maxmustermann/kibana
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

[Security Solution] [Detections] Update search after to use one single date range filter (#86921) (#87428)

Browse source 
## Summary

Ref: https://github.com/elastic/kibana/issues/86874



replaces `should` with a single lower bounded and upper bounded date range filter.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: Devin W. Hurley <devin.hurley@elastic.co>
This commit is contained in:
Garrett Spong 2021-01-06 03:02:14 -07:00 committed by GitHub
parent 24f9ed1e0e
commit da64375fa5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 42 additions and 189 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

198
x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts
View file

@ -38,33 +38,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
@ -118,33 +97,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
@ -199,33 +157,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
@ -281,33 +218,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
@ -362,33 +278,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
@ -445,33 +340,12 @@ describe('create_signals', () => {
bool: {
filter: [
{
bool: {
should: [
{
range: {
'@timestamp': {
gte: 'now-5m',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
'@timestamp': {
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
'@timestamp': {
gte: 'now-5m',
lte: 'today',
format: 'strict_date_optional_time',
},
},
},
],

33
x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.ts
View file

@ -49,33 +49,12 @@ export const buildEventsSearchQuery = ({
const rangeFilter: unknown[] = [
{
bool: {
should: [
{
range: {
[sortField]: {
gte: from,
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
range: {
[sortField]: {
lte: to,
format: 'strict_date_optional_time',
},
},
},
],
minimum_should_match: 1,
range: {
[sortField]: {
lte: to,
gte: from,
format: 'strict_date_optional_time',
},
},
},
];