[8.x] [Security Solution][Notes] - allow filtering by note association (

#195501) (#196508)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution][Notes] - allow filtering by note association
(#195501)](#195501)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Philippe
Oberti","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-10-16T09:32:51Z","message":"[Security
Solution][Notes] - allow filtering by note association
(#195501)","sha":"66708b26c5dd2918692d77da81edcd1d3836cec5","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["backport","release_note:skip","v9.0.0","Team:Threat
Hunting:Investigations","v8.16.0"],"title":"[Security Solution][Notes] -
allow filtering by note
association","number":195501,"url":"https://github.com/elastic/kibana/pull/195501","mergeCommit":{"message":"[Security
Solution][Notes] - allow filtering by note association
(#195501)","sha":"66708b26c5dd2918692d77da81edcd1d3836cec5"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/195501","number":195501,"mergeCommit":{"message":"[Security
Solution][Notes] - allow filtering by note association
(#195501)","sha":"66708b26c5dd2918692d77da81edcd1d3836cec5"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Philippe Oberti <[email protected]>

oas_docs/output/kibana.serverless.staging.yaml

@@ -15016,6 +15016,10 @@ paths:
           schema:
             nullable: true
             type: string
+        - in: query
+          name: associatedFilter
+          schema:
+            $ref: '#/components/schemas/Security_Timeline_API_AssociatedFilterType'
       responses:
         '200':
           content:
@@ -31680,6 +31684,14 @@ components:
     Security_Osquery_API_VersionOrUndefined:
       $ref: '#/components/schemas/Security_Osquery_API_Version'
       nullable: true
+    Security_Timeline_API_AssociatedFilterType:
+      description: Filter notes based on their association with a document or saved object.
+      enum:
+        - document_only
+        - saved_object_only
+        - document_and_saved_object
+        - orphan
+      type: string
     Security_Timeline_API_BareNote:
       type: object
       properties:

oas_docs/output/kibana.serverless.yaml

@@ -15016,6 +15016,10 @@ paths:
           schema:
             nullable: true
             type: string
+        - in: query
+          name: associatedFilter
+          schema:
+            $ref: '#/components/schemas/Security_Timeline_API_AssociatedFilterType'
       responses:
         '200':
           content:
@@ -31680,6 +31684,14 @@ components:
     Security_Osquery_API_VersionOrUndefined:
       $ref: '#/components/schemas/Security_Osquery_API_Version'
       nullable: true
+    Security_Timeline_API_AssociatedFilterType:
+      description: Filter notes based on their association with a document or saved object.
+      enum:
+        - document_only
+        - saved_object_only
+        - document_and_saved_object
+        - orphan
+      type: string
     Security_Timeline_API_BareNote:
       type: object
       properties:

oas_docs/output/kibana.staging.yaml

@@ -18446,6 +18446,10 @@ paths:
           schema:
             nullable: true
             type: string
+        - in: query
+          name: associatedFilter
+          schema:
+            $ref: '#/components/schemas/Security_Timeline_API_AssociatedFilterType'
       responses:
         '200':
           content:
@@ -40445,6 +40449,14 @@ components:
     Security_Osquery_API_VersionOrUndefined:
       $ref: '#/components/schemas/Security_Osquery_API_Version'
       nullable: true
+    Security_Timeline_API_AssociatedFilterType:
+      description: Filter notes based on their association with a document or saved object.
+      enum:
+        - document_only
+        - saved_object_only
+        - document_and_saved_object
+        - orphan
+      type: string
     Security_Timeline_API_BareNote:
       type: object
       properties:

oas_docs/output/kibana.yaml

@@ -18446,6 +18446,10 @@ paths:
           schema:
             nullable: true
             type: string
+        - in: query
+          name: associatedFilter
+          schema:
+            $ref: '#/components/schemas/Security_Timeline_API_AssociatedFilterType'
       responses:
         '200':
           content:
@@ -40445,6 +40449,14 @@ components:
     Security_Osquery_API_VersionOrUndefined:
       $ref: '#/components/schemas/Security_Osquery_API_Version'
       nullable: true
+    Security_Timeline_API_AssociatedFilterType:
+      description: Filter notes based on their association with a document or saved object.
+      enum:
+        - document_only
+        - saved_object_only
+        - document_and_saved_object
+        - orphan
+      type: string
     Security_Timeline_API_BareNote:
       type: object
       properties:

x-pack/plugins/security_solution/common/api/timeline/get_notes/get_notes_route.gen.ts

