[CTI] Threat Intel Card on Overview page needs to accommodate Fleet TI integrations

x-pack/plugins/security_solution/common/search_strategy/security_solution/cti/index.ts

@@ -47,7 +47,6 @@ export const isValidEventField = (field: string): field is EventField =>
 export interface CtiDataSourceRequestOptions extends IEsSearchRequest {
   defaultIndex: string[];
   factoryQueryType?: FactoryQueryTypes;
-  hostName?: string;
   timerange?: TimerangeInput;
 }
 

x-pack/plugins/security_solution/cypress/integration/overview/cti_link_panel.spec.ts

@@ -52,23 +52,6 @@ describe('CTI Link Panel', () => {
     });
 
     it('renders dashboard module as expected when there are events in the selected time period', () => {
-      cy.intercept('GET', '/api/fleet/epm/packages*', {
-        response: [
-          {
-            name: 'ti_abusech',
-            title: 'AbuseCH',
-            id: 'ti_abusech',
-            status: 'installed',
-          },
-          {
-            name: 'ti_anomali',
-            title: 'Anomali',
-            id: 'ti_anomali',
-            status: 'not_installed',
-          },
-        ],
-      });
-
       loginAndWaitForPage(OVERVIEW_URL);
       cy.get(`${OVERVIEW_CTI_LINKS} ${OVERVIEW_CTI_LINKS_INFO_INNER_PANEL}`).should('exist');
       cy.get(`${OVERVIEW_CTI_LINKS} ${OVERVIEW_CTI_ENABLE_INTEGRATIONS_BUTTON}`).should('exist');
@@ -77,31 +60,4 @@ describe('CTI Link Panel', () => {
       cy.get(`${OVERVIEW_CTI_TOTAL_EVENT_COUNT}`).should('have.text', 'Showing: 1 indicator');
     });
   });
-
-  describe('all integrations installed', () => {
-    before(() => {
-      esArchiverLoad('threat_indicator');
-      cy.intercept('GET', '/api/fleet/epm/packages*', {
-        response: [
-          {
-            name: 'ti_abusech',
-            title: 'AbuseCH',
-            id: 'ti_abusech',
-            status: 'installed',
-          },
-        ],
-      });
-    });
-
-    after(() => {
-      esArchiverUnload('threat_indicator');
-    });
-
-    it('render cti dashboard without enable integrations button', () => {
-      loginAndWaitForPage(OVERVIEW_URL);
-      cy.get(`${OVERVIEW_CTI_LINKS} ${OVERVIEW_CTI_ENABLE_INTEGRATIONS_BUTTON}`).should(
-        'not.exist'
-      );
-    });
-  });
 });

x-pack/plugins/security_solution/public/overview/components/link_panel/types.ts

@@ -21,5 +21,5 @@ export interface LinkPanelViewProps {
   listItems: LinkPanelListItem[];
   splitPanel?: JSX.Element;
   totalCount?: number;
-  isSomeIntegrationsDisabled?: boolean;
+  allIntegrationsInstalled?: boolean;
 }

x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_enabled_module.test.tsx

@@ -49,7 +49,7 @@ describe('CtiEnabledModule', () => {
       <Provider store={store}>
         <I18nProvider>
           <ThemeProvider theme={mockTheme}>
-            <CtiEnabledModule {...mockProps} isSomeIntegrationsDisabled={true} />
+            <CtiEnabledModule {...mockProps} allIntegrationsInstalled={true} />
           </ThemeProvider>
         </I18nProvider>
       </Provider>

x-pack/plugins/security_solution/public/overview/components/overview_cti_links/cti_enabled_module.tsx

