fix validation upon saving

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/threat_match_mapping_edit/index.tsx

@@ -6,3 +6,4 @@
  */
 
 export * from './threat_match_mapping_edit';
+export { DEFAULT_THREAT_MAPPING_VALUE } from './threat_match_mapping_field';

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/threat_match_mapping_edit/threat_match_mapping_edit.tsx

@@ -10,8 +10,8 @@ import type { DataViewBase } from '@kbn/es-query';
 import type { ThreatMapEntries } from '../../../../common/components/threat_match/types';
 import type { FieldConfig } from '../../../../shared_imports';
 import { UseField } from '../../../../shared_imports';
-import { threatMatchMappingValidatorFactory } from '../../../rule_creation_ui/validators/threat_match_mapping_validator';
-import { ThreatMatchField } from './threat_match_mapping_field';
+import { threatMatchMappingValidator } from './validators/threat_match_mapping_validator';
+import { ThreatMatchMappingField } from './threat_match_mapping_field';
 import * as i18n from './translations';
 
 interface ThreatMatchMappingEditProps {
@@ -29,7 +29,7 @@ export const ThreatMatchMappingEdit = memo(function ThreatMatchMappingEdit({
     <UseField
       path={path}
       config={THREAT_MATCH_MAPPING_FIELD_CONFIG}
-      component={ThreatMatchField}
+      component={ThreatMatchMappingField}
       componentProps={{
         indexPatterns,
         threatIndexPatterns,
@@ -42,7 +42,7 @@ const THREAT_MATCH_MAPPING_FIELD_CONFIG: FieldConfig<ThreatMapEntries[]> = {
   label: i18n.THREAT_MATCH_MAPPING_FIELD_LABEL,
   validations: [
     {
-      validator: threatMatchMappingValidatorFactory(),
+      validator: threatMatchMappingValidator,
     },
   ],
 };

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/threat_match_mapping_edit/threat_match_mapping_field.tsx

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useCallback, useEffect } from 'react';
+import React, { useCallback } from 'react';
 import { EuiFormRow } from '@elastic/eui';
 import type { DataViewBase } from '@kbn/es-query';
 import { createOrNewEntryItem } from '../../../../common/components/threat_match/helpers';
@@ -14,24 +14,26 @@ import { ThreatMatchComponent } from '../../../../common/components/threat_match
 import type { FieldHook } from '../../../../shared_imports';
 import { getFieldValidityAndErrorMessage } from '../../../../shared_imports';
 
-interface ThreatMatchFieldProps {
+export const DEFAULT_THREAT_MAPPING_VALUE = [createOrNewEntryItem()];
+
+interface ThreatMatchMappingFieldProps {
   field: FieldHook<ThreatMapEntries[]>;
   threatIndexPatterns: DataViewBase;
   indexPatterns: DataViewBase;
 }
 
-export function ThreatMatchField({
+export function ThreatMatchMappingField({
   field,
   threatIndexPatterns,
   indexPatterns,
-}: ThreatMatchFieldProps): JSX.Element {
+}: ThreatMatchMappingFieldProps): JSX.Element {
   const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
-  const { value, setValue, clearErrors } = field;
+  const { setValue } = field;
 
   const handleMappingChange = useCallback(
     (entryItems: ThreatMapEntries[]): void => {
       if (entryItems.length === 0) {
-        setValue(DEFAULT_VALUE);
+        setValue(DEFAULT_THREAT_MAPPING_VALUE);
         return;
       }
 
@@ -40,19 +42,6 @@ export function ThreatMatchField({
     [setValue]
   );
 
-  useEffect(() => {
-    if (!Array.isArray(value) || value.length === 0) {
-      setValue(DEFAULT_VALUE);
-
-      // Avoid showing validation errors when setting default value
-      // Since Form Hook's validation is async setTimeout is required
-      // to clear error after validation
-      setTimeout(() => {
-        clearErrors();
-      });
-    }
-  }, [value, setValue, clearErrors]);
-
   return (
     <EuiFormRow
       label={field.label}
@@ -73,5 +62,3 @@ export function ThreatMatchField({
     </EuiFormRow>
   );
 }
-
-const DEFAULT_VALUE = [createOrNewEntryItem()];

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/threat_match_mapping_edit/validators/threat_match_mapping_validator.ts

