[SIEM][Detection Engine] Fixes bug with timeline templates not working

[FrankHassanabad]

Summary

Fixes a bug with the timeline templates not working when specifying filters.

• Creates a type safe mechanism for getting StringArrays or regular strings
• AddsType Script function returns to functions in the helpers file
• Adds unit tests for the effected areas of code and corner cases

Before this fix you would get these toaster errors if you tried to use a template name such as host.name in the timeline filters:

After this fix it will work for you.

Testing:

1. Create a timeline template that has a host.name as both a query and a filter such as this. You can give the value of the host.name any value such as placeholder.

2. Create a signal that uses it and produces a lot of signals off of something such as all host names

3. Ensure you select your Timeline template you saved by using the drop down

4. Once your signals have run, go to the signals page and send one of the signals for your newly crated rule which has a host name to the timeline from "View in timeline"

You should notice that your timeline has both the query and the filter set correctly such as this

Other notes

All the different fields you can choose from for templates are:

  'host.name',
  'host.hostname',
  'host.domain',
  'host.id',
  'host.ip',
  'client.ip',
  'destination.ip',
  'server.ip',
  'source.ip',
  'network.community_id',
  'user.name',
  'process.name',

And it should not work with anything outside of those. You should be able to mix and match them into different filters and queries to have a multiples of them.

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 8e292c4

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[yctercero]

Pulled down and ran through test steps. LGTM - thanks for adding the unit tests!

[dhurley14]

LGTM thanks for the bug fix!

[rylnd]

LGTM. I appreciate the tests!