[SIEM][Detections Engine] Add note markdown field to backend

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts

@@ -59,6 +59,7 @@ export const mockPrepackagedRule = (): PrepackagedRules => ({
   version: 1,
   false_positives: [],
   max_signals: 100,
+  note: '',
   timeline_id: 'timeline-id',
   timeline_title: 'timeline-title',
 });
@@ -392,6 +393,7 @@ export const getResult = (): RuleAlertType => ({
       },
     ],
     references: ['http://www.example.com', 'https://ww.example.com'],
+    note: '# Investigative notes',
     version: 1,
   },
   createdAt: new Date('2019-12-13T16:40:33.400Z'),

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/index/signals_mapping.json

@@ -133,6 +133,9 @@
                   }
                 }
               },
+              "note": {
+                "type": "text"
+              },
               "type": {
                 "type": "keyword"
               },

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts

@@ -78,6 +78,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
               to,
               type,
               references,
+              note,
               timeline_id: timelineId,
               timeline_title: timelineTitle,
               version,
@@ -131,6 +132,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
                 type,
                 threat,
                 references,
+                note,
                 version,
               });
               return transformValidateBulkError(ruleIdOrUuid, createdRule);

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts

@@ -55,6 +55,7 @@ export const createRulesRoute = (router: IRouter): void => {
         to,
         type,
         references,
+        note,
       } = request.body;
       const siemResponse = buildSiemResponse(response);
 
@@ -117,6 +118,7 @@ export const createRulesRoute = (router: IRouter): void => {
           type,
           threat,
           references,
+          note,
           version: 1,
         });
         const ruleStatuses = await savedObjectsClient.find<

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts

@@ -134,6 +134,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                     to,
                     type,
                     references,
+                    note,
                     timeline_id: timelineId,
                     timeline_title: timelineTitle,
                     version,
@@ -183,6 +184,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                         type,
                         threat,
                         references,
+                        note,
                         version,
                       });
                       resolve({ rule_id: ruleId, status_code: 200 });
@@ -217,6 +219,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                         type,
                         threat,
                         references,
+                        note,
                         version,
                       });
                       resolve({ rule_id: ruleId, status_code: 200 });

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts

@@ -71,6 +71,7 @@ export const patchRulesBulkRoute = (router: IRouter) => {
             type,
             threat,
             references,
+            note,
             version,
           } = payloadRule;
           const idOrRuleIdOrUnknown = id ?? ruleId ?? '(unknown id)';
@@ -104,6 +105,7 @@ export const patchRulesBulkRoute = (router: IRouter) => {
               type,
               threat,
               references,
+              note,
               version,
             });
             if (rule != null) {

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_route.ts

@@ -55,6 +55,7 @@ export const patchRulesRoute = (router: IRouter) => {
         type,
         threat,
         references,
+        note,
         version,
       } = request.body;
       const siemResponse = buildSiemResponse(response);
@@ -101,6 +102,7 @@ export const patchRulesRoute = (router: IRouter) => {
           type,
           threat,
           references,
+          note,
           version,
         });
         if (rule != null) {

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts

@@ -72,6 +72,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
             type,
             threat,
             references,
+            note,
             version,
           } = payloadRule;
           const finalIndex = outputIndex ?? siemClient.signalsIndex;
@@ -107,6 +108,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
               type,
               threat,
               references,
+              note,
               version,
             });
             if (rule != null) {

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts

@@ -55,6 +55,7 @@ export const updateRulesRoute = (router: IRouter) => {
         type,
         threat,
         references,
+        note,
         version,
       } = request.body;
       const siemResponse = buildSiemResponse(response);
@@ -103,6 +104,7 @@ export const updateRulesRoute = (router: IRouter) => {
           type,
           threat,
           references,
+          note,
           version,
         });
         if (rule != null) {

