From 4b1cd6d63577de62c37e0acc4f406d8d7c21a65a Mon Sep 17 00:00:00 2001
From: Steph Milovic <stephanie.milovic@elastic.co>
Date: Fri, 16 Oct 2020 10:25:24 -0600
Subject: [PATCH] [Security Solution] [Maps] Kibana index pattern, comma bug
 fix (#80208) (#80769)

---
 .../components/embeddables/__mocks__/mock.ts  | 27 ++++++++++++
 .../embeddables/embedded_map_helpers.test.tsx | 44 ++++++++++++++++++-
 .../embeddables/embedded_map_helpers.tsx      | 10 ++++-
 3 files changed, 79 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/__mocks__/mock.ts b/x-pack/plugins/security_solution/public/network/components/embeddables/__mocks__/mock.ts
index 6f8c3e1123854..d2f482c320002 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/__mocks__/mock.ts
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/__mocks__/mock.ts
@@ -484,3 +484,30 @@ export const mockCCSGlobIndexPattern: IndexPatternSavedObject = {
     title: '*:*',
   },
 };
+
+export const mockCommaFilebeatAuditbeatGlobIndexPattern: IndexPatternSavedObject = {
+  id: 'filebeat-*,auditbeat-*',
+  type: 'index-pattern',
+  _version: 'abc',
+  attributes: {
+    title: 'filebeat-*,auditbeat-*',
+  },
+};
+
+export const mockCommaFilebeatAuditbeatCCSGlobIndexPattern: IndexPatternSavedObject = {
+  id: '*:filebeat-*,*:auditbeat-*',
+  type: 'index-pattern',
+  _version: 'abc',
+  attributes: {
+    title: '*:filebeat-*,*:auditbeat-*',
+  },
+};
+
+export const mockCommaFilebeatExclusionGlobIndexPattern: IndexPatternSavedObject = {
+  id: 'filebeat-*,-filebeat-7.6.0*',
+  type: 'index-pattern',
+  _version: 'abc',
+  attributes: {
+    title: 'filebeat-*,-filebeat-7.6.0*',
+  },
+};
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.test.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.test.tsx
index 0c6b90ec2b9dd..c503690e776af 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.test.tsx
@@ -12,9 +12,12 @@ import {
   mockAPMRegexIndexPattern,
   mockAPMTransactionIndexPattern,
   mockAuditbeatIndexPattern,
+  mockCCSGlobIndexPattern,
+  mockCommaFilebeatAuditbeatCCSGlobIndexPattern,
+  mockCommaFilebeatAuditbeatGlobIndexPattern,
+  mockCommaFilebeatExclusionGlobIndexPattern,
   mockFilebeatIndexPattern,
   mockGlobIndexPattern,
-  mockCCSGlobIndexPattern,
 } from './__mocks__/mock';
 
 const mockEmbeddable = embeddablePluginMock.createStartContract();
@@ -122,5 +125,44 @@ describe('embedded_map_helpers', () => {
       });
       expect(matchingIndexPatterns).toEqual([mockFilebeatIndexPattern]);
     });
+
+    test('matches on comma separated Kibana index pattern', () => {
+      const matchingIndexPatterns = findMatchingIndexPatterns({
+        kibanaIndexPatterns: [
+          mockCommaFilebeatAuditbeatGlobIndexPattern,
+          mockAuditbeatIndexPattern,
+        ],
+        siemDefaultIndices,
+      });
+      expect(matchingIndexPatterns).toEqual([
+        mockCommaFilebeatAuditbeatGlobIndexPattern,
+        mockAuditbeatIndexPattern,
+      ]);
+    });
+
+    test('matches on excluded comma separated Kibana index pattern', () => {
+      const matchingIndexPatterns = findMatchingIndexPatterns({
+        kibanaIndexPatterns: [
+          mockCommaFilebeatExclusionGlobIndexPattern,
+          mockAuditbeatIndexPattern,
+        ],
+        siemDefaultIndices,
+      });
+      expect(matchingIndexPatterns).toEqual([
+        mockCommaFilebeatExclusionGlobIndexPattern,
+        mockAuditbeatIndexPattern,
+      ]);
+    });
+
+    test('matches on CCS comma separated Kibana index pattern', () => {
+      const matchingIndexPatterns = findMatchingIndexPatterns({
+        kibanaIndexPatterns: [
+          mockCommaFilebeatAuditbeatCCSGlobIndexPattern,
+          mockAuditbeatIndexPattern,
+        ],
+        siemDefaultIndices: ['cluster2:filebeat-*', 'cluster1:auditbeat-*'],
+      });
+      expect(matchingIndexPatterns).toEqual([mockCommaFilebeatAuditbeatCCSGlobIndexPattern]);
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.tsx
index 25928197590ea..4ac759ea534ec 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.tsx
@@ -150,7 +150,15 @@ export const findMatchingIndexPatterns = ({
       const pattern = kip.attributes.title;
       return (
         !ignoredIndexPatterns.includes(pattern) &&
-        siemDefaultIndices.some((sdi) => minimatch(sdi, pattern))
+        siemDefaultIndices.some((sdi) => {
+          const splitPattern = pattern.split(',') ?? [];
+          return splitPattern.length > 1
+            ? splitPattern.some((p) => {
+                const isMatch = minimatch(sdi, p);
+                return isMatch && p.charAt(0) === '-' ? false : isMatch;
+              })
+            : minimatch(sdi, pattern);
+        })
       );
     });
   } catch {