@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+import {
+  containsInvalidItems,
+  singleEntryThreat,
+} from '../../../../../common/components/threat_match/helpers';
+import type { FormData, ValidationFunc } from '../../../../../shared_imports';
+import type { ThreatMapEntries } from '../../../../../common/components/threat_match/types';
+
+export const threatMatchMappingValidator: ValidationFunc<FormData, string, ThreatMapEntries[]> = (
+  ...args
+) => {
+  const [{ path, value }] = args;
+
+  if (singleEntryThreat(value)) {
+    return {
+      code: 'ERR_FIELD_MISSING',
+      path,
+      message: i18n.translate(
+        'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.customThreatQueryFieldRequiredError',
+        {
+          defaultMessage: 'At least one indicator match is required.',
+        }
+      ),
+    };
+  }
+
+  if (containsInvalidItems(value)) {
+    return {
+      code: 'ERR_FIELD_MISSING',
+      path,
+      message: i18n.translate(
+        'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.customThreatQueryFieldRequiredEmptyError',
+        {
+          defaultMessage: 'All matches require both a field and threat index field.',
+        }
+      ),
+    };
+  }
+};

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/threat_match_query_edit/threat_match_query_edit.tsx

@@ -11,7 +11,7 @@ import type { FieldConfig } from '../../../../shared_imports';
 import { UseField } from '../../../../shared_imports';
 import type { FieldValueQueryBar } from '../../../rule_creation_ui/components/query_bar';
 import { QueryBarDefineRule } from '../../../rule_creation_ui/components/query_bar';
-import { queryRequiredValidatorFactory } from '../../../rule_creation_ui/validators/query_required_validator_factory';
+import { threatMatchQueryRequiredValidator } from './validators/threat_match_query_required_validator';
 import { kueryValidatorFactory } from '../../../rule_creation_ui/validators/kuery_validator_factory';
 import * as i18n from './translations';
 
@@ -47,7 +47,7 @@ const THREAT_MATCH_QUERY_FIELD_CONFIG: FieldConfig<FieldValueQueryBar> = {
   label: i18n.THREAT_MATCH_QUERY_FIELD_LABEL,
   validations: [
     {
-      validator: queryRequiredValidatorFactory('threat_match'),
+      validator: threatMatchQueryRequiredValidator,
     },
     {
       validator: kueryValidatorFactory(),

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/threat_match_query_edit/validators/threat_match_query_required_validator.ts

@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isEmpty } from 'lodash';
+import type { FieldValueQueryBar } from '../../../../rule_creation_ui/components/query_bar';
+import type { FormData, ValidationFunc } from '../../../../../shared_imports';
+import * as i18n from './translations';
+
+export const threatMatchQueryRequiredValidator: ValidationFunc<
+  FormData,
+  string,
+  FieldValueQueryBar
+> = (...args) => {
+  const [{ path, value }] = args;
+
+  if (isEmpty(value.query.query as string) && isEmpty(value.filters)) {
+    return {
+      code: 'ERR_FIELD_MISSING',
+      path,
+      message: i18n.THREAT_MATCH_QUERY_REQUIRED_ERROR,
+    };
+  }
+};

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/threat_match_query_edit/validators/translations.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const THREAT_MATCH_QUERY_REQUIRED_ERROR = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.threatMatchQueryBar.requiredError',
+  {
+    defaultMessage: 'A custom query is required.',
+  }
+);

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx

@@ -361,9 +361,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
     }
   }, [ruleType, previousRuleType, getFields]);
 
-  usePersistentThreatMatchState({
-    form,
-  });
+  usePersistentThreatMatchState({ form });
   usePersistentAlertSuppressionState({ form, ruleTypePath: 'ruleType' });
 
   // if saved query failed to load:

x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts

@@ -6,6 +6,7 @@
  */
 
 import type { Type } from '@kbn/securitysolution-io-ts-alerting-types';
+import { DEFAULT_THREAT_MAPPING_VALUE } from '../../../../detection_engine/rule_creation/components/threat_match_mapping_edit';
 import {
   ALERT_SUPPRESSION_DURATION_FIELD_NAME,
   ALERT_SUPPRESSION_DURATION_TYPE_FIELD_NAME,
@@ -56,7 +57,7 @@ export const stepDefineDefaultValue: DefineStepRule = {
   },
   requiredFields: [],
   relatedIntegrations: [],
-  threatMapping: [],
+  threatMapping: DEFAULT_THREAT_MAPPING_VALUE,
   threshold: {
     field: [],
     value: '200',