Use RuleDataReader to query for threshold signal history (#129763)

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts

@@ -261,6 +261,7 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
                   tuple,
                   wrapHits,
                   wrapSequences,
+                  ruleDataReader: ruleDataClient.getReader({ namespace: options.spaceId }),
                 },
               });
 

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/threshold/create_threshold_alert_type.ts

@@ -50,7 +50,15 @@ export const createThresholdAlertType = (
     producer: SERVER_APP_ID,
     async executor(execOptions) {
       const {
-        runOpts: { buildRuleMessage, bulkCreate, exceptionItems, completeRule, tuple, wrapHits },
+        runOpts: {
+          buildRuleMessage,
+          bulkCreate,
+          exceptionItems,
+          completeRule,
+          tuple,
+          wrapHits,
+          ruleDataReader,
+        },
         services,
         startedAt,
         state,
@@ -69,6 +77,7 @@ export const createThresholdAlertType = (
         tuple,
         version,
         wrapHits,
+        ruleDataReader,
       });
 
       return result;

x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts

@@ -18,7 +18,11 @@ import {
   WithoutReservedActionGroups,
 } from '../../../../../alerting/common';
 import { ListClient } from '../../../../../lists/server';
-import { PersistenceServices, IRuleDataClient } from '../../../../../rule_registry/server';
+import {
+  PersistenceServices,
+  IRuleDataClient,
+  IRuleDataReader,
+} from '../../../../../rule_registry/server';
 import { ConfigType } from '../../../config';
 import { SetupPlugins } from '../../../plugin';
 import { CompleteRule, RuleParams } from '../schemas/rule_schemas';
@@ -61,6 +65,7 @@ export interface RunOpts<TParams extends RuleParams> {
   };
   wrapHits: WrapHits;
   wrapSequences: WrapSequences;
+  ruleDataReader: IRuleDataReader;
 }
 
 export type SecurityAlertType<

x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/threshold.test.ts

@@ -18,6 +18,7 @@ import { buildRuleMessageFactory } from '../rule_messages';
 import { sampleEmptyDocSearchResults } from '../__mocks__/es_results';
 import { allowedExperimentalValues } from '../../../../../common/experimental_features';
 import { ThresholdRuleParams } from '../../schemas/rule_schemas';
+import { createRuleDataClientMock } from '../../../../../../rule_registry/server/rule_data_client/rule_data_client.mock';
 
 describe('threshold_executor', () => {
   const version = '8.0.0';
@@ -49,6 +50,7 @@ describe('threshold_executor', () => {
 
   describe('thresholdExecutor', () => {
     it('should set a warning when exception list for threshold rule contains value list exceptions', async () => {
+      const ruleDataClientMock = createRuleDataClientMock();
       const exceptionItems = [getExceptionListItemSchemaMock({ entries: [getEntryListMock()] })];
       const response = await thresholdExecutor({
         completeRule: thresholdCompleteRule,
@@ -69,6 +71,7 @@ describe('threshold_executor', () => {
           createdItems: [],
         })),
         wrapHits: jest.fn(),
+        ruleDataReader: ruleDataClientMock.getReader({ namespace: 'default' }),
       });
       expect(response.warningMessages.length).toEqual(1);
     });

x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/threshold.ts

@@ -41,6 +41,7 @@ import { BuildRuleMessage } from '../rule_messages';
 import { ExperimentalFeatures } from '../../../../../common/experimental_features';
 import { withSecuritySpan } from '../../../../utils/with_security_span';
 import { buildThresholdSignalHistory } from '../threshold/build_signal_history';
+import { IRuleDataReader } from '../../../../../../rule_registry/server';
 
 export const thresholdExecutor = async ({
   completeRule,
@@ -55,6 +56,7 @@ export const thresholdExecutor = async ({
   state,
   bulkCreate,
   wrapHits,
+  ruleDataReader,
 }: {
   completeRule: CompleteRule<ThresholdRuleParams>;
   tuple: RuleRangeTuple;
@@ -68,6 +70,7 @@ export const thresholdExecutor = async ({
   state: ThresholdAlertState;
   bulkCreate: BulkCreate;
   wrapHits: WrapHits;
+  ruleDataReader: IRuleDataReader;
 }): Promise<SearchAfterAndBulkCreateReturnType & { state: ThresholdAlertState }> => {
   let result = createSearchAfterReturnType();
   const ruleParams = completeRule.ruleParams;
@@ -77,15 +80,11 @@ export const thresholdExecutor = async ({
     const { signalHistory, searchErrors: previousSearchErrors } = state.initialized
       ? { signalHistory: state.signalHistory, searchErrors: [] }
       : await getThresholdSignalHistory({
-          indexPattern: ['*'], // TODO: get outputIndex?
           from: tuple.from.toISOString(),
           to: tuple.to.toISOString(),
-          services,
-          logger,
           ruleId: ruleParams.ruleId,
           bucketByFields: ruleParams.threshold.field,
-          timestampOverride: ruleParams.timestampOverride,
-          buildRuleMessage,
+          ruleDataReader,
         });
 
     if (!state.initialized) {

x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/get_threshold_signal_history.test.ts

@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { buildPreviousThresholdAlertRequest } from './get_threshold_signal_history';
+
+describe('buildPreviousThresholdAlertRequest', () => {
+  it('should generate a proper request when bucketByFields is empty', async () => {
+    const bucketByFields: string[] = [];
+    const to = 'now';
+    const from = 'now-6m';
+    const ruleId = 'threshold-rule';
+
+    expect(
+      buildPreviousThresholdAlertRequest({ from, to, ruleId, bucketByFields })
+    ).toMatchSnapshot();
+  });
+
+  it('should generate a proper request when bucketByFields contains multiple fields', async () => {
+    const bucketByFields: string[] = ['host.name', 'user.name'];
+    const to = 'now';
+    const from = 'now-6m';
+    const ruleId = 'threshold-rule';
+
+    expect(
+      buildPreviousThresholdAlertRequest({ from, to, ruleId, bucketByFields })
+    ).toMatchSnapshot();
+  });
+});