dns histogram

x-pack/plugins/security_solution/public/common/components/matrix_histogram/index.tsx

@@ -235,6 +235,10 @@ export const MatrixHistogramComponent: React.FC<MatrixHistogramComponentProps> =
   ]);
 
   const timerange = useMemo(() => ({ from: startDate, to: endDate }), [startDate, endDate]);
+  const extraVisualizationOptions = useMemo(
+    () => ({ dnsIsPtrIncluded: isPtrIncluded ?? false }),
+    [isPtrIncluded]
+  );
   if (hideHistogram) {
     return null;
   }
@@ -310,6 +314,7 @@ export const MatrixHistogramComponent: React.FC<MatrixHistogramComponentProps> =
                 lensAttributes={lensAttributes}
                 stackByField={selectedStackByOption.value}
                 timerange={timerange}
+                extraOptions={extraVisualizationOptions}
               />
             ) : (
               <MatrixHistogramChartContent

x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/network/dns_top_domains.test.ts

@@ -5,12 +5,14 @@
  * 2.0.
  */
 
+import type { RenderResult } from '@testing-library/react-hooks';
 import { renderHook } from '@testing-library/react-hooks';
 import { wrapper } from '../../mocks';
+import type { LensAttributes } from '../../types';
 
 import { useLensAttributes } from '../../use_lens_attributes';
 
-import { dnsTopDomainsLensAttributes } from './dns_top_domains';
+import { getDnsTopDomainsLensAttributes } from './dns_top_domains';
 
 jest.mock('../../../../containers/sourcerer', () => ({
   useSourcererDataView: jest.fn().mockReturnValue({
@@ -30,17 +32,129 @@ jest.mock('../../../../utils/route/use_route_spy', () => ({
   ]),
 }));
 
-describe('dnsTopDomainsLensAttributes', () => {
-  it('should render', () => {
-    const { result } = renderHook(
+describe('getDnsTopDomainsLensAttributes', () => {
+  let result: RenderResult<LensAttributes | null>;
+  const render = () => {
+    const hookRenderResponse = renderHook(
       () =>
         useLensAttributes({
-          lensAttributes: dnsTopDomainsLensAttributes,
+          getLensAttributes: getDnsTopDomainsLensAttributes,
           stackByField: 'event.dataset',
         }),
       { wrapper }
     );
-
+    return hookRenderResponse.result;
+  };
+  beforeAll(() => {
+    result = render();
+  });
+  it('should render', () => {
     expect(result?.current).toMatchSnapshot();
   });
+  it('should EXCLUDE PTR record by default', () => {
+    expect(result?.current?.state.filters[0]).toEqual(
+      expect.objectContaining({
+        meta: {
+          alias: null,
+          disabled: false,
+          indexRefName: 'filter-index-pattern-0',
+          key: 'dns.question.type',
+          negate: true,
+          params: {
+            query: 'PTR',
+          },
+          type: 'phrase',
+        },
+        query: {
+          match_phrase: {
+            'dns.question.type': 'PTR',
+          },
+        },
+      })
+    );
+  });
+  it('should add network details filter if detail name is available', () => {
+    expect(result?.current?.state.filters[1]).toEqual(
+      expect.objectContaining({
+        query: {
+          bool: {
+            minimum_should_match: 1,
+            should: [
+              {
+                match_phrase: {
+                  'source.ip': '192.168.1.1',
+                },
+              },
+              {
+                match_phrase: {
+                  'destination.ip': '192.168.1.1',
+                },
+              },
+            ],
+          },
+        },
+      })
+    );
+  });
+  it('should add tab filter if it is on event tab', () => {
+    expect(result?.current?.state.filters[2]).toEqual(
+      expect.objectContaining({
+        query: {
+          bool: {
+            minimum_should_match: 1,
+            should: [
+              {
+                exists: {
+                  field: 'source.ip',
+                },
+              },
+              {
+                exists: {
+                  field: 'destination.ip',
+                },
+              },
+            ],
+          },
+        },
+      })
+    );
+  });
+  it('should add index filter', () => {
+    expect(result?.current?.state.filters[3]).toEqual(
+      expect.objectContaining({
+        query: {
+          bool: {
+            minimum_should_match: 1,
+            should: [
+              {
+                match_phrase: {
+                  _index: 'auditbeat-mytest-*',
+                },
+              },
+            ],
+          },
+        },
+      })
+    );
+  });
+  it('should add filters from global search bar', () => {
+    expect(result?.current?.state.filters[4]).toEqual(
+      expect.objectContaining({
+        query: {
+          match_phrase: {
+            'host.id': '123',
+          },
+        },
+      })
+    );
+  });
+
+  it('should add query from global search bar', () => {
+    expect(result?.current?.state.query).toMatchInlineSnapshot(`
+      Object {
+        "language": "kql",
+        "query": "host.name: *",
+      }
+    `);
+  });
 });