[Security Solution] expandable flyout - prevalence data is calculated…

… from 30d to now (#162791)
elastic · Aug 8, 2023 · f9f2d37 · f9f2d37
1 parent b8841bc
commit f9f2d37
Show file tree

Hide file tree

Showing 14 changed files with 15 additions and 121 deletions.
diff --git a/...e2e/investigations/alerts/expandable_flyout/alert_details_left_panel_prevalence_tab.cy.ts b/...e2e/investigations/alerts/expandable_flyout/alert_details_left_panel_prevalence_tab.cy.ts
@@ -70,7 +70,7 @@ describe(
       );
       cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_DOC_COUNT_CELL).should(
         'contain.text',
-        2
+        0
       );
       cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_HOST_PREVALENCE_CELL).should(
         'contain.text',

diff --git a/x-pack/plugins/security_solution/public/flyout/left/components/prevalence_details.tsx b/x-pack/plugins/security_solution/public/flyout/left/components/prevalence_details.tsx
@@ -37,7 +37,6 @@ import { EventKind } from '../../shared/hooks/use_fetch_field_value_pair_by_even
 
 interface PrevalenceDetailsTableCell {
   highlightedField: { name: string; values: string[] };
-  scopeId: string;
 }
 
 export const PREVALENCE_TAB_ID = 'prevalence-details';
@@ -60,7 +59,6 @@ const columns: Array<EuiBasicTableColumn<unknown>> = [
     render: (data: PrevalenceDetailsTableCell) => (
       <PrevalenceDetailsCountCell
         highlightedField={data.highlightedField}
-        scopeId={data.scopeId}
         type={{
           eventKind: EventKind.signal,
           include: true,
@@ -75,7 +73,6 @@ const columns: Array<EuiBasicTableColumn<unknown>> = [
     render: (data: PrevalenceDetailsTableCell) => (
       <PrevalenceDetailsCountCell
         highlightedField={data.highlightedField}
-        scopeId={data.scopeId}
         type={{
           eventKind: EventKind.signal,
           exclude: true,
@@ -90,7 +87,6 @@ const columns: Array<EuiBasicTableColumn<unknown>> = [
     render: (data: PrevalenceDetailsTableCell) => (
       <PrevalenceDetailsPrevalenceCell
         highlightedField={data.highlightedField}
-        scopeId={data.scopeId}
         aggregationField={'host.name'}
       />
     ),
@@ -102,7 +98,6 @@ const columns: Array<EuiBasicTableColumn<unknown>> = [
     render: (data: PrevalenceDetailsTableCell) => (
       <PrevalenceDetailsPrevalenceCell
         highlightedField={data.highlightedField}
-        scopeId={data.scopeId}
         aggregationField={'user.name'}
       />
     ),
@@ -129,7 +124,6 @@ export const PrevalenceDetails: React.FC = () => {
         name: summaryRow.description.data.field,
         values: summaryRow.description.values || [],
       },
-      scopeId,
     });
 
     return (summaryRows || []).map((summaryRow) => {

diff --git a/...ns/security_solution/public/flyout/left/components/prevalence_details_count_cell.test.tsx b/...ns/security_solution/public/flyout/left/components/prevalence_details_count_cell.test.tsx
@@ -24,7 +24,6 @@ const highlightedField = {
   name: 'field',
   values: ['values'],
 };
-const scopeId = 'scopeId';
 const type = {
   eventKind: EventKind.signal,
   include: true,
@@ -39,11 +38,7 @@ describe('PrevalenceDetailsAlertCountCell', () => {
     });
 
     const { getByTestId } = render(
-      <PrevalenceDetailsCountCell
-        highlightedField={highlightedField}
-        scopeId={scopeId}
-        type={type}
-      />
+      <PrevalenceDetailsCountCell highlightedField={highlightedField} type={type} />
     );
 
     expect(getByTestId(PREVALENCE_DETAILS_COUNT_CELL_LOADING_TEST_ID)).toBeInTheDocument();
@@ -57,11 +52,7 @@ describe('PrevalenceDetailsAlertCountCell', () => {
     });
 
