[Security Solution][Alerts] Provide more information about rule exception behavior before creation

packages/kbn-securitysolution-autocomplete/src/field/index.tsx

@@ -27,6 +27,7 @@ export const FieldComponent: React.FC<FieldProps> = ({
   placeholder,
   selectedField,
   acceptsCustomOptions = false,
+  showMappingConflicts = false,
 }): JSX.Element => {
   const {
     isInvalid,
@@ -44,6 +45,7 @@ export const FieldComponent: React.FC<FieldProps> = ({
     isRequired,
     selectedField,
     fieldInputWidth,
+    showMappingConflicts,
     onChange,
   });
 
@@ -68,6 +70,7 @@ export const FieldComponent: React.FC<FieldProps> = ({
           values: { searchValuePlaceholder: '{searchValue}' },
         })}
         fullWidth
+        renderOption={renderFields}
       />
     );
   }

packages/kbn-securitysolution-autocomplete/src/field/types.ts

@@ -7,6 +7,7 @@
  */
 
 import { DataViewBase, DataViewFieldBase } from '@kbn/es-query';
+import { FieldConflictsInfo } from '@kbn/securitysolution-list-utils';
 import { GetGenericComboBoxPropsReturn } from '../get_generic_combo_box_props';
 
 export interface FieldProps extends FieldBaseProps {
@@ -15,13 +16,15 @@ export interface FieldProps extends FieldBaseProps {
   isLoading: boolean;
   placeholder: string;
   acceptsCustomOptions?: boolean;
+  showMappingConflicts?: boolean;
 }
 export interface FieldBaseProps {
   indexPattern: DataViewBase | undefined;
   fieldTypeFilter?: string[];
   isRequired?: boolean;
   selectedField?: DataViewFieldBase | undefined;
   fieldInputWidth?: number;
+  showMappingConflicts?: boolean;
   onChange: (a: DataViewFieldBase[]) => void;
 }
 
@@ -32,6 +35,7 @@ export interface ComboBoxFields {
 
 export interface GetFieldComboBoxPropsReturn extends GetGenericComboBoxPropsReturn {
   disabledLabelTooltipTexts: { [label: string]: string };
+  mappingConflictsTooltipInfo: { [label: string]: FieldConflictsInfo[] };
 }
 
 export interface DataViewField extends DataViewFieldBase {

packages/kbn-securitysolution-autocomplete/src/field/use_field.tsx

@@ -7,10 +7,18 @@
  */
 import React from 'react';
 import { useCallback, useMemo, useState } from 'react';
-import { EuiComboBoxOptionOption, EuiToolTip } from '@elastic/eui';
+import {
+  EuiComboBoxOptionOption,
+  EuiIcon,
+  EuiSpacer,
+  EuiToolTip,
+  useEuiPaddingSize,
+} from '@elastic/eui';
 import { DataViewBase, DataViewFieldBase } from '@kbn/es-query';
 
+import { FieldConflictsInfo, getMappingConflictsInfo } from '@kbn/securitysolution-list-utils';
 import { getGenericComboBoxProps } from '../get_generic_combo_box_props';
+import * as i18n from '../translations';
 import {
   ComboBoxFields,
   DataViewField,
@@ -72,6 +80,22 @@ const getDisabledLabelTooltipTexts = (fields: ComboBoxFields) => {
   );
   return disabledLabelTooltipTexts;
 };
+
+const getMappingConflictsTooltipInfo = (fields: ComboBoxFields) => {
+  const mappingConflictsTooltipInfo = fields.availableFields.reduce(
+    (acc: { [label: string]: FieldConflictsInfo[] }, field: DataViewField) => {
+      const conflictsInfo = getMappingConflictsInfo(field);
+      if (!conflictsInfo) {
+        return acc;
+      }
+      acc[field.name] = conflictsInfo;
+      return acc;
+    },
+    {}
+  );
+  return mappingConflictsTooltipInfo;
+};
+
 const getComboBoxProps = (fields: ComboBoxFields): GetFieldComboBoxPropsReturn => {
   const { availableFields, selectedFields } = fields;
 
@@ -81,9 +105,11 @@ const getComboBoxProps = (fields: ComboBoxFields): GetFieldComboBoxPropsReturn =
     selectedOptions: selectedFields,
   });
   const disabledLabelTooltipTexts = getDisabledLabelTooltipTexts(fields);
+  const mappingConflictsTooltipInfo = getMappingConflictsTooltipInfo(fields);
   return {
     ...genericProps,
     disabledLabelTooltipTexts,
+    mappingConflictsTooltipInfo,
   };
 };
 
