[Security Solution] [142435] add is one of operator

x-pack/plugins/security_solution/common/types/timeline/index.ts

@@ -57,7 +57,11 @@ const SavedColumnHeaderRuntimeType = runtimeTypes.partial({
 const SavedDataProviderQueryMatchBasicRuntimeType = runtimeTypes.partial({
   field: unionWithNullType(runtimeTypes.string),
   displayField: unionWithNullType(runtimeTypes.string),
-  value: unionWithNullType(runtimeTypes.string),
+  value: runtimeTypes.union([
+    runtimeTypes.null,
+    runtimeTypes.string,
+    runtimeTypes.array(runtimeTypes.string),
+  ]),
   displayValue: unionWithNullType(runtimeTypes.string),
   operator: unionWithNullType(runtimeTypes.string),
 });
@@ -652,7 +656,7 @@ export interface DataProviderResult {
 export interface QueryMatchResult {
   field?: Maybe<string>;
   displayField?: Maybe<string>;
-  value?: Maybe<string>;
+  value?: Maybe<string | string[]>;
   displayValue?: Maybe<string>;
   operator?: Maybe<string>;
 }

x-pack/plugins/security_solution/public/common/components/event_details/table/use_action_cell_data_provider.ts

@@ -25,10 +25,11 @@ import {
 } from '../../../../timelines/components/timeline/body/renderers/constants';
 import { BYTES_FORMAT } from '../../../../timelines/components/timeline/body/renderers/bytes';
 import { EVENT_DURATION_FIELD_NAME } from '../../../../timelines/components/duration';
+import { getDisplayValue } from '../../../../timelines/components/timeline/data_providers/helpers';
 import { PORT_NAMES } from '../../../../network/components/port/helpers';
 import { INDICATOR_REFERENCE } from '../../../../../common/cti/constants';
 import type { BrowserField } from '../../../containers/source';
-import type { DataProvider } from '../../../../../common/types';
+import type { DataProvider, QueryOperator } from '../../../../../common/types';
 import { IS_OPERATOR } from '../../../../../common/types';
 
 export interface UseActionCellDataProvider {
@@ -48,7 +49,12 @@ export interface ActionCellValuesAndDataProvider {
   dataProviders: DataProvider[];
 }
 
-export const getDataProvider = (field: string, id: string, value: string): DataProvider => ({
+export const getDataProvider = (
+  field: string,
+  id: string,
+  value: string | string[],
+  operator: QueryOperator = IS_OPERATOR
+): DataProvider => ({
   and: [],
   enabled: true,
   id: escapeDataProviderId(id),
@@ -58,7 +64,8 @@ export const getDataProvider = (field: string, id: string, value: string): DataP
   queryMatch: {
     field,
     value,
-    operator: IS_OPERATOR,
+    operator,
+    displayValue: getDisplayValue(value),
   },
 });
 

x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_actions.tsx

@@ -80,6 +80,20 @@ export const useHoverActions = ({
 
   const { closeTopN, toggleTopN, isShowingTopN } = useTopNPopOver(handleClosePopOverTrigger);
 
+  const values = useMemo(() => {
+    const val = dataProvider.queryMatch.value;
+
+    if (typeof val === 'number') {
+      return val.toString();
+    }
+
+    if (Array.isArray(val)) {
+      return val.map((item) => String(item));
+    }
+
+    return val;
+  }, [dataProvider.queryMatch.value]);
+
   const hoverContent = useMemo(() => {
     // display links as additional content in the hover menu to enable keyboard
     // navigation of links (when the draggable contains them):
@@ -110,11 +124,7 @@ export const useHoverActions = ({
         showTopN={isShowingTopN}
         scopeId={id}
         toggleTopN={toggleTopN}
-        values={
-          typeof dataProvider.queryMatch.value !== 'number'
-            ? dataProvider.queryMatch.value
-            : `${dataProvider.queryMatch.value}`
-        }
+        values={values}
       />
     );
   }, [
@@ -131,6 +141,7 @@ export const useHoverActions = ({
     onFilterAdded,
     id,
     toggleTopN,
+    values,
   ]);
 
   const setContainerRef = useCallback((e: HTMLDivElement) => {

x-pack/plugins/security_solution/public/common/containers/source/mock.ts

@@ -439,6 +439,22 @@ export const mocksSource = {
         },
       },
     },
+    {
+      aggregatable: false,
+      category: 'nestedField',
+      description: '',
+      example: '',
+      format: '',
+      indexes: ['auditbeat', 'filebeat', 'packetbeat'],
+      name: 'nestedField.thirdAttributes',
+      searchable: true,
+      type: 'date',
+      subType: {
+        nested: {
+          path: 'nestedField',
+        },
+      },
+    },
   ],
 };
 
@@ -952,6 +968,22 @@ export const mockBrowserFields: BrowserFields = {
           },
         },
       },
+      'nestedField.thirdAttributes': {
+        aggregatable: false,
+        category: 'nestedField',
+        description: '',
+        example: '',
+        format: '',
+        indexes: ['auditbeat', 'filebeat', 'packetbeat'],
+        name: 'nestedField.thirdAttributes',
+        searchable: true,
+        type: 'date',
+        subType: {
+          nested: {
+            path: 'nestedField',
+          },
+        },
+      },
     },
   },
 };

x-pack/plugins/security_solution/public/overview/components/detection_response/hooks/mock_data.ts

@@ -30,13 +30,14 @@ export const dataProviderWithOneFilter = [
   {
     and: [],
     enabled: true,
-    id: '',
+    id: 'mock-id',
     name: 'host.hostname',
     excluded: false,
     kqlQuery: '',
     queryMatch: {
       field: 'host.hostname',
       value: 'Host-u6ou715rzy',
+      displayValue: 'Host-u6ou715rzy',
       operator: ':' as QueryOperator,
     },
   },
@@ -49,25 +50,27 @@ export const dataProviderWithAndFilters = [
         and: [],
         enabled: true,
         excluded: false,
-        id: '',
+        id: 'mock-id',
         kqlQuery: '',
         name: 'kibana.alerts.workflow_status',
         queryMatch: {
           field: 'kibana.alerts.workflow_status',
           operator: ':' as QueryOperator,
           value: 'open',
+          displayValue: 'open',
         },
       },
     ],
 
     enabled: true,
-    id: '',
+    id: 'mock-id',
     name: 'host.hostname',
     excluded: false,
     kqlQuery: '',
     queryMatch: {
       field: 'host.hostname',
       value: 'Host-u6ou715rzy',
+      displayValue: 'Host-u6ou715rzy',
       operator: ':' as QueryOperator,
     },
   },
@@ -79,25 +82,27 @@ export const dataProviderWithOrFilters = [
       {
         and: [],
         enabled: true,
-        id: '',
+        id: 'mock-id',
         name: 'kibana.alerts.workflow_status',
         excluded: false,
         kqlQuery: '',
         queryMatch: {
           field: 'kibana.alerts.workflow_status',
           value: 'open',
+          displayValue: 'open',
           operator: ':' as QueryOperator,
         },
       },
     ],
     enabled: true,
-    id: '',
+    id: 'mock-id',
     name: 'host.hostname',
     excluded: false,
     kqlQuery: '',
     queryMatch: {
       field: 'host.hostname',
       value: 'Host-u6ou715rzy',
+      displayValue: 'Host-u6ou715rzy',
       operator: ':' as QueryOperator,
     },
   },
@@ -106,25 +111,27 @@ export const dataProviderWithOrFilters = [
       {
         and: [],
         enabled: true,
-        id: '',
+        id: 'mock-id',
         name: 'kibana.alerts.workflow_status',
         excluded: false,
         kqlQuery: '',
         queryMatch: {
           field: 'kibana.alerts.workflow_status',
           value: 'closed',
+          displayValue: 'closed',
           operator: ':' as QueryOperator,
         },
       },
     ],
     enabled: true,
-    id: '',
+    id: 'mock-id',
     name: 'host.hostname',
     excluded: false,
     kqlQuery: '',
     queryMatch: {
       field: 'host.hostname',
       value: 'Host-u6ou715rzy',
+      displayValue: 'Host-u6ou715rzy',
       operator: ':' as QueryOperator,
     },
   },
@@ -133,25 +140,27 @@ export const dataProviderWithOrFilters = [
       {
         and: [],
         enabled: true,
-        id: '',
+        id: 'mock-id',
         name: 'kibana.alerts.workflow_status',
         excluded: false,
         kqlQuery: '',
         queryMatch: {
           field: 'kibana.alerts.workflow_status',
           value: 'acknowledged',
+          displayValue: 'acknowledged',
           operator: ':' as QueryOperator,
         },
       },
     ],
     enabled: true,
-    id: '',
+    id: 'mock-id',
     name: 'host.hostname',
     excluded: false,
     kqlQuery: '',
     queryMatch: {
       field: 'host.hostname',
       value: 'Host-u6ou715rzy',
+      displayValue: 'Host-u6ou715rzy',
       operator: ':' as QueryOperator,
     },
   },

x-pack/plugins/security_solution/public/overview/components/detection_response/hooks/use_navigate_to_timeline.test.ts

@@ -33,6 +33,10 @@ jest.mock('react-redux', () => {
   };
 });
 
+jest.mock('uuid', () => ({
+  v4: () => 'mock-id',
+}));
+
 const id = 'timeline-1';
 const renderUseNavigatgeToTimeline = () => renderHook(() => useNavigateToTimeline());
 

x-pack/plugins/security_solution/public/overview/components/detection_response/hooks/use_navigate_to_timeline.tsx

@@ -7,12 +7,13 @@
 
 import { useCallback, useMemo } from 'react';
 import { useDispatch } from 'react-redux';
+import { v4 as uuid } from 'uuid';
 
 import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 import { sourcererActions } from '../../../../common/store/sourcerer';
 import { getDataProvider } from '../../../../common/components/event_details/table/use_action_cell_data_provider';
-import type { DataProvider } from '../../../../../common/types/timeline';
+import type { DataProvider, QueryOperator } from '../../../../../common/types/timeline';
 import { TimelineId, TimelineType } from '../../../../../common/types/timeline';
 import { useCreateTimeline } from '../../../../timelines/components/timeline/properties/use_create_timeline';
 import { updateProviders } from '../../../../timelines/store/timeline/actions';
@@ -21,7 +22,8 @@ import type { TimeRange } from '../../../../common/store/inputs/model';
 
 export interface Filter {
   field: string;
-  value: string;
+  value: string | string[];
+  operator?: QueryOperator;
 }
 
 export const useNavigateToTimeline = () => {
@@ -79,10 +81,17 @@ export const useNavigateToTimeline = () => {
         const mainFilter = orFilterGroup[0];
 
         if (mainFilter) {
-          const dataProvider = getDataProvider(mainFilter.field, '', mainFilter.value);
+          const dataProvider = getDataProvider(
+            mainFilter.field,
+            uuid(),
+            mainFilter.value,
+            mainFilter.operator
+          );
 
           for (const filter of orFilterGroup.slice(1)) {
-            dataProvider.and.push(getDataProvider(filter.field, '', filter.value));
+            dataProvider.and.push(
+              getDataProvider(filter.field, uuid(), filter.value, filter.operator)
+            );
           }
           dataProviders.push(dataProvider);
         }