[SIEM] Fixes escape bug for filterQuery (#43030) (#45006)

x-pack/legacy/plugins/siem/public/components/page/add_to_kql/index.test.tsx

@@ -109,14 +109,14 @@ describe('AddToKql Component', () => {
       filterQuery: {
         kuery: {
           kind: 'kuery',
-          expression: 'host.name: siem-kibana',
+          expression: 'host.name: "siem-kibana"',
         },
         serializedQuery:
-          '{"bool":{"should":[{"match":{"host.name":"siem-kibana"}}],"minimum_should_match":1}}',
+          '{"bool":{"should":[{"match_phrase":{"host.name":"siem-kibana"}}],"minimum_should_match":1}}',
       },
       filterQueryDraft: {
         kind: 'kuery',
-        expression: 'host.name: siem-kibana',
+        expression: 'host.name: "siem-kibana"',
       },
     });
   });
@@ -173,14 +173,14 @@ describe('AddToKql Component', () => {
       filterQuery: {
         kuery: {
           kind: 'kuery',
-          expression: 'host.name: siem-kibana',
+          expression: 'host.name: "siem-kibana"',
         },
         serializedQuery:
-          '{"bool":{"should":[{"match":{"host.name":"siem-kibana"}}],"minimum_should_match":1}}',
+          '{"bool":{"should":[{"match_phrase":{"host.name":"siem-kibana"}}],"minimum_should_match":1}}',
       },
       filterQueryDraft: {
         kind: 'kuery',
-        expression: 'host.name: siem-kibana',
+        expression: 'host.name: "siem-kibana"',
       },
     });
   });

x-pack/legacy/plugins/siem/public/components/page/hosts/hosts_table/columns.tsx

@@ -57,7 +57,7 @@ export const getHostsColumns = (
               ) : (
                 <AddToKql
                   indexPattern={indexPattern}
-                  expression={`host.name: "${escapeQueryValue(hostName[0])}"`}
+                  expression={`host.name: ${escapeQueryValue(hostName[0])}`}
                   componentFilterType="hosts"
                   type={type}
                 >
@@ -106,7 +106,7 @@ export const getHostsColumns = (
         return (
           <AddToKql
             indexPattern={indexPattern}
-            expression={`host.os.name: "${escapeQueryValue(hostOsName)}"`}
+            expression={`host.os.name: ${escapeQueryValue(hostOsName)}`}
             componentFilterType="hosts"
             type={type}
           >
@@ -128,7 +128,7 @@ export const getHostsColumns = (
         return (
           <AddToKql
             indexPattern={indexPattern}
-            expression={`host.os.version: "${escapeQueryValue(hostOsVersion)}"`}
+            expression={`host.os.version: ${escapeQueryValue(hostOsVersion)}`}
             componentFilterType="hosts"
             type={type}
           >

x-pack/legacy/plugins/siem/public/components/page/network/domains_table/columns.tsx

@@ -106,7 +106,7 @@ export const getDomainsColumns = (
               key={escapeDataProviderId(
                 `${tableId}-table-${flowTarget}-${flowDirection}-direction-${direction}`
               )}
-              expression={`network.direction: "${escapeQueryValue(direction)}"`}
+              expression={`network.direction: ${escapeQueryValue(direction)}`}
               type={type}
               componentFilterType={'network'}
             >

x-pack/legacy/plugins/siem/public/lib/keury/index.test.ts

@@ -22,7 +22,7 @@ describe('Kuery escape', () => {
 
   it('should escape special characters', () => {
     const value = `This \\ has (a lot of) <special> characters, don't you *think*? "Yes."`;
-    const expected = `This \\\\ has \\(a lot of\\) \\<special\\> characters, don't you \\*think\\*? \\"Yes.\\"`;
+    const expected = `This \\ has (a lot of) <special> characters, don't you *think*? \\"Yes.\\"`;
     expect(escapeKuery(value)).to.be(expected);
   });
 
@@ -51,8 +51,8 @@ describe('Kuery escape', () => {
   });
 
   it('should escape both keywords and special characters', () => {
-    const value = 'Hello, world, and <nice> to meet you!';
-    const expected = 'Hello, world, \\and \\<nice\\> to meet you!';
+    const value = 'Hello, "world", and <nice> to meet you!';
+    const expected = 'Hello, \\"world\\", \\and <nice> to meet you!';
     expect(escapeKuery(value)).to.be(expected);
   });
 

x-pack/legacy/plugins/siem/public/lib/keury/index.ts

@@ -28,7 +28,7 @@ export const escapeQueryValue = (val: number | string = ''): string | number =>
     if (isEmpty(val)) {
       return '""';
     }
-    return val.split(' ').length > 1 ? `"${escapeKuery(val)}"` : escapeKuery(val);
+    return `"${escapeKuery(val)}"`;
   }
 
   return val;
@@ -52,7 +52,7 @@ const escapeWhitespace = (val: string) =>
     .replace(/\n/g, '\\n');
 
 // See the SpecialCharacter rule in kuery.peg
-const escapeSpecialCharacters = (val: string) => val.replace(/[\\():<>"*]/g, '\\$&'); // $& means the whole matched string
+const escapeSpecialCharacters = (val: string) => val.replace(/["]/g, '\\$&'); // $& means the whole matched string
 
 // See the Keyword rule in kuery.peg
 const escapeAndOr = (val: string) => val.replace(/(\s+)(and|or)(\s+)/gi, '$1\\$2$3');

x-pack/legacy/plugins/siem/public/pages/hosts/details/utils.ts

@@ -75,7 +75,7 @@ export const getFilterQuery = (
       : ''
     : convertKueryToElasticSearchQuery(
         `${filterQueryExpression} ${
-          hostName ? `and host.name: "${escapeQueryValue(hostName)}"` : ''
+          hostName ? `and host.name: ${escapeQueryValue(hostName)}` : ''
         }`,
         indexPattern
       );

x-pack/legacy/plugins/siem/public/pages/hosts/helpers.ts

@@ -16,9 +16,9 @@ export const getHostDetailsEventsKqlQueryExpression = ({
 }): string => {
   if (filterQueryExpression.length) {
     return `${filterQueryExpression}${
-      hostName.length ? ` and host.name: "${escapeQueryValue(hostName)}"` : ''
+      hostName.length ? ` and host.name: ${escapeQueryValue(hostName)}` : ''
     }`;
   } else {
-    return hostName.length ? `host.name: "${escapeQueryValue(hostName)}"` : '';
+    return hostName.length ? `host.name: ${escapeQueryValue(hostName)}` : '';
   }
 };