/*! Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements.
 * Licensed under the Elastic License 2.0; you may not use this file except in compliance with the Elastic License 2.0. */
(window.securitySolution_bundle_jsonpfunction=window.securitySolution_bundle_jsonpfunction||[]).push([[17,12],{1e3:function(e,t,n){var a=n(435),i=8;function r(e,t,n){var l=a(e,i,void 0,void 0,void 0,void 0,void 0,t=n?void 0:t);return l.placeholder=r.placeholder,l}r.placeholder={},e.exports=r},1001:function(e,t,n){var a=n(1002),i=n(440),r=n(1003);e.exports=function(e){if(!i(e))return!1;var t=a(e);return"[object Error]"==t||"[object DOMException]"==t||"string"==typeof e.message&&"string"==typeof e.name&&!r(e)}},1002:function(e,t,n){e.exports=n(33)(355)},1003:function(e,t,n){e.exports=n(33)(3667)},1004:function(e,t,n){var a=n(715),i=n(440);e.exports=function(e){return i(e)&&"[object WeakMap]"==a(e)}},1005:function(e,t,n){var a=n(628),i=n(904);e.exports=function(e){return i("function"==typeof e?e:a(e,1))}},1006:function(e,t,n){var a=n(1007),i=n(1009),r=n(632);e.exports=function(e){var t=i(e);return 1==t.length&&t[0][2]?r(t[0][0],t[0][1]):function(n){return n===e||a(n,e,t)}}},1007:function(e,t,n){var a=n(1008),i=n(630);e.exports=function(e,t,n,r){var l=n.length,o=l,s=!r;if(null==e)return!o;for(e=Object(e);l--;){var u=n[l];if(s&&u[2]?u[1]!==e[u[0]]:!(u[0]in e))return!1}for(;++l<o;){var c=(u=n[l])[0],d=e[c],m=u[1];if(s&&u[2]){if(void 0===d&&!(c in e))return!1}else{var p=new a;if(r)var b=r(d,m,c,e,t,p);if(!(void 0===b?i(m,d,3,r,p):b))return!1}}return!0}},1008:function(e,t,n){e.exports=n(33)(1599)},1009:function(e,t,n){var a=n(631),i=n(905);e.exports=function(e){for(var t=i(e),n=t.length;n--;){var r=t[n],l=e[r];t[n]=[r,l,a(l)]}return t}},1010:function(e,t,n){var a=n(630),i=n(1011),r=n(1012),l=n(634),o=n(631),s=n(632),u=n(288);e.exports=function(e,t){return l(e)&&o(t)?s(u(e),t):function(n){var l=i(n,e);return void 0===l&&l===t?r(n,e):a(t,l,3)}}},1011:function(e,t,n){e.exports=n(33)(1936)},1012:function(e,t,n){var a=n(1013),i=n(1014);e.exports=function(e,t){return null!=e&&i(e,t,a)}},1013:function(e,t){e.exports=function(e,t){return null!=e&&t in Object(e)}},1014:function(e,t,n){var a=n(633),i=n(716),r=n(258),l=n(442),o=n(1015),s=n(288);e.exports=function(e,t,n){for(var u=-1,c=(t=a(t,e)).length,d=!1;++u<c;){var m=s(t[u]);if(!(d=null!=e&&n(e,m)))break;e=e[m]}return d||++u!=c?d:!!(c=null==e?0:e.length)&&o(c)&&l(m,c)&&(r(e)||i(e))}},1015:function(e,t,n){e.exports=n(33)(1611)},1016:function(e,t,n){var a=n(1017),i=n(1018),r=n(634),l=n(288);e.exports=function(e){return r(e)?a(l(e)):i(e)}},1017:function(e,t){e.exports=function(e){return function(t){return null==t?void 0:t[e]}}},1018:function(e,t,n){var a=n(1019);e.exports=function(e){return function(t){return a(t,e)}}},1019:function(e,t,n){e.exports=n(33)(1652)},1020:function(e,t,n){var a=n(435),i=n(1021)((function(e,t){return a(e,256,void 0,void 0,void 0,t)}));e.exports=i},1021:function(e,t,n){e.exports=n(33)(3668)},1022:function(e,t,n){var a=n(1023),i=n(441),r=n(258),l=n(1024),o=n(1025),s=n(288),u=n(1026);e.exports=function(e){return r(e)?a(e,s):l(e)?[e]:i(o(u(e)))}},1023:function(e,t,n){e.exports=n(33)(1653)},1024:function(e,t,n){e.exports=n(33)(820)},1025:function(e,t,n){e.exports=n(33)(3636)},1026:function(e,t,n){e.exports=n(33)(3638)},1027:function(e,t,n){e.exports=n(1028)},1028:function(e,t,n){var a=n(635);e.exports=function(e,t,n){return null==e?e:a(e,t,n)}},1029:function(e,t,n){e.exports=n(33)(1655)},1030:function(e,t,n){var a=n(549)("setWith",n(1031));a.placeholder=n(550),e.exports=a},1031:function(e,t,n){e.exports=n(1032)},1032:function(e,t,n){var a=n(635);e.exports=function(e,t,n,i){return i="function"==typeof i?i:void 0,null==e?e:a(e,t,n,i)}},1037:function(e,t){e.exports="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxzdmcgd2lkdGg9IjI1NnB4IiBoZWlnaHQ9IjI1NXB4IiB2aWV3Qm94PSIwIDAgMjU2IDI1NSIgdmVyc2lvbj0iMS4xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiBwcmVzZXJ2ZUFzcGVjdFJhdGlvPSJ4TWlkWU1pZCI+Cgk8Zz4KCQk8cGF0aCBkPSJNMjU1LjIxNDYxNywwLjI1NzU4MDI0NyBMMjU1LjIxNDYxNyw2My45OTM2NzkgTDE5MS42MDk2NzksMTI3LjU5ODYxNyBMMTkxLjYwOTY3OSw2My43Mjk3Nzc4IEwyNTUuMjE0NjE3LDAuMjU3NTgwMjQ3IiBmaWxsPSIjQTU5NkZGIj48L3BhdGg+CgkJPHBhdGggZD0iTTEyOC4wMDYzMjEsMC4yNTc1ODAyNDcgTDEyOC4wMDYzMjEsNjMuOTkzNjc5IEwxOTEuNjExMjU5LDEyNy41OTg2MTcgTDE5MS42MTEyNTksNjMuNzI5Nzc3OCBMMTI4LjAwNjMyMSwwLjI1NzU4MDI0NyIgZmlsbD0iIzAwMDAwMCI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0yNTUuMzQ1Nzc4LDI1NC44MDM3NTMgTDE5MS42MDk2NzksMjU0LjgwMzc1MyBMMTI4LjAwNDc0MSwxOTEuMTk4ODE1IEwxOTEuODcyLDE5MS4xOTg4MTUgTDI1NS4zNDU3NzgsMjU0LjgwMzc1MyIgZmlsbD0iI0E1OTZGRiI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0yNTUuMzQ1Nzc4LDEyNy41OTU0NTcgTDE5MS42MDk2NzksMTI3LjU5NTQ1NyBMMTI4LjAwNDc0MSwxOTEuMjAwMzk1IEwxOTEuODcyLDE5MS4yMDAzOTUgTDI1NS4zNDU3NzgsMTI3LjU5NTQ1NyIgZmlsbD0iIzAwMDAwMCI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0wLjgwMTE4NTE4NSwyNTQuOTM2NDk0IEwwLjgwMTE4NTE4NSwxOTEuMTk4ODE1IEw2NC40MDYxMjM1LDEyNy41OTM4NzcgTDY0LjQwNjEyMzUsMTkxLjQ2MjcxNiBMMC44MDExODUxODUsMjU0LjkzNjQ5NCIgZmlsbD0iI0E1OTZGRiI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0xMjguMDA5NDgxLDI1NC45MzY0OTQgTDEyOC4wMDk0ODEsMTkxLjE5ODgxNSBMNjQuNDA0NTQzMiwxMjcuNTkzODc3IEw2NC40MDQ1NDMyLDE5MS40NjI3MTYgTDEyOC4wMDk0ODEsMjU0LjkzNjQ5NCIgZmlsbD0iIzAwMDAwMCI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0wLjY3MTYwNDkzOCwwLjM4NTU4MDI0NyBMNjQuNDA3NzAzNywwLjM4NTU4MDI0NyBMMTI4LjAxMjY0Miw2My45OTA1MTg1IEw2NC4xNDUzODI3LDYzLjk5MDUxODUgTDAuNjcxNjA0OTM4LDAuMzg1NTgwMjQ3IiBmaWxsPSIjQTU5NkZGIj48L3BhdGg+CgkJPHBhdGggZD0iTTAuNjcxNjA0OTM4LDEyNy41OTM4NzcgTDY0LjQwNzcwMzcsMTI3LjU5Mzg3NyBMMTI4LjAxMjY0Miw2My45ODg5MzgzIEw2NC4xNDUzODI3LDYzLjk4ODkzODMgTDAuNjcxNjA0OTM4LDEyNy41OTM4NzciIGZpbGw9IiMwMDAwMDAiPjwvcGF0aD4KCTwvZz4KPC9zdmc+Cg=="},1038:function(e,t,n){"use