[Entity Analytics] Show Asset Criticality in Risk Input Left Flyout

x-pack/plugins/security_solution/common/entity_analytics/asset_criticality/types.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { AssetCriticalityRecord } from '../../api/entity_analytics/asset_criticality';
+
+export type CriticalityLevel = AssetCriticalityRecord['criticality_level'];

x-pack/plugins/security_solution/common/entity_analytics/risk_engine/types.ts

@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import type { CriticalityLevel } from '../asset_criticality/types';
 import type { RiskCategories } from './risk_weights/types';
 
 export enum RiskScoreEntity {
@@ -56,9 +57,9 @@ export interface RiskScore {
   '@timestamp': string;
   id_field: string;
   id_value: string;
-  criticality_level?: string | undefined;
+  criticality_level?: CriticalityLevel;
   criticality_modifier?: number | undefined;
-  calculated_level: string;
+  calculated_level: RiskLevels;
   calculated_score: number;
   calculated_score_norm: number;
   category_1_score: number;

x-pack/plugins/security_solution/common/search_strategy/security_solution/risk_score/all/index.ts

@@ -8,10 +8,8 @@
 import type { IEsSearchResponse } from '@kbn/data-plugin/common';
 
 import type { Inspect, Maybe, SortField } from '../../../common';
-import {
-  type RiskInputs,
-  RiskLevels as RiskSeverity,
-} from '../../../../entity_analytics/risk_engine';
+import type { RiskScore } from '../../../../entity_analytics/risk_engine';
+import { RiskLevels as RiskSeverity } from '../../../../entity_analytics/risk_engine';
 
 export interface HostsRiskScoreStrategyResponse extends IEsSearchResponse {
   inspect?: Maybe<Inspect>;
@@ -25,12 +23,9 @@ export interface UsersRiskScoreStrategyResponse extends IEsSearchResponse {
   data: UserRiskScore[] | undefined;
 }
 
-export interface RiskStats {
+export interface RiskStats extends RiskScore {
   rule_risks: RuleRisk[];
-  calculated_score_norm: number;
   multipliers: string[];
-  calculated_level: RiskSeverity;
-  inputs?: RiskInputs;
 }
 
 export { RiskSeverity };

x-pack/plugins/security_solution/public/entity_analytics/common/get_alerts_query_for_risk_score.test.ts

@@ -5,13 +5,24 @@
  * 2.0.
  */
 import { getAlertsQueryForRiskScore } from './get_alerts_query_for_risk_score';
+import type { RiskStats } from '../../../common/search_strategy/security_solution/risk_score/all';
 import { RiskSeverity } from '../../../common/search_strategy/security_solution/risk_score/all';
 
-const risk = {
+const risk: RiskStats = {
   calculated_level: RiskSeverity.critical,
   calculated_score_norm: 70,
   rule_risks: [],
   multipliers: [],
+  '@timestamp': '',
+  id_field: '',
+  id_value: '',
+  calculated_score: 0,
+  category_1_score: 0,
+  category_1_count: 0,
+  category_2_score: 0,
+  category_2_count: 0,
+  notes: [],
+  inputs: [],
 };
 
 describe('getAlertsQueryForRiskScore', () => {

x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/asset_criticality_badge.tsx

@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { EuiHealth, EuiText } from '@elastic/eui';
+import { euiLightVars } from '@kbn/ui-theme';
+import { CRITICALITY_LEVEL_TITLE, CRITICALITY_LEVEL_DESCRIPTION } from './translations';
+import type { CriticalityLevel } from '../../../../common/entity_analytics/asset_criticality/types';
+
+const CRITICALITY_LEVEL_COLOR: Record<CriticalityLevel, string> = {
+  very_important: '#E7664C',
+  important: '#D6BF57',
+  normal: '#54B399',
+  not_important: euiLightVars.euiColorMediumShade,
+};
+
+export const AssetCriticalityBadge: React.FC<{
+  criticalityLevel: CriticalityLevel;
+  withDescription?: boolean;
+  style?: React.CSSProperties;
+  dataTestSubj?: string;
+}> = ({
+  criticalityLevel,
+  style,
+  dataTestSubj = 'asset-criticality-badge',
+  withDescription = false,
+}) => {
+  const showDescription = withDescription ?? false;
+  const badgeContent = showDescription ? (
+    <>
+      <strong>{CRITICALITY_LEVEL_TITLE[criticalityLevel]}</strong>
+      <EuiText size="s" color="subdued">
+        <p>{CRITICALITY_LEVEL_DESCRIPTION[criticalityLevel]}</p>
+      </EuiText>
+    </>
+  ) : (
+    CRITICALITY_LEVEL_TITLE[criticalityLevel]
+  );
+
+  return (
+    <EuiHealth
+      data-test-subj={dataTestSubj}
+      color={CRITICALITY_LEVEL_COLOR[criticalityLevel]}
+      style={style}
+    >
+      {badgeContent}
+    </EuiHealth>
+  );
+};

x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/asset_criticality_selector.tsx

