[Security Solution][Bulk actions]- Fix bulk actions data views behavi…

…or (elastic#138448) (elastic#138466) ## Summary Addresses [bug](elastic#138383) found where even when `overwrite_data_views` was false, the rule's `index` property was being modified. Please see added integration tests to understand desired behavior of changes. There is one edge case which is a bit weird, but I think too late to address in 8.4. If a user uses bulk delete on a rule with a data view and _no_ index patterns defined and `overwrite_data_views = true`, both data view and index will be set to `undefined`. Per our current behavior, a rule with no data source defaults to using the default index patterns. Not sure this is ideal, but it is in line with the behavior that already exists for a rule. (cherry picked from commit 9e8b5b9) Co-authored-by: Yara Tercero <[email protected]>
kibanamachine · Aug 9, 2022 · 8f667ba · 8f667ba
1 parent a889f56
commit 8f667ba
Show file tree

Hide file tree

Showing 3 changed files with 305 additions and 72 deletions.
diff --git a/...rity_solution/server/lib/detection_engine/rules/bulk_actions/rule_params_modifier.test.ts b/...rity_solution/server/lib/detection_engine/rules/bulk_actions/rule_params_modifier.test.ts
@@ -126,6 +126,36 @@ describe('ruleParamsModifier', () => {
       expect(editedRuleParams).toHaveProperty('dataViewId', undefined);
     });
 
+    test('should set dataViewId to undefined if overwrite_data_views=true on delete_index_patterns action', () => {
+      const editedRuleParams = ruleParamsModifier(
+        { dataViewId: 'test-data-view', index: ['test-*', 'index'] } as RuleAlertType['params'],
+        [
+          {
+            type: BulkActionEditType.delete_index_patterns,
+            value: ['index'],
+            overwrite_data_views: true,
+          },
+        ]
+      );
+      expect(editedRuleParams).toHaveProperty('dataViewId', undefined);
+      expect(editedRuleParams).toHaveProperty('index', ['test-*']);
+    });
+
+    test('should set dataViewId to undefined and index to undefined if overwrite_data_views=true on delete_index_patterns action and rule had no index patterns to begin with', () => {
+      const editedRuleParams = ruleParamsModifier(
+        { dataViewId: 'test-data-view', index: undefined } as RuleAlertType['params'],
+        [
+          {
+            type: BulkActionEditType.delete_index_patterns,
+            value: ['index'],
+            overwrite_data_views: true,
+          },
+        ]
+      );
+      expect(editedRuleParams).toHaveProperty('dataViewId', undefined);
+      expect(editedRuleParams).toHaveProperty('index', undefined);
+    });
+
     test('should throw error on adding index pattern if rule is of machine learning type', () => {
       expect(() =>
         ruleParamsModifier({ type: 'machine_learning' } as RuleAlertType['params'], [

diff --git a/.../security_solution/server/lib/detection_engine/rules/bulk_actions/rule_params_modifier.ts b/.../security_solution/server/lib/detection_engine/rules/bulk_actions/rule_params_modifier.ts
@@ -35,6 +35,10 @@ const applyBulkActionEditToRuleParams = (
         "Index patterns can't be added. Machine learning rule doesn't have index patterns property"
       );
 
+      if (ruleParams.dataViewId != null && !action.overwrite_data_views) {
+        break;
+      }
+
       if (action.overwrite_data_views) {
         ruleParams.dataViewId = undefined;
       }
@@ -48,6 +52,14 @@ const applyBulkActionEditToRuleParams = (
         "Index patterns can't be deleted. Machine learning rule doesn't have index patterns property"
       );
 
+      if (ruleParams.dataViewId != null && !action.overwrite_data_views) {
+        break;
+      }
+
+      if (action.overwrite_data_views) {
+        ruleParams.dataViewId = undefined;
+      }
+
       if (ruleParams.index) {
         ruleParams.index = deleteItemsFromArray(ruleParams.index, action.value);
       }
@@ -59,6 +71,10 @@ const applyBulkActionEditToRuleParams = (
         "Index patterns can't be overwritten. Machine learning rule doesn't have index patterns property"
       );
 
+      if (ruleParams.dataViewId != null && !action.overwrite_data_views) {
+        break;
+      }
+
       if (action.overwrite_data_views) {
         ruleParams.dataViewId = undefined;
       }