strict";var a=n(796),i=n(2);function r(e,t,n){return e[t]?e[t][0]?e[t][0][n]:e[t][n]:"contentBoxSize"===t?e.contentRect["inlineSize"===n?"width":"height"]:void 0}e.exports=function(e){void 0===e&&(e={});var t=e.onResize,n=i.useRef(void 0);n.current=t;var l=e.round||Math.round,o=i.useRef(),s=i.useState({width:void 0,height:void 0}),u=s[0],c=s[1],d=i.useRef(!1);i.useEffect((function(){return d.current=!1,function(){d.current=!0}}),[]);var m=i.useRef({width:void 0,height:void 0}),p=function(e,t){var n=i.useRef(null),a=i.useRef(null);a.current=t;var r=i.useRef(null);i.useEffect((function(){l()}));var l=i.useCallback((function(){var t=r.current,i=a.current,l=t||(i?i instanceof Element?i:i.current:null);n.current&&n.current.element===l&&n.current.subscriber===e||(n.current&&n.current.cleanup&&n.current.cleanup(),n.current={element:l,subscriber:e,cleanup:l?e(l):void 0})}),[e]);return i.useEffect((function(){return function(){n.current&&n.current.cleanup&&(n.current.cleanup(),n.current=null)}}),[]),i.useCallback((function(e){r.current=e,l()}),[l])}(i.useCallback((function(t){return o.current&&o.current.box===e.box&&o.current.round===l||(o.current={box:e.box,round:l,instance:new a.ResizeObserver((function(t){var a=t[0],i="border-box"===e.box?"borderBoxSize":"device-pixel-content-box"===e.box?"devicePixelContentBoxSize":"contentBoxSize",o=r(a,i,"inlineSize"),s=r(a,i,"blockSize"),u=o?l(o):void 0,p=s?l(s):void 0;if(m.current.width!==u||m.current.height!==p){var b={width:u,height:p};m.current.width=u,m.current.height=p,n.current?n.current(b):d.current||c(b)}}))}),o.current.instance.observe(t,{box:e.box}),function(){o.current&&o.current.instance.unobserve(t)}}),[e.box,l]),e.ref);return i.useMemo((function(){return{ref:p,width:u.width,height:u.height}}),[p,u.width,u.height])}},1076:function(e,t,n){"use strict";var a=n(295);n.d(t,"a",(function(){return a.a})),n.d(t,"b",(function(){return a.b}))},116:function(e,t,n){"use strict";n.d(t,"c",(function(){return x})),n.d(t,"d",(function(){return j})),n.d(t,"a",(function(){return T})),n.d(t,"b",(function(){return w}));var a=n(2),i=n(103),r=n(5),l=n(45),o=n(158),s=n(110),u=n(181),c=n(111),d=n(4),m=n(142),p=n(105),b=n(477),f=n(108),g=n(689),y=n(377),h=n(183),v=n(160),E=n(221),O=n(340),S=n(102);const x=(e=s.SourcererScopeName.default)=>{const t=Object(i.useDispatch)(),{data:{dataViews:n}}=Object(S.j)().services,l=Object(a.useRef)(new AbortController),d=Object(a.useRef)(!0),h=Object(a.useRef)(!0),{loading:O,isSignalIndexExists:x,signalIndexName:k}=Object(u.c)(),T=Object(v.d)(E.a.sourcerer),C=Object(a.useMemo)((()=>o.d.getSourcererDataViewsSelector()),[]),{defaultDataView:w,signalIndexName:I}=Object(p.a)((e=>C(e))),{addError:M,addWarning:A}=Object(f.a)();Object(a.useEffect)((()=>{null!