From fc5423d7e483557ea0dbbe5354ae35cd0149d46c Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Sat, 21 Sep 2024 01:44:02 +1000
Subject: [PATCH] [8.x] [EDR Workflows][Osquery] Fix last results pack value
 (#192678) (#193579)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Backport

This will backport the following commits from `main` to `8.x`:
- [[EDR Workflows][Osquery] Fix last results pack value
(#192678)](https://github.com/elastic/kibana/pull/192678)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Konrad
Szwarc","email":"konrad.szwarc@elastic.co"},"sourceCommit":{"committedDate":"2024-09-17T08:18:09Z","message":"[EDR
Workflows][Osquery] Fix last results pack value (#192678)\n\nThe “Last
Results” tab in the active pack details is displaying\r\nincorrect
date-time values. This is due to a mismatch in data format.\r\nThe
component responsible for formatting the date-time values expects
a\r\nstring, but it is currently receiving an array with a single
string\r\ninside.\r\n\r\nBefore:\r\n\r\n![Screenshot 2024-09-12 at 10
33\r\n39](https://github.com/user-attachments/assets/844fd699-a086-44d8-aa0b-a06e65e5aa60)\r\n\r\nAfter:
\r\n\r\n![Screenshot 2024-09-12 at 12
40\r\n04](https://github.com/user-attachments/assets/bcce9b69-58b8-438d-89e8-c78a3922845c)","sha":"cfcb6e8f4ddf078ccdcec2a03788e39c6e4dfdef","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Defend
Workflows","v8.16.0","backport:version"],"title":"[EDR
Workflows][Osquery] Fix last results pack
value","number":192678,"url":"https://github.com/elastic/kibana/pull/192678","mergeCommit":{"message":"[EDR
Workflows][Osquery] Fix last results pack value (#192678)\n\nThe “Last
Results” tab in the active pack details is displaying\r\nincorrect
date-time values. This is due to a mismatch in data format.\r\nThe
component responsible for formatting the date-time values expects
a\r\nstring, but it is currently receiving an array with a single
string\r\ninside.\r\n\r\nBefore:\r\n\r\n![Screenshot 2024-09-12 at 10
33\r\n39](https://github.com/user-attachments/assets/844fd699-a086-44d8-aa0b-a06e65e5aa60)\r\n\r\nAfter:
\r\n\r\n![Screenshot 2024-09-12 at 12
40\r\n04](https://github.com/user-attachments/assets/bcce9b69-58b8-438d-89e8-c78a3922845c)","sha":"cfcb6e8f4ddf078ccdcec2a03788e39c6e4dfdef"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/192678","number":192678,"mergeCommit":{"message":"[EDR
Workflows][Osquery] Fix last results pack value (#192678)\n\nThe “Last
Results” tab in the active pack details is displaying\r\nincorrect
date-time values. This is due to a mismatch in data format.\r\nThe
component responsible for formatting the date-time values expects
a\r\nstring, but it is currently receiving an array with a single
string\r\ninside.\r\n\r\nBefore:\r\n\r\n![Screenshot 2024-09-12 at 10
33\r\n39](https://github.com/user-attachments/assets/844fd699-a086-44d8-aa0b-a06e65e5aa60)\r\n\r\nAfter:
\r\n\r\n![Screenshot 2024-09-12 at 12
40\r\n04](https://github.com/user-attachments/assets/bcce9b69-58b8-438d-89e8-c78a3922845c)","sha":"cfcb6e8f4ddf078ccdcec2a03788e39c6e4dfdef"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Konrad Szwarc <konrad.szwarc@elastic.co>
---
 .../packs/pack_queries_status_table.tsx       | 40 +++++++++----------
 1 file changed, 19 insertions(+), 21 deletions(-)

diff --git a/x-pack/plugins/osquery/public/packs/pack_queries_status_table.tsx b/x-pack/plugins/osquery/public/packs/pack_queries_status_table.tsx
index 53d55aef7475c..d43721a61b6d2 100644
--- a/x-pack/plugins/osquery/public/packs/pack_queries_status_table.tsx
+++ b/x-pack/plugins/osquery/public/packs/pack_queries_status_table.tsx
@@ -187,7 +187,7 @@ const ViewResultsInLensActionComponent: React.FC<ViewResultsInDiscoverActionProp
   const { data: logsDataView } = useLogsDataView({ skip: !actionId, checkOnly: true });
 
   const handleClick = useCallback(
-    (event: any) => {
+    (event: React.MouseEvent<HTMLButtonElement>) => {
       event.preventDefault();
 
       if (logsDataView?.id) {
@@ -372,33 +372,31 @@ const ScheduledQueryLastResults: React.FC<ScheduledQueryLastResultsProps> = ({
     interval,
   });
 
+  const timestamp = useMemo(() => {
+    const dateTime = lastResultsData?.['@timestamp'];
+    if (!dateTime) return undefined;
+
+    return Array.isArray(dateTime) ? dateTime[0] : dateTime;
+  }, [lastResultsData]);
+
   if (isLoading) {
     return <EuiLoadingSpinner />;
   }
 
-  if (!lastResultsData) {
-    return <>{'-'}</>;
-  }
-
   return (
     <EuiFlexGroup gutterSize="s" alignItems="center">
       <EuiFlexItem grow={4}>
-        {lastResultsData?.['@timestamp'] ? (
+        {timestamp ? (
           <EuiToolTip
             content={
               <>
-                <FormattedDate
-                  value={lastResultsData['@timestamp']}
-                  year="numeric"
-                  month="short"
-                  day="2-digit"
-                />{' '}
-                <FormattedTime value={lastResultsData['@timestamp']} timeZoneName="short" />
+                <FormattedDate value={timestamp} year="numeric" month="short" day="2-digit" />{' '}
+                <FormattedTime value={timestamp} timeZoneName="short" />
               </>
             }
           >
             <div data-test-subj="last-results-date">
-              <FormattedRelative value={lastResultsData['@timestamp']} />
+              <FormattedRelative value={timestamp} />
             </div>
           </EuiToolTip>
         ) : (
@@ -584,7 +582,7 @@ const PackQueriesStatusTableComponent: React.FC<PackQueriesStatusTableProps> = (
     Record<string, ReturnType<typeof ScheduledQueryExpandedContent>>
   >({});
 
-  const renderQueryColumn = useCallback((query: string, item: any) => {
+  const renderQueryColumn = useCallback((query: string, item: PackQueryFormData) => {
     const singleLine = removeMultilines(query);
     const content = singleLine.length > 55 ? `${singleLine.substring(0, 55)}...` : singleLine;
 
@@ -618,7 +616,7 @@ const PackQueriesStatusTableComponent: React.FC<PackQueriesStatusTableProps> = (
   );
 
   const renderLastResultsColumn = useCallback(
-    (item: any) => (
+    (item: PackQueryFormData) => (
       <ScheduledQueryLastResults
         actionId={getPackActionId(item.id, packName)}
         interval={item.interval}
@@ -627,19 +625,19 @@ const PackQueriesStatusTableComponent: React.FC<PackQueriesStatusTableProps> = (
     [packName]
   );
   const renderDocsColumn = useCallback(
-    (item: any) => (
+    (item: PackQueryFormData) => (
       <DocsColumnResults actionId={getPackActionId(item.id, packName)} interval={item.interval} />
     ),
     [packName]
   );
   const renderAgentsColumn = useCallback(
-    (item: any) => (
+    (item: PackQueryFormData) => (
       <AgentsColumnResults actionId={getPackActionId(item.id, packName)} interval={item.interval} />
     ),
     [packName]
   );
   const renderErrorsColumn = useCallback(
-    (item: any) => (
+    (item: PackQueryFormData) => (
       <ErrorsColumnResults
         queryId={item.id}
         interval={item.interval}
@@ -652,12 +650,12 @@ const PackQueriesStatusTableComponent: React.FC<PackQueriesStatusTableProps> = (
   );
 
   const renderDiscoverResultsAction = useCallback(
-    (item: any) => <PackViewInDiscoverAction item={item} packName={packName} />,
+    (item: PackQueryFormData) => <PackViewInDiscoverAction item={item} packName={packName} />,
     [packName]
   );
 
   const renderLensResultsAction = useCallback(
-    (item: any) => <PackViewInLensAction item={item} packName={packName} />,
+    (item: PackQueryFormData) => <PackViewInLensAction item={item} packName={packName} />,
     [packName]
   );