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.test.ts

@@ -92,6 +92,7 @@ describe('utils', () => {
         timeline_title: 'some-timeline-title',
         to: 'now',
         type: 'query',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(rule).toEqual(expected);
@@ -154,6 +155,7 @@ describe('utils', () => {
         timeline_title: 'some-timeline-title',
         to: 'now',
         type: 'query',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(omitData).toEqual(expected);
@@ -218,6 +220,7 @@ describe('utils', () => {
         timeline_title: 'some-timeline-title',
         to: 'now',
         type: 'query',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(rule).toEqual(expected);
@@ -282,6 +285,7 @@ describe('utils', () => {
         timeline_title: 'some-timeline-title',
         to: 'now',
         type: 'query',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(rule).toEqual(expected);
@@ -344,6 +348,7 @@ describe('utils', () => {
         timeline_title: 'some-timeline-title',
         to: 'now',
         type: 'query',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(omitData).toEqual(expected);
@@ -409,6 +414,7 @@ describe('utils', () => {
         timeline_title: 'some-timeline-title',
         to: 'now',
         type: 'query',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(ruleWithEnabledFalse).toEqual(expected);
@@ -474,6 +480,7 @@ describe('utils', () => {
         timeline_title: 'some-timeline-title',
         to: 'now',
         type: 'query',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(ruleWithEnabledFalse).toEqual(expected);
@@ -539,6 +546,7 @@ describe('utils', () => {
         timeline_title: 'some-timeline-title',
         to: 'now',
         type: 'query',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(rule).toEqual(expected);
@@ -688,6 +696,7 @@ describe('utils', () => {
         },
         timeline_id: 'some-timeline-id',
         timeline_title: 'some-timeline-title',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(output).toEqual({
@@ -769,6 +778,7 @@ describe('utils', () => {
         },
         timeline_id: 'some-timeline-id',
         timeline_title: 'some-timeline-title',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(output).toEqual(expected);
@@ -941,6 +951,7 @@ describe('utils', () => {
         },
         timeline_id: 'some-timeline-id',
         timeline_title: 'some-timeline-title',
+        note: '# Investigative notes',
         version: 1,
       };
       expect(output).toEqual(expected);
@@ -1053,6 +1064,7 @@ describe('utils', () => {
           type: 'query',
           updated_at: '2019-12-13T16:40:33.400Z',
           updated_by: 'elastic',
+          note: '# Investigative notes',
           version: 1,
         },
       ]);
@@ -1112,6 +1124,7 @@ describe('utils', () => {
           type: 'query',
           updated_at: '2019-12-13T16:40:33.400Z',
           updated_by: 'elastic',
+          note: '# Investigative notes',
           version: 1,
         },
         {
@@ -1160,6 +1173,7 @@ describe('utils', () => {
           type: 'query',
           updated_at: '2019-12-13T16:40:33.400Z',
           updated_by: 'elastic',
+          note: '# Investigative notes',
           version: 1,
         },
       ]);

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts

@@ -131,6 +131,7 @@ export const transformAlertToRule = (
     to: alert.params.to,
     type: alert.params.type,
     threat: alert.params.threat,
+    note: alert.params.note,
     version: alert.params.version,
     status: ruleStatus?.attributes.status,
     status_date: ruleStatus?.attributes.statusDate,

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/validate.test.ts

@@ -72,6 +72,7 @@ export const ruleOutput: RulesSchema = {
   meta: {
     someMeta: 'someField',
   },
+  note: '# Investigative notes',
   timeline_title: 'some-timeline-title',
   timeline_id: 'some-timeline-id',
 };

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/add_prepackaged_rules_schema.test.ts

@@ -1274,4 +1274,62 @@ describe('add prepackaged rules schema', () => {
       'child "severity" fails because ["severity" must be one of [low, medium, high, critical]]'
     );
   });
+
+  describe('note', () => {
+    test('You can set note to any string you want', () => {
+      expect(
+        addPrepackagedRulesSchema.validate<Partial<PrepackagedRules>>({
+          rule_id: 'rule-1',
+          risk_score: 50,
+          description: 'some description',
+          from: 'now-5m',
+          to: 'now',
+          index: ['index-1'],
+          name: 'some-name',
+          severity: 'low',
+          interval: '5m',
+          type: 'query',
+          references: ['index-1'],
+          query: 'some query',
+          language: 'kuery',
+          max_signals: 1,
+          meta: {
+            somethingMadeUp: { somethingElse: true },
+          },
+          note: '# test header',
+          version: 1,
+        }).error
+      ).toBeFalsy();
+    });
+
+    test('You cannot create note as anything other than a string', () => {
+      expect(
+        addPrepackagedRulesSchema.validate<
+          Partial<Omit<PrepackagedRules, 'note'> & { note: object }>
+        >({
+          rule_id: 'rule-1',
+          risk_score: 50,
+          description: 'some description',
+          from: 'now-5m',
+          to: 'now',
+          index: ['index-1'],
+          name: 'some-name',
+          severity: 'low',
+          interval: '5m',
+          type: 'query',
+          references: ['index-1'],
+          query: 'some query',
+          language: 'kuery',
+          max_signals: 1,
+          meta: {
+            somethingMadeUp: { somethingElse: true },
+          },
+          note: {
+            somethingMadeUp: { somethingElse: true },
+          },
+          version: 1,
+        }).error.message
+      ).toEqual('child "note" fails because ["note" must be a string]');
+    });
+  });
 });

x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/add_prepackaged_rules_schema.ts

@@ -32,6 +32,7 @@ import {
   type,
   threat,
   references,
+  note,
   version,
 } from './schemas';
 /* eslint-enable @typescript-eslint/camelcase */
@@ -79,5 +80,6 @@ export const addPrepackagedRulesSchema = Joi.object({
   type: type.required(),
   threat: threat.default([]),
   references: references.default([]),
+  note: note.allow(''),
   version: version.required(),
 });