=w.error&&A({title:r.i18n.translate("xpack.securitySolution.sourcerer.permissions.title",{defaultMessage:"Write role required to generate data"}),text:r.i18n.translate("xpack.securitySolution.sourcerer.permissions.toastMessage",{defaultMessage:"Users with write permission need to access the Elastic Security app to initialize the app source data."})})}),[A,w.error]);const N=Object(a.useMemo)((()=>c.b.getTimelineByIdSelector()),[]),F=Object(p.a)((e=>N(e,m.f.active))),D=Object(a.useMemo)((()=>o.d.getSourcererScopeSelector()),[]),{sourcererScope:{selectedDataViewId:R,selectedPatterns:P,missingPatterns:L}}=Object(p.a)((t=>D(t,e))),{selectedDataView:B,sourcererScope:{selectedDataViewId:_,selectedPatterns:z,missingPatterns:q}}=Object(p.a)((e=>D(e,s.SourcererScopeName.timeline))),{indexFieldsSearch:$}=Object(y.b)(),V=Object(a.useCallback)((n=>{null!=n?Object.keys(n).forEach((a=>{var i,r,l,u;a===s.SourcererScopeName.default&&e===s.SourcererScopeName.detections||t(o.a.setSelectedDataView({id:a,selectedDataViewId:null!==(i=null===(r=n[a])||void 0===r?void 0:r.id)&&void 0!==i?i:null,selectedPatterns:null!==(l=null===(u=n[a])||void 0===u?void 0:u.selectedPatterns)&&void 0!==l?l:[]}))})):R&&T({[s.SourcererScopeName.default]:{id:R,selectedPatterns:P}})}),[t,R,e,P,T]);Object(v.b)(E.a.sourcerer,V);const H=Object(a.useRef)([]);Object(a.useEffect)((()=>{[...new Set([R,_])].forEach(((e,t)=>{if(null!=e&&e.length>0&&!H.current.includes(e)){H.current=[...H.current,e];const n=0===t?s.SourcererScopeName.default:s.SourcererScopeName.timeline,a=e===R?0===P.length&&0===L.length:_===e&&0===q.length&&0===(null==B?void 0:B.patternList.length);$({dataViewId:e,scopeId:n,needToBeInit:a,...a&&n===s.SourcererScopeName.timeline?{skipScopeUpdate:z.length>0}:{}})}}))}),[$,L.length,R,P.length,_,q.length,B,z.length]),Object(a.useEffect)((()=>{!O&&null!=k&&null==I&&(null==F||null==F.savedObjectId)&&d.current&&w.id.length>0?(d.current=!1,t(o.a.setSelectedDataView({id:s.SourcererScopeName.timeline,selectedDataViewId:w.id,selectedPatterns:Object(b.b)(w,s.SourcererScopeName.timeline,k,!0)}))):null!=I&&(null==F||null==F.savedObjectId)&&d.current&&w.id.length>0&&(d.current=!1,t(o.a.setSelectedDataView({id:s.SourcererScopeName.timeline,selectedDataViewId:w.id,selectedPatterns:Object(b.b)(w,s.SourcererScopeName.timeline,I,!0)})))}),[F,w,t,O,k,I]);const{dataViewId:U}=j(e),Q=Object(a.useCallback)((e=>{-1===w.title.indexOf(e)&&(l.current.abort(),(async a=>{l.current=new AbortController,t(o.a.setSourcererScopeLoading({loading:!0}));try{const i=await Object(g.a)({body:{patternList:a},signal:l.current.signal,dataViewService:n,dataViewId:U});null!