[Security Solution] Refactor timeline details to use search strategy

x-pack/plugins/security_solution/common/ecs/index.ts

@@ -27,52 +27,28 @@ import { SystemEcs } from './system';
 
 export interface Ecs {
   _id: string;
-
   _index?: string;
-
   auditd?: AuditdEcs;
-
   destination?: DestinationEcs;
-
   dns?: DnsEcs;
-
   endgame?: EndgameEcs;
-
   event?: EventEcs;
-
   geo?: GeoEcs;
-
   host?: HostEcs;
-
   network?: NetworkEcs;
-
   rule?: RuleEcs;
-
   signal?: SignalEcs;
-
   source?: SourceEcs;
-
   suricata?: SuricataEcs;
-
   tls?: TlsEcs;
-
   zeek?: ZeekEcs;
-
   http?: HttpEcs;
-
   url?: UrlEcs;
-
   timestamp?: string;
-
   message?: string[];
-
   user?: UserEcs;
-
   winlog?: WinlogEcs;
-
   process?: ProcessEcs;
-
   file?: File;
-
   system?: SystemEcs;
 }

x-pack/plugins/security_solution/common/search_strategy/common/index.ts

@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../src/plugins/data/common';
+
+export type Maybe<T> = T | null;
+
+export type SearchHit = IEsSearchResponse<object>['rawResponse']['hits']['hits'][0];
+
+export interface TotalValue {
+  value: number;
+  relation: string;
+}
+
+export interface Inspect {
+  dsl: string[];
+}
+
+export interface PageInfoPaginated {
+  activePage: number;
+  fakeTotalCount: number;
+  showMorePagesIndicator: boolean;
+}
+
+export interface CursorType {
+  value?: Maybe<string>;
+  tiebreaker?: Maybe<string>;
+}
+
+export enum Direction {
+  asc = 'asc',
+  desc = 'desc',
+}
+
+export interface SortField<Field = string> {
+  field: Field;
+  direction: Direction;
+}
+
+export interface TimerangeInput {
+  /** The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan. */
+  interval: string;
+  /** The end of the timerange */
+  to: string;
+  /** The beginning of the timerange */
+  from: string;
+}
+
+export interface PaginationInput {
+  /** The limit parameter allows you to configure the maximum amount of items to be returned */
+  limit: number;
+  /** The cursor parameter defines the next result you want to fetch */
+  cursor?: Maybe<string>;
+  /** The tiebreaker parameter allow to be more precise to fetch the next item */
+  tiebreaker?: Maybe<string>;
+}
+
+export interface PaginationInputPaginated {
+  /** The activePage parameter defines the page of results you want to fetch */
+  activePage: number;
+  /** The cursorStart parameter defines the start of the results to be displayed */
+  cursorStart: number;
+  /** The fakePossibleCount parameter determines the total count in order to show 5 additional pages */
+  fakePossibleCount: number;
+  /** The querySize parameter is the number of items to be returned */
+  querySize: number;
+}
+
+export interface DocValueFields {
+  field: string;
+  format: string;
+}
+
+export interface Explanation {
+  value: number;
+  description: string;
+  details: Explanation[];
+}
+
+export interface TotalValue {
+  value: number;
+  relation: string;
+}
+export interface ShardsResponse {
+  total: number;
+  successful: number;
+  failed: number;
+  skipped: number;
+}
+
+export interface TotalHit {
+  value: number;
+  relation: string;
+}
+
+export interface Hit {
+  _index: string;
+  _type: string;
+  _id: string;
+  _score: number | null;
+}
+
+export interface Hits<T, U> {
+  hits: {
+    total: T;
+    max_score: number | null;
+    hits: U[];
+  };
+}
+
+export interface GenericBuckets {
+  key: string;
+  doc_count: number;
+}
+
+export type StringOrNumber = string | number;

x-pack/plugins/security_solution/common/search_strategy/index.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './common';
+export * from './security_solution';
+export * from './timeline';

