fix coverage overview activity filter

elastic · Aug 14, 2023 · 238c65f · 238c65f
1 parent 6e241a8
commit 238c65f
Show file tree

Hide file tree

Showing 2 changed files with 53 additions and 5 deletions.
diff --git a/...on_engine/rule_management/api/rules/coverage_overview/handle_coverage_overview_request.ts b/...on_engine/rule_management/api/rules/coverage_overview/handle_coverage_overview_request.ts
@@ -33,16 +33,19 @@ export async function handleCoverageOverviewRequest({
   params: { filter },
   deps: { rulesClient },
 }: HandleCoverageOverviewRequestArgs): Promise<CoverageOverviewResponse> {
+  const activitySet = new Set(filter?.activity);
   const kqlFilter = filter
     ? convertRulesFilterToKQL({
         filter: filter.search_term,
         showCustomRules: filter.source?.includes(CoverageOverviewRuleSource.Custom) ?? false,
         showElasticRules: filter.source?.includes(CoverageOverviewRuleSource.Prebuilt) ?? false,
-        enabled: filter.activity?.includes(CoverageOverviewRuleActivity.Disabled)
-          ? false
-          : filter.activity?.includes(CoverageOverviewRuleActivity.Enabled)
-          ? true
-          : undefined,
+        enabled:
+          (activitySet.has(CoverageOverviewRuleActivity.Enabled) &&
+            activitySet.has(CoverageOverviewRuleActivity.Disabled)) ||
+          (!activitySet.has(CoverageOverviewRuleActivity.Enabled) &&
+            !activitySet.has(CoverageOverviewRuleActivity.Disabled))
+            ? undefined
+            : activitySet.has(CoverageOverviewRuleActivity.Enabled),
       })
     : undefined;
 

diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/coverage_overview.ts b/x-pack/test/detection_engine_api_integration/basic/tests/coverage_overview.ts
@@ -341,6 +341,51 @@ export default ({ getService }: FtrProviderContext): void => {
             },
           });
         });
+
+        it('returns response filtered by enabled and disabled rules equal to response if enabled and disabled are not set', async () => {
+          const expectedRule1 = await createRule(supertest, log, {
+            ...getSimpleRule('rule-1'),
+            name: 'Disabled rule',
+            threat: generateThreatArray(1),
+          });
+          const expectedRule2 = await createRule(supertest, log, {
+            ...getSimpleRule('rule-2', true),
+            name: 'Enabled rule',
+            threat: generateThreatArray(2),
+          });
+
+          const { body } = await supertest
+            .post(RULE_MANAGEMENT_COVERAGE_OVERVIEW_URL)
+            .set('kbn-xsrf', 'true')
+            .send({
+              filter: {
+                activity: ['enabled', 'disabled'],
+              },
+            })
+            .expect(200);
+
+          expect(body).to.eql({
+            coverage: {
+              T001: [expectedRule1.id],
+              TA001: [expectedRule1.id],
+              'T001.001': [expectedRule1.id],
+              T002: [expectedRule2.id],
+              TA002: [expectedRule2.id],
+              'T002.002': [expectedRule2.id],
+            },
+            unmapped_rule_ids: [],
+            rules_data: {
+              [expectedRule1.id]: {
+                activity: 'disabled',
+                name: 'Disabled rule',
+              },
+              [expectedRule2.id]: {
+                activity: 'enabled',
+                name: 'Enabled rule',
+              },
+            },
+          });
+        });
       });
 
       describe('source', () => {