cleanup

x-pack/plugins/osquery/common/schemas/routes/action/create_action_request_body_schema.ts

@@ -17,7 +17,7 @@ import {
 export const createActionRequestBodySchema = t.type({
   agentSelection,
   query,
-  savedQueryId: savedQueryIdOrUndefined,
+  saved_query_id: savedQueryIdOrUndefined,
   ecs_mapping: ecsMappingOrUndefined,
 });
 

x-pack/plugins/osquery/public/actions/actions_table.tsx

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { isArray } from 'lodash';
+import { isArray, pickBy } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { EuiBasicTable, EuiButtonIcon, EuiCodeBlock, formatDate } from '@elastic/eui';
 import React, { useState, useCallback, useMemo } from 'react';
@@ -72,9 +72,12 @@ const ActionsTableComponent = () => {
   const handlePlayClick = useCallback(
     (item) =>
       push('/live_queries/new', {
-        form: {
-          query: item._source?.data?.query,
-        },
+        form: pickBy({
+          agentIds: item.fields.agents,
+          query: item._source.data.query,
+          ecs_mapping: item._source.data.ecs_mapping,
+          savedQueryId: item._source.data.saved_query_id,
+        }),
       }),
     [push]
   );

x-pack/plugins/osquery/public/actions/use_action_details.ts

@@ -62,7 +62,6 @@ export const useActionDetails = ({ actionId, filterQuery, skip = false }: UseAct
             defaultMessage: 'Error while fetching action details',
           }),
         }),
-
       retryDelay: 1000,
     }
   );

x-pack/plugins/osquery/public/agents/agents_table.tsx

@@ -65,15 +65,16 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
     loading: groupsLoading,
     totalCount: totalNumAgents,
     groups,
+    isFetched: groupsFetched,
   } = useAgentGroups(osqueryPolicyData);
   const grouper = useMemo(() => new AgentGrouper(), []);
-  const { isLoading: agentsLoading, data: agents } = useAllAgents(
-    osqueryPolicyData,
-    debouncedSearchValue,
-    {
-      perPage,
-    }
-  );
+  const {
+    isLoading: agentsLoading,
+    data: agents,
+    isFetched: agentsFetched,
+  } = useAllAgents(osqueryPolicyData, debouncedSearchValue, {
+    perPage,
+  });
 
   // option related
   const [options, setOptions] = useState<GroupOption[]>([]);
@@ -97,7 +98,8 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
 
         if (policyOptions) {
           const defaultOptions = policyOptions.options?.filter((option) =>
-            agentSelection.policiesSelected.includes(option.label)
+            // @ts-expect-error update types
+            agentSelection.policiesSelected.includes(option.key)
           );
 
           if (defaultOptions?.length) {
@@ -110,15 +112,26 @@ const AgentsTableComponent: React.FC<AgentsTableProps> = ({ agentSelection, onCh
   }, [agentSelection, options, selectedOptions]);
 
   useEffect(() => {
-    // update the groups when groups or agents have changed
-    grouper.setTotalAgents(totalNumAgents);
-    grouper.updateGroup(AGENT_GROUP_KEY.Platform, groups.platforms);
-    grouper.updateGroup(AGENT_GROUP_KEY.Policy, groups.policies);
-    // @ts-expect-error update types
-    grouper.updateGroup(AGENT_GROUP_KEY.Agent, agents);
-    const newOptions = grouper.generateOptions();
-    setOptions(newOptions);
-  }, [groups.platforms, groups.policies, totalNumAgents, groupsLoading, agents, grouper]);
+    if (agentsFetched && groupsFetched) {
+      // update the groups when groups or agents have changed
+      grouper.setTotalAgents(totalNumAgents);
+      grouper.updateGroup(AGENT_GROUP_KEY.Platform, groups.platforms);
+      grouper.updateGroup(AGENT_GROUP_KEY.Policy, groups.policies);
+      // @ts-expect-error update types
+      grouper.updateGroup(AGENT_GROUP_KEY.Agent, agents);
+      const newOptions = grouper.generateOptions();
+      setOptions(newOptions);
+    }
+  }, [
+    groups.platforms,
+    groups.policies,
+    totalNumAgents,
+    groupsLoading,
+    agents,
+    agentsFetched,
+    groupsFetched,
+    grouper,
+  ]);
 
   const onSelection = useCallback(
     (selection: GroupOption[]) => {

x-pack/plugins/osquery/public/agents/use_agent_groups.ts

@@ -35,7 +35,7 @@ export const useAgentGroups = ({ osqueryPolicies, osqueryPoliciesLoading }: UseA
   const [loading, setLoading] = useState(true);
   const [overlap, setOverlap] = useState<Overlap>(() => ({}));
   const [totalCount, setTotalCount] = useState<number>(0);
-  useQuery(
+  const { isFetched } = useQuery(
     ['agentGroups'],
     async () => {
       const responseData = await data.search
@@ -110,6 +110,7 @@ export const useAgentGroups = ({ osqueryPolicies, osqueryPoliciesLoading }: UseA
   );
 