@@ -12,7 +12,7 @@ import { useCtiDashboardLinks } from '../../containers/overview_cti_links';
 import { ThreatIntelPanelView } from './threat_intel_panel_view';
 
 export const CtiEnabledModuleComponent: React.FC<ThreatIntelLinkPanelProps> = (props) => {
-  const { to, from, isSomeIntegrationsDisabled, allTiDataSources, setQuery, deleteQuery } = props;
+  const { to, from, allIntegrationsInstalled, allTiDataSources, setQuery, deleteQuery } = props;
   const { tiDataSources, totalCount } = useTiDataSources({
     to,
     from,
@@ -26,7 +26,7 @@ export const CtiEnabledModuleComponent: React.FC<ThreatIntelLinkPanelProps> = (p
     <ThreatIntelPanelView
       listItems={listItems}
       totalCount={totalCount}
-      isSomeIntegrationsDisabled={isSomeIntegrationsDisabled}
+      allIntegrationsInstalled={allIntegrationsInstalled}
     />
   );
 };

x-pack/plugins/security_solution/public/overview/components/overview_cti_links/index.test.tsx

@@ -49,13 +49,27 @@ describe('ThreatIntelLinkPanel', () => {
       <Provider store={store}>
         <I18nProvider>
           <ThemeProvider theme={mockTheme}>
-            <ThreatIntelLinkPanel {...mockProps} isSomeIntegrationsDisabled={true} />
+            <ThreatIntelLinkPanel {...mockProps} allIntegrationsInstalled={true} />
           </ThemeProvider>
         </I18nProvider>
       </Provider>
     );
 
     expect(wrapper.find('[data-test-subj="cti-enabled-module"]').length).toEqual(1);
+    expect(wrapper.find('[data-test-subj="cti-enable-integrations-button"]').length).toEqual(0);
+  });
+
+  it('renders Enable source buttons when not all integrations installed', () => {
+    const wrapper = mount(
+      <Provider store={store}>
+        <I18nProvider>
+          <ThemeProvider theme={mockTheme}>
+            <ThreatIntelLinkPanel {...mockProps} allIntegrationsInstalled={false} />
+          </ThemeProvider>
+        </I18nProvider>
+      </Provider>
+    );
+    expect(wrapper.find('[data-test-subj="cti-enable-integrations-button"]').length).not.toBe(0);
   });
 
   it('renders CtiDisabledModule when Threat Intel module is disabled', () => {
@@ -66,7 +80,7 @@ describe('ThreatIntelLinkPanel', () => {
             <ThreatIntelLinkPanel
               {...mockProps}
               allTiDataSources={[]}
-              isSomeIntegrationsDisabled={true}
+              allIntegrationsInstalled={true}
             />
           </ThemeProvider>
         </I18nProvider>

x-pack/plugins/security_solution/public/overview/components/overview_cti_links/index.tsx

@@ -16,19 +16,19 @@ export type ThreatIntelLinkPanelProps = Pick<
   GlobalTimeArgs,
   'from' | 'to' | 'deleteQuery' | 'setQuery'
 > & {
-  isSomeIntegrationsDisabled: boolean | undefined;
+  allIntegrationsInstalled: boolean | undefined;
   allTiDataSources: TiDataSources[];
 };
 
 const ThreatIntelLinkPanelComponent: React.FC<ThreatIntelLinkPanelProps> = (props) => {
-  const { isSomeIntegrationsDisabled, allTiDataSources } = props;
+  const { allIntegrationsInstalled, allTiDataSources } = props;
   const isThreatIntelModuleEnabled = allTiDataSources.length > 0;
   return isThreatIntelModuleEnabled ? (
     <div data-test-subj="cti-enabled-module">
       <CtiEnabledModule
         {...props}
         allTiDataSources={allTiDataSources}
-        isSomeIntegrationsDisabled={Boolean(isSomeIntegrationsDisabled)}
+        allIntegrationsInstalled={Boolean(allIntegrationsInstalled)}
       />
     </div>
   ) : (

x-pack/plugins/security_solution/public/overview/components/overview_cti_links/mock.ts

