[Security Solution][Alerts] Add suppression icon to rule name in cases alerts table (#148934)

## Summary

Addresses https://github.com/elastic/kibana/issues/145805

`kibana.alert.suppression.docs_count` field is not always returned in
ecsData, sometimes it's in data instead. We now check both data sources
for the docs_count.


![image](https://user-images.githubusercontent.com/55718608/212439168-e4afb150-6b8c-4bbd-9fdb-2d083b468151.png)
This commit is contained in:
Marshall Main 2023-01-25 14:34:20 -08:00 committed by GitHub
parent de32cac471
commit f5fe104633
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -7,6 +7,7 @@
import type { EuiDataGridCellValueElementProps } from '@elastic/eui';
import { EuiIcon, EuiToolTip, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
import { find } from 'lodash/fp';
import React, { useMemo } from 'react';
import { GuidedOnboardingTourStep } from '../../../common/components/guided_onboarding_tour/tour_step';
import { isDetectionsAlertsTable } from '../../../common/components/top_n/helpers';
@ -42,7 +43,15 @@ export const RenderCellValue: React.FC<EuiDataGridCellValueElementProps & CellVa
[columnId, props.isDetails, rowIndex, scopeId]
);
const suppressionCount = props.ecsData?.kibana?.alert.suppression?.docs_count;
// We check both ecsData and data for the suppression count because it could be in either one,
// depending on where RenderCellValue is being used - when used in cases, data is populated,
// whereas in the regular security alerts table it's in ecsData
const ecsSuppressionCount = props.ecsData?.kibana?.alert.suppression?.docs_count?.[0];
const dataSuppressionCount = find({ field: 'kibana.alert.suppression.docs_count' }, props.data)
?.value?.[0] as number | undefined;
const actualSuppressionCount = ecsSuppressionCount
? parseInt(ecsSuppressionCount, 10)
: dataSuppressionCount;
const component = (
<GuidedOnboardingTourStep
@ -55,14 +64,11 @@ export const RenderCellValue: React.FC<EuiDataGridCellValueElementProps & CellVa
);
return columnId === SIGNAL_RULE_NAME_FIELD_NAME &&
suppressionCount &&
parseInt(suppressionCount[0], 10) > 0 ? (
actualSuppressionCount &&
actualSuppressionCount > 0 ? (
<EuiFlexGroup gutterSize="xs">
<EuiFlexItem grow={false}>
<EuiToolTip
position="top"
content={SUPPRESSED_ALERT_TOOLTIP(parseInt(suppressionCount[0], 10))}
>
<EuiToolTip position="top" content={SUPPRESSED_ALERT_TOOLTIP(actualSuppressionCount)}>
<EuiIcon type="layers" />
</EuiToolTip>
</EuiFlexItem>
@ -108,7 +114,7 @@ export const useRenderCellValue = ({
}
return (
<DefaultCellRenderer
<RenderCellValue
browserFields={browserFields}
columnId={columnId}
data={data}