[Security Solution] Add threshold, machine_learning_job_id and `a…

…nomaly_threshold` editable fields (elastic#200323)

**Partially addresses: elastic#171520

## Summary
**Changes in this PR**:
- `threshold` and `machine_learning_job_id`, `anomaly_threshold` are now
editable in the Rule Upgrade flyout

<img width="1840" alt="Scherm­afbeelding 2024-11-26 om 08 59 24"
src="https://github.com/user-attachments/assets/b76ef89b-8051-4eba-8d67-9e86a0408e83">


### Testing
- Ensure the `prebuiltRulesCustomizationEnabled` feature flag is
enabled.
- To simulate the availability of prebuilt rule upgrades, downgrade a
currently installed prebuilt rule using the `PATCH
api/detection_engine/rules` API.
   - Set `version: 1` in the request body to downgrade it to version 1.
- Modify other rule fields in the request body as needed to test the
changes.

x-pack/platform/plugins/private/translations/translations/fr-FR.json

@@ -37684,7 +37684,6 @@
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdCardinalityFieldLabel": "Compte",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdCardinalityValueFieldLabel": "Valeurs uniques",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdFieldCardinalityFieldHelpText": "Sélectionner un champ pour vérifier la cardinalité",
-    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdLabel": "Seuil",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ga.enableThresholdSuppressionForFieldsLabel": "Supprimer les alertes par champs sélectionnés : {fieldsString}",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ga.enableThresholdSuppressionLabel": "Supprimer les alertes",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.groupByDurationValueLabel": "Supprimer les alertes pour",

x-pack/platform/plugins/private/translations/translations/ja-JP.json

@@ -37542,7 +37542,6 @@
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdCardinalityFieldLabel": "カウント",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdCardinalityValueFieldLabel": "一意の値",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdFieldCardinalityFieldHelpText": "カーディナリティを確認するフィールドを選択します",
-    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdLabel": "しきい値",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ga.enableThresholdSuppressionForFieldsLabel": "選択したフィールドでアラートを非表示：{fieldsString}",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ga.enableThresholdSuppressionLabel": "アラートを非表示",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.groupByDurationValueLabel": "アラートを非表示",

x-pack/platform/plugins/private/translations/translations/zh-CN.json

@@ -36974,7 +36974,6 @@
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdCardinalityFieldLabel": "计数",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdCardinalityValueFieldLabel": "唯一值",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdFieldCardinalityFieldHelpText": "选择字段以检查基数",
-    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdLabel": "阈值",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ga.enableThresholdSuppressionForFieldsLabel": "对选定字段阻止告警：{fieldsString}",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ga.enableThresholdSuppressionLabel": "阻止告警",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.groupByDurationValueLabel": "阻止以下项的告警",

x-pack/solutions/security/plugins/security_solution/public/common/utils/normalize_machine_learning_job_id.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { MachineLearningJobId } from '../../../common/api/detection_engine';
+
+export function normalizeMachineLearningJobId(jobId: MachineLearningJobId): string[] {
+  return typeof jobId === 'string' ? [jobId] : jobId;
+}

x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation/components/anomaly_threshold_edit/anomaly_threshold_edit.tsx

@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { UseField } from '../../../../shared_imports';
+import { AnomalyThresholdSlider } from '../../../rule_creation_ui/components/anomaly_threshold_slider';
+import * as i18n from './translations';
+
+const componentProps = {
+  describedByIds: ['anomalyThreshold'],
+};
+
+interface AnomalyThresholdEditProps {
+  path: string;
+}
+
+export function AnomalyThresholdEdit({ path }: AnomalyThresholdEditProps): JSX.Element {
+  return (
+    <UseField
+      path={path}
+      config={ANOMALY_THRESHOLD_FIELD_CONFIG}
+      component={AnomalyThresholdSlider}
+      componentProps={componentProps}
+    />
+  );
+}
+
+const ANOMALY_THRESHOLD_FIELD_CONFIG = {
+  label: i18n.ANOMALY_THRESHOLD_LABEL,
+};

x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation/components/anomaly_threshold_edit/index.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { AnomalyThresholdEdit } from './anomaly_threshold_edit';

x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation/components/anomaly_threshold_edit/translations.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ANOMALY_THRESHOLD_LABEL = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldAnomalyThresholdLabel',
+  {
+    defaultMessage: 'Anomaly score threshold',
+  }
+);

x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation/components/create_ml_job_button/create_ml_job_button.tsx

@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiButton } from '@elastic/eui';
+import { useKibana } from '../../../../common/lib/kibana';
+import * as i18n from './translations';
+
+export function CreateCustomMlJobButton(): JSX.Element {
+  const { navigateToApp } = useKibana().services.application;
+
+  return (
+    <EuiButton
+      iconType="popout"
+      iconSide="right"
+      onClick={() => navigateToApp('ml', { openInNewTab: true })}
+    >
+      {i18n.CREATE_CUSTOM_JOB_BUTTON_TITLE}
+    </EuiButton>
+  );
+}

x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation/components/create_ml_job_button/translations.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const CREATE_CUSTOM_JOB_BUTTON_TITLE = i18n.translate(
+  'xpack.securitySolution.detectionEngine.mlSelectJob.createCustomJobButtonTitle',
+  {
+    defaultMessage: 'Create custom job',
+  }
+);

x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation/components/machine_learning_job_id_edit/index.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { MachineLearningJobIdEdit } from './machine_learning_job_id_edit';

x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation/components/machine_learning_job_id_edit/machine_learning_job_id_edit.tsx

@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo } from 'react';
+import { UseField, fieldValidators } from '../../../../shared_imports';
+import { MlJobSelect } from '../ml_job_select';
+import { useSecurityJobs } from '../../../../common/components/ml_popover/hooks/use_security_jobs';
+import * as i18n from './translations';
+
+interface MachineLearningJobIdEditProps {
+  path: string;
+  shouldShowHelpText?: boolean;
+}
+
+export function MachineLearningJobIdEdit({
+  path,
+  shouldShowHelpText,
+}: MachineLearningJobIdEditProps): JSX.Element {
+  const { loading, jobs } = useSecurityJobs();
+
+  const componentProps = useMemo(
+    () => ({
+      jobs,
+      loading,
+      shouldShowHelpText,
+    }),
+    [jobs, loading, shouldShowHelpText]
+  );
+
+  return (
+    <UseField
+      path={path}
+      config={MACHINE_LEARNING_JOB_ID_FIELD_CONFIG}
+      component={MlJobSelect}
+      componentProps={componentProps}
+    />
+  );
+}
+
+const MACHINE_LEARNING_JOB_ID_FIELD_CONFIG = {
+  label: i18n.MACHINE_LEARNING_JOB_ID_LABEL,
+  validations: [
+    {
+      validator: fieldValidators.emptyField(
+        i18n.MACHINE_LEARNING_JOB_ID_EMPTY_FIELD_VALIDATION_ERROR
+      ),
+    },
+  ],
+};

x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation/components/machine_learning_job_id_edit/translations.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const MACHINE_LEARNING_JOB_ID_LABEL = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldMachineLearningJobIdLabel',
+  {
+    defaultMessage: 'Machine Learning job',
+  }
+);
+
+export const MACHINE_LEARNING_JOB_ID_EMPTY_FIELD_VALIDATION_ERROR = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdRequired',
+  {
+    defaultMessage: 'A Machine Learning job is required.',
+  }
+);

x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation/components/ml_job_select/help_text.test.tsx

@@ -8,15 +8,46 @@
 import React from 'react';
 import { shallow } from 'enzyme';
 import { HelpText } from './help_text';
+import type { SecurityJob } from '../../../../common/components/ml_popover/types';
+
+jest.mock('../../../../common/lib/kibana', () => {
+  return {
+    useKibana: jest.fn().mockReturnValue({
+      services: {
+        application: {
+          getUrlForApp: () => '/app/ml',
+        },
+      },
+    }),
+  };
+});
 
 describe('MlJobSelect help text', () => {
   it('does not show warning if all jobs are running', () => {
-    const wrapper = shallow(<HelpText href={'https://test.com'} notRunningJobIds={[]} />);
+    const jobs = [
+      {
+        id: 'test-id',
+        jobState: 'opened',
+        datafeedState: 'opened',
+      },
+    ] as SecurityJob[];
+    const selectedJobIds = ['test-id'];
+
+    const wrapper = shallow(<HelpText jobs={jobs} selectedJobIds={selectedJobIds} />);
     expect(wrapper.find('[data-test-subj="ml-warning-not-running-jobs"]')).toHaveLength(0);
   });
 
   it('shows warning if there are jobs not running', () => {
-    const wrapper = shallow(<HelpText href={'https://test.com'} notRunningJobIds={['id']} />);
+    const jobs = [
+      {
+        id: 'test-id',
+        jobState: 'closed',
+        datafeedState: 'stopped',
+      },
+    ] as SecurityJob[];
+    const selectedJobIds = ['test-id'];
+
+    const wrapper = shallow(<HelpText jobs={jobs} selectedJobIds={selectedJobIds} />);
     expect(wrapper.find('[data-test-subj="ml-warning-not-running-jobs"]')).toHaveLength(1);
   });
 });