[8.x] [Security Solution][Detection Engine] log ES requests when running rule preview (#191107)

x-pack/plugins/security_solution/common/api/detection_engine/rule_preview/rule_preview.gen.ts

@@ -15,6 +15,7 @@
  */
 
 import { z } from '@kbn/zod';
+import { BooleanFromString } from '@kbn/zod-helpers';
 
 import {
   EqlRuleCreateProps,
@@ -34,6 +35,13 @@ export const RulePreviewParams = z.object({
   timeframeEnd: z.string().datetime(),
 });
 
+export type RulePreviewLoggedRequest = z.infer<typeof RulePreviewLoggedRequest>;
+export const RulePreviewLoggedRequest = z.object({
+  request: NonEmptyString,
+  description: NonEmptyString.optional(),
+  duration: z.number().int().optional(),
+});
+
 export type RulePreviewLogs = z.infer<typeof RulePreviewLogs>;
 export const RulePreviewLogs = z.object({
   errors: z.array(NonEmptyString),
@@ -43,7 +51,17 @@ export const RulePreviewLogs = z.object({
    */
   duration: z.number().int(),
   startedAt: NonEmptyString.optional(),
+  requests: z.array(RulePreviewLoggedRequest).optional(),
+});
+
+export type RulePreviewRequestQuery = z.infer<typeof RulePreviewRequestQuery>;
+export const RulePreviewRequestQuery = z.object({
+  /**
+   * Enables logging and returning in response ES queries, performed during rule execution
+   */
+  enable_logged_requests: BooleanFromString.optional(),
 });
+export type RulePreviewRequestQueryInput = z.input<typeof RulePreviewRequestQuery>;
 
 export type RulePreviewRequestBody = z.infer<typeof RulePreviewRequestBody>;
 export const RulePreviewRequestBody = z.discriminatedUnion('type', [

x-pack/plugins/security_solution/common/api/detection_engine/rule_preview/rule_preview.schema.yaml

@@ -11,6 +11,13 @@ paths:
       summary: Preview rule alerts generated on specified time range
       tags:
         - Rule preview API
+      parameters:
+        - name: enable_logged_requests
+          in: query
+          description: Enables logging and returning in response ES queries, performed during rule execution
+          required: false
+          schema:
+            type: boolean
       requestBody:
         description: An object containing tags to add or remove and alert ids the changes will be applied
         required: true
@@ -94,6 +101,18 @@ components:
           format: date-time
       required: [invocationCount, timeframeEnd]
 
+    RulePreviewLoggedRequest:
+      type: object  
+      properties:
+        request:
+          $ref: '../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
+        description:
+          $ref: '../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
+        duration:
+          type: integer
+      required:
+        - request
+
     RulePreviewLogs:
       type: object
       properties:
@@ -110,6 +129,10 @@ components:
           description: Execution duration in milliseconds
         startedAt:
           $ref: '../../model/primitives.schema.yaml#/components/schemas/NonEmptyString'
+        requests:
+          type: array
+          items:
+            $ref: '#/components/schemas/RulePreviewLoggedRequest'
       required:
         - errors
         - warnings

x-pack/plugins/security_solution/common/api/quickstart_client.gen.ts

@@ -99,6 +99,7 @@ import type {
   GetRuleExecutionResultsResponse,
 } from './detection_engine/rule_monitoring/rule_execution_logs/get_rule_execution_results/get_rule_execution_results_route.gen';
 import type {
+  RulePreviewRequestQueryInput,
   RulePreviewRequestBodyInput,
   RulePreviewResponse,
 } from './detection_engine/rule_preview/rule_preview.gen';
@@ -1614,6 +1615,7 @@ detection engine rules.
         },
         method: 'POST',
         body: props.body,
+        query: props.query,
       })
       .catch(catchAxiosErrorFormatAndThrow);
   }
@@ -1970,6 +1972,7 @@ export interface ResolveTimelineProps {
   query: ResolveTimelineRequestQueryInput;
 }
 export interface RulePreviewProps {
+  query: RulePreviewRequestQueryInput;
   body: RulePreviewRequestBodyInput;
 }
 export interface SearchAlertsProps {

x-pack/plugins/security_solution/common/experimental_features.ts

@@ -133,6 +133,11 @@ export const allowedExperimentalValues = Object.freeze({
    */
   esqlRulesDisabled: false,
 
+  /**
+   * enables logging requests during rule preview
+   */
+  loggingRequestsEnabled: false,
+
   /**
    * Enables Protection Updates tab in the Endpoint Policy Details page
    */

x-pack/plugins/security_solution/docs/openapi/ess/security_solution_detections_api_2023_10_31.bundled.schema.yaml

@@ -891,6 +891,15 @@ paths:
   /api/detection_engine/rules/preview:
     post:
       operationId: RulePreview
+      parameters:
+        - description: >-
+            Enables logging and returning in response ES queries, performed
+            during rule execution
+          in: query
+          name: enable_logged_requests
+          required: false
+          schema:
+            type: boolean
       requestBody:
         content:
           application/json:
@@ -5178,6 +5187,17 @@ components:
         - $ref: '#/components/schemas/MachineLearningRulePatchProps'
         - $ref: '#/components/schemas/NewTermsRulePatchProps'
         - $ref: '#/components/schemas/EsqlRulePatchProps'
+    RulePreviewLoggedRequest:
+      type: object
+      properties:
+        description:
+          $ref: '#/components/schemas/NonEmptyString'
+        duration:
+          type: integer
+        request:
+          $ref: '#/components/schemas/NonEmptyString'
+      required:
+        - request
     RulePreviewLogs:
       type: object
       properties:
@@ -5188,6 +5208,10 @@ components:
           items:
             $ref: '#/components/schemas/NonEmptyString'
           type: array
+        requests:
+          items:
+            $ref: '#/components/schemas/RulePreviewLoggedRequest'
+          type: array
         startedAt:
           $ref: '#/components/schemas/NonEmptyString'
         warnings:

x-pack/plugins/security_solution/docs/openapi/serverless/security_solution_detections_api_2023_10_31.bundled.schema.yaml

@@ -476,6 +476,15 @@ paths:
   /api/detection_engine/rules/preview:
     post:
       operationId: RulePreview
+      parameters:
+        - description: >-
+            Enables logging and returning in response ES queries, performed
+            during rule execution
+          in: query
+          name: enable_logged_requests
+          required: false
+          schema:
+            type: boolean
       requestBody:
         content:
           application/json:
@@ -4331,6 +4340,17 @@ components:
         - $ref: '#/components/schemas/MachineLearningRulePatchProps'
         - $ref: '#/components/schemas/NewTermsRulePatchProps'
         - $ref: '#/components/schemas/EsqlRulePatchProps'
+    RulePreviewLoggedRequest:
+      type: object
+      properties:
+        description:
+          $ref: '#/components/schemas/NonEmptyString'
+        duration:
+          type: integer
+        request:
+          $ref: '#/components/schemas/NonEmptyString'
+      required:
+        - request
     RulePreviewLogs:
       type: object
       properties:
@@ -4341,6 +4361,10 @@ components:
           items:
             $ref: '#/components/schemas/NonEmptyString'
           type: array
+        requests:
+          items:
+            $ref: '#/components/schemas/RulePreviewLoggedRequest'
+          type: array
         startedAt:
           $ref: '#/components/schemas/NonEmptyString'
         warnings: