[Security Solution] [Endpoint] Allow add endpoint event filter option…

… from users events tab (#132238) (#132254) * Allow add endpoint event filter option from users events tab * Updates var name (cherry picked from commit b5d8f51) Co-authored-by: David Sánchez <david.sanchezsoler@elastic.co>
elastic · May 16, 2022 · 915bf7b · 915bf7b
1 parent bd49aeb
commit 915bf7b
Show file tree

Hide file tree

Showing 2 changed files with 51 additions and 7 deletions.
diff --git a/...on/public/detections/components/alerts_table/timeline_actions/alert_context_menu.test.tsx b/...on/public/detections/components/alerts_table/timeline_actions/alert_context_menu.test.tsx
@@ -191,6 +191,36 @@ describe('InvestigateInResolverAction', () => {
         expect(wrapper.find(addEndpointEventFilterButton).first().exists()).toEqual(true);
         expect(wrapper.find(addEndpointEventFilterButton).first().props().disabled).toEqual(true);
       });
+
+      test('it enables AddEndpointEventFilter when timeline id is user events page', () => {
+        const wrapper = mount(
+          <AlertContextMenu {...endpointEventProps} timelineId={TimelineId.usersPageEvents} />,
+          {
+            wrappingComponent: TestProviders,
+          }
+        );
+
+        wrapper.find(actionMenuButton).simulate('click');
+        expect(wrapper.find(addEndpointEventFilterButton).first().exists()).toEqual(true);
+        expect(wrapper.find(addEndpointEventFilterButton).first().props().disabled).toEqual(false);
+      });
+
+      test('it disables AddEndpointEventFilter when timeline id is user events page but is not from endpoint', () => {
+        const customProps = {
+          ...props,
+          ecsRowData: { ...ecsRowData, agent: { type: ['other'] }, event: { kind: ['event'] } },
+        };
+        const wrapper = mount(
+          <AlertContextMenu {...customProps} timelineId={TimelineId.usersPageEvents} />,
+          {
+            wrappingComponent: TestProviders,
+          }
+        );
+
+        wrapper.find(actionMenuButton).simulate('click');
+        expect(wrapper.find(addEndpointEventFilterButton).first().exists()).toEqual(true);
+        expect(wrapper.find(addEndpointEventFilterButton).first().props().disabled).toEqual(true);
+      });
     });
     describe('when users can NOT access endpoint management', () => {
       beforeEach(() => {
@@ -212,6 +242,19 @@ describe('InvestigateInResolverAction', () => {
         expect(wrapper.find(addEndpointEventFilterButton).first().exists()).toEqual(true);
         expect(wrapper.find(addEndpointEventFilterButton).first().props().disabled).toEqual(true);
       });
+
+      test('it disables AddEndpointEventFilter when timeline id is user events page but cannot acces endpoint management', () => {
+        const wrapper = mount(
+          <AlertContextMenu {...endpointEventProps} timelineId={TimelineId.usersPageEvents} />,
+          {
+            wrappingComponent: TestProviders,
+          }
+        );
+
+        wrapper.find(actionMenuButton).simulate('click');
+        expect(wrapper.find(addEndpointEventFilterButton).first().exists()).toEqual(true);
+        expect(wrapper.find(addEndpointEventFilterButton).first().props().disabled).toEqual(true);
+      });
     });
   });
 });
diff --git a/...olution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx b/...olution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
@@ -91,6 +91,10 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps & PropsFromRedux
   const isAgentEndpoint = useMemo(() => ecsRowData.agent?.type?.includes('endpoint'), [ecsRowData]);
 
   const isEndpointEvent = useMemo(() => isEvent && isAgentEndpoint, [isEvent, isAgentEndpoint]);
+  const timelineIdAllowsAddEndpointEventFilter = useMemo(
+    () => timelineId === TimelineId.hostsPageEvents || timelineId === TimelineId.usersPageEvents,
+    [timelineId]
+  );
 
   const onButtonClick = useCallback(() => {
     setPopover(!isPopoverOpen);
@@ -177,13 +181,10 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps & PropsFromRedux
   const { eventFilterActionItems } = useEventFilterAction({
     onAddEventFilterClick: handleOnAddEventFilterClick,
     disabled:
-      !isEndpointEvent ||
-      !canCreateEndpointEventFilters ||
-      timelineId !== TimelineId.hostsPageEvents,
-    tooltipMessage:
-      timelineId !== TimelineId.hostsPageEvents
-        ? i18n.ACTION_ADD_EVENT_FILTER_DISABLED_TOOLTIP
-        : undefined,
+      !isEndpointEvent || !canCreateEndpointEventFilters || !timelineIdAllowsAddEndpointEventFilter,
+    tooltipMessage: !timelineIdAllowsAddEndpointEventFilter
+      ? i18n.ACTION_ADD_EVENT_FILTER_DISABLED_TOOLTIP
+      : undefined,
   });
   const items: React.ReactElement[] = useMemo(
     () =>