[8.18] [Security Solution] Adds normalization for filter meta field diff (#210191) (#212318)

# Backport This will backport the following commits from `main` to `8.18`: - [[Security Solution] Adds normalization for filter `meta` field diff (#210191)](https://github.com/elastic/kibana/pull/210191)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
2025-04-24 09:48:58 -04:00 · 2025-02-25 13:08:26 +11:00 · 2025-02-25 13:08:26 +11:00 · 17a2932b9b
commit 17a2932b9b
parent 2deb11215f
3 changed files with 108 additions and 31 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -2382,6 +2382,7 @@ x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout  @elastic/
 /x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/prebuilt_rules @elastic/security-detection-rule-management
 /x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/rule_management @elastic/security-detection-rule-management
 /x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/rule_monitoring @elastic/security-detection-rule-management
+/x-pack/solutions/security/plugins/security_solution/common/detection_engine/prebuilt_rules @elastic/security-detection-rule-management
 /x-pack/solutions/security/plugins/security_solution/common/detection_engine/rule_management @elastic/security-detection-rule-management

 /x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management @elastic/security-detection-rule-management
--- a/x-pack/solutions/security/plugins/security_solution/common/detection_engine/prebuilt_rules/diff/extract_rule_data_query.test.ts
+++ b/x-pack/solutions/security/plugins/security_solution/common/detection_engine/prebuilt_rules/diff/extract_rule_data_query.test.ts
@ -5,7 +5,7 @@
 * 2.0.
 */

-import type { Filter } from '@kbn/es-query';
+import { FilterStateStore, type Filter } from '@kbn/es-query';
 import { KqlQueryType } from '../../../api/detection_engine';
 import {
  extractRuleEqlQuery,
@ -29,6 +29,9 @@ const mockFilter: Filter = {
      field: 'value',
    },
  },
+  $state: {
+    store: FilterStateStore.APP_STATE,
+  },
 };

 describe('extract rule data queries', () => {
@ -44,36 +47,107 @@ describe('extract rule data queries', () => {
      });
    });

-    it('normalizes filters', () => {
-      const extractedKqlQuery = extractRuleKqlQuery(
-        'event.kind:alert',
-        'kuery',
-        [mockFilter],
-        undefined
-      );
+    describe('filters normalization', () => {
+      it('normalizes filters[].query when all fields present', () => {
+        const extractedKqlQuery = extractRuleKqlQuery(
+          'some:query',
+          'kuery',
+          [mockFilter],
+          undefined
+        );

-      expect(extractedKqlQuery).toEqual({
-        type: KqlQueryType.inline_query,
-        query: 'event.kind:alert',
-        language: 'kuery',
-        filters: [
-          {
-            meta: {
-              negate: false,
-              disabled: false,
-              type: 'phrase',
-              key: 'test',
-              params: {
-                query: 'value',
+        expect(extractedKqlQuery).toMatchObject({
+          filters: [
+            {
+              query: {
+                term: {
+                  field: 'value',
+                },
              },
            },
-            query: {
-              term: {
-                field: 'value',
-              },
+          ],
+        });
+      });
+
+      it('normalizes filters[].query when query object is missing', () => {
+        const extractedKqlQuery = extractRuleKqlQuery(
+          'some:query',
+          'kuery',
+          [{ ...mockFilter, query: undefined }],
+          undefined
+        );
+
+        expect(extractedKqlQuery).not.toMatchObject({
+          filters: [
+            {
+              query: expect.anything(),
            },
+          ],
+        });
+      });
+
+      it.each([
+        {
+          caseName: 'when all fields present',
+          filter: mockFilter,
+          expectedFilterMeta: {
+            negate: false,
+            disabled: false,
          },
-        ],
+        },
+        {
+          caseName: 'when disabled field is missing',
+          filter: { ...mockFilter, meta: { ...mockFilter.meta, disabled: undefined } },
+          expectedFilterMeta: {
+            negate: false,
+            disabled: false,
+          },
+        },
+        {
+          caseName: 'when negate field is missing',
+          filter: { ...mockFilter, meta: { ...mockFilter.meta, negate: undefined } },
+          expectedFilterMeta: {
+            disabled: false,
+          },
+        },
+        {
+          caseName: 'when query object is missing',
+          filter: { ...mockFilter, query: undefined },
+          expectedFilterMeta: {
+            negate: false,
+            disabled: false,
+          },
+        },
+      ])('normalizes filters[].meta $caseName', ({ filter, expectedFilterMeta }) => {
+        const extractedKqlQuery = extractRuleKqlQuery('some:query', 'kuery', [filter], undefined);
+
+        expect(extractedKqlQuery).toMatchObject({
+          filters: [
+            {
+              meta: expectedFilterMeta,
+            },
+          ],
+        });
+      });
+
+      it('normalizes filters[].meta when query object is missing', () => {
+        const extractedKqlQuery = extractRuleKqlQuery(
+          'some:query',
+          'kuery',
+          [{ ...mockFilter, query: undefined }],
+          undefined
+        );
+
+        expect(extractedKqlQuery).toMatchObject({
+          filters: [
+            {
+              meta: {
+                negate: false,
+                disabled: false,
+              },
+            },
+          ],
+        });
      });
    });
  });
--- a/x-pack/solutions/security/plugins/security_solution/common/detection_engine/prebuilt_rules/diff/extract_rule_data_query.ts
+++ b/x-pack/solutions/security/plugins/security_solution/common/detection_engine/prebuilt_rules/diff/extract_rule_data_query.ts
@ -84,19 +84,21 @@ export const extractRuleEsqlQuery = (
 };

 /**
- * Removes the null `alias` field that gets appended from the internal kibana filter util for comparison
- * Relevant issue: https://github.com/elastic/kibana/issues/202966
+ * Normalizes filter properties to only include ones relevant to the query itself
+ * Relevant issues:
+ *  - https://github.com/elastic/kibana/issues/202966
+ *  - https://github.com/elastic/kibana/issues/206527
 */
 const normalizeFilterArray = (filters: RuleFilterArray | undefined): RuleFilterArray => {
  if (!filters?.length) {
    return [];
  }
  return (filters as Filter[]).map((filter) => ({
-    ...filter,
+    query: filter.query,
    meta: filter.meta
      ? {
-          ...filter.meta,
-          alias: filter.meta.alias ?? undefined,
+          negate: filter.meta.negate,
+          disabled: filter.meta.disabled !== undefined ? filter.meta.disabled : false,
        }
      : undefined,
  }));