[Security Solution] Fixes custom index fields not appearing in exceptions modal (#122387)

x-pack/plugins/security_solution/common/ecs/index.ts

@@ -74,4 +74,5 @@ export interface Ecs {
   Target?: Target;
   dll?: DllEcs;
   'kibana.alert.workflow_status'?: 'open' | 'acknowledged' | 'in-progress' | 'closed';
+  'kibana.alert.rule.parameters'?: { index: string[] };
 }

x-pack/plugins/security_solution/cypress/integration/exceptions/exceptions_modal.spec.ts

@@ -29,6 +29,7 @@ import {
   LOADING_SPINNER,
   EXCEPTION_ITEM_CONTAINER,
   ADD_EXCEPTIONS_BTN,
+  EXCEPTION_FIELD_LIST,
 } from '../../screens/exceptions';
 
 import { ALERTS_URL } from '../../urls/navigation';
@@ -196,4 +197,13 @@ describe('Exceptions modal', () => {
 
     closeExceptionBuilderModal();
   });
+
+  it('Contains custom index fields', () => {
+    cy.get(ADD_EXCEPTIONS_BTN).click({ force: true });
+
+    cy.get(FIELD_INPUT).eq(0).click({ force: true });
+    cy.get(EXCEPTION_FIELD_LIST).contains('unique_value.test');
+
+    closeExceptionBuilderModal();
+  });
 });

x-pack/plugins/security_solution/cypress/screens/exceptions.ts

@@ -56,3 +56,6 @@ export const EXCEPTIONS_TABLE_MODAL = '[data-test-subj="referenceErrorModal"]';
 export const EXCEPTIONS_TABLE_MODAL_CONFIRM_BTN = '[data-test-subj="confirmModalConfirmButton"]';
 
 export const EXCEPTION_ITEM_CONTAINER = '[data-test-subj="exceptionEntriesContainer"]';
+
+export const EXCEPTION_FIELD_LIST =
+  '[data-test-subj="comboBoxOptionsList fieldAutocompleteComboBox-optionsList"]';

x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx

@@ -121,6 +121,9 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps & PropsFromRedux
     }
   }, [timelineId, globalQuery, timelineQuery, routeProps]);
 
+  const ruleIndex =
+    ecsRowData['kibana.alert.rule.parameters']?.index ?? ecsRowData?.signal?.rule?.index;
+
   const {
     exceptionModalType,
     onAddExceptionCancel,
@@ -128,7 +131,7 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps & PropsFromRedux
     onAddExceptionTypeClick,
     ruleIndices,
   } = useExceptionModal({
-    ruleIndex: ecsRowData?.signal?.rule?.index,
+    ruleIndex,
     refetch: refetchAll,
     timelineId,
   });

x-pack/test/security_solution_cypress/es_archives/exceptions/data.json

@@ -8,6 +8,9 @@
       "agent": {
         "name": "bond"
       },
+      "unique_value": {
+        "test": "test field"
+      },
       "user" : [ 
         {
           "name" : "john",

x-pack/test/security_solution_cypress/es_archives/exceptions/mappings.json

@@ -25,6 +25,14 @@
             }
           }
         },
+        "unique_value": {
+          "properties": {
+            "test": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
         "user": {
           "type": "nested",
           "properties": {