@@ -68,7 +68,7 @@ export const mockProps = {
   from: '2020-01-21T20:49:57.080Z',
   setQuery: jest.fn(),
   deleteQuery: jest.fn(),
-  isSomeIntegrationsDisabled: true,
+  allIntegrationsInstalled: true,
   allTiDataSources: [
     { dataset: 'ti_abusech', name: 'AbuseCH', count: 5, path: '/dashboard_path_abuseurl' },
   ],

x-pack/plugins/security_solution/public/overview/components/overview_cti_links/threat_intel_panel_view.tsx

@@ -43,7 +43,7 @@ export const ThreatIntelPanelView: React.FC<LinkPanelViewProps> = ({
   listItems,
   splitPanel,
   totalCount = 0,
-  isSomeIntegrationsDisabled,
+  allIntegrationsInstalled,
 }) => {
   const integrationsLink = useIntegrationsPageLink();
 
@@ -55,7 +55,7 @@ export const ThreatIntelPanelView: React.FC<LinkPanelViewProps> = ({
         infoPanel: useMemo(
           () => (
             <>
-              {isSomeIntegrationsDisabled ? (
+              {allIntegrationsInstalled === false ? (
                 <InnerLinkPanel
                   dataTestSubj="cti-inner-panel-info"
                   color={'warning'}
@@ -75,7 +75,7 @@ export const ThreatIntelPanelView: React.FC<LinkPanelViewProps> = ({
               ) : null}
             </>
           ),
-          [isSomeIntegrationsDisabled, integrationsLink]
+          [allIntegrationsInstalled, integrationsLink]
         ),
         inspectQueryId: isInspectEnabled ? CTIEventCountQueryId : undefined,
         listItems,

x-pack/plugins/security_solution/public/overview/containers/overview_cti_links/api.ts

@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { KibanaServices } from '../../../common/lib/kibana';
+import { EPM_API_ROUTES } from '../../../../../fleet/common';
+
+export interface IntegrationResponse {
+  id: string;
+  status: string;
+  savedObject?: {
+    attributes?: {
+      installed_kibana: Array<{
+        type: string;
+        id: string;
+      }>;
+    };
+  };
+}
+
+export const fetchIntegrations = () =>
+  KibanaServices.get().http.fetch<{
+    response: IntegrationResponse[];
+  }>(EPM_API_ROUTES.LIST_PATTERN, {
+    method: 'GET',
+  });

x-pack/plugins/security_solution/public/overview/containers/overview_cti_links/use_all_ti_data_sources.ts

@@ -16,7 +16,7 @@ export const useAllTiDataSources = () => {
     []
   );
 
-  const { tiDataSources, isInitialyLoaded } = useTiDataSources({ to, from });
+  const { tiDataSources, isInitiallyLoaded } = useTiDataSources({ to, from });
 
-  return { tiDataSources, isInitialyLoaded };
+  return { tiDataSources, isInitiallyLoaded };
 };

x-pack/plugins/security_solution/public/overview/containers/overview_cti_links/use_ti_data_sources.ts

@@ -81,7 +81,7 @@ export const useTiDataSources = ({
   deleteQuery,
 }: TiDataSourcesProps) => {
   const [tiDataSources, setTiDataSources] = useState<TiDataSources[]>([]);
-  const [isInitialyLoaded, setIsInitialyLoaded] = useState(false);
+  const [isInitiallyLoaded, setIsInitiallyLoaded] = useState(false);
   const { data, uiSettings } = useKibana().services;
   const defaultThreatIndices = uiSettings.get<string[]>(DEFAULT_THREAT_INDEX_KEY);
   const { result, start, loading } = useTiDataSourcesComplete();
@@ -117,10 +117,10 @@ export const useTiDataSources = ({
   }, [deleteQuery]);
 
   useEffect(() => {
-    if (result && !isInitialyLoaded) {
-      setIsInitialyLoaded(true);
+    if (result && !isInitiallyLoaded) {
+      setIsInitiallyLoaded(true);
     }
-  }, [isInitialyLoaded, result]);
+  }, [isInitiallyLoaded, result]);
 
   useEffect(() => {
     if (!loading && result) {
@@ -170,5 +170,5 @@ export const useTiDataSources = ({
 
   const totalCount = tiDataSources.reduce((acc, val) => acc + val.count, 0);
 
