Merge branch '7.9' of github.com:elastic/kibana into backport/7.9/pr-…

…73592

x-pack/plugins/security_solution/common/endpoint/generate_data.ts

@@ -1041,7 +1041,7 @@ export class EndpointDocGenerator {
           config: {
             artifact_manifest: {
               value: {
-                manifest_version: 'WzAsMF0=',
+                manifest_version: '1.0.0',
                 schema_version: 'v1',
                 artifacts: {},
               },

x-pack/plugins/security_solution/common/endpoint/schema/common.ts

@@ -23,8 +23,6 @@ export const encryptionAlgorithm = t.keyof({
 
 export const identifier = t.string;
 
-export const manifestVersion = t.string;
-
 export const manifestSchemaVersion = t.keyof({
   v1: null,
 });
@@ -34,4 +32,7 @@ export const relativeUrl = t.string;
 
 export const sha256 = t.string;
 
+export const semanticVersion = t.string;
+export type SemanticVersion = t.TypeOf<typeof semanticVersion>;
+
 export const size = t.number;

x-pack/plugins/security_solution/common/endpoint/schema/manifest.ts

@@ -11,9 +11,9 @@ import {
   encryptionAlgorithm,
   identifier,
   manifestSchemaVersion,
-  manifestVersion,
   relativeUrl,
   sha256,
+  semanticVersion,
   size,
 } from './common';
 
@@ -50,7 +50,7 @@ export type ManifestEntryDispatchSchema = t.TypeOf<typeof manifestEntryDispatchS
 
 export const manifestBaseSchema = t.exact(
   t.type({
-    manifest_version: manifestVersion,
+    manifest_version: semanticVersion,
     schema_version: manifestSchemaVersion,
   })
 );

x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx

@@ -67,7 +67,8 @@ export interface AddExceptionModalProps extends AddExceptionModalBaseProps {
 
 const Modal = styled(EuiModal)`
   ${({ theme }) => css`
-    width: ${theme.eui.euiBreakpoints.m};
+    width: ${theme.eui.euiBreakpoints.l};
+    max-width: ${theme.eui.euiBreakpoints.l};
   `}
 `;
 
@@ -233,7 +234,7 @@ export const AddExceptionModal = memo(function AddExceptionModal({
   );
 
   const retrieveAlertOsTypes = useCallback(() => {
-    const osDefaults = ['windows', 'macos', 'linux'];
+    const osDefaults = ['windows', 'macos'];
     if (alertData) {
       const osTypes = getMappedNonEcsValue({
         data: alertData.nonEcsData,
@@ -285,7 +286,9 @@ export const AddExceptionModal = memo(function AddExceptionModal({
     <EuiOverlayMask onClick={onCancel}>
       <Modal onClose={onCancel} data-test-subj="add-exception-modal">
         <ModalHeader>
-          <EuiModalHeaderTitle>{i18n.ADD_EXCEPTION}</EuiModalHeaderTitle>
+          <EuiModalHeaderTitle>
+            {exceptionListType === 'endpoint' ? i18n.ADD_ENDPOINT_EXCEPTION : i18n.ADD_EXCEPTION}
+          </EuiModalHeaderTitle>
           <ModalHeaderSubtitle className="eui-textTruncate" title={ruleName}>
             {ruleName}
           </ModalHeaderSubtitle>
@@ -330,13 +333,6 @@ export const AddExceptionModal = memo(function AddExceptionModal({
 