@@ -18,6 +18,19 @@ import { z } from '@kbn/zod';
 
 import { Note } from '../model/components.gen';
 
+/**
+ * Filter notes based on their association with a document or saved object.
+ */
+export type AssociatedFilterType = z.infer<typeof AssociatedFilterType>;
+export const AssociatedFilterType = z.enum([
+  'document_only',
+  'saved_object_only',
+  'document_and_saved_object',
+  'orphan',
+]);
+export type AssociatedFilterTypeEnum = typeof AssociatedFilterType.enum;
+export const AssociatedFilterTypeEnum = AssociatedFilterType.enum;
+
 export type DocumentIds = z.infer<typeof DocumentIds>;
 export const DocumentIds = z.union([z.array(z.string()), z.string()]);
 
@@ -41,6 +54,7 @@ export const GetNotesRequestQuery = z.object({
   sortOrder: z.string().nullable().optional(),
   filter: z.string().nullable().optional(),
   userFilter: z.string().nullable().optional(),
+  associatedFilter: AssociatedFilterType.optional(),
 });
 export type GetNotesRequestQueryInput = z.input<typeof GetNotesRequestQuery>;
 

x-pack/plugins/security_solution/common/api/timeline/get_notes/get_notes_route.schema.yaml

@@ -56,6 +56,10 @@ paths:
           schema:
             nullable: true
             type: string
+        - name: associatedFilter
+          in: query
+          schema:
+            $ref: '#/components/schemas/AssociatedFilterType'
       responses:
         '200':
           description: Indicates the requested notes were returned.
@@ -68,6 +72,14 @@ paths:
 
 components:
   schemas:
+    AssociatedFilterType:
+        type: string
+        enum:
+            - document_only
+            - saved_object_only
+            - document_and_saved_object
+            - orphan
+        description: Filter notes based on their association with a document or saved object.
     DocumentIds:
       oneOf:
         - type: array

x-pack/plugins/security_solution/common/notes/constants.ts

@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export enum AssociatedFilter {
+  all = 'all',
+  documentOnly = 'document_only',
+  savedObjectOnly = 'saved_object_only',
+  documentAndSavedObject = 'document_and_saved_object',
+  orphan = 'orphan',
+}

x-pack/plugins/security_solution/docs/openapi/ess/security_solution_timeline_api_2023_10_31.bundled.schema.yaml

@@ -101,6 +101,10 @@ paths:
           schema:
             nullable: true
             type: string
+        - in: query
+          name: associatedFilter
+          schema:
+            $ref: '#/components/schemas/AssociatedFilterType'
       responses:
         '200':
           content:
@@ -908,6 +912,14 @@ paths:
         - 'access:securitySolution'
 components:
   schemas:
+    AssociatedFilterType:
+      description: Filter notes based on their association with a document or saved object.
+      enum:
+        - document_only
+        - saved_object_only
+        - document_and_saved_object
+        - orphan
+      type: string
     BareNote:
       type: object
       properties:

x-pack/plugins/security_solution/docs/openapi/serverless/security_solution_timeline_api_2023_10_31.bundled.schema.yaml

