[8.11] [Security Solution] Coverage overview rule duplication fix (#169708)

x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/coverage_overview/build_coverage_overview_dashboard_model.test.ts

@@ -0,0 +1,288 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CoverageOverviewRuleActivity } from '../../../../../common/api/detection_engine';
+import type { CoverageOverviewResponse } from '../../../../../common/api/detection_engine';
+import { buildCoverageOverviewDashboardModel } from './build_coverage_overview_dashboard_model';
+import {
+  getMockCoverageOverviewSubtechniques,
+  getMockCoverageOverviewTactics,
+  getMockCoverageOverviewTechniques,
+} from '../../model/coverage_overview/__mocks__';
+
+const mockTactics = getMockCoverageOverviewTactics();
+const mockTechniques = getMockCoverageOverviewTechniques();
+const mockSubtechniques = getMockCoverageOverviewSubtechniques();
+
+describe('buildCoverageOverviewDashboardModel', () => {
+  beforeEach(() => {
+    jest.mock('../../../../detections/mitre/mitre_tactics_techniques', () => {
+      return {
+        tactics: mockTactics,
+        techniques: mockTechniques,
+        subtechniques: mockSubtechniques,
+      };
+    });
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('maps API response', async () => {
+    const mockApiResponse: CoverageOverviewResponse = {
+      coverage: {
+        TA001: ['test-rule-1'],
+        TA002: ['test-rule-1'],
+        T001: ['test-rule-1'],
+        T002: ['test-rule-1'],
+        'T001.001': ['test-rule-1'],
+      },
+      unmapped_rule_ids: ['test-rule-2'],
+      rules_data: {
+        'test-rule-1': {
+          name: 'Test rule 1',
+          activity: CoverageOverviewRuleActivity.Enabled,
+        },
+        'test-rule-2': {
+          name: 'Test rule 2',
+          activity: CoverageOverviewRuleActivity.Enabled,
+        },
+      },
+    };
+
+    const model = await buildCoverageOverviewDashboardModel(mockApiResponse);
+
+    expect(model).toEqual({
+      metrics: {
+        totalEnabledRulesCount: 2,
+        totalRulesCount: 2,
+      },
+      mitreTactics: [
+        {
+          availableRules: [],
+          disabledRules: [],
+          enabledRules: [
+            {
+              id: 'test-rule-1',
+              name: 'Test rule 1',
+            },
+          ],
+          id: 'TA001',
+          name: 'Tactic 1',
+          reference: 'https://some-link/TA001',
+          techniques: [
+            {
+              availableRules: [],
+              disabledRules: [],
+              enabledRules: [
+                {
+                  id: 'test-rule-1',
+                  name: 'Test rule 1',
+                },
+              ],
+              id: 'T001',
+              name: 'Technique 1',
+              reference: 'https://some-link/T001',
+              subtechniques: [
+                {
+                  availableRules: [],
+                  disabledRules: [],
+                  enabledRules: [
+                    {
+                      id: 'test-rule-1',
+                      name: 'Test rule 1',
+                    },
+                  ],
+                  id: 'T001.001',
+                  name: 'Subtechnique 1',
+                  reference: 'https://some-link/T001/001',
+                },
+                {
+                  availableRules: [],
+                  disabledRules: [],
+                  enabledRules: [],
+                  id: 'T001.002',
+                  name: 'Subtechnique 2',
+                  reference: 'https://some-link/T001/002',
+                },
+              ],
+            },
+            {
+              availableRules: [],
+              disabledRules: [],
+              enabledRules: [
+                {
+                  id: 'test-rule-1',
+                  name: 'Test rule 1',
+                },
+              ],
+              id: 'T002',
+              name: 'Technique 2',
+              reference: 'https://some-link/T002',
+              subtechniques: [],
+            },
+          ],
+        },
+        {
+          availableRules: [],
+          disabledRules: [],
+          enabledRules: [
+            {
+              id: 'test-rule-1',
+              name: 'Test rule 1',
+            },
+          ],
+          id: 'TA002',
+          name: 'Tactic 2',