     const { getByTestId } = render(
-      <PrevalenceDetailsCountCell
-        highlightedField={highlightedField}
-        scopeId={scopeId}
-        type={type}
-      />
+      <PrevalenceDetailsCountCell highlightedField={highlightedField} type={type} />
     );
 
     expect(getByTestId(PREVALENCE_DETAILS_COUNT_CELL_ERROR_TEST_ID)).toBeInTheDocument();
@@ -75,11 +66,7 @@ describe('PrevalenceDetailsAlertCountCell', () => {
     });
 
     const { getByTestId } = render(
-      <PrevalenceDetailsCountCell
-        highlightedField={highlightedField}
-        scopeId={scopeId}
-        type={type}
-      />
+      <PrevalenceDetailsCountCell highlightedField={highlightedField} type={type} />
     );
 
     expect(getByTestId(PREVALENCE_DETAILS_COUNT_CELL_VALUE_TEST_ID)).toBeInTheDocument();
@@ -94,11 +81,7 @@ describe('PrevalenceDetailsAlertCountCell', () => {
     });
 
     const { getByTestId } = render(
-      <PrevalenceDetailsCountCell
-        highlightedField={highlightedField}
-        scopeId={scopeId}
-        type={type}
-      />
+      <PrevalenceDetailsCountCell highlightedField={highlightedField} type={type} />
     );
 
     expect(getByTestId(PREVALENCE_DETAILS_COUNT_CELL_VALUE_TEST_ID)).toBeInTheDocument();

diff --git a/...plugins/security_solution/public/flyout/left/components/prevalence_details_count_cell.tsx b/...plugins/security_solution/public/flyout/left/components/prevalence_details_count_cell.tsx
@@ -15,17 +15,12 @@ import {
 } from './test_ids';
 import type { EventType } from '../../shared/hooks/use_fetch_field_value_pair_by_event_type';
 import { useFetchFieldValuePairByEventType } from '../../shared/hooks/use_fetch_field_value_pair_by_event_type';
-import { TimelineId } from '../../../../common/types';
 
 export interface PrevalenceDetailsCountCellProps {
   /**
    * The highlighted field name and values
    * */
   highlightedField: { name: string; values: string[] };
-  /**
-   * The scope id
-   */
-  scopeId: string;
   /**
    * Limit the search to include or exclude a specific value for the event.kind field
    * (alert, asset, enrichment, event, metric, state, pipeline_error, signal)
@@ -41,12 +36,10 @@ export interface PrevalenceDetailsCountCellProps {
  */
 export const PrevalenceDetailsCountCell: VFC<PrevalenceDetailsCountCellProps> = ({
   highlightedField,
-  scopeId,
   type,
 }) => {
   const { loading, error, count } = useFetchFieldValuePairByEventType({
     highlightedField,
-    isActiveTimelines: scopeId === TimelineId.active,
     type,
   });
 

diff --git a/...curity_solution/public/flyout/left/components/prevalence_details_prevalence_cell.test.tsx b/...curity_solution/public/flyout/left/components/prevalence_details_prevalence_cell.test.tsx
@@ -23,7 +23,6 @@ const highlightedField = {
   name: 'field',
   values: ['values'],
 };
-const scopeId = 'scopeId';
 const aggregationField = 'aggregationField';
 