@@ -101,6 +101,10 @@ paths:
           schema:
             nullable: true
             type: string
+        - in: query
+          name: associatedFilter
+          schema:
+            $ref: '#/components/schemas/AssociatedFilterType'
       responses:
         '200':
           content:
@@ -908,6 +912,14 @@ paths:
         - 'access:securitySolution'
 components:
   schemas:
+    AssociatedFilterType:
+      description: Filter notes based on their association with a document or saved object.
+      enum:
+        - document_only
+        - saved_object_only
+        - document_and_saved_object
+        - orphan
+      type: string
     BareNote:
       type: object
       properties:

x-pack/plugins/security_solution/public/common/mock/global_state.ts

@@ -7,6 +7,7 @@
 
 import { TableId } from '@kbn/securitysolution-data-table';
 import type { DataViewSpec } from '@kbn/data-views-plugin/public';
+import { AssociatedFilter } from '../../../common/notes/constants';
 import { ReqStatus } from '../../notes/store/notes.slice';
 import { HostsFields } from '../../../common/api/search_strategy/hosts/model/sort';
 import { InputsModelId } from '../store/inputs/constants';
@@ -550,6 +551,7 @@ export const mockGlobalState: State = {
     },
     filter: '',
     userFilter: '',
+    associatedFilter: AssociatedFilter.all,
     search: '',
     selectedIds: [],
     pendingDeleteIds: [],

x-pack/plugins/security_solution/public/notes/api/api.ts

@@ -11,6 +11,7 @@ import type {
   GetNotesResponse,
   PersistNoteRouteResponse,
 } from '../../../common/api/timeline';
+import type { AssociatedFilter } from '../../../common/notes/constants';
 import { KibanaServices } from '../../common/lib/kibana';
 import { NOTE_URL } from '../../../common/constants';
 
@@ -43,6 +44,7 @@ export const fetchNotes = async ({
   sortOrder,
   filter,
   userFilter,
+  associatedFilter,
   search,
 }: {
   page: number;
@@ -51,6 +53,7 @@ export const fetchNotes = async ({
   sortOrder: string;
   filter: string;
   userFilter: string;
+  associatedFilter: AssociatedFilter;
   search: string;
 }) => {
   const response = await KibanaServices.get().http.get<GetNotesResponse>(NOTE_URL, {
@@ -61,6 +64,7 @@ export const fetchNotes = async ({
       sortOrder,
       filter,
       userFilter,
+      associatedFilter,
       search,
     },
     version: '2023-10-31',

x-pack/plugins/security_solution/public/notes/components/search_row.test.tsx

@@ -9,7 +9,8 @@ import { fireEvent, render, screen } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import React from 'react';
 import { SearchRow } from './search_row';
-import { SEARCH_BAR_TEST_ID, USER_SELECT_TEST_ID } from './test_ids';
+import { ASSOCIATED_NOT_SELECT_TEST_ID, SEARCH_BAR_TEST_ID, USER_SELECT_TEST_ID } from './test_ids';
+import { AssociatedFilter } from '../../../common/notes/constants';
 import { useSuggestUsers } from '../../common/components/user_profiles/use_suggest_users';
 
 jest.mock('../../common/components/user_profiles/use_suggest_users');
@@ -38,6 +39,7 @@ describe('SearchRow', () => {
 
     expect(getByTestId(SEARCH_BAR_TEST_ID)).toBeInTheDocument();
     expect(getByTestId(USER_SELECT_TEST_ID)).toBeInTheDocument();
+    expect(getByTestId(ASSOCIATED_NOT_SELECT_TEST_ID)).toBeInTheDocument();
   });
 
   it('should call the correct action when entering a value in the search bar', async () => {
@@ -62,4 +64,13 @@ describe('SearchRow', () => {
 
     expect(mockDispatch).toHaveBeenCalled();
   });
+
+  it('should call the correct action when select a value in the associated note dropdown', async () => {
+    const { getByTestId } = render(<SearchRow />);
+
+    const associatedNoteSelect = getByTestId(ASSOCIATED_NOT_SELECT_TEST_ID);
+    await userEvent.selectOptions(associatedNoteSelect, [AssociatedFilter.documentOnly]);
+
+    expect(mockDispatch).toHaveBeenCalled();
+  });
 });

