[9.0] [Security Solution][Risk Score] Use Risk Engine SavedObject intead of localStorage on the Risk Score web page (#215304) (#215440)

# Backport This will backport the following commits from `main` to `9.0`: - [[Security Solution][Risk Score] Use Risk Engine SavedObject intead of localStorage on the Risk Score web page (#215304)](https://github.com/elastic/kibana/pull/215304)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Abhishek Bhatia <117628830+abhishekbhatia1710@users.noreply.github.com>
2025-04-24 09:48:58 -04:00 · 2025-03-21 15:58:41 +01:00 · 2025-03-21 15:58:41 +01:00 · c0a9009362
commit c0a9009362
parent 9b73c01bd6
7 changed files with 50 additions and 101 deletions
--- a/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_settings_route.gen.ts
+++ b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_settings_route.gen.ts
@ -21,4 +21,8 @@ import { DateRange } from '../common/common.gen';
 export type ReadRiskEngineSettingsResponse = z.infer<typeof ReadRiskEngineSettingsResponse>;
 export const ReadRiskEngineSettingsResponse = z.object({
  range: DateRange.optional(),
+  /**
+   * Include closed alerts in the risk score calculation
+   */
+  includeClosedAlerts: z.boolean().optional(),
 });
--- a/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_settings_route.schema.yaml
+++ b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_settings_route.schema.yaml
@ -21,3 +21,6 @@ paths:
                properties:
                  range:
                    $ref: '../common/common.schema.yaml#/components/schemas/DateRange'
+                  includeClosedAlerts:
+                    type: boolean
+                    description: Include closed alerts in the risk score calculation
--- a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_configuration_section.test.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_configuration_section.test.tsx
@ -22,10 +22,8 @@ describe('RiskScoreConfigurationSection', () => {
  const mockConfigureSO = useConfigureSORiskEngineMutation as jest.Mock;
  const defaultProps = {
    includeClosedAlerts: false,
-    setIncludeClosedAlerts: jest.fn(),
    from: 'now-30d',
    to: 'now',
-    onDateChange: jest.fn(),
  };

  const mockAddSuccess = jest.fn();
@ -50,13 +48,17 @@ describe('RiskScoreConfigurationSection', () => {
      <RiskScoreConfigurationSection {...defaultProps} includeClosedAlerts={true} />
    );
    wrapper.find(EuiSwitch).simulate('click');
-    expect(defaultProps.setIncludeClosedAlerts).toHaveBeenCalledWith(true);
+    expect(wrapper.find(EuiSwitch).prop('checked')).toBe(true);
+    act(() => {
+      wrapper.find(EuiSwitch).simulate('click');
+    });
+    wrapper.update();
+    expect(wrapper.find(EuiSwitch).prop('checked')).toBe(true);
  });

  it('calls onDateChange on date change', () => {
    const wrapper = mount(<RiskScoreConfigurationSection {...defaultProps} />);
    wrapper.find(EuiSuperDatePicker).props().onTimeChange({ start: 'now-30d', end: 'now' });
-    expect(defaultProps.onDateChange).toHaveBeenCalledWith({ start: 'now-30d', end: 'now' });
  });

  it('shows bottom bar when changes are made', async () => {
@ -71,20 +73,20 @@ describe('RiskScoreConfigurationSection', () => {
  });

  it('saves changes', () => {
-    const wrapper = mount(
-      <RiskScoreConfigurationSection {...defaultProps} includeClosedAlerts={true} />
-    );
+    const wrapper = mount(<RiskScoreConfigurationSection {...defaultProps} />);

-    // Simulate clicking the switch
+    // Simulate clicking the toggle switch
    const closedAlertsToggle = wrapper.find('button[data-test-subj="includeClosedAlertsSwitch"]');
    expect(closedAlertsToggle.exists()).toBe(true);
    closedAlertsToggle.simulate('click');

    wrapper.update();

+    // Simulate clicking the save button in the bottom bar
    const saveChangesButton = wrapper.find('button[data-test-subj="riskScoreSaveButton"]');
    expect(saveChangesButton.exists()).toBe(true);
    saveChangesButton.simulate('click');
+    wrapper.update();
    const callArgs = mockMutate.mock.calls[0][0];
    expect(callArgs).toEqual({
      includeClosedAlerts: true,
--- a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_configuration_section.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_configuration_section.tsx
@ -5,7 +5,7 @@
 * 2.0.
 */

-import React, { useState, useEffect, useRef } from 'react';
+import React, { useState, useEffect } from 'react';
 import {
  EuiSuperDatePicker,
  EuiButton,
@ -18,7 +18,6 @@ import {
  EuiSpacer,
  useEuiTheme,
 } from '@elastic/eui';
-import useLocalStorage from 'react-use/lib/useLocalStorage';
 import { useAppToasts } from '../../common/hooks/use_app_toasts';
 import * as i18n from '../translations';
 import { useConfigureSORiskEngineMutation } from '../api/hooks/use_configure_risk_engine_saved_object';
@ -26,87 +25,45 @@ import { getEntityAnalyticsRiskScorePageStyles } from './risk_score_page_styles'

 export const RiskScoreConfigurationSection = ({
  includeClosedAlerts,
-  setIncludeClosedAlerts,
  from,
  to,
-  onDateChange,
 }: {
  includeClosedAlerts: boolean;
-  setIncludeClosedAlerts: (value: boolean) => void;
  from: string;
  to: string;
-  onDateChange: ({ start, end }: { start: string; end: string }) => void;
 }) => {
  const { euiTheme } = useEuiTheme();
  const styles = getEntityAnalyticsRiskScorePageStyles(euiTheme);
-  const [start, setFrom] = useState(from);
-  const [end, setTo] = useState(to);
+  const [checked, setChecked] = useState(includeClosedAlerts);
  const [isLoading, setIsLoading] = useState(false);
  const [showBar, setShowBar] = useState(false);
  const { addSuccess } = useAppToasts();
-  const initialIncludeClosedAlerts = useRef(includeClosedAlerts);
-  const initialStart = useRef(from);
-  const initialEnd = useRef(to);
-
-  const [savedIncludeClosedAlerts, setSavedIncludeClosedAlerts] = useLocalStorage(
-    'includeClosedAlerts',
-    includeClosedAlerts ?? false
-  );
-  const [savedStart, setSavedStart] = useLocalStorage(
-    'entityAnalytics:riskScoreConfiguration:fromDate',
-    from
-  );
-  const [savedEnd, setSavedEnd] = useLocalStorage(
-    'entityAnalytics:riskScoreConfiguration:toDate',
-    to
-  );
+  const [start, setStart] = useState(from);
+  const [end, setEnd] = useState(to);

  useEffect(() => {
-    if (savedIncludeClosedAlerts !== null && savedIncludeClosedAlerts !== undefined) {
-      initialIncludeClosedAlerts.current = savedIncludeClosedAlerts;
-      setIncludeClosedAlerts(savedIncludeClosedAlerts);
-    }
-    if (savedStart && savedEnd) {
-      initialStart.current = savedStart;
-      initialEnd.current = savedEnd;
-      setFrom(savedStart);
-      setTo(savedEnd);
-    }
-  }, [savedIncludeClosedAlerts, savedStart, savedEnd, setIncludeClosedAlerts]);
+    setChecked(includeClosedAlerts);
+    setStart(from);
+    setEnd(to);
+  }, [includeClosedAlerts, from, to]);

-  const onRefresh = ({ start: newStart, end: newEnd }: { start: string; end: string }) => {
-    setFrom(newStart);
-    const adjustedEnd = newStart === newEnd ? 'now' : newEnd;
-    setTo(adjustedEnd);
-    onDateChange({ start: newStart, end: adjustedEnd });
-    checkForChanges(newStart, adjustedEnd, includeClosedAlerts);
+  const handleDateChange = ({ start: newStart, end: newEnd }: { start: string; end: string }) => {
+    setShowBar(true);
+    setStart(newStart);
+    setEnd(newEnd);
  };

-  const handleToggle = () => {
-    const newValue = !includeClosedAlerts;
-    setIncludeClosedAlerts(newValue);
-    checkForChanges(start, end, newValue);
+  const onChange = () => {
+    setChecked((prev) => !prev);
+    setShowBar(true);
  };
-
-  const checkForChanges = (newStart: string, newEnd: string, newIncludeClosedAlerts: boolean) => {
-    if (
-      newStart !== initialStart.current ||
-      newEnd !== initialEnd.current ||
-      newIncludeClosedAlerts !== initialIncludeClosedAlerts.current
-    ) {
-      setShowBar(true);
-    } else {
-      setShowBar(false);
-    }
-  };
-
  const { mutate } = useConfigureSORiskEngineMutation();

  const handleSave = () => {
    setIsLoading(true);
    mutate(
      {
-        includeClosedAlerts,
+        includeClosedAlerts: checked,
        range: { start, end },
      },
      {
@ -116,14 +73,6 @@ export const RiskScoreConfigurationSection = ({
            toastLifeTimeMs: 5000,
          });
          setIsLoading(false);
-
-          initialStart.current = start;
-          initialEnd.current = end;
-          initialIncludeClosedAlerts.current = includeClosedAlerts;
-
-          setSavedIncludeClosedAlerts(includeClosedAlerts);
-          setSavedStart(start);
-          setSavedEnd(end);
        },
        onError: () => {
          setIsLoading(false);
@ -138,8 +87,8 @@ export const RiskScoreConfigurationSection = ({
        <div>
          <EuiSwitch
            label={i18n.INCLUDE_CLOSED_ALERTS_LABEL}
-            checked={includeClosedAlerts}
-            onChange={handleToggle}
+            checked={checked}
+            onChange={onChange}
            data-test-subj="includeClosedAlertsSwitch"
          />
        </div>
@ -148,7 +97,7 @@ export const RiskScoreConfigurationSection = ({
          <EuiSuperDatePicker
            start={start}
            end={end}
-            onTimeChange={onRefresh}
+            onTimeChange={handleDateChange}
            width={'auto'}
            compressed={false}
            showUpdateButton={false}
@ -170,9 +119,9 @@ export const RiskScoreConfigurationSection = ({
                  iconType="cross"
                  onClick={() => {
                    setShowBar(false);
-                    setFrom(initialStart.current);
-                    setTo(initialEnd.current);
-                    setIncludeClosedAlerts(initialIncludeClosedAlerts.current);
+                    setStart(start);
+                    setEnd(end);
+                    setChecked(includeClosedAlerts);
                  }}
                >
                  {i18n.DISCARD_CHANGES}
--- a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/pages/entity_analytics_management_page.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/pages/entity_analytics_management_page.tsx
@ -5,7 +5,7 @@
 * 2.0.
 */

-import React, { useState, useCallback } from 'react';
+import React, { useState } from 'react';
 import {
  EuiFlexGroup,
  EuiFlexItem,
@ -28,6 +28,7 @@ import { useScheduleNowRiskEngineMutation } from '../api/hooks/use_schedule_now_
 import { useAppToasts } from '../../common/hooks/use_app_toasts';
 import * as i18n from '../translations';
 import { getEntityAnalyticsRiskScorePageStyles } from '../components/risk_score_page_styles';
+import { useRiskEngineSettings } from '../api/hooks/use_risk_engine_settings';

 const TEN_SECONDS = 10000;

@ -35,9 +36,10 @@ export const EntityAnalyticsManagementPage = () => {
  const { euiTheme } = useEuiTheme();
  const styles = getEntityAnalyticsRiskScorePageStyles(euiTheme);
  const privileges = useMissingRiskEnginePrivileges();
-  const [includeClosedAlerts, setIncludeClosedAlerts] = useState(false);
-  const [from, setFrom] = useState(localStorage.getItem('dateStart') || 'now-30d');
-  const [to, setTo] = useState(localStorage.getItem('dateEnd') || 'now');
+  const { data: riskEngineSettings } = useRiskEngineSettings();
+  const includeClosedAlerts = riskEngineSettings?.includeClosedAlerts ?? false;
+  const from = riskEngineSettings?.range?.start ?? 'now-30d';
+  const to = riskEngineSettings?.range?.end || 'now';
  const { data: riskEngineStatus } = useRiskEngineStatus({
    refetchInterval: TEN_SECONDS,
    structuralSharing: false, // Force the component to rerender after every Risk Engine Status API call
@ -65,20 +67,6 @@ export const EntityAnalyticsManagementPage = () => {
    }
  };

-  const handleIncludeClosedAlertsToggle = useCallback(
-    (value: boolean) => {
-      setIncludeClosedAlerts(value);
-    },
-    [setIncludeClosedAlerts]
-  );
-
-  const handleDateChange = ({ start, end }: { start: string; end: string }) => {
-    setFrom(start);
-    setTo(end);
-    localStorage.setItem('dateStart', start);
-    localStorage.setItem('dateEnd', end);
-  };
-
  const { status, runAt } = riskEngineStatus?.risk_engine_task_status || {};

  const isRunning = status === 'running' || (!!runAt && new Date(runAt) < new Date());
@ -148,10 +136,8 @@ export const EntityAnalyticsManagementPage = () => {
        <EuiFlexItem grow={2}>
          <RiskScoreConfigurationSection
            includeClosedAlerts={includeClosedAlerts}
-            setIncludeClosedAlerts={handleIncludeClosedAlertsToggle}
            from={from}
            to={to}
-            onDateChange={handleDateChange}
          />
          <EuiHorizontalRule />
          <RiskScoreUsefulLinksSection />
--- a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/settings.ts
+++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/settings.ts
@ -55,6 +55,9 @@ export const riskEngineSettingsRoute = (router: EntityAnalyticsRoutesDeps['route
          return response.ok({
            body: {
              range: result.range,
+              includeClosedAlerts:
+                Array.isArray(result?.excludeAlertStatuses) &&
+                !result.excludeAlertStatuses.includes('closed'),
            },
          });
        } catch (e) {
--- a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/types.ts
+++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/types.ts
@ -81,6 +81,8 @@ export interface RiskEngineConfiguration {
  _meta: {
    mappingsVersion: number;
  };
+  excludeAlertStatuses?: string[];
+  excludeAlertTags?: string[];
 }

 export interface CalculateScoresParams {