refactoring

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/esql_autocomplete/esql_autocomplete.tsx

@@ -23,6 +23,7 @@ interface AutocompleteFieldProps {
   fieldType: 'string';
   placeholder?: string;
   esqlQuery: string | undefined;
+  singleSelection: boolean | undefined;
 }
 
 /**
@@ -38,6 +39,7 @@ export const EsqlAutocomplete: React.FC<AutocompleteFieldProps> = ({
   fieldType,
   placeholder,
   esqlQuery,
+  singleSelection,
 }): JSX.Element => {
   const handleValuesChange = useCallback(
     ([newOption]: EuiComboBoxOptionOption[]): void => {
@@ -70,7 +72,7 @@ export const EsqlAutocomplete: React.FC<AutocompleteFieldProps> = ({
         isLoading={isLoading}
         isDisabled={isDisabled || isLoading}
         isClearable={false}
-        singleSelection={AS_PLAIN_TEXT}
+        singleSelection={singleSelection ? AS_PLAIN_TEXT : false}
         data-test-subj="esqlAutocompleteComboBox"
         style={{ width: `${COMPONENT_WIDTH}px` }}
         fullWidth

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx

@@ -38,8 +38,8 @@ import { DEFAULT_INDICATOR_SOURCE_PATH } from '../../../../../common/constants';
 import { useKibana } from '../../../../common/lib/kibana';
 import { useRuleIndices } from '../../../rule_management/logic/use_rule_indices';
 import { EsqlAutocomplete } from '../esql_autocomplete';
-import { EsqlFieldsSelect } from '../esql_fields_select';
 import { MultiSelectFieldsAutocomplete } from '../multi_select_fields';
+import { useInvestigationFields } from '../../hooks/use_investigation_fields';
 
 const CommonUseField = getUseField({ component: Field });
 
@@ -129,6 +129,12 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
     [getFields]
   );
 
+  const { investigationFields, isLoading: isInvestigationFieldsLoading } = useInvestigationFields({
+    esqlQuery,
+    isEsqlRule: isEsqlRuleValue,
+    indexPatternsFields: indexPattern.fields,
+  });
+
   return (
     <>
       <StepContentWrapper addPadding={!isUpdateView}>
@@ -241,8 +247,8 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
               path="investigationFields"
               component={MultiSelectFieldsAutocomplete}
               componentProps={{
-                browserFields: indexPattern.fields,
-                isDisabled: isLoading || indexPatternLoading,
+                browserFields: investigationFields,
+                isDisabled: isLoading || indexPatternLoading || isInvestigationFieldsLoading,
                 fullWidth: true,
                 dataTestSubj: 'detectionEngineStepAboutRuleInvestigationFields',
               }}

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.ts

@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { useMemo } from 'react';
+import type { Datatable, ExpressionsStart } from '@kbn/expressions-plugin/public';
+import type { DataViewFieldBase } from '@kbn/es-query';
+import { computeIsESQLQueryAggregating } from '@kbn/securitysolution-utils';
+
+import { useQuery } from '@tanstack/react-query';
+
+import { useKibana } from '@kbn/kibana-react-plugin/public';
+
+import { getEsqlQueryConfig } from '../../rule_creation/logic/get_esql_query_config';
+
+const esqlToFields = (
+  data: { error: unknown } | Datatable | undefined | null
+): DataViewFieldBase[] => {
+  if (data && 'error' in data) {
+    return [];
+  }
+
+  const fields = (data?.columns ?? []).map(({ id, meta }) => {
+    return {
+      name: id,
+      type: meta.type,
+    };
+  });
+
+  return fields;
+};
+
+type UseEsqlFields = (esqlQuery: string | undefined) => {
+  isLoading: boolean;
+  fields: DataViewFieldBase[];
+};
+
+/**
+ * fetches ES|QL fields and convert them to DataViewBase fields
+ */
+const useEsqlFields: UseEsqlFields = (esqlQuery) => {
+  const kibana = useKibana<{ expressions: ExpressionsStart }>();
+
+  const { expressions } = kibana.services;
+
+  const queryConfig = getEsqlQueryConfig({ esqlQuery, expressions });
+  const { data, isLoading } = useQuery(queryConfig);
+
+  const fields = useMemo(() => {
+    return esqlToFields(data);
+  }, [data]);
+
+  return {
+    fields,
+    isLoading,
+  };
+};
+
+type UseInvestigationFields = (params: {
+  isEsqlRule: boolean;
+  esqlQuery: string | undefined;
+  indexPatternsFields: DataViewFieldBase[];
+}) => {
+  isLoading: boolean;
+  investigationFields: DataViewFieldBase[];
+};
+
+export const useInvestigationFields: UseInvestigationFields = ({
+  isEsqlRule,
+  esqlQuery,
+  indexPatternsFields,
+}) => {
+  const { fields: esqlFields, isLoading } = useEsqlFields(esqlQuery);
+
+  const investigationFields = useMemo(() => {
+    if (!esqlQuery || !isEsqlRule) {
+      return indexPatternsFields;
+    }
+
+    // alerts generated from non-aggregating queries are enriched with source document
+    // so, index patterns fields should be included in the list of investigation fields
+    const isEsqlQueryAggregating = computeIsESQLQueryAggregating(esqlQuery);
+
+    return isEsqlQueryAggregating ? esqlFields : [...esqlFields, ...indexPatternsFields];
+  }, [esqlFields, esqlQuery, indexPatternsFields, isEsqlRule]);
+
+  return {
+    investigationFields,
+    isLoading,
+  };
+};