[Security Solution] Incorporates EQL options in EQL query validation on both Rule Creation and Timeline

src/plugins/data/server/search/strategies/eql_search/eql_search_strategy.test.ts

@@ -277,6 +277,51 @@ describe('EQL search strategy', () => {
 
         expect(requestOptions).toEqual({ ignore: [400], meta: true, signal: undefined });
       });
+
+      describe('EQL-specific arguments', () => {
+        it('passes along a timestamp_field argument', async () => {
+          const eqlSearch = eqlSearchStrategyProvider(mockSearchConfig, mockLogger);
+          const request: EqlSearchStrategyRequest = {
+            // @ts-expect-error timestamp_field not allowed at top level when using `typesWithBodyKey`
+            params: { index: 'all', timestamp_field: 'timestamp' },
+          };
+
+          await firstValueFrom(eqlSearch.search(request, {}, mockDeps));
+          const [[actualParams]] = mockEqlSearch.mock.calls;
+
+          expect(actualParams).toEqual(expect.objectContaining({ timestamp_field: 'timestamp' }));
+        });
+
+        it('passes along an event_category_field argument', async () => {
+          const eqlSearch = eqlSearchStrategyProvider(mockSearchConfig, mockLogger);
+          const request: EqlSearchStrategyRequest = {
+            // @ts-expect-error timestamp_field not allowed at top level when using `typesWithBodyKey`
+            params: { index: 'all', event_category_field: 'event_category' },
+          };
+
+          await firstValueFrom(eqlSearch.search(request, {}, mockDeps));
+          const [[actualParams]] = mockEqlSearch.mock.calls;
+
+          expect(actualParams).toEqual(
+            expect.objectContaining({ event_category_field: 'event_category' })
+          );
+        });
+
+        it('passes along a tiebreaker_field argument', async () => {
+          const eqlSearch = eqlSearchStrategyProvider(mockSearchConfig, mockLogger);
+          const request: EqlSearchStrategyRequest = {
+            // @ts-expect-error tiebreaker_field not allowed at top level when using `typesWithBodyKey`
+            params: { index: 'all', tiebreaker_field: 'event_category' },
+          };
+
+          await firstValueFrom(eqlSearch.search(request, {}, mockDeps));
+          const [[actualParams]] = mockEqlSearch.mock.calls;
+
+          expect(actualParams).toEqual(
+            expect.objectContaining({ tiebreaker_field: 'event_category' })
+          );
+        });
+      });
     });
 
     describe('response', () => {

x-pack/plugins/security_solution/public/common/hooks/eql/api.ts

@@ -11,6 +11,7 @@ import type { EqlSearchStrategyRequest, EqlSearchStrategyResponse } from '@kbn/d
 import { EQL_SEARCH_STRATEGY } from '@kbn/data-plugin/common';
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
+import type { EqlOptionsSelected } from '../../../../common/search_strategy';
 import {
   getValidationErrors,
   isErrorResponse,
@@ -23,6 +24,7 @@ interface Params {
   data: DataPublicPluginStart;
   signal: AbortSignal;
   runtimeMappings: estypes.MappingRuntimeFields | undefined;
+  options: Omit<EqlOptionsSelected, 'query' | 'size'> | undefined;
 }
 
 export const validateEql = async ({
@@ -31,13 +33,18 @@ export const validateEql = async ({
   query,
   signal,
   runtimeMappings,
+  options,
 }: Params): Promise<{ valid: boolean; errors: string[] }> => {
   const { rawResponse: response } = await firstValueFrom(
     data.search.search<EqlSearchStrategyRequest, EqlSearchStrategyResponse>(
       {
         params: {
           index: dataViewTitle,
           body: { query, runtime_mappings: runtimeMappings, size: 0 },
+          // @ts-expect-error top-level keys are unexpected in {@link EqlSearchRequest}
+          timestamp_field: options?.timestampField,
+          tiebreaker_field: options?.tiebreakerField || undefined,
+          event_category_field: options?.eventCategoryField,
         },
         options: { ignore: [400] },
       },

