From c4649d3b13f58c75478733c4e925bbfeaf1ddd8a Mon Sep 17 00:00:00 2001
From: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>
Date: Wed, 6 Mar 2024 10:58:52 +0000
Subject: [PATCH] simplify investigation fields hook

---
 .../components/step_about_rule/index.tsx                 | 3 +--
 .../hooks/use_investigation_fields.test.ts               | 9 ++-------
 .../rule_creation_ui/hooks/use_investigation_fields.ts   | 6 ++----
 3 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx
index 3113ff29c0a9a..839618669dc06 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx
@@ -130,8 +130,7 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
   );
 
   const { investigationFields, isLoading: isInvestigationFieldsLoading } = useInvestigationFields({
-    esqlQuery,
-    isEsqlRule: isEsqlRuleValue,
+    esqlQuery: isEsqlRuleValue ? esqlQuery : undefined,
     indexPatternsFields: indexPattern.fields,
   });
 
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.test.ts
index beae91010ce05..4819f87d5a41f 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.test.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.test.ts
@@ -55,7 +55,6 @@ describe('useInvestigationFields', () => {
     const { result } = renderHook(
       () =>
         useInvestigationFields({
-          isEsqlRule: true,
           esqlQuery: mockEsqlQuery,
           indexPatternsFields: mockIndexPatternFields,
         }),
@@ -69,7 +68,6 @@ describe('useInvestigationFields', () => {
     const { result, waitForNextUpdate } = renderHook(
       () =>
         useInvestigationFields({
-          isEsqlRule: true,
           esqlQuery: '',
           indexPatternsFields: mockIndexPatternFields,
         }),
@@ -81,12 +79,11 @@ describe('useInvestigationFields', () => {
     expect(result.current.investigationFields).toEqual(mockIndexPatternFields);
   });
 
-  it('should return only index pattern fields when rule type is not ES|QL', async () => {
+  it('should return only index pattern fields when ES|QL query is undefined', async () => {
     const { result } = renderHook(
       () =>
         useInvestigationFields({
-          isEsqlRule: false,
-          esqlQuery: mockEsqlQuery,
+          esqlQuery: undefined,
           indexPatternsFields: mockIndexPatternFields,
         }),
       { wrapper }
@@ -101,7 +98,6 @@ describe('useInvestigationFields', () => {
     const { result } = renderHook(
       () =>
         useInvestigationFields({
-          isEsqlRule: true,
           esqlQuery: mockEsqlQuery,
           indexPatternsFields: mockIndexPatternFields,
         }),
@@ -123,7 +119,6 @@ describe('useInvestigationFields', () => {
     const { result } = renderHook(
       () =>
         useInvestigationFields({
-          isEsqlRule: true,
           esqlQuery: mockEsqlQuery,
           indexPatternsFields: mockIndexPatternFields,
         }),
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.ts
index f7dd517436612..b9b5dc1a07713 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_investigation_fields.ts
@@ -59,7 +59,6 @@ const useEsqlFields: UseEsqlFields = (esqlQuery) => {
 };
 
 type UseInvestigationFields = (params: {
-  isEsqlRule: boolean;
   esqlQuery: string | undefined;
   indexPatternsFields: DataViewFieldBase[];
 }) => {
@@ -68,14 +67,13 @@ type UseInvestigationFields = (params: {
 };
 
 export const useInvestigationFields: UseInvestigationFields = ({
-  isEsqlRule,
   esqlQuery,
   indexPatternsFields,
 }) => {
   const { fields: esqlFields, isLoading } = useEsqlFields(esqlQuery);
 
   const investigationFields = useMemo(() => {
-    if (!esqlQuery || !isEsqlRule) {
+    if (!esqlQuery) {
       return indexPatternsFields;
     }
 
@@ -84,7 +82,7 @@ export const useInvestigationFields: UseInvestigationFields = ({
     const isEsqlQueryAggregating = computeIsESQLQueryAggregating(esqlQuery);
 
     return isEsqlQueryAggregating ? esqlFields : [...esqlFields, ...indexPatternsFields];
-  }, [esqlFields, esqlQuery, indexPatternsFields, isEsqlRule]);
+  }, [esqlFields, esqlQuery, indexPatternsFields]);
 
   return {
     investigationFields,