[Security Solution] [Detections] Display rule type query text for non…

…-custom query rule types (#178821) ## Summary Ref: #174581 Fixes UI bug where "Custom query" would be displayed instead of the actual rule type of "EQL Query" or "ESQL Query" --------- Co-authored-by: Vitalii Dmyterko <[email protected]>
elastic · Mar 19, 2024 · 28c9753 · 28c9753
1 parent 674a750
commit 28c9753
Show file tree

Hide file tree

Showing 4 changed files with 72 additions and 0 deletions.
diff --git a/...ion/public/detection_engine/rule_creation_ui/components/description_step/helpers.test.tsx b/...ion/public/detection_engine/rule_creation_ui/components/description_step/helpers.test.tsx
@@ -28,6 +28,7 @@ import {
   buildNoteDescription,
   buildRuleTypeDescription,
   buildHighlightedFieldsOverrideDescription,
+  getQueryLabel,
 } from './helpers';
 import type { ListItems } from './types';
 
@@ -533,4 +534,35 @@ describe('helpers', () => {
       expect(result).toHaveLength(0);
     });
   });
+
+  describe('getQueryLabel', () => {
+    test('returns query label for unknown rule type', () => {
+      const label = getQueryLabel(undefined);
+      expect(label).toEqual(i18n.QUERY_LABEL);
+    });
+    test('returns query label for query rule type', () => {
+      const label = getQueryLabel('query');
+      expect(label).toEqual(i18n.QUERY_LABEL);
+    });
+    test('returns query label for eql rule type', () => {
+      const label = getQueryLabel('eql');
+      expect(label).toEqual(i18n.EQL_QUERY_LABEL);
+    });
+    test('returns query label for saved_query rule type', () => {
+      const label = getQueryLabel('saved_query');
+      expect(label).toEqual(i18n.SAVED_QUERY_LABEL);
+    });
+    test('returns query label for threshold rule type', () => {
+      const label = getQueryLabel('threshold');
+      expect(label).toEqual(i18n.QUERY_LABEL);
+    });
+    test('returns query label for new_terms rule type', () => {
+      const label = getQueryLabel('new_terms');
+      expect(label).toEqual(i18n.QUERY_LABEL);
+    });
+    test('returns query label for esql rule type', () => {
+      const label = getQueryLabel('esql');
+      expect(label).toEqual(i18n.ESQL_QUERY_LABEL);
+    });
+  });
 });
diff --git a/...solution/public/detection_engine/rule_creation_ui/components/description_step/helpers.tsx b/...solution/public/detection_engine/rule_creation_ui/components/description_step/helpers.tsx
@@ -69,6 +69,19 @@ const Query = styled.div`
   white-space: pre-wrap;
 `;
 
+export const getQueryLabel = (ruleType: Type | undefined): string => {
+  switch (ruleType) {
+    case 'eql':
+      return i18n.EQL_QUERY_LABEL;
+    case 'saved_query':
+      return i18n.SAVED_QUERY_LABEL;
+    case 'esql':
+      return i18n.ESQL_QUERY_LABEL;
+    default:
+      return i18n.QUERY_LABEL;
+  }
+};
+
 export const buildQueryBarDescription = ({
   field,
   filters,

diff --git a/...ution/public/detection_engine/rule_creation_ui/components/description_step/index.test.tsx b/...ution/public/detection_engine/rule_creation_ui/components/description_step/index.test.tsx
@@ -331,6 +331,29 @@ describe('description_step', () => {
           mockQueryBar.queryBar.query.query
         );
       });
+
+      test('returns correct field name when queryBar exist', () => {
+        const mockQueryBar = {
+          ruleType: 'eql',
+          queryBar: {
+            query: {
+              query: 'user.name: root or user.name: admin',
+              language: 'kuery',
+            },
+            filters: null,
+            saved_id: null,
+          },
+        };
+        const result: ListItems[] = getDescriptionItem(
+          'queryBar',
+          'Query bar label',
+          mockQueryBar,
+          mockFilterManager,
+          mockLicenseService
+        );
+
+        expect(result[0].title).toEqual(<>{i18n.EQL_QUERY_LABEL}</>);
+      });
     });
 
     describe('threat', () => {

diff --git a/...y_solution/public/detection_engine/rule_creation_ui/components/description_step/index.tsx b/...y_solution/public/detection_engine/rule_creation_ui/components/description_step/index.tsx
@@ -47,6 +47,7 @@ import {
   buildAlertSuppressionWindowDescription,
   buildAlertSuppressionMissingFieldsDescription,
   buildHighlightedFieldsOverrideDescription,
+  getQueryLabel,
 } from './helpers';
 import * as i18n from './translations';
 import { buildMlJobsDescription } from './build_ml_jobs_description';
@@ -200,11 +201,14 @@ export const getDescriptionItem = (
     const query = get('queryBar.query.query', data);
     const savedId = get('queryBar.saved_id', data);
     const savedQueryName = get('queryBar.title', data);
+    const ruleType: Type = get('ruleType', data);
+    const queryLabel = getQueryLabel(ruleType);
     return buildQueryBarDescription({
       field,
       filters,
       filterManager,
       query,
+      queryLabel,
       savedId,
       savedQueryName,
       indexPatterns,