x-pack/plugins/security_solution/public/notes/components/search_row.tsx

@@ -5,30 +5,48 @@
  * 2.0.
  */
 
-import { EuiComboBox, EuiFlexGroup, EuiFlexItem, EuiSearchBar } from '@elastic/eui';
 import React, { useMemo, useCallback, useState } from 'react';
+import type { EuiSelectOption } from '@elastic/eui';
+import {
+  EuiComboBox,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSearchBar,
+  EuiSelect,
+  useGeneratedHtmlId,
+} from '@elastic/eui';
 import { useDispatch } from 'react-redux';
 import type { UserProfileWithAvatar } from '@kbn/user-profile-components';
 import { i18n } from '@kbn/i18n';
 import type { EuiComboBoxOptionOption } from '@elastic/eui/src/components/combo_box/types';
-import { SEARCH_BAR_TEST_ID, USER_SELECT_TEST_ID } from './test_ids';
+import { ASSOCIATED_NOT_SELECT_TEST_ID, SEARCH_BAR_TEST_ID, USER_SELECT_TEST_ID } from './test_ids';
 import { useSuggestUsers } from '../../common/components/user_profiles/use_suggest_users';
-import { userFilterUsers, userSearchedNotes } from '..';
+import { userFilterAssociatedNotes, userFilterUsers, userSearchedNotes } from '..';
+import { AssociatedFilter } from '../../../common/notes/constants';
 
 export const USERS_DROPDOWN = i18n.translate('xpack.securitySolution.notes.usersDropdownLabel', {
   defaultMessage: 'Users',
 });
+const FILTER_SELECT = i18n.translate('xpack.securitySolution.notes.management.filterSelect', {
+  defaultMessage: 'Select filter',
+});
+
+const searchBox = {
+  placeholder: 'Search note contents',
+  incremental: false,
+  'data-test-subj': SEARCH_BAR_TEST_ID,
+};
+const associatedNoteSelectOptions: EuiSelectOption[] = [
+  { value: AssociatedFilter.all, text: 'All' },
+  { value: AssociatedFilter.documentOnly, text: 'Attached to document only' },
+  { value: AssociatedFilter.savedObjectOnly, text: 'Attached to timeline only' },
+  { value: AssociatedFilter.documentAndSavedObject, text: 'Attached to document and timeline' },
+  { value: AssociatedFilter.orphan, text: 'Orphan' },
+];
 
 export const SearchRow = React.memo(() => {
   const dispatch = useDispatch();
-  const searchBox = useMemo(
-    () => ({
-      placeholder: 'Search note contents',
-      incremental: false,
-      'data-test-subj': SEARCH_BAR_TEST_ID,
-    }),
-    []
-  );
+  const associatedSelectId = useGeneratedHtmlId({ prefix: 'associatedSelectId' });
 
   const onQueryChange = useCallback(
     ({ queryText }: { queryText: string }) => {
@@ -57,6 +75,13 @@ export const SearchRow = React.memo(() => {
     [dispatch]
   );
 
+  const onAssociatedNoteSelectChange = useCallback(
+    (e: React.ChangeEvent<HTMLSelectElement>) => {
+      dispatch(userFilterAssociatedNotes(e.target.value as AssociatedFilter));
+    },
+    [dispatch]
+  );
+
   return (
     <EuiFlexGroup gutterSize="m">
       <EuiFlexItem>
@@ -73,6 +98,16 @@ export const SearchRow = React.memo(() => {
           data-test-subj={USER_SELECT_TEST_ID}
         />
       </EuiFlexItem>
+      <EuiFlexItem grow={false}>
+        <EuiSelect
+          id={associatedSelectId}
+          options={associatedNoteSelectOptions}
+          onChange={onAssociatedNoteSelectChange}
+          prepend={FILTER_SELECT}
+          aria-label={FILTER_SELECT}
+          data-test-subj={ASSOCIATED_NOT_SELECT_TEST_ID}
+        />
+      </EuiFlexItem>
     </EuiFlexGroup>
   );
 });