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/eql_query_bar/eql_query_bar.test.tsx

@@ -13,6 +13,7 @@ import { mockQueryBar } from '../../../rule_management_ui/components/rules_table
 import type { EqlQueryBarProps } from './eql_query_bar';
 import { EqlQueryBar } from './eql_query_bar';
 import { getEqlValidationError } from './validators.mock';
+import { fireEvent, render, within } from '@testing-library/react';
 
 jest.mock('../../../../common/lib/kibana');
 
@@ -117,4 +118,38 @@ describe('EqlQueryBar', () => {
 
     expect(wrapper.find('[data-test-subj="eql-validation-errors-popover"]').exists()).toEqual(true);
   });
+
+  describe('EQL options interaction', () => {
+    const mockOptionsData = {
+      keywordFields: [],
+      dateFields: [{ label: 'timestamp', value: 'timestamp' }],
+      nonDateFields: [],
+    };
+
+    it('invokes onOptionsChange when the EQL options change', () => {
+      const onOptionsChangeMock = jest.fn();
+
+      const { getByTestId, getByText } = render(
+        <TestProviders>
+          <EqlQueryBar
+            dataTestSubj="myQueryBar"
+            field={mockField}
+            isLoading={false}
+            optionsData={mockOptionsData}
+            indexPattern={mockIndexPattern}
+            onOptionsChange={onOptionsChangeMock}
+          />
+        </TestProviders>
+      );
+
+      // open options popover
+      fireEvent.click(getByTestId('eql-settings-trigger'));
+      // display combobox options
+      within(getByTestId(`eql-timestamp-field`)).getByRole('combobox').focus();
+      // select timestamp
+      getByText('timestamp').click();
+
+      expect(onOptionsChangeMock).toHaveBeenCalledWith('timestampField', 'timestamp');
+    });
+  });
 });

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/eql_query_bar/eql_query_bar.tsx

@@ -11,7 +11,7 @@ import { Subscription } from 'rxjs';
 import styled from 'styled-components';
 import deepEqual from 'fast-deep-equal';
 import { EuiFormRow, EuiSpacer, EuiTextArea } from '@elastic/eui';
-import type { DataViewBase, Filter, Query } from '@kbn/es-query';
+import type { DataViewBase } from '@kbn/es-query';
 import { FilterManager } from '@kbn/data-plugin/public';
 
 import type { FieldHook } from '../../../../shared_imports';
@@ -58,12 +58,6 @@ const StyledFormRow = styled(EuiFormRow)`
   }
 `;
 
-export interface FieldValueQueryBar {
-  filters: Filter[];
-  query: Query;
-  saved_id?: string;
-}
-
 export interface EqlQueryBarProps {
   dataTestSubj: string;
   field: FieldHook<DefineStepRule['queryBar']>;

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/eql_query_bar/validators.ts

@@ -58,7 +58,7 @@ export const eqlValidator = async (
   const [{ value, formData }] = args;
   const { query: queryValue } = value as FieldValueQueryBar;
   const query = queryValue.query as string;
-  const { dataViewId, index, ruleType } = formData as DefineStepRule;
+  const { dataViewId, index, ruleType, eqlOptions } = formData as DefineStepRule;
 
   const needsValidation =
     (ruleType === undefined && !isEmpty(query)) || (isEqlRule(ruleType) && !isEmpty(query));
@@ -82,7 +82,14 @@ export const eqlValidator = async (
     }
 
     const signal = new AbortController().signal;
-    const response = await validateEql({ data, query, signal, dataViewTitle, runtimeMappings });
+    const response = await validateEql({
+      data,
+      query,
+      signal,
+      dataViewTitle,
+      runtimeMappings,
+      options: eqlOptions,
+    });
 
     if (response?.valid === false) {
       return {

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx

@@ -59,7 +59,14 @@ import { StepContentWrapper } from '../../../rule_creation/components/step_conte
 import { ThresholdInput } from '../threshold_input';
 import { SuppressionInfoIcon } from '../suppression_info_icon';
 import { EsqlInfoIcon } from '../../../rule_creation/components/esql_info_icon';
-import { Field, Form, getUseField, UseField, UseMultiFields } from '../../../../shared_imports';
+import {
+  Field,
+  Form,
+  getUseField,
+  HiddenField,
+  UseField,
+  UseMultiFields,
+} from '../../../../shared_imports';
 import type { FormHook } from '../../../../shared_imports';
 import { schema } from './schema';
 import { getTermsAggregationFields } from './utils';
@@ -768,14 +775,20 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
       onOpenTimeline,
     ]
   );
+
   const onOptionsChange = useCallback(
     (field: FieldsEqlOptions, value: string | undefined) => {
-      setOptionsSelected((prevOptions) => ({
-        ...prevOptions,
-        [field]: value,
-      }));
+      setOptionsSelected((prevOptions) => {
+        const newOptions = {
+          ...prevOptions,
+          [field]: value,
+        };
+
+        setFieldValue('eqlOptions', newOptions);
+        return newOptions;
+      });
     },
-    [setOptionsSelected]
+    [setFieldValue, setOptionsSelected]
   );
 
   const optionsData = useMemo(
@@ -814,17 +827,16 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
     <>
       <StepContentWrapper addPadding={!isUpdateView}>
         <Form form={form} data-test-subj="stepDefineRule">
-          <StyledVisibleContainer isVisible={false}>
-            <UseField
-              path="dataSourceType"
-              componentProps={{
-                euiFieldProps: {
-                  fullWidth: true,
-                  placeholder: '',
-                },
-              }}
-            />
-          </StyledVisibleContainer>
+          <UseField
+            path="dataSourceType"
+            component={HiddenField}
+            componentProps={{
+              euiFieldProps: {
+                fullWidth: true,
+                placeholder: '',
+              },
+            }}
+          />
           <UseField
             path="ruleType"
             component={SelectRuleType}
@@ -838,29 +850,31 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
               </StyledVisibleContainer>
               <EuiSpacer size="s" />
               {isEqlRule(ruleType) ? (
-                <UseField
-                  key="EqlQueryBar"
-                  path="queryBar"
-                  component={EqlQueryBar}
-                  componentProps={{
-                    optionsData,
-                    optionsSelected,
-                    isSizeOptionDisabled: true,
-                    onOptionsChange,
-                    onValidityChange: setIsQueryBarValid,
-                    idAria: 'detectionEngineStepDefineRuleEqlQueryBar',
-                    isDisabled: isLoading,
-                    isLoading: isIndexPatternLoading,
-                    indexPattern,
-                    showFilterBar: true,
-                    // isLoading: indexPatternsLoading,
-                    dataTestSubj: 'detectionEngineStepDefineRuleEqlQueryBar',
-                  }}
-                  config={{
-                    ...schema.queryBar,
-                    label: i18n.EQL_QUERY_BAR_LABEL,
-                  }}
-                />
+                <>
+                  <UseField
+                    key="EqlQueryBar"
+                    path="queryBar"
+                    component={EqlQueryBar}
+                    componentProps={{
+                      optionsData,
+                      optionsSelected,
+                      isSizeOptionDisabled: true,
+                      onOptionsChange,
+                      onValidityChange: setIsQueryBarValid,
+                      idAria: 'detectionEngineStepDefineRuleEqlQueryBar',
+                      isDisabled: isLoading,
+                      isLoading: isIndexPatternLoading,
+                      indexPattern,
+                      showFilterBar: true,
+                      dataTestSubj: 'detectionEngineStepDefineRuleEqlQueryBar',
+                    }}
+                    config={{
+                      ...schema.queryBar,
+                      label: i18n.EQL_QUERY_BAR_LABEL,
+                    }}
+                  />
+                  <UseField path="eqlOptions" component={HiddenField} />
+                </>
               ) : isEsqlRule(ruleType) ? (
                 EsqlQueryBarMemo
               ) : (

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/schema.tsx

@@ -130,9 +130,10 @@ export const schema: FormSchema<DefineStepRule> = {
     ),
     validations: [],
   },
-  eqlOptions: {},
+  eqlOptions: {
+    fieldsToValidateOnChange: ['eqlOptions', 'queryBar'],
+  },
   queryBar: {
-    fieldsToValidateOnChange: ['queryBar'],
     validations: [
       {
         validator: (

x-pack/plugins/security_solution/public/shared_imports.ts

@@ -28,6 +28,6 @@ export {
   useFormData,
   VALIDATION_TYPES,
 } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib';
-export { Field, SelectField } from '@kbn/es-ui-shared-plugin/static/forms/components';
+export { Field, SelectField, HiddenField } from '@kbn/es-ui-shared-plugin/static/forms/components';
 export { fieldValidators } from '@kbn/es-ui-shared-plugin/static/forms/helpers';
 export type { ERROR_CODE } from '@kbn/es-ui-shared-plugin/static/forms/helpers/field_validators/types';

x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/eql/index.tsx

@@ -10,7 +10,10 @@ import React, { memo, useCallback, useEffect, useMemo, useRef, useState } from '
 import { useDispatch } from 'react-redux';
 import styled from 'styled-components';
 
-import type { FieldsEqlOptions } from '../../../../../../common/search_strategy';
+import type {
+  EqlOptionsSelected,
+  FieldsEqlOptions,
+} from '../../../../../../common/search_strategy';
 import { useSourcererDataView } from '../../../../../common/containers/sourcerer';
 import { useDeepEqualSelector } from '../../../../../common/hooks/use_selector';
 import { SourcererScopeName } from '../../../../../common/store/sourcerer/model';
@@ -31,6 +34,7 @@ import { getEqlOptions } from './selectors';
 interface TimelineEqlQueryBar {
   index: string[];
   eqlQueryBar: FieldValueQueryBar;
+  eqlOptions: EqlOptionsSelected;
 }
 
 const defaultValues = {
@@ -40,13 +44,17 @@ const defaultValues = {
     filters: [],
     saved_id: null,
   },
+  eqlOptions: {},
 };
 
 const schema: FormSchema<TimelineEqlQueryBar> = {
   index: {
     fieldsToValidateOnChange: ['index', 'eqlQueryBar'],
     validations: [],
   },
+  eqlOptions: {
+    fieldsToValidateOnChange: ['eqlOptions', 'eqlQueryBar'],
+  },
   eqlQueryBar: {
     validations: [
       {
@@ -89,18 +97,20 @@ export const EqlQueryBarTimeline = memo(({ timelineId }: { timelineId: string })
     options: { stripEmptyFields: false },
     schema,
   });
-  const { getFields } = form;
+  const { getFields, setFieldValue } = form;
 
   const onOptionsChange = useCallback(
-    (field: FieldsEqlOptions, value: string | undefined) =>
+    (field: FieldsEqlOptions, value: string | undefined) => {
       dispatch(
         timelineActions.updateEqlOptions({
           id: timelineId,
           field,
           value,
         })
-      ),
-    [dispatch, timelineId]
+      );
+      setFieldValue('eqlOptions', { ...optionsSelected, [field]: value });
+    },
+    [dispatch, optionsSelected, setFieldValue, timelineId]
   );
 
   const [{ eqlQueryBar: formEqlQueryBar }] = useFormData<TimelineEqlQueryBar>({
@@ -179,6 +189,7 @@ export const EqlQueryBarTimeline = memo(({ timelineId }: { timelineId: string })
   return (
     <Form form={form} data-test-subj="EqlQueryBarTimeline">
       <HiddenUseField key="Index" path="index" />
+      <HiddenUseField key="EqlOptions" path="eqlOptions" />
       <UseField
         key="EqlQueryBar"
         path="eqlQueryBar"