                 <EuiSpacer />
 
-                {exceptionListType === 'endpoint' && (
-                  <>
-                    <EuiText size="s">{i18n.ENDPOINT_QUARANTINE_TEXT}</EuiText>
-                    <EuiSpacer />
-                  </>
-                )}
-
                 <AddExceptionComments
                   newCommentValue={comment}
                   newCommentOnChange={onCommentChange}
@@ -367,6 +363,14 @@ export const AddExceptionModal = memo(function AddExceptionModal({
                     disabled={shouldDisableBulkClose}
                   />
                 </EuiFormRow>
+                {exceptionListType === 'endpoint' && (
+                  <>
+                    <EuiSpacer />
+                    <EuiText color="subdued" size="s">
+                      {i18n.ENDPOINT_QUARANTINE_TEXT}
+                    </EuiText>
+                  </>
+                )}
               </ModalBodySection>
             </>
           )}

x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/translations.ts

@@ -17,6 +17,13 @@ export const ADD_EXCEPTION = i18n.translate(
   }
 );
 
+export const ADD_ENDPOINT_EXCEPTION = i18n.translate(
+  'xpack.securitySolution.exceptions.addException.addEndpointException',
+  {
+    defaultMessage: 'Add Endpoint Exception',
+  }
+);
+
 export const ADD_EXCEPTION_ERROR = i18n.translate(
   'xpack.securitySolution.exceptions.addException.error',
   {
@@ -49,14 +56,15 @@ export const ENDPOINT_QUARANTINE_TEXT = i18n.translate(
   'xpack.securitySolution.exceptions.addException.endpointQuarantineText',
   {
     defaultMessage:
-      'Any file in quarantine on any endpoint that matches the attribute(s) selected will automatically be restored to its original location',
+      'Any file in quarantine on any endpoint that matches the attribute(s) selected will automatically be restored to its original location. This exception will apply to any rule that is linked to the Global Endpoint Exception List.',
   }
 );
 
 export const BULK_CLOSE_LABEL = i18n.translate(
   'xpack.securitySolution.exceptions.addException.bulkCloseLabel',
   {
-    defaultMessage: 'Close all alerts that match attributes in this exception',
+    defaultMessage:
+      'Close all alerts that match this exception, including alerts generated by other rules',
   }
 );
 

x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_entry_item.tsx

@@ -110,6 +110,7 @@ export const BuilderEntryItem: React.FC<EntryItemProps> = ({
           isDisabled={indexPattern == null}
           onChange={handleFieldChange}
           data-test-subj="exceptionBuilderEntryField"
+          fieldInputWidth={275}
         />
       );
 

x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx

@@ -54,7 +54,8 @@ interface EditExceptionModalProps {
 
 const Modal = styled(EuiModal)`
   ${({ theme }) => css`
-    width: ${theme.eui.euiBreakpoints.m};
+    width: ${theme.eui.euiBreakpoints.l};
+    max-width: ${theme.eui.euiBreakpoints.l};
   `}
 `;
 
@@ -211,7 +212,11 @@ export const EditExceptionModal = memo(function EditExceptionModal({
     <EuiOverlayMask onClick={onCancel}>
       <Modal onClose={onCancel} data-test-subj="add-exception-modal">
         <ModalHeader>
-          <EuiModalHeaderTitle>{i18n.EDIT_EXCEPTION_TITLE}</EuiModalHeaderTitle>
+          <EuiModalHeaderTitle>
+            {exceptionListType === 'endpoint'
+              ? i18n.EDIT_ENDPOINT_EXCEPTION_TITLE
+              : i18n.EDIT_EXCEPTION_TITLE}
+          </EuiModalHeaderTitle>
           <ModalHeaderSubtitle className="eui-textTruncate" title={ruleName}>
             {ruleName}
           </ModalHeaderSubtitle>
@@ -243,13 +248,6 @@ export const EditExceptionModal = memo(function EditExceptionModal({
 
               <EuiSpacer />
 
-              {exceptionListType === 'endpoint' && (
-                <>
-                  <EuiText size="s">{i18n.ENDPOINT_QUARANTINE_TEXT}</EuiText>
-                  <EuiSpacer />
-                </>
-              )}
-
               <AddExceptionComments
                 exceptionItemComments={exceptionItem.comments}
                 newCommentValue={comment}
@@ -269,6 +267,14 @@ export const EditExceptionModal = memo(function EditExceptionModal({
                   disabled={shouldDisableBulkClose}
                 />
               </EuiFormRow>
+              {exceptionListType === 'endpoint' && (
+                <>
+                  <EuiSpacer />
+                  <EuiText color="subdued" size="s">
+                    {i18n.ENDPOINT_QUARANTINE_TEXT}
+                  </EuiText>
+                </>
+              )}
             </ModalBodySection>
           </>
         )}

x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/translations.ts

@@ -24,6 +24,13 @@ export const EDIT_EXCEPTION_TITLE = i18n.translate(
   }
 );
 
+export const EDIT_ENDPOINT_EXCEPTION_TITLE = i18n.translate(
+  'xpack.securitySolution.exceptions.editException.editEndpointExceptionTitle',
+  {
+    defaultMessage: 'Edit Endpoint Exception',
+  }
+);
+
 export const EDIT_EXCEPTION_ERROR = i18n.translate(
   'xpack.securitySolution.exceptions.editException.error',
   {
@@ -41,7 +48,8 @@ export const EDIT_EXCEPTION_SUCCESS = i18n.translate(
 export const BULK_CLOSE_LABEL = i18n.translate(
   'xpack.securitySolution.exceptions.editException.bulkCloseLabel',
   {
-    defaultMessage: 'Close all alerts that match attributes in this exception',
+    defaultMessage:
+      'Close all alerts that match this exception, including alerts generated by other rules',
   }
 );
 
@@ -57,7 +65,7 @@ export const ENDPOINT_QUARANTINE_TEXT = i18n.translate(
   'xpack.securitySolution.exceptions.editException.endpointQuarantineText',
   {
     defaultMessage:
-      'Any file in quarantine on any endpoint that matches the attribute(s) selected will automatically be restored to its original location',
+      'Any file in quarantine on any endpoint that matches the attribute(s) selected will automatically be restored to its original location. This exception will apply to any rule that is linked to the Global Endpoint Exception List.',
   }
 );
 

x-pack/plugins/security_solution/public/common/components/exceptions/exceptionable_fields.json

@@ -7,32 +7,40 @@
   "Target.process.Ext.services",
   "Target.process.Ext.user",
   "Target.process.command_line",
+  "Target.process.command_line.text",
   "Target.process.executable",
+  "Target.process.executable.text",
   "Target.process.hash.md5",
   "Target.process.hash.sha1",
   "Target.process.hash.sha256",
   "Target.process.hash.sha512",
   "Target.process.name",
+  "Target.process.name.text",
   "Target.process.parent.Ext.code_signature.status",
   "Target.process.parent.Ext.code_signature.subject_name",
   "Target.process.parent.Ext.code_signature.trusted",
   "Target.process.parent.Ext.code_signature.valid",
   "Target.process.parent.command_line",
+  "Target.process.parent.command_line.text",
   "Target.process.parent.executable",
+  "Target.process.parent.executable.text",
   "Target.process.parent.hash.md5",
   "Target.process.parent.hash.sha1",
   "Target.process.parent.hash.sha256",
   "Target.process.parent.hash.sha512",
   "Target.process.parent.name",
+  "Target.process.parent.name.text",
   "Target.process.parent.pgid",
   "Target.process.parent.working_directory",
+  "Target.process.parent.working_directory.text",
   "Target.process.pe.company",
   "Target.process.pe.description",
   "Target.process.pe.file_version",
   "Target.process.pe.original_file_name",
   "Target.process.pe.product",
   "Target.process.pgid",
   "Target.process.working_directory",
+  "Target.process.working_directory.text",
   "agent.id",
   "agent.type",
   "agent.version",
@@ -67,13 +75,15 @@
   "file.name",
   "file.owner",
   "file.path",
+  "file.path.text",
   "file.pe.company",
   "file.pe.description",
   "file.pe.file_version",
   "file.pe.original_file_name",
   "file.pe.product",
   "file.size",
   "file.target_path",
+  "file.target_path.text",
   "file.type",
   "file.uid",
   "group.Ext.real.id",
@@ -85,8 +95,10 @@
   "host.os.Ext.variant",
   "host.os.family",
   "host.os.full",
+  "host.os.full.text",
   "host.os.kernel",
   "host.os.name",
+  "host.os.name.text",
   "host.os.platform",
   "host.os.version",
   "host.type",
@@ -97,31 +109,39 @@
   "process.Ext.services",
   "process.Ext.user",
   "process.command_line",
+  "process.command_line.text",
   "process.executable",
+  "process.executable.text",
   "process.hash.md5",
   "process.hash.sha1",
   "process.hash.sha256",
   "process.hash.sha512",
   "process.name",
+  "process.name.text",
   "process.parent.Ext.code_signature.status",
   "process.parent.Ext.code_signature.subject_name",
   "process.parent.Ext.code_signature.trusted",
   "process.parent.Ext.code_signature.valid",
   "process.parent.command_line",
+  "process.parent.command_line.text",
   "process.parent.executable",
+  "process.parent.executable.text",
   "process.parent.hash.md5",
   "process.parent.hash.sha1",
   "process.parent.hash.sha256",
   "process.parent.hash.sha512",
   "process.parent.name",
+  "process.parent.name.text",
   "process.parent.pgid",
   "process.parent.working_directory",
+  "process.parent.working_directory.text",
   "process.pe.company",
   "process.pe.description",
   "process.pe.file_version",
   "process.pe.original_file_name",
   "process.pe.product",
   "process.pgid",
   "process.working_directory",
+  "process.working_directory.text",
   "rule.uuid"
 ]

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

@@ -440,7 +440,7 @@ export const defaultEndpointExceptionItems = (
           ],
         },
         {
-          field: 'file.path',
+          field: 'file.path.text',
           operator: 'included',
           type: 'match',
           value: filePath ?? '',

x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx

@@ -36,7 +36,7 @@ import { alertsHistogramOptions } from '../../components/alerts_histogram_panel/
 import { useUserInfo } from '../../components/user_info';
 import { EVENTS_VIEWER_HEADER_HEIGHT } from '../../../common/components/events_viewer/events_viewer';
 import { OverviewEmpty } from '../../../overview/components/overview_empty';
-import { DetectionEngineNoIndex } from './detection_engine_no_signal_index';
+import { DetectionEngineNoIndex } from './detection_engine_no_index';
 import { DetectionEngineHeaderPage } from '../../components/detection_engine_header_page';
 import { useListsConfig } from '../../containers/detection_engine/lists/use_lists_config';
 import { DetectionEngineUserUnauthenticated } from './detection_engine_user_unauthenticated';
@@ -144,7 +144,10 @@ export const DetectionEnginePageComponent: React.FC<PropsFromRedux> = ({
     return (
       <WrapperPage>
         <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
-        <DetectionEngineNoIndex />
+        <DetectionEngineNoIndex
+          needsSignalsIndex={isSignalIndexExists === false}
+          needsListsIndex={needsListsConfiguration}
+        />
       </WrapperPage>
     );
   }

x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.test.tsx → x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_index.test.tsx

@@ -7,12 +7,14 @@
 import React from 'react';
 import { shallow } from 'enzyme';
 
-import { DetectionEngineNoIndex } from './detection_engine_no_signal_index';
+import { DetectionEngineNoIndex } from './detection_engine_no_index';
 jest.mock('../../../common/lib/kibana');
 
 describe('DetectionEngineNoIndex', () => {
   it('renders correctly', () => {
-    const wrapper = shallow(<DetectionEngineNoIndex />);
+    const wrapper = shallow(
+      <DetectionEngineNoIndex needsSignalsIndex={true} needsListsIndex={false} />
+    );
 
     expect(wrapper.find('EmptyPage')).toHaveLength(1);
   });