   return {
+    isFetched,
     loading,
     totalCount,
     groups: {

x-pack/plugins/osquery/public/live_queries/form/index.tsx

@@ -93,6 +93,16 @@ const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({
   );
 
   const formSchema = {
+    agentSelection: {
+      defaultValue: {
+        agents: [],
+        allAgentsSelected: false,
+        platformsSelected: [],
+        policiesSelected: [],
+      },
+      type: FIELD_TYPES.JSON,
+      validations: [],
+    },
     savedQueryId: {
       type: FIELD_TYPES.TEXT,
       validations: [],
@@ -196,7 +206,7 @@ const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({
     (savedQuery) => {
       if (savedQuery) {
         setFieldValue('query', savedQuery.query);
-        setFieldValue('savedQueryId', savedQuery.id);
+        setFieldValue('savedQueryId', savedQuery.savedQueryId);
         if (!isEmpty(savedQuery.ecs_mapping)) {
           setFieldValue('ecs_mapping', savedQuery.ecs_mapping);
           setAdvancedContentState('open');
@@ -222,6 +232,13 @@ const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({
     setAdvancedContentState(newState);
   }, []);
 
+  const ecsFieldProps = useMemo(
+    () => ({
+      isDisabled: !permissions.writeSavedQueries,
+    }),
+    [permissions.writeSavedQueries]
+  );
+
   const queryFieldStepContent = useMemo(
     () => (
       <>
@@ -249,6 +266,7 @@ const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({
             component={ECSMappingEditorField}
             query={query}
             fieldRef={ecsFieldRef}
+            euiFieldProps={ecsFieldProps}
           />
         </StyledEuiAccordion>
         <EuiSpacer />
@@ -293,6 +311,7 @@ const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({
       advancedContentState,
       handleToggle,
       query,
+      ecsFieldProps,
       singleAgentMode,
       agentSelected,
       queryValueProvided,

x-pack/plugins/osquery/public/live_queries/index.tsx

@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { castArray } from 'lodash';
 import { EuiCode, EuiLoadingContent, EuiEmptyPrompt } from '@elastic/eui';
 import React, { useMemo } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -16,34 +17,43 @@ import { OsqueryIcon } from '../components/osquery_icon';
 
 interface LiveQueryProps {
   agentId?: string;
-  agentPolicyId?: string;
+  agentIds?: string[];
+  agentPolicyIds?: string[];
   onSuccess?: () => void;
   query?: string;
+  savedQueryId?: string;
+  ecs_mapping?: unknown;
 }
 
 const LiveQueryComponent: React.FC<LiveQueryProps> = ({
   agentId,
-  agentPolicyId,
+  agentIds,
+  agentPolicyIds,
   onSuccess,
   query,
+  savedQueryId,
+  // eslint-disable-next-line @typescript-eslint/naming-convention
+  ecs_mapping,
 }) => {
   const { data: hasActionResultsPrivileges, isFetched } = useActionResultsPrivileges();
 
   const defaultValue = useMemo(() => {
-    if (agentId || agentPolicyId || query) {
+    if (agentId || agentPolicyIds || query) {
       return {
         agentSelection: {
           allAgentsSelected: false,
-          agents: agentId ? [agentId] : [],
+          agents: castArray(agentId ?? agentIds ?? []),
           platformsSelected: [],
-          policiesSelected: agentPolicyId ? [agentPolicyId] : [],
+          policiesSelected: agentPolicyIds ?? [],
         },
         query,
+        savedQueryId,
+        ecs_mapping,
       };
     }
 
     return undefined;
-  }, [agentId, agentPolicyId, query]);
+  }, [agentId, agentIds, agentPolicyIds, ecs_mapping, query, savedQueryId]);
 
   if (!isFetched) {
     return <EuiLoadingContent lines={10} />;

x-pack/plugins/osquery/public/packs/form/index.tsx

@@ -37,6 +37,7 @@ import { useAgentPolicies } from '../../agent_policies';
 import { useCreatePack } from '../use_create_pack';
 import { useUpdatePack } from '../use_update_pack';
 import { convertPackQueriesToSO, convertSOQueriesToPack } from './utils';
+import { idSchemaValidation } from '../queries/validations';
 
 const GhostFormField = () => <></>;
 
@@ -82,6 +83,9 @@ const PackFormComponent: React.FC<PackFormProps> = ({ defaultValue, editMode = f
           defaultMessage: 'Name',
         }),
         validations: [
+          {
+            validator: idSchemaValidation,
+          },
           {
             validator: fieldValidators.emptyField(
               i18n.translate('xpack.osquery.pack.form.nameFieldRequiredErrorMessage', {