@@ -6,7 +6,6 @@
  */
 
 import type { EuiSuperSelectOption } from '@elastic/eui';
-
 import {
   EuiAccordion,
   EuiButton,
@@ -26,21 +25,14 @@ import {
   EuiHorizontalRule,
   useEuiTheme,
 } from '@elastic/eui';
-
 import React, { useState } from 'react';
-
 import { FormattedMessage } from '@kbn/i18n-react';
-
 import { css } from '@emotion/react';
-import {
-  CRITICALITY_LEVEL_DESCRIPTION,
-  CRITICALITY_LEVEL_TITLE,
-  PICK_ASSET_CRITICALITY,
-} from './translations';
+import { PICK_ASSET_CRITICALITY } from './translations';
+import { AssetCriticalityBadge } from './asset_criticality_badge';
 import type { Entity, ModalState, State } from './use_asset_criticality';
 import { useAssetCriticalityData, useCriticalityModal } from './use_asset_criticality';
-import type { CriticalityLevel } from './common';
-import { CRITICALITY_LEVEL_COLOR } from './common';
+import type { CriticalityLevel } from '../../../../common/entity_analytics/asset_criticality/types';
 
 interface Props {
   entity: Entity;
@@ -87,12 +79,10 @@ export const AssetCriticalitySelector: React.FC<Props> = ({ entity }) => {
             <EuiFlexItem>
               <EuiText size="s">
                 {criticality.status === 'update' && criticality.query.data?.criticality_level ? (
-                  <EuiHealth
-                    data-test-subj="asset-criticality-level"
-                    color={CRITICALITY_LEVEL_COLOR[criticality.query.data.criticality_level]}
-                  >
-                    {CRITICALITY_LEVEL_TITLE[criticality.query.data.criticality_level]}
-                  </EuiHealth>
+                  <AssetCriticalityBadge
+                    criticalityLevel={criticality.query.data.criticality_level}
+                    dataTestSubj="asset-criticality-level"
+                  />
                 ) : (
                   <EuiHealth color="subdued">
                     <FormattedMessage
@@ -194,21 +184,15 @@ const AssetCriticalityModal: React.FC<ModalProps> = ({ criticality, modal, entit
 const option = (level: CriticalityLevel): EuiSuperSelectOption<CriticalityLevel> => ({
   value: level,
   dropdownDisplay: (
-    <EuiHealth
-      color={CRITICALITY_LEVEL_COLOR[level]}
+    <AssetCriticalityBadge
+      criticalityLevel={level}
       style={{ lineHeight: 'inherit' }}
-      data-test-subj="asset-criticality-modal-select-option"
-    >
-      <strong>{CRITICALITY_LEVEL_TITLE[level]}</strong>
-      <EuiText size="s" color="subdued">
-        <p>{CRITICALITY_LEVEL_DESCRIPTION[level]}</p>
-      </EuiText>
-    </EuiHealth>
+      dataTestSubj="asset-criticality-modal-select-option"
+      withDescription
+    />
   ),
   inputDisplay: (
-    <EuiHealth color={CRITICALITY_LEVEL_COLOR[level]} style={{ lineHeight: 'inherit' }}>
-      {CRITICALITY_LEVEL_TITLE[level]}
-    </EuiHealth>
+    <AssetCriticalityBadge criticalityLevel={level} style={{ lineHeight: 'inherit' }} />
   ),
 });
 const options: Array<EuiSuperSelectOption<CriticalityLevel>> = [

x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/index.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './asset_criticality_badge';
+export * from './common';

x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/translations.ts

@@ -6,7 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import type { CriticalityLevel } from './common';
+import type { CriticalityLevel } from '../../../../common/entity_analytics/asset_criticality/types';
 
 export const PICK_ASSET_CRITICALITY = i18n.translate(
   'xpack.securitySolution.entityAnalytics.assetCriticality.pickerText',

x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality/use_asset_criticality.ts

@@ -14,7 +14,16 @@ import type { AssetCriticalityRecord } from '../../../../common/api/entity_analy
 import type { EntityAnalyticsPrivileges } from '../../../../common/api/entity_analytics/common';
 import type { AssetCriticality } from '../../api/api';
 import { useEntityAnalyticsRoutes } from '../../api/api';
-import { buildCriticalityQueryKeys } from './common';
+
+// SUGGESTION: @tiansivive Move this to some more general place within Entity Analytics
+export const buildCriticalityQueryKeys = (id: string) => {
+  const ASSET_CRITICALITY = 'ASSET_CRITICALITY';
+  const PRIVILEGES = 'PRIVILEGES';
+  return {
+    doc: [ASSET_CRITICALITY, id],
+    privileges: [ASSET_CRITICALITY, PRIVILEGES, id],
+  };
+};
 
 export const useAssetCriticalityData = (entity: Entity, modal: ModalState): State => {
   const QC = useQueryClient();