-  return { tiDataSources, totalCount, isInitialyLoaded };
+  return { tiDataSources, totalCount, isInitiallyLoaded };
 };

x-pack/plugins/security_solution/public/overview/containers/overview_cti_links/use_ti_integrations.ts

@@ -6,30 +6,18 @@
  */
 
 import { useEffect, useState } from 'react';
-import { KibanaServices } from '../../../common/lib/kibana';
-import { EPM_API_ROUTES, installationStatuses } from '../../../../../fleet/common';
-import { TI_INTEGRATION_PREFIX } from '../../../../common/cti/constants';
 
-interface IntegrationResponse {
-  id: string;
-  status: string;
-  savedObject?: {
-    attributes?: {
-      installed_kibana: Array<{
-        type: string;
-        id: string;
-      }>;
-    };
-  };
-}
+import { installationStatuses } from '../../../../../fleet/common';
+import { TI_INTEGRATION_PREFIX } from '../../../../common/cti/constants';
+import { fetchIntegrations, IntegrationResponse } from './api';
 
 export interface Integration {
   id: string;
   dashboardIds: string[];
 }
 
 interface TiIntegrationStatus {
-  isSomeIntegrationsDisabled: boolean;
+  allIntegrationsInstalled: boolean;
 }
 
 export const useTiIntegrations = () => {
@@ -40,26 +28,22 @@ export const useTiIntegrations = () => {
   useEffect(() => {
     const getPackages = async () => {
       try {
-        const { response: integrations } = await KibanaServices.get().http.fetch<{
-          response: IntegrationResponse[];
-        }>(EPM_API_ROUTES.LIST_PATTERN, {
-          method: 'GET',
-        });
+        const { response: integrations } = await fetchIntegrations();
         const tiIntegrations = integrations.filter((integration: IntegrationResponse) =>
           integration.id.startsWith(TI_INTEGRATION_PREFIX)
         );
 
-        const isSomeIntegrationsDisabled = tiIntegrations.some(
+        const allIntegrationsInstalled = tiIntegrations.every(
           (integration: IntegrationResponse) =>
-            integration.status !== installationStatuses.Installed
+            integration.status === installationStatuses.Installed
         );
 
         setTiIntegrationsStatus({
-          isSomeIntegrationsDisabled,
+          allIntegrationsInstalled,
         });
       } catch (e) {
         setTiIntegrationsStatus({
-          isSomeIntegrationsDisabled: true,
+          allIntegrationsInstalled: false,
         });
       }
     };

x-pack/plugins/security_solution/public/overview/pages/overview.tsx

@@ -76,7 +76,7 @@ const OverviewComponent = () => {
     endpointPrivileges: { canAccessFleet },
   } = useUserPrivileges();
   const { hasIndexRead, hasKibanaREAD } = useAlertsPrivileges();
-  const { tiDataSources: allTiDataSources, isInitialyLoaded: allTiDataSourcesLoaded } =
+  const { tiDataSources: allTiDataSources, isInitiallyLoaded: allTiDataSourcesLoaded } =
     useAllTiDataSources();
   const tiIntegrationStatus = useTiIntegrations();
   const isTiLoaded = tiIntegrationStatus && allTiDataSourcesLoaded;
@@ -156,9 +156,7 @@ const OverviewComponent = () => {
                       <EuiFlexItem grow={1}>
                         {isTiLoaded && (
                           <ThreatIntelLinkPanel
-                            isSomeIntegrationsDisabled={
-                              tiIntegrationStatus?.isSomeIntegrationsDisabled
-                            }
+                            allIntegrationsInstalled={tiIntegrationStatus?.allIntegrationsInstalled}
                             allTiDataSources={allTiDataSources}
                             deleteQuery={deleteQuery}
                             from={from}