 describe('PrevalenceDetailsAlertCountCell', () => {
@@ -42,7 +41,6 @@ describe('PrevalenceDetailsAlertCountCell', () => {
     const { getByTestId } = render(
       <PrevalenceDetailsPrevalenceCell
         highlightedField={highlightedField}
-        scopeId={scopeId}
         aggregationField={aggregationField}
       />
     );
@@ -65,7 +63,6 @@ describe('PrevalenceDetailsAlertCountCell', () => {
     const { getByTestId } = render(
       <PrevalenceDetailsPrevalenceCell
         highlightedField={highlightedField}
-        scopeId={scopeId}
         aggregationField={aggregationField}
       />
     );
@@ -88,7 +85,6 @@ describe('PrevalenceDetailsAlertCountCell', () => {
     const { getByTestId } = render(
       <PrevalenceDetailsPrevalenceCell
         highlightedField={highlightedField}
-        scopeId={scopeId}
         aggregationField={aggregationField}
       />
     );
@@ -111,7 +107,6 @@ describe('PrevalenceDetailsAlertCountCell', () => {
     const { getByTestId } = render(
       <PrevalenceDetailsPrevalenceCell
         highlightedField={highlightedField}
-        scopeId={scopeId}
         aggregationField={aggregationField}
       />
     );
@@ -134,7 +129,6 @@ describe('PrevalenceDetailsAlertCountCell', () => {
     const { getByTestId } = render(
       <PrevalenceDetailsPrevalenceCell
         highlightedField={highlightedField}
-        scopeId={scopeId}
         aggregationField={aggregationField}
       />
     );
@@ -157,7 +151,6 @@ describe('PrevalenceDetailsAlertCountCell', () => {
     const { getByTestId } = render(
       <PrevalenceDetailsPrevalenceCell
         highlightedField={highlightedField}
-        scopeId={scopeId}
         aggregationField={aggregationField}
       />
     );

diff --git a/...ns/security_solution/public/flyout/left/components/prevalence_details_prevalence_cell.tsx b/...ns/security_solution/public/flyout/left/components/prevalence_details_prevalence_cell.tsx
@@ -14,18 +14,13 @@ import {
   PREVALENCE_DETAILS_PREVALENCE_CELL_VALUE_TEST_ID,
 } from './test_ids';
 import { useFetchFieldValuePairWithAggregation } from '../../shared/hooks/use_fetch_field_value_pair_with_aggregation';
-import { TimelineId } from '../../../../common/types';
 import { useFetchUniqueByField } from '../../shared/hooks/use_fetch_unique_by_field';
 
 export interface PrevalenceDetailsPrevalenceCellProps {
   /**
    * The highlighted field name and values
    * */
   highlightedField: { name: string; values: string[] };
-  /**
-   * The scope id
-   */
-  scopeId: string;
   /**
    * The aggregation field
    */
@@ -38,7 +33,6 @@ export interface PrevalenceDetailsPrevalenceCellProps {
  */
 export const PrevalenceDetailsPrevalenceCell: VFC<PrevalenceDetailsPrevalenceCellProps> = ({
   highlightedField,
-  scopeId,
   aggregationField,
 }) => {
   const {
@@ -47,7 +41,6 @@ export const PrevalenceDetailsPrevalenceCell: VFC<PrevalenceDetailsPrevalenceCel
     count: aggregationCount,
   } = useFetchFieldValuePairWithAggregation({
     highlightedField,
-    isActiveTimelines: scopeId === TimelineId.active,
     aggregationField,
   });
 

diff --git a/x-pack/plugins/security_solution/public/flyout/right/components/prevalence_overview.test.tsx b/x-pack/plugins/security_solution/public/flyout/right/components/prevalence_overview.test.tsx
@@ -26,7 +26,6 @@ const highlightedField = {
   name: 'field',
   values: ['values'],
 };
-const scopeId = 'scopeId';
 const callbackIfNull = jest.fn();
 
 const panelContextValue = {
@@ -61,7 +60,6 @@ describe('<PrevalenceOverview />', () => {
       prevalenceRows: [
         <PrevalenceOverviewRow
           highlightedField={highlightedField}
-          scopeId={scopeId}
           callbackIfNull={callbackIfNull}
           data-test-subj={'test'}
         />,
@@ -106,7 +104,6 @@ describe('<PrevalenceOverview />', () => {
       prevalenceRows: [
         <PrevalenceOverviewRow
           highlightedField={highlightedField}
-          scopeId={scopeId}
           callbackIfNull={callbackIfNull}
           data-test-subj={'test'}
         />,

