Skip to content

Commit

Permalink
clean
Browse files Browse the repository at this point in the history
  • Loading branch information
@stephmilovic
stephmilovic committed Feb 25, 2021
1 parent a410c1d commit 90ba99f
Show file tree
Hide file tree
Showing 2 changed files with 106 additions and 45 deletions.
120 changes: 86 additions & 34 deletions .../security_solution/server/search_strategy/timeline/factory/events/details/helpers.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ describe('Events Details Helpers', () => {
},
],
};
const mockReturn = [
const resultFields = [
{
category: 'event',
field: 'event.category',
Expand Down Expand Up @@ -256,8 +256,8 @@ describe('Events Details Helpers', () => {
{
category: 'threat',
field: 'threat.indicator.first_seen',
values: ['2021-02-22T17:29:25.195Z', '2021-02-22T17:29:25.195Z'],
originalValue: ['2021-02-22T17:29:25.195Z', '2021-02-22T17:29:25.195Z'],
values: ['2021-02-22T17:29:25.195Z'],
originalValue: ['2021-02-22T17:29:25.195Z'],
isObjectArray: false,
},
{
Expand All @@ -270,8 +270,8 @@ describe('Events Details Helpers', () => {
{
category: 'threat',
field: 'threat.indicator.type',
values: ['custom', 'custom'],
originalValue: ['custom', 'custom'],
values: ['custom'],
originalValue: ['custom'],
isObjectArray: false,
},
{
Expand Down Expand Up @@ -320,11 +320,11 @@ describe('Events Details Helpers', () => {
describe('#getDataFromFieldsHits', () => {
it('happy path', () => {
const result = getDataFromFieldsHits(fields);
expect(result).toEqual(mockReturn);
expect(result).toEqual(resultFields);
});
it('lets get weird', () => {
const whackFields = {
'threat.indicator': [
'crazy.pants': [
{
'matched.field': ['matched_field'],
first_seen: ['2021-02-22T17:29:25.195Z'],
Expand All @@ -339,13 +339,30 @@ describe('Events Details Helpers', () => {
lazer: [
{
cool: true,
lazer: [
{
lazer: [
{
lazer: [
{
lazer: [
{
whoa: false,
},
],
},
],
},
],
},
],
},
],
},
{
lazer: [
{
cool: true,
cool: false,
},
],
},
Expand All @@ -356,38 +373,73 @@ describe('Events Details Helpers', () => {
},
],
},
{
'matched.field': ['matched_field_2'],
first_seen: ['2021-02-22T17:29:25.195Z'],
provider: ['other_you'],
type: ['custom'],
'matched.atomic': ['matched_atomic_2'],
lazer: [
{
'great.field': [
{
wowoe: [
{
fooooo: ['grrrrr'],
},
],
astring: 'cool',
aNumber: 1,
anObject: {
neat: true,
},
},
],
},
],
},
],
};
const whackResultFields = [
{
category: 'crazy',
field: 'crazy.pants.matched.field',
values: ['matched_field'],
originalValue: ['matched_field'],
isObjectArray: false,
},
{
category: 'crazy',
field: 'crazy.pants.first_seen',
values: ['2021-02-22T17:29:25.195Z'],
originalValue: ['2021-02-22T17:29:25.195Z'],
isObjectArray: false,
},
{
category: 'crazy',
field: 'crazy.pants.provider',
values: ['yourself'],
originalValue: ['yourself'],
isObjectArray: false,
},
{
category: 'crazy',
field: 'crazy.pants.type',
values: ['custom'],
originalValue: ['custom'],
isObjectArray: false,
},
{
category: 'crazy',
field: 'crazy.pants.matched.atomic',
values: ['matched_atomic'],
originalValue: ['matched_atomic'],
isObjectArray: false,
},
{
category: 'crazy',
field: 'crazy.pants.lazer.great.field',
values: ['grrrrr', 'grrrrr_2'],
originalValue: ['grrrrr', 'grrrrr_2'],
isObjectArray: false,
},
{
category: 'crazy',
field: 'crazy.pants.lazer.lazer.lazer.cool',
values: ['true', 'false'],
originalValue: ['true', 'false'],
isObjectArray: false,
},
{
category: 'crazy',
field: 'crazy.pants.lazer.lazer.lazer.lazer.lazer.lazer.lazer.whoa',
values: ['false'],
originalValue: ['false'],
isObjectArray: false,
},
];
const result = getDataFromFieldsHits(whackFields);
expect(result).toEqual(whackResultFields);
});
});
it('#getDataFromFieldsHitsSafety', async () => {
const result = await getDataFromFieldsHitsSafety(fields);
expect(result).toEqual(mockReturn);
expect(result).toEqual(resultFields);
});
it('#getDataFromSourceHits', () => {
const _source: EventSource = {
Expand Down
31 changes: 20 additions & 11 deletions ...ugins/security_solution/server/search_strategy/timeline/factory/events/details/helpers.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -84,34 +84,43 @@ export const getDataFromFieldsHits = (
const objArrStr = toObjectArrayOfStrings(item);
const strArr = objArrStr.map(({ str }) => str);
const isObjectArray = objArrStr.some((o) => o.isObjectArray);
const preKey = prependField ? `${prependField}.${field}` : field;
const dotField = prependField ? `${prependField}.${field}` : field;

// return simple field value (non-object, non-array)
if (!isObjectArray) {
return [
...accumulator,
{
category: fieldCategory,
field: preKey,
field: dotField,
values: isGeoField(field) ? formatGeoLocation(item) : strArr,
originalValue: strArr,
isObjectArray,
} as TimelineEventsDetailsItem,
];
}
let yay;
if (Array.isArray(item)) {
yay = item.reduce((acc, i) => [...acc, getDataFromFieldsHits(i, preKey, fieldCategory)], []);
} else {
yay = getDataFromFieldsHits(item, prependField, fieldCategory);
}
const flat = [...accumulator, ...yay].flat().reduce(

// format nested fields
const nestedFields = Array.isArray(item)
? item
.reduce((acc, i) => [...acc, getDataFromFieldsHits(i, dotField, fieldCategory)], [])
.flat()
: getDataFromFieldsHits(item, prependField, fieldCategory);

// combine duplicate fields
const flat = [...accumulator, ...nestedFields].reduce(
(acc, f) => ({
...acc,
...(acc[f.field] != null
? {
[f.field]: {
...f,
originalValue: [...acc[f.field].originalValue, ...f.originalValue],
values: [...acc[f.field].values, ...f.values],
originalValue: acc[f.field].originalValue.includes(f.originalValue[0])
? acc[f.field].originalValue
: [...acc[f.field].originalValue, ...f.originalValue],
values: acc[f.field].values.includes(f.values[0])
? acc[f.field].values
: [...acc[f.field].values, ...f.values],
},
}
: { [f.field]: f }),
Expand Down

0 comments on commit 90ba99f

Please sign in to comment.