=i&&i.defaultDataView.patternList.includes(e)&&($({dataViewId:i.defaultDataView.id}),t(o.a.setSourcererDataViews(i))),t(o.a.setSourcererScopeLoading({loading:!1}))}catch(e){"AbortError"===e.name||M(e,{title:r.i18n.translate("xpack.securitySolution.sourcerer.error.title",{defaultMessage:"Error updating Security Data View"}),toastMessage:r.i18n.translate("xpack.securitySolution.sourcerer.error.toastMessage",{defaultMessage:"Refresh the page"})}),t(o.a.setSourcererScopeLoading({loading:!1}))}})([...w.title.split(","),e]))}),[w.title,t,n,U,$,M]),G=Object(a.useCallback)((()=>{!O&&null!=k&&null==I&&w.id.length>0&&(Q(k),t(o.a.setSignalIndexName({signalIndexName:k})))}),[w.id.length,t,O,k,I,Q]);Object(a.useEffect)((()=>{G()}),[k]),Object(a.useEffect)((()=>{e===s.SourcererScopeName.detections&&x&&null!=k&&h.current&&w.id.length>0?(h.current=!1,t(o.a.setSelectedDataView({id:s.SourcererScopeName.detections,selectedDataViewId:w.id,selectedPatterns:Object(b.b)(w,s.SourcererScopeName.detections,k,!0)}))):e===s.SourcererScopeName.detections&&null!=I&&d.current&&w.id.length>0&&(h.current=!1,o.a.setSelectedDataView({id:s.SourcererScopeName.detections,selectedDataViewId:w.id,selectedPatterns:Object(b.b)(w,s.SourcererScopeName.detections,I,!0)}))}),[w,t,x,e,k,I])},j=(e=s.SourcererScopeName.default)=>{const{getDataViewsSelector:t,getSourcererDataViewSelector:n,getScopeSelector:i}=Object(a.useMemo)((()=>({getDataViewsSelector:o.d.getSourcererDataViewsSelector(),getSourcererDataViewSelector:o.d.sourcererDataViewSelector(),getScopeSelector:o.d.scopeIdSelector()})),[]),{defaultDataView:r,signalIndexName:l,selectedDataView:u,sourcererScope:{missingPatterns:c,selectedPatterns:d,loading:m}}=Object(p.a)((a=>{const r=i(a,e);return{...t(a),selectedDataView:n(a,r.selectedDataViewId),sourcererScope:r}})),f=Object(a.useMemo)((()=>Object(O.b)(d)),[d]),[g,v]=Object(a.useState)([]),[E,S]=Object(h.b)(g),x=Object(a.useMemo)((()=>{var e,t,n,a,i,r,l;return{...S,dataView:S.dataView,runtimeMappings:null!==(e=null===(t=S.dataView)||void 0===t?void 0:t.runtimeFieldMap)&&void 0!==e?e:{},title:null!==(n=null===(a=S.dataView)||void 0===a?void 0:a.title)&&void 0!==n?n:"",id:null!==(i=null===(r=S.dataView)||void 0===r?void 0:r.id)&&void 0!==i?i:null,loading:E,patternList:S.indexes,indexFields:S.indexPatterns.fields,fields:null===(l=S.dataView)||void 0===l?void 0:l.fields}}),[S,E]);Object(a.useEffect)((()=>{null==u||c.length>0?v(f):v([])}),[c,u,f]);const j=Object(a.useMemo)((()=>null==u||c.length>0?x:u),[x,c.length,u]),k=Object(a.useMemo)((()=>!(!m&&!j.loading)||Object(b.a)({scopeId:e,signalIndexName:l,patternList:j.patternList,isDefaultDataViewSelected:j.id===r.id})),[r.id,m,e,l,j.id,j.loading,j.patternList]),T=Object(a.useCallback)((()=>{const{browserFields:e}=Object(y.a)(j.patternList.join(","),j.fields);return e}),[j.fields,j.patternList]);return Object(a.useMemo)((()=>({browserFields:T(),dataViewId:j.id,indexPattern:{fields:j.indexFields,title:f.join(","),getName:()=>f.join(",")},indicesExist:k,loading:m||j.loading,runtimeMappings:j.runtimeMappings,patternList:j.title.split(","),selectedPatterns:f,...g.length>0?