[7.x] [Security Solution][Detections] Fix adding an action to detection rules (#83722) (#83776)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_field/index.test.tsx

@@ -31,13 +31,20 @@ describe('RuleActionsField', () => {
         },
       },
     });
+
+    const messageVariables = {
+      context: [],
+      state: [],
+      params: [],
+    };
+
     const Component = () => {
       const field = useFormFieldMock();
       const { form } = useForm();
 
       return (
         <Form form={form}>
-          <RuleActionsField euiFieldProps={{ options: [] }} field={field} />
+          <RuleActionsField field={field} messageVariables={messageVariables} />
         </Form>
       );
     };

x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_field/index.tsx

@@ -12,17 +12,21 @@ import ReactMarkdown from 'react-markdown';
 import styled from 'styled-components';
 
 import { NOTIFICATION_SUPPORTED_ACTION_TYPES_IDS } from '../../../../../common/constants';
-import { SelectField, useFormContext } from '../../../../shared_imports';
+import { FieldHook, useFormContext } from '../../../../shared_imports';
 import {
   ActionForm,
   ActionType,
   loadActionTypes,
+  ActionVariables,
 } from '../../../../../../triggers_actions_ui/public';
 import { AlertAction } from '../../../../../../alerts/common';
 import { useKibana } from '../../../../common/lib/kibana';
 import { FORM_ERRORS_TITLE } from './translations';
 
-type ThrottleSelectField = typeof SelectField;
+interface Props {
+  field: FieldHook;
+  messageVariables: ActionVariables;
+}
 
 const DEFAULT_ACTION_GROUP_ID = 'default';
 const DEFAULT_ACTION_MESSAGE =
@@ -34,7 +38,7 @@ const FieldErrorsContainer = styled.div`
   }
 `;
 
-export const RuleActionsField: ThrottleSelectField = ({ field, messageVariables }) => {
+export const RuleActionsField: React.FC<Props> = ({ field, messageVariables }) => {
   const [fieldErrors, setFieldErrors] = useState<string | null>(null);
   const [supportedActionTypes, setSupportedActionTypes] = useState<ActionType[] | undefined>();
   const form = useFormContext();

x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.test.tsx

@@ -30,10 +30,20 @@ jest.mock('../../../../common/lib/kibana', () => ({
   }),
 }));
 
+const actionMessageParams = {
+  context: [],
+  state: [],
+  params: [],
+};
+
 describe('StepRuleActions', () => {
   it('renders correctly', () => {
     const wrapper = shallow(
-      <StepRuleActions actionMessageParams={[]} isReadOnlyView={false} isLoading={false} />
+      <StepRuleActions
+        actionMessageParams={actionMessageParams}
+        isReadOnlyView={false}
+        isLoading={false}
+      />
     );
 
     expect(wrapper.find('[data-test-subj="stepRuleActions"]')).toHaveLength(1);

x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx

@@ -16,7 +16,7 @@ import {
 import { findIndex } from 'lodash/fp';
 import React, { FC, memo, useCallback, useEffect, useMemo } from 'react';
 
-import { ActionVariable } from '../../../../../../triggers_actions_ui/public';
+import { ActionVariables } from '../../../../../../triggers_actions_ui/public';
 import {
   RuleStep,
   RuleStepProps,
@@ -38,7 +38,7 @@ import { APP_ID } from '../../../../../common/constants';
 
 interface StepRuleActionsProps extends RuleStepProps {
   defaultValues?: ActionsStepRule | null;
-  actionMessageParams: ActionVariable[];
+  actionMessageParams: ActionVariables;
 }
 
 const stepActionsDefaultValue: ActionsStepRule = {

x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx

@@ -11,7 +11,7 @@ import { useLocation } from 'react-router-dom';
 
 import styled from 'styled-components';
 import { EuiFlexItem } from '@elastic/eui';
-import { ActionVariable } from '../../../../../../triggers_actions_ui/public';
+import { ActionVariables } from '../../../../../../triggers_actions_ui/public';
 import { RuleAlertAction } from '../../../../../common/detection_engine/types';
 import { assertUnreachable } from '../../../../../common/utility_types';
 import { transformRuleToAlertAction } from '../../../../../common/detection_engine/transform_actions';
@@ -366,21 +366,26 @@ export const getActionMessageRuleParams = (ruleType: Type): string[] => {
   return ruleParamsKeys;
 };
 
-export const getActionMessageParams = memoizeOne((ruleType: Type | undefined): ActionVariable[] => {
-  if (!ruleType) {
-    return [];
+export const getActionMessageParams = memoizeOne(
+  (ruleType: Type | undefined): ActionVariables => {
+    if (!ruleType) {
+      return { state: [], params: [] };
+    }
+    const actionMessageRuleParams = getActionMessageRuleParams(ruleType);
+    // Prefixes are being added automatically by the ActionTypeForm
+    return {
+      state: [{ name: 'signals_count', description: 'state.signals_count' }],
+      params: [],
+      context: [
+        { name: 'results_link', description: 'context.results_link' },
+        ...actionMessageRuleParams.map((param) => {
+          const extendedParam = `rule.${param}`;
+          return { name: extendedParam, description: `context.${extendedParam}` };
+        }),
+      ],
+    };
   }
-  const actionMessageRuleParams = getActionMessageRuleParams(ruleType);
-
-  return [
-    { name: 'state.signals_count', description: 'state.signals_count' },
-    { name: '{context.results_link}', description: 'context.results_link' },
-    ...actionMessageRuleParams.map((param) => {
-      const extendedParam = `context.rule.${param}`;
-      return { name: extendedParam, description: extendedParam };
-    }),
-  ];
-});
+);
 
 // typed as null not undefined as the initial state for this value is null.
 export const userHasNoPermissions = (canUserCRUD: boolean | null): boolean =>

x-pack/plugins/triggers_actions_ui/public/index.ts

@@ -21,6 +21,7 @@ export {
   AlertTypeParamsExpressionProps,
   ValidationResult,
   ActionVariable,
+  ActionVariables,
   ActionConnector,
   IErrorObject,
 } from './types';