github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 17:59:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Detections] Add validation for Threshold value field (#72611) (#72776)

Browse source 
Co-authored-by: Patryk Kopyciński <patryk.kopycinski@elastic.co>
This commit is contained in:
Garrett Spong 2020-07-21 22:44:52 -06:00 • committed by GitHub
parent 996f0ad10e
commit 1ba3dbcfcf
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 50 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/schema.tsx
View file

@ -202,6 +202,20 @@ export const schema: FormSchema = {
defaultMessage: 'Threshold',
}
),
validations: [
{
validator: fieldValidators.numberGreaterThanField({
than: 1,
message: i18n.translate(
'xpack.securitySolution.detectionEngine.validations.thresholdValueFieldData.numberGreaterThanOrEqualOneErrorMessage',
{
defaultMessage: 'Value must be greater than or equal one.',
}
),
allowEquality: true,
}),
},
],
},
},
};

35
x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.test.ts
View file

@ -193,4 +193,39 @@ describe('getThresholdSignalQueryFields', () => {
'event.dataset': 'traefik.access',
});
});
it('should return proper object for exists filters', () => {
const filters = {
bool: {
should: [
{
bool: {
should: [
{
exists: {
field: 'process.name',
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
exists: {
field: 'event.type',
},
},
],
minimum_should_match: 1,
},
},
],
minimum_should_match: 1,
},
};
expect(getThresholdSignalQueryFields(filters)).toEqual({});
});
});

2
x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.ts
View file

@ -83,7 +83,7 @@ export const getThresholdSignalQueryFields = (filter: unknown) => {
return { ...acc, ...item.match_phrase };
}
if (item.bool.should && (item.bool.should[0].match || item.bool.should[0].match_phrase)) {
if (item.bool?.should && (item.bool.should[0].match || item.bool.should[0].match_phrase)) {
return { ...acc, ...(item.bool.should[0].match || item.bool.should[0].match_phrase) };
}