[Security Solution][Endpoint][Host Isolation] Remove agent status for…

… non endpoint alerts (elastic#102976)

x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.tsx

@@ -37,6 +37,7 @@ import { SummaryView } from './summary_view';
 import { AlertSummaryRow, getSummaryColumns, SummaryRow } from './helpers';
 import { useRuleAsync } from '../../../detections/containers/detection_engine/rules/use_rule_async';
 import { LineClamp } from '../line_clamp';
+import { endpointAlertCheck } from '../../utils/endpoint_alert_check';
 
 const StyledEuiDescriptionList = styled(EuiDescriptionList)`
   padding: 24px 4px 4px;
@@ -53,7 +54,7 @@ const fields = [
   { id: 'signal.rule.severity', label: ALERTS_HEADERS_SEVERITY },
   { id: 'signal.rule.risk_score', label: ALERTS_HEADERS_RISK_SCORE },
   { id: 'host.name' },
-  { id: 'host.status' },
+  { id: 'agent.status' },
   { id: 'user.name' },
   { id: SOURCE_IP_FIELD_NAME, fieldType: IP_FIELD_TYPE },
   { id: DESTINATION_IP_FIELD_NAME, fieldType: IP_FIELD_TYPE },
@@ -178,6 +179,10 @@ const AlertSummaryViewComponent: React.FC<{
     timelineId,
   ]);
 
+  const isEndpointAlert = useMemo(() => {
+    return endpointAlertCheck({ data });
+  }, [data]);
+
   const agentId = useMemo(() => {
     const findAgentId = find({ category: 'agent', field: 'agent.id' }, data)?.values;
     return findAgentId ? findAgentId[0] : '';
@@ -188,7 +193,7 @@ const AlertSummaryViewComponent: React.FC<{
     description: {
       contextId: timelineId,
       eventId,
-      fieldName: 'host.status',
+      fieldName: 'agent.status',
       value: agentId,
       linkValue: undefined,
     },
@@ -209,7 +214,7 @@ const AlertSummaryViewComponent: React.FC<{
       <EuiSpacer size="l" />
       <SummaryView
         summaryColumns={summaryColumns}
-        summaryRows={summaryRowsWithAgentStatus}
+        summaryRows={isEndpointAlert ? summaryRowsWithAgentStatus : summaryRows}
         title={title}
       />
       {maybeRule?.note && (

x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.test.ts

@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import _ from 'lodash';
+import { mockDetailItemData } from '../mock';
+import { endpointAlertCheck } from './endpoint_alert_check';
+
+describe('utils', () => {
+  describe('endpointAlertCheck', () => {
+    it('should return false if detections data does not come from endpoint rule', () => {
+      expect(endpointAlertCheck({ data: mockDetailItemData })).toBeFalsy();
+    });
+    it('should return true if detections data comes from an endpoint rule', () => {
+      _.remove(mockDetailItemData, function (o) {
+        return o.field === 'agent.type';
+      });
+      const mockEndpointDetailItemData = _.concat(mockDetailItemData, {
+        field: 'agent.type',
+        originalValue: 'endpoint',
+        values: ['endpoint'],
+        isObjectArray: false,
+      });
+
+      expect(endpointAlertCheck({ data: mockEndpointDetailItemData })).toBeTruthy();
+    });
+  });
+});

x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.ts

@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { find } from 'lodash/fp';
+import { TimelineEventsDetailsItem } from '../../../common/search_strategy';
+
+export const endpointAlertCheck = ({ data }: { data: TimelineEventsDetailsItem[] | null }) => {
+  const findEndpointAlert = find({ field: 'agent.type' }, data)?.values;
+  return findEndpointAlert ? findEndpointAlert[0] === 'endpoint' : false;
+};

x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx

@@ -32,6 +32,7 @@ import {
 } from '../../../../detections/components/host_isolation/translations';
 import { ALERT_DETAILS } from './translations';
 import { useIsolationPrivileges } from '../../../../common/hooks/endpoint/use_isolate_privileges';
+import { endpointAlertCheck } from '../../../../common/utils/endpoint_alert_check';
 
 const StyledEuiFlyoutBody = styled(EuiFlyoutBody)`
   .euiFlyoutBody__overflow {
@@ -92,8 +93,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
   const isAlert = some({ category: 'signal', field: 'signal.rule.id' }, detailsData);
 
   const isEndpointAlert = useMemo(() => {
-    const findEndpointAlert = find({ category: 'agent', field: 'agent.type' }, detailsData)?.values;
-    return findEndpointAlert ? findEndpointAlert[0] === 'endpoint' : false;
+    return endpointAlertCheck({ data: detailsData });
   }, [detailsData]);
 
   const agentId = useMemo(() => {

x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx

@@ -16,4 +16,4 @@ export const REFERENCE_URL_FIELD_NAME = 'reference.url';
 export const EVENT_URL_FIELD_NAME = 'event.url';
 export const SIGNAL_RULE_NAME_FIELD_NAME = 'signal.rule.name';
 export const SIGNAL_STATUS_FIELD_NAME = 'signal.status';
-export const HOST_STATUS_FIELD_NAME = 'host.status';
+export const AGENT_STATUS_FIELD_NAME = 'agent.status';

x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx

@@ -32,7 +32,7 @@ import {
   REFERENCE_URL_FIELD_NAME,
   EVENT_URL_FIELD_NAME,
   SIGNAL_STATUS_FIELD_NAME,
-  HOST_STATUS_FIELD_NAME,
+  AGENT_STATUS_FIELD_NAME,
   GEO_FIELD_TYPE,
 } from './constants';
 import { RenderRuleName, renderEventModule, renderUrl } from './formatted_field_helpers';
@@ -120,7 +120,7 @@ const FormattedFieldValueComponent: React.FC<{
     return (
       <RuleStatus contextId={contextId} eventId={eventId} fieldName={fieldName} value={value} />
     );
-  } else if (fieldName === HOST_STATUS_FIELD_NAME) {
+  } else if (fieldName === AGENT_STATUS_FIELD_NAME) {
     return (
       <AgentStatuses
         contextId={contextId}