diff --git a/...plugins/security_solution/public/flyout/right/components/prevalence_overview_row.test.tsx b/...plugins/security_solution/public/flyout/right/components/prevalence_overview_row.test.tsx
@@ -18,7 +18,6 @@ const highlightedField = {
   name: 'field',
   values: ['values'],
 };
-const scopeId = 'scopeId';
 const dataTestSubj = 'test';
 const iconDataTestSubj = 'testIcon';
 const valueDataTestSubj = 'testValue';
@@ -41,7 +40,6 @@ describe('<PrevalenceOverviewRow />', () => {
     const { getByTestId, getAllByText, queryByTestId } = render(
       <PrevalenceOverviewRow
         highlightedField={highlightedField}
-        scopeId={scopeId}
         callbackIfNull={() => {}}
         data-test-subj={dataTestSubj}
       />
@@ -71,7 +69,6 @@ describe('<PrevalenceOverviewRow />', () => {
     const { queryAllByAltText } = render(
       <PrevalenceOverviewRow
         highlightedField={highlightedField}
-        scopeId={scopeId}
         callbackIfNull={callbackIfNull}
         data-test-subj={dataTestSubj}
       />
@@ -97,7 +94,6 @@ describe('<PrevalenceOverviewRow />', () => {
     const { queryAllByAltText } = render(
       <PrevalenceOverviewRow
         highlightedField={highlightedField}
-        scopeId={scopeId}
         callbackIfNull={callbackIfNull}
         data-test-subj={dataTestSubj}
       />
@@ -122,7 +118,6 @@ describe('<PrevalenceOverviewRow />', () => {
     const { getByTestId } = render(
       <PrevalenceOverviewRow
         highlightedField={highlightedField}
-        scopeId={scopeId}
         callbackIfNull={() => {}}
         data-test-subj={dataTestSubj}
       />

diff --git a/x-pack/plugins/security_solution/public/flyout/right/components/prevalence_overview_row.tsx b/x-pack/plugins/security_solution/public/flyout/right/components/prevalence_overview_row.tsx
@@ -11,7 +11,6 @@ import { PREVALENCE_ROW_UNCOMMON } from './translations';
 import { useFetchFieldValuePairWithAggregation } from '../../shared/hooks/use_fetch_field_value_pair_with_aggregation';
 import { useFetchUniqueByField } from '../../shared/hooks/use_fetch_unique_by_field';
 import { InsightsSummaryRow } from './insights_summary_row';
-import { TimelineId } from '../../../../common/types';
 
 const HOST_FIELD = 'host.name';
 const PERCENTAGE_THRESHOLD = 0.1; // we show the prevalence if its value is below 10%
@@ -21,10 +20,6 @@ export interface PrevalenceOverviewRowProps {
    * The highlighted field name and values
    * */
   highlightedField: { name: string; values: string[] };
-  /**
-   * Maintain backwards compatibility // TODO remove when possible
-   */
-  scopeId: string;
   /**
    * This is a solution to allow the parent component to NOT render if all its row children are null
    */
@@ -42,19 +37,15 @@ export interface PrevalenceOverviewRowProps {
  */
 export const PrevalenceOverviewRow: VFC<PrevalenceOverviewRowProps> = ({
   highlightedField,
-  scopeId,
   callbackIfNull,
   'data-test-subj': dataTestSubj,
 }) => {
-  const isActiveTimelines = scopeId === TimelineId.active;
-
   const {
     loading: hostsLoading,
     error: hostsError,
     count: hostsCount,
   } = useFetchFieldValuePairWithAggregation({
     highlightedField,
-    isActiveTimelines,
     aggregationField: HOST_FIELD,
   });
 

diff --git a/x-pack/plugins/security_solution/public/flyout/right/hooks/use_prevalence.tsx b/x-pack/plugins/security_solution/public/flyout/right/hooks/use_prevalence.tsx
@@ -79,14 +79,13 @@ export const usePrevalence = ({
         return (
           <PrevalenceOverviewRow
             highlightedField={highlightedField}
-            scopeId={scopeId}
             callbackIfNull={() => setCount((prevCount) => prevCount + 1)}
             data-test-subj={INSIGHTS_PREVALENCE_TEST_ID}
             key={row.description.data.field}
           />
         );
       }),
-    [summaryRows, scopeId]
+    [summaryRows]
   );
 
   return {