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IEsSearchRequest, IEsSearchResponse } from '../../../../../../src/plugins/data/common';
+import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
 import { ESQuery } from '../../typed_json';
 import {
   HostOverviewStrategyResponse,
@@ -26,116 +26,20 @@ import {
   NetworkHttpStrategyResponse,
   NetworkHttpRequestOptions,
 } from './network';
+import {
+  DocValueFields,
+  TimerangeInput,
+  SortField,
+  PaginationInput,
+  PaginationInputPaginated,
+} from '../common';
 
 export * from './hosts';
 export * from './network';
-export type Maybe<T> = T | null;
+export * from '../common';
 
 export type FactoryQueryTypes = HostsQueries | NetworkQueries;
 
-export type SearchHit = IEsSearchResponse<object>['rawResponse']['hits']['hits'][0];
-
-export interface TotalValue {
-  value: number;
-  relation: string;
-}
-
-export interface Inspect {
-  dsl: string[];
-}
-
-export interface PageInfoPaginated {
-  activePage: number;
-  fakeTotalCount: number;
-  showMorePagesIndicator: boolean;
-}
-
-export interface CursorType {
-  value?: Maybe<string>;
-  tiebreaker?: Maybe<string>;
-}
-
-export enum Direction {
-  asc = 'asc',
-  desc = 'desc',
-}
-
-export interface SortField<Field = string> {
-  field: Field;
-  direction: Direction;
-}
-
-export interface TimerangeInput {
-  /** The interval string to use for last bucket. The format is '{value}{unit}'. For example '5m' would return the metrics for the last 5 minutes of the timespan. */
-  interval: string;
-  /** The end of the timerange */
-  to: string;
-  /** The beginning of the timerange */
-  from: string;
-}
-
-export interface PaginationInput {
-  /** The limit parameter allows you to configure the maximum amount of items to be returned */
-  limit: number;
-  /** The cursor parameter defines the next result you want to fetch */
-  cursor?: Maybe<string>;
-  /** The tiebreaker parameter allow to be more precise to fetch the next item */
-  tiebreaker?: Maybe<string>;
-}
-
-export interface PaginationInputPaginated {
-  /** The activePage parameter defines the page of results you want to fetch */
-  activePage: number;
-  /** The cursorStart parameter defines the start of the results to be displayed */
-  cursorStart: number;
-  /** The fakePossibleCount parameter determines the total count in order to show 5 additional pages */
-  fakePossibleCount: number;
-  /** The querySize parameter is the number of items to be returned */
-  querySize: number;
-}
-
-export interface DocValueFields {
-  field: string;
-  format: string;
-}
-
-export interface Explanation {
-  value: number;
-  description: string;
-  details: Explanation[];
-}
-
-export interface TotalValue {
-  value: number;
-  relation: string;
-}
-export interface ShardsResponse {
-  total: number;
-  successful: number;
-  failed: number;
-  skipped: number;
-}
-
-export interface TotalHit {
-  value: number;
-  relation: string;
-}
-
-export interface Hit {
-  _index: string;
-  _type: string;
-  _id: string;
-  _score: number | null;
-}
-
-export interface Hits<T, U> {
-  hits: {
-    total: T;
-    max_score: number | null;
-    hits: U[];
-  };
-}
-
 export interface RequestBasicOptions extends IEsSearchRequest {
   timerange: TimerangeInput;
   filterQuery: ESQuery | string | undefined;
@@ -183,10 +87,3 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   : T extends NetworkQueries.http
   ? NetworkHttpRequestOptions
   : never;
-
-export type StringOrNumber = string | number;
-
-export interface GenericBuckets {
-  key: string;
-  doc_count: number;
-}

x-pack/plugins/security_solution/common/search_strategy/timeline/details/index.ts

@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../common';
+import { TimelineRequestOptionsPaginated } from '..';
+
+export interface DetailItem {
+  field: string;
+  values?: Maybe<string[]>;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  originalValue?: Maybe<any>;
+}
+
+export interface TimelineDetailsStrategyResponse extends IEsSearchResponse {
+  data?: Maybe<DetailItem[]>;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface TimelineDetailsRequestOptions extends Partial<TimelineRequestOptionsPaginated> {
+  defaultIndex: string[];
+  executeQuery: boolean;
+  indexName: string;
+  eventId: string;
+}