{activePatterns:j.patternList}:{},sourcererDataView:j.dataView})),[T,j,f,k,m,g.length])},k=[d.d,`${d.mc}/id/:id`,`${d.r}/:detailName`],T=e=>null==Object(l.matchPath)(e,{path:k,strict:!1})?s.SourcererScopeName.default:s.SourcererScopeName.detections,C=[d.d,d.u,`${d.mc}/id/:id`,d.zb,d.Ic,d.Mb,d.Tb],w=e=>null!=Object(l.matchPath)(e,{path:C,strict:!1})},117:function(e,t,n){"use strict";n.d(t,"e",(function(){return c})),n.d(t,"b",(function(){return d})),n.d(t,"d",(function(){return m})),n.d(t,"c",(function(){return p})),n.d(t,"a",(function(){return b})),n.d(t,"f",(function(){return f}));var a=n(42),i=n(2),r=n.n(i),l=n(41),o=n.n(l);const s=n(5).i18n.translate("xpack.securitySolution.emptyString.emptyStringDescription",{defaultMessage:"Empty string"}),u=o.a.span.withConfig({displayName:"EmptyWrapper",componentId:"sc-1h9raim-0"})(["color:",";"],(e=>e.theme.eui.euiColorMediumShade));u.displayName="EmptyWrapper";const c=()=>"—",d=()=>`(${s})`,m=()=>r.a.createElement(u,null,c()),p=()=>r.a.createElement(u,null,d()),b=e=>null==e?m():Object(a.isString)(e)&&""===e?p():r.a.createElement(r.a.Fragment,null,e),f=e=>null==e?m():""===e?p():r.a.createElement(r.a.Fragment,null,e)},121:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return f})),n.d(t,"c",(function(){return h}));var a=n(40),i=n(2),r=n.n(i),l=n(41),o=n.n(l),s=n(321),u=n(153),c=n(117),d=n(150),m=n(379);const p=({field:e,tooltipContent:t})=>null!=t?t:e,b=r.a.memo((({children:e,field:t,tooltipContent:n,tooltipPosition:i,value:l})=>(e=>null===e)(n)?r.a.createElement(r.a.Fragment,null,e||l):r.a.createElement(a.EuiToolTip,{"data-test-subj":`${t}-tooltip`,position:i,content:p({tooltipContent:n,field:t})},r.a.createElement(r.a.Fragment,null,e||l))));b.displayName="Content";const f=r.a.memo((({hideTopN:e=!1,id:t,isDraggable:n=!0,field:a,fieldType:l="",isAggregatable:o=!1,value:c,name:p,children:f,scopeId:g,tooltipContent:y,tooltipPosition:h,queryValue:v,truncate:E})=>{const O=Object(i.useMemo)((()=>{var e;return{and:[],enabled:!0,id:Object(u.i)(t),name:p||(null!==(e=null==c?void 0:c.toString())&&void 0!==e?e:""),excluded:!1,kqlQuery:"",queryMatch:{field:a,value:v||(null!=c?c:""),operator:d.d}}}),[a,t,p,v,c]),S=Object(i.useCallback)(((e,t,n)=>n.isDragging?r.a.createElement(s.a,null,r.a.createElement(m.a,{dataProvider:e})):r.a.createElement(b,{field:a,tooltipContent:y,tooltipPosition:h,value:c},f)),[f,a,y,h,c]);return null==c?null:r.a.createElement(s.b,{dataProvider:O,fieldType:l,isAggregatable:o,hideTopN:e,isDraggable:n,render:S,scopeId:g,truncate:E})}));f.displayName="DefaultDraggable";const g=o()(a.EuiBadge).withConfig({displayName:"Badge",componentId:"sc-1g0jgxk-0"})(["vertical-align:top;"]);g.displayName="Badge";const y=({contextId:e,eventId:t,field:n,value:a,iconType:i,isDraggable:l,isAggregatable:o,fieldType:s,name:u,color:d="