@@ -93,11 +119,13 @@ export const useField = ({
   isRequired,
   selectedField,
   fieldInputWidth,
+  showMappingConflicts,
   onChange,
 }: FieldBaseProps) => {
   const [touched, setIsTouched] = useState(false);
 
   const [customOption, setCustomOption] = useState<DataViewFieldBase | null>(null);
+  const sPaddingSize = useEuiPaddingSize('s');
 
   const { availableFields, selectedFields } = useMemo(() => {
     const indexPatternsToUse =
@@ -107,7 +135,13 @@ export const useField = ({
     return getComboBoxFields(indexPatternsToUse, selectedField, fieldTypeFilter);
   }, [indexPattern, fieldTypeFilter, selectedField, customOption]);
 
-  const { comboOptions, labels, selectedComboOptions, disabledLabelTooltipTexts } = useMemo(
+  const {
+    comboOptions,
+    labels,
+    selectedComboOptions,
+    disabledLabelTooltipTexts,
+    mappingConflictsTooltipInfo,
+  } = useMemo(
     () => getComboBoxProps({ availableFields, selectedFields }),
     [availableFields, selectedFields]
   );
@@ -168,6 +202,46 @@ export const useField = ({
         </EuiToolTip>
       );
     }
+
+    const conflictsInfo = mappingConflictsTooltipInfo[label];
+    if (showMappingConflicts && conflictsInfo) {
+      const tooltipContent = (
+        <>
+          {i18n.FIELD_CONFLICT_INDICES_WARNING_DESCRIPTION}
+          {conflictsInfo.map((info) => {
+            const groupDetails = info.groupedIndices.map(
+              ({ name, count }) =>
+                `${count > 1 ? i18n.CONFLICT_MULTIPLE_INDEX_DESCRIPTION(name, count) : name}`
+            );
+            return (
+              <>
+                <EuiSpacer size="s" />
+                {`${
+                  info.totalIndexCount > 1
+                    ? i18n.CONFLICT_MULTIPLE_INDEX_DESCRIPTION(info.type, info.totalIndexCount)
+                    : info.type
+                }: ${groupDetails.join(', ')}`}
+              </>
+            );
+          })}
+        </>
+      );
+      return (
+        <EuiToolTip position="bottom" content={tooltipContent}>
+          <>
+            {label}
+            <EuiIcon
+              tabIndex={0}
+              type="alert"
+              title={i18n.FIELD_CONFLICT_INDICES_WARNING_TITLE}
+              size="s"
+              css={{ marginLeft: `${sPaddingSize}` }}
+            />
+          </>
+        </EuiToolTip>
+      );
+    }
+
     return label;
   };
   return {

packages/kbn-securitysolution-autocomplete/src/translations/index.ts

@@ -43,6 +43,26 @@ export const SEE_DOCUMENTATION = i18n.translate('autocomplete.seeDocumentation',
   defaultMessage: 'See Documentation',
 });
 
+export const FIELD_CONFLICT_INDICES_WARNING_TITLE = i18n.translate(
+  'autocomplete.conflictIndicesWarning.title',
+  {
+    defaultMessage: 'Mapping Conflict',
+  }
+);
+
+export const FIELD_CONFLICT_INDICES_WARNING_DESCRIPTION = i18n.translate(
+  'autocomplete.conflictIndicesWarning.description',
+  {
+    defaultMessage: 'This field is defined as several types across different indices.',
+  }
+);
+
+export const CONFLICT_MULTIPLE_INDEX_DESCRIPTION = (name: string, count: number): string =>
+  i18n.translate('autocomplete.conflictIndicesWarning.index.description', {
+    defaultMessage: '{name} ({count} indices)',
+    values: { count, name },
+  });
+
 // eslint-disable-next-line import/no-default-export
 export default {
   LOADING,

packages/kbn-securitysolution-list-utils/src/helpers/index.test.ts

@@ -0,0 +1,146 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { getMappingConflictsInfo } from '.';
+
+describe('Helpers', () => {
+  describe('getMappingConflictsInfo', () => {
+    test('it return null if there are not conflicts', () => {
+      const field = {
+        name: 'field1',
+        type: 'string',
+      };
+      const conflictsInfo = getMappingConflictsInfo(field);
+
+      expect(conflictsInfo).toBeNull();
+    });
+    test('it groups ".ds-" data stream indices', () => {
+      const field = {
+        name: 'field1',
+        type: 'conflict',
+        conflictDescriptions: {
+          text: [
+            '.ds-logs-default-2023.01.18-000001',
+            '.ds-logs-default-2023.01.18-000002',
+            '.ds-logs-tortilla.process-default-2022.11.20-000011',
+            '.ds-logs-tortilla.process-default-2022.11.20-000012',
+            '.ds-logs-tortilla.process-default-2022.11.20-000016',
+          ],
+          long: [
+            '.ds-logs-default-2023.01.18-000004',
+            '.ds-logs-default-2023.01.18-000005',
+            'partial-.ds-logs-gcp.audit-2021.12.22-000240',
+            'partial-.ds-logs-gcp.audit-2021.12.22-000242',
+          ],
+        },
+      };
+      const conflictsInfo = getMappingConflictsInfo(field);
+
+      expect(conflictsInfo).toEqual([
+        {
+          type: 'text',
+          totalIndexCount: 5,
+          groupedIndices: [
+            { name: 'logs-tortilla.process-default', count: 3 },
+            { name: 'logs-default', count: 2 },
+          ],
+        },
+        {
+          type: 'long',
+          totalIndexCount: 4,
+          groupedIndices: [
+            { name: 'logs-default', count: 2 },
+            { name: 'logs-gcp.audit', count: 2 },
+          ],
+        },
+      ]);
+    });
+    test('it groups old ".siem-" indices', () => {
+      const field = {
+        name: 'field1',
+        type: 'conflict',
+        conflictDescriptions: {
+          text: [
+            '.siem-signals-default-000001',
+            '.siem-signals-default-000002',
+            '.siem-signals-default-000011',
+            '.siem-signals-default-000012',
+          ],
+          unmapped: [
+            '.siem-signals-default-000004',
+            '.siem-signals-default-000005',
+            '.siem-signals-default-000240',
+          ],
+        },
+      };
+      const conflictsInfo = getMappingConflictsInfo(field);
+
+      expect(conflictsInfo).toEqual([
+        {
+          type: 'text',
+          totalIndexCount: 4,
+          groupedIndices: [{ name: '.siem-signals-default', count: 4 }],
+        },
+        {
+          type: 'unmapped',
+          totalIndexCount: 3,
+          groupedIndices: [{ name: '.siem-signals-default', count: 3 }],
+        },
+      ]);
+    });
+    test('it groups mixed indices', () => {
+      const field = {
+        name: 'field1',
+        type: 'conflict',
+        conflictDescriptions: {
+          boolean: [
+            '.ds-logs-default-2023.01.18-000001',
+            '.ds-logs-tortilla.process-default-2022.11.20-000011',
+            '.ds-logs-tortilla.process-default-2022.11.20-000012',
+            '.ds-logs-tortilla.process-default-2022.11.20-000016',
+            '.siem-signals-default-000001',
+            '.siem-signals-default-000002',
+            '.siem-signals-default-000012',
+            'my-own-index-1',
+            'my-own-index-2',
+          ],
+          unmapped: [
+            '.siem-signals-default-000004',
+            'partial-.ds-logs-gcp.audit-2021.12.22-000240',
+            'partial-.ds-logs-gcp.audit-2021.12.22-000242',
+            'my-own-index-3',
+          ],
+        },
+      };
+      const conflictsInfo = getMappingConflictsInfo(field);
+
+      expect(conflictsInfo).toEqual([
+        {
+          type: 'boolean',
+          totalIndexCount: 9,
+          groupedIndices: [
+            { name: 'logs-tortilla.process-default', count: 3 },
+            { name: '.siem-signals-default', count: 3 },
+            { name: 'logs-default', count: 1 },
+            { name: 'my-own-index-1', count: 1 },
+            { name: 'my-own-index-2', count: 1 },
+          ],
+        },
+        {
+          type: 'unmapped',
+          totalIndexCount: 4,
+          groupedIndices: [
+            { name: 'logs-gcp.audit', count: 2 },
+            { name: '.siem-signals-default', count: 1 },
+            { name: 'my-own-index-3', count: 1 },
+          ],
+        },
+      ]);
+    });
+  });
+});