+          reference: 'https://some-link/TA002',
+          techniques: [
+            {
+              availableRules: [],
+              disabledRules: [],
+              enabledRules: [
+                {
+                  id: 'test-rule-1',
+                  name: 'Test rule 1',
+                },
+              ],
+              id: 'T002',
+              name: 'Technique 2',
+              reference: 'https://some-link/T002',
+              subtechniques: [],
+            },
+          ],
+        },
+      ],
+      unmappedRules: {
+        availableRules: [],
+        disabledRules: [],
+        enabledRules: [expect.objectContaining({ id: 'test-rule-2' })],
+      },
+    });
+  });
+
+  it('maps techniques that appear in multiple tactics', async () => {
+    const mockApiResponse: CoverageOverviewResponse = {
+      coverage: {
+        TA001: ['test-rule-1', 'test-rule-2'],
+        TA002: ['test-rule-2'],
+        T002: ['test-rule-1', 'test-rule-2'],
+      },
+      unmapped_rule_ids: [],
+      rules_data: {
+        'test-rule-1': {
+          name: 'Test rule',
+          activity: CoverageOverviewRuleActivity.Enabled,
+        },
+        'test-rule-2': {
+          name: 'Test rule 2',
+          activity: CoverageOverviewRuleActivity.Enabled,
+        },
+      },
+    };
+
+    const model = await buildCoverageOverviewDashboardModel(mockApiResponse);
+
+    expect(model.mitreTactics).toEqual([
+      expect.objectContaining({
+        id: 'TA001',
+        enabledRules: [
+          expect.objectContaining({ id: 'test-rule-1' }),
+          expect.objectContaining({ id: 'test-rule-2' }),
+        ],
+        techniques: [
+          expect.objectContaining({ id: 'T001', enabledRules: [] }),
+          expect.objectContaining({
+            id: 'T002',
+            enabledRules: [
+              expect.objectContaining({ id: 'test-rule-1' }),
+              expect.objectContaining({ id: 'test-rule-2' }),
+            ],
+          }),
+        ],
+      }),
+      expect.objectContaining({
+        id: 'TA002',
+        enabledRules: [expect.objectContaining({ id: 'test-rule-2' })],
+        techniques: [
+          expect.objectContaining({
+            id: 'T002',
+            enabledRules: [expect.objectContaining({ id: 'test-rule-2' })],
+          }),
+        ],
+      }),
+    ]);
+  });
+
+  it('maps unmapped rules', async () => {
+    const mockApiResponse: CoverageOverviewResponse = {
+      coverage: {
+        TA001: ['test-rule-1'],
+        T002: ['test-rule-1'],
+      },
+      unmapped_rule_ids: ['test-rule-2'],
+      rules_data: {
+        'test-rule-1': {
+          name: 'Test rule 1',
+          activity: CoverageOverviewRuleActivity.Enabled,
+        },
+        'test-rule-2': {
+          name: 'Test rule 2',
+          activity: CoverageOverviewRuleActivity.Enabled,
+        },
+      },
+    };
+
+    const model = await buildCoverageOverviewDashboardModel(mockApiResponse);
+
+    expect(model.unmappedRules).toEqual({
+      availableRules: [],
+      disabledRules: [],
+      enabledRules: [expect.objectContaining({ id: 'test-rule-2' })],
+    });
+    expect(model.mitreTactics).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          id: 'TA001',
+          enabledRules: expect.not.arrayContaining(['test-rule-2']),
+        }),
+      ])
+    );
+  });
+
+  it('maps metrics fields', async () => {
+    const mockApiResponse: CoverageOverviewResponse = {
+      coverage: {
+        TA001: ['test-rule-1'],
+        T002: ['test-rule-1'],
+      },
+      unmapped_rule_ids: ['test-rule-2'],
+      rules_data: {
+        'test-rule-1': {
+          name: 'Test rule 1',
+          activity: CoverageOverviewRuleActivity.Enabled,
+        },
+        'test-rule-2': {
+          name: 'Test rule 2',
+          activity: CoverageOverviewRuleActivity.Enabled,
+        },
+        'test-rule-3': {
+          name: 'Test rule 3',
+          activity: CoverageOverviewRuleActivity.Disabled,
+        },
+      },
+    };
+
+    const model = await buildCoverageOverviewDashboardModel(mockApiResponse);
+
+    expect(model.metrics).toEqual({
+      totalEnabledRulesCount: 2,
+      totalRulesCount: 3,
+    });
+  });
+});

x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/coverage_overview/build_coverage_overview_dashboard_model.ts

