[SIEM][Detections Engine] - Add rule markdown field to rule create, detail, and edit flows

x-pack/legacy/plugins/siem/cypress/screens/rule_details.ts

@@ -25,10 +25,10 @@ export const ABOUT_TIMELINE = 3;
 export const DEFINITION_CUSTOM_QUERY = 1;
 
 export const DEFINITION_DESCRIPTION =
-  '[data-test-subj="definition"] .euiDescriptionList__description';
+  '[data-test-subj="listItemColumnStepRuleDescription"] .euiDescriptionList__description';
 
 export const DEFINITION_INDEX_PATTERNS =
-  '[data-test-subj="definition"] .euiDescriptionList__description .euiBadge__text';
+  '[data-test-subj="listItemColumnStepRuleDescription"] .euiDescriptionList__description .euiBadge__text';
 
 export const RULE_NAME_HEADER = '[data-test-subj="header-page-title"]';
 

x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/types.ts

@@ -33,6 +33,7 @@ export const NewRuleSchema = t.intersection([
     threat: t.array(t.unknown),
     to: t.string,
     updated_by: t.string,
+    note: t.string,
   }),
 ]);
 
@@ -86,6 +87,7 @@ export const RuleSchema = t.intersection([
     status_date: t.string,
     timeline_id: t.string,
     timeline_title: t.string,
+    note: t.string,
     version: t.number,
   }),
 ]);

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/__mocks__/mock.ts

@@ -4,7 +4,40 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { esFilters } from '../../../../../../../../../../src/plugins/data/public';
 import { Rule, RuleError } from '../../../../../containers/detection_engine/rules';
+import { AboutStepRule, DefineStepRule, ScheduleStepRule } from '../../types';
+import { FieldValueQueryBar } from '../../components/query_bar';
+
+export const mockQueryBar: FieldValueQueryBar = {
+  query: {
+    query: 'test query',
+    language: 'kuery',
+  },
+  filters: [
+    {
+      $state: {
+        store: esFilters.FilterStateStore.GLOBAL_STATE,
+      },
+      meta: {
+        alias: null,
+        disabled: false,
+        key: 'event.category',
+        negate: false,
+        params: {
+          query: 'file',
+        },
+        type: 'phrase',
+      },
+      query: {
+        match_phrase: {
+          'event.category': 'file',
+        },
+      },
+    },
+  ],
+  saved_id: 'test123',
+};
 
 export const mockRule = (id: string): Rule => ({
   created_at: '2020-01-10T21:11:45.839Z',
@@ -37,9 +70,129 @@ export const mockRule = (id: string): Rule => ({
   to: 'now',
   type: 'saved_query',
   threat: [],
+  note: '# this is some markdown documentation',
   version: 1,
 });
 
+export const mockRuleWithEverything = (id: string): Rule => ({
+  created_at: '2020-01-10T21:11:45.839Z',
+  updated_at: '2020-01-10T21:11:45.839Z',
+  created_by: 'elastic',
+  description: '24/7',
+  enabled: true,
+  false_positives: ['test'],
+  filters: [
+    {
+      $state: {
+        store: esFilters.FilterStateStore.GLOBAL_STATE,
+      },
+      meta: {
+        alias: null,
+        disabled: false,
+        key: 'event.category',
+        negate: false,
+        params: {
+          query: 'file',
+        },
+        type: 'phrase',
+      },
+      query: {
+        match_phrase: {
+          'event.category': 'file',
+        },
+      },
+    },
+  ],
+  from: 'now-300s',
+  id,
+  immutable: false,
+  index: ['auditbeat-*'],
+  interval: '5m',
+  rule_id: 'b5ba41ab-aaf3-4f43-971b-bdf9434ce0ea',
+  language: 'kuery',
+  output_index: '.siem-signals-default',
+  max_signals: 100,
+  risk_score: 21,
+  name: 'Query with rule-id',
+  query: 'user.name: root or user.name: admin',
+  references: ['www.test.co'],
+  saved_id: 'test123',
+  timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+  timeline_title: 'Titled timeline',
+  meta: { from: '0m' },
+  severity: 'low',
+  updated_by: 'elastic',
+  tags: ['tag1', 'tag2'],
+  to: 'now',
+  type: 'saved_query',
+  threat: [
+    {
+      framework: 'mockFramework',
+      tactic: {
+        id: '1234',
+        name: 'tactic1',
+        reference: 'reference1',
+      },
+      technique: [
+        {
+          id: '456',
+          name: 'technique1',
+          reference: 'technique reference',
+        },
+      ],
+    },
+  ],
+  note: '# this is some markdown documentation',
+  version: 1,
+});
+
+export const mockAboutStepRule = (isNew = false): AboutStepRule => ({
+  isNew,
+  name: 'Query with rule-id',
+  description: '24/7',
+  severity: 'low',
+  riskScore: 21,
+  references: ['www.test.co'],
+  falsePositives: ['test'],
+  tags: ['tag1', 'tag2'],
+  timeline: {
+    id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+    title: 'Titled timeline',
+  },
+  threat: [
+    {
+      framework: 'mockFramework',
+      tactic: {
+        id: '1234',
+        name: 'tactic1',
+        reference: 'reference1',
+      },
+      technique: [
+        {
+          id: '456',
+          name: 'technique1',
+          reference: 'technique reference',
+        },
+      ],
+    },
+  ],
+  note: '# this is some markdown documentation',
+});
+
+export const mockDefineStepRule = (isNew = false): DefineStepRule => ({
+  isNew,
+  index: ['filebeat-'],
+  queryBar: mockQueryBar,
+});
+
+export const mockScheduleStepRule = (isNew = false, enabled = false): ScheduleStepRule => ({
+  isNew,
+  enabled,
+  interval: '5m',
+  from: '6m',
+  to: 'now',
+});
+
 export const mockRuleError = (id: string): RuleError => ({
   rule_id: id,
   error: { status_code: 404, message: `id: "${id}" not found` },