdit({
+  finalDiffableRule,
+}: TimestampOverrideEditProps): JSX.Element {
+  const defaultIndexPattern = useDefaultIndexPattern();
+  const indexPatternParameters = getUseRuleIndexPatternParameters(
+    finalDiffableRule,
+    defaultIndexPattern
+  );
+  const { indexPattern, isIndexPatternLoading } = useRuleIndexPattern(indexPatternParameters);
+
+  return (
+    <>
+      <UseField
+        path="timestampOverride"
+        component={AutocompleteField}
+        componentProps={{
+          fieldType: 'date',
+          indices: indexPattern,
+          isDisabled: isIndexPatternLoading,
+          placeholder: '',
+        }}
+      />
+      <TimestampFallbackDisabled />
+    </>
+  );
+}
+
+function TimestampFallbackDisabled() {
+  const [formData] = useFormData();
+  const { timestampOverride } = formData;
+
+  if (timestampOverride && timestampOverride !== '@timestamp') {
+    return <UseField path="timestampOverrideFallbackDisabled" component={Field} />;
+  }
+
+  return null;
+}
+
+export function timestampOverrideDeserializer(defaultValue: FormData) {
+  return {
+    timestampOverride: defaultValue.field_name,
+    timestampOverrideFallbackDisabled: defaultValue.fallback_disabled ?? false,
+  };
+}
+
+export function timestampOverrideSerializer(formData: FormData): {
+  timestamp_override: TimestampOverrideObject | undefined;
+} {
+  if (formData.timestampOverride === '') {
+    return { timestamp_override: undefined };
+  }
+
+  return {
+    timestamp_override: {
+      field_name: formData.timestampOverride,
+      fallback_disabled: formData.timestampOverrideFallbackDisabled,
+    },
+  };
+}