@@ -40,12 +40,16 @@ export async function buildCoverageOverviewDashboardModel(
 
     for (const technique of tactic.techniques) {
       for (const ruleId of apiResponse.coverage[technique.id] ?? []) {
-        addRule(technique, ruleId, apiResponse.rules_data[ruleId]);
+        if (apiResponse.coverage[tactic.id]?.includes(ruleId)) {
+          addRule(technique, ruleId, apiResponse.rules_data[ruleId]);
+        }
       }
 
       for (const subtechnique of technique.subtechniques) {
         for (const ruleId of apiResponse.coverage[subtechnique.id] ?? []) {
-          addRule(subtechnique, ruleId, apiResponse.rules_data[ruleId]);
+          if (apiResponse.coverage[tactic.id]?.includes(ruleId)) {
+            addRule(subtechnique, ruleId, apiResponse.rules_data[ruleId]);
+          }
         }
       }
     }

x-pack/plugins/security_solution/public/detection_engine/rule_management/logic/coverage_overview/build_coverage_overview_mitre_graph.test.ts

@@ -5,66 +5,19 @@
  * 2.0.
  */
 
+import {
+  getMockCoverageOverviewTactics,
+  getMockCoverageOverviewTechniques,
+  getMockCoverageOverviewSubtechniques,
+} from '../../model/coverage_overview/__mocks__';
 import { buildCoverageOverviewMitreGraph } from './build_coverage_overview_mitre_graph';
 
 describe('buildCoverageOverviewModel', () => {
   it('builds domain model', () => {
-    const tactics = [
-      {
-        name: 'Tactic 1',
-        id: 'TA001',
-        reference: 'https://some-link/TA001',
-        label: 'Tactic 1',
-        value: 'tactic1',
-      },
-      {
-        name: 'Tactic 2',
-        id: 'TA002',
-        reference: 'https://some-link/TA002',
-        label: 'Tactic 2',
-        value: 'tactic2',
-      },
-    ];
-    const techniques = [
-      {
-        name: 'Technique 1',
-        id: 'T001',
-        reference: 'https://some-link/T001',
-        tactics: ['tactic-1'],
-        label: 'Technique 1',
-        value: 'technique1',
-      },
-      {
-        name: 'Technique 2',
-        id: 'T002',
-        reference: 'https://some-link/T002',
-        tactics: ['tactic-1', 'tactic-2'],
-        label: 'Technique 2',
-        value: 'technique2',
-      },
-    ];
-    const subtechniques = [
-      {
-        name: 'Subtechnique 1',
-        id: 'T001.001',
-        reference: 'https://some-link/T001/001',
-        tactics: ['tactic-1'],
-        techniqueId: 'T001',
-        label: 'Subtechnique 1',
-        value: 'subtechnique1',
-      },
-      {
-        name: 'Subtechnique 2',
-        id: 'T001.002',
-        reference: 'https://some-link/T001/002',
-        tactics: ['tactic-1'],
-        techniqueId: 'T001',
-        label: 'Subtechnique 2',
-        value: 'subtechnique2',
-      },
-    ];
-
-    const model = buildCoverageOverviewMitreGraph(tactics, techniques, subtechniques);
+    const mockTactics = getMockCoverageOverviewTactics();
+    const mockTechniques = getMockCoverageOverviewTechniques();
+    const mockSubtechniques = getMockCoverageOverviewSubtechniques();
+    const model = buildCoverageOverviewMitreGraph(mockTactics, mockTechniques, mockSubtechniques);
 
     expect(model).toEqual([
       {