[Security Solution] Add nested field inside of data provider (#93721) (…

…#94080)

* add nested field inside of dataprovider

* make sure to get nested

* fix elq server side

* add mock for nested attributes

* Add basic tests for nested fields query generation

* Update snapshots and failing tests with nestedFields

* fix nested date

Co-authored-by: Kevin Qualters <kevin.qualters@elastic.co>

Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>
Co-authored-by: Kevin Qualters <kevin.qualters@elastic.co>
Co-authored-by: MadameSheema <snootchie.boochies@gmail.com>

x-pack/plugins/security_solution/common/search_strategy/index_fields/index.ts

@@ -71,6 +71,12 @@ export interface BrowserField {
   name: string;
   searchable: boolean;
   type: string;
+  subType?: {
+    [key: string]: unknown;
+    nested?: {
+      path: string;
+    };
+  };
 }
 
 export type BrowserFields = Readonly<Record<string, Partial<BrowserField>>>;

x-pack/plugins/security_solution/public/common/components/query_bar/index.test.tsx

@@ -163,6 +163,18 @@ describe('QueryBar ', () => {
               searchable: true,
               type: 'string',
             },
+            {
+              aggregatable: false,
+              name: 'nestedField.firstAttributes',
+              searchable: true,
+              type: 'string',
+            },
+            {
+              aggregatable: false,
+              name: 'nestedField.secondAttributes',
+              searchable: true,
+              type: 'string',
+            },
           ],
           title: 'filebeat-*,auditbeat-*,packetbeat-*',
         },
@@ -174,6 +186,7 @@ describe('QueryBar ', () => {
         query: 'here: query',
       },
       refreshInterval: undefined,
+      savedQuery: undefined,
       showAutoRefreshOnly: false,
       showDatePicker: false,
       showFilterBar: true,

x-pack/plugins/security_solution/public/common/containers/source/mock.ts

@@ -294,6 +294,38 @@ export const mocksSource = {
       searchable: true,
       type: 'date',
     },
+    {
+      aggregatable: false,
+      category: 'nestedField',
+      description: '',
+      example: '',
+      format: '',
+      indexes: ['auditbeat', 'filebeat', 'packetbeat'],
+      name: 'nestedField.firstAttributes',
+      searchable: true,
+      type: 'string',
+      subType: {
+        nested: {
+          path: 'nestedField',
+        },
+      },
+    },
+    {
+      aggregatable: false,
+      category: 'nestedField',
+      description: '',
+      example: '',
+      format: '',
+      indexes: ['auditbeat', 'filebeat', 'packetbeat'],
+      name: 'nestedField.secondAttributes',
+      searchable: true,
+      type: 'string',
+      subType: {
+        nested: {
+          path: 'nestedField',
+        },
+      },
+    },
   ],
 };
 
@@ -646,6 +678,42 @@ export const mockBrowserFields: BrowserFields = {
       },
     },
   },
+  nestedField: {
+    fields: {
+      'nestedField.firstAttributes': {
+        aggregatable: false,
+        category: 'nestedField',
+        description: '',
+        example: '',
+        format: '',
+        indexes: ['auditbeat', 'filebeat', 'packetbeat'],
+        name: 'nestedField.firstAttributes',
+        searchable: true,
+        type: 'string',
+        subType: {
+          nested: {
+            path: 'nestedField',
+          },
+        },
+      },
+      'nestedField.secondAttributes': {
+        aggregatable: false,
+        category: 'nestedField',
+        description: '',
+        example: '',
+        format: '',
+        indexes: ['auditbeat', 'filebeat', 'packetbeat'],
+        name: 'nestedField.secondAttributes',
+        searchable: true,
+        type: 'string',
+        subType: {
+          nested: {
+            path: 'nestedField',
+          },
+        },
+      },
+    },
+  },
 };
 
 export const mockDocValueFields: DocValueFields[] = [

x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx

@@ -104,7 +104,11 @@ export const useInitSourcerer = (
           selectedPatterns: [signalIndexName],
         })
       );
-    } else if (signalIndexNameSelector != null && initialTimelineSourcerer.current) {
+    } else if (
+      scopeId === SourcererScopeName.detections &&
+      signalIndexNameSelector != null &&
+      initialTimelineSourcerer.current
+    ) {
       initialDetectionSourcerer.current = false;
       dispatch(
         sourcererActions.setSelectedIndexPatterns({

x-pack/plugins/security_solution/public/common/mock/index_pattern.ts

@@ -93,6 +93,18 @@ export const mockIndexPattern: IIndexPattern = {
       type: 'string',
       aggregatable: true,
     },
+    {
+      name: 'nestedField.firstAttributes',
+      searchable: true,
+      type: 'string',
+      aggregatable: false,
+    },
+    {
+      name: 'nestedField.secondAttributes',
+      searchable: true,
+      type: 'string',
+      aggregatable: false,
+    },
   ],
   title: 'filebeat-*,auditbeat-*,packetbeat-*',
 };

x-pack/plugins/security_solution/public/hosts/pages/details/details_tabs.test.tsx

@@ -120,6 +120,18 @@ describe('body', () => {
             { name: 'agent.test7', searchable: true, type: 'string', aggregatable: true },
             { name: 'agent.test8', searchable: true, type: 'string', aggregatable: true },
             { name: 'host.name', searchable: true, type: 'string', aggregatable: true },
+            {
+              aggregatable: false,
+              name: 'nestedField.firstAttributes',
+              searchable: true,
+              type: 'string',
+            },
+            {
+              aggregatable: false,
+              name: 'nestedField.secondAttributes',
+              searchable: true,
+              type: 'string',
+            },
           ],
           title: 'filebeat-*,auditbeat-*,packetbeat-*',
         },

x-pack/plugins/security_solution/public/timelines/components/edit_data_provider/helpers.test.tsx

@@ -82,6 +82,17 @@ describe('helpers', () => {
           ],
         },
         { label: 'event', options: [{ label: 'event.end' }] },
+        {
+          label: 'nestedField',
+          options: [
+            {
+              label: 'nestedField.firstAttributes',
+            },
+            {
+              label: 'nestedField.secondAttributes',
+            },
+          ],
+        },
         { label: 'source', options: [{ label: 'source.ip' }, { label: 'source.port' }] },
       ]);
     });

x-pack/plugins/security_solution/public/timelines/components/fields_browser/header.test.tsx

@@ -217,7 +217,7 @@ describe('Header', () => {
     );
 
     expect(wrapper.find('[data-test-subj="categories-count"]').first().text()).toEqual(
-      '9 categories'
+      '10 categories'
     );
   });
 
@@ -254,6 +254,6 @@ describe('Header', () => {
       </TestProviders>
     );
 
-    expect(wrapper.find('[data-test-subj="fields-count"]').first().text()).toEqual('25 fields');
+    expect(wrapper.find('[data-test-subj="fields-count"]').first().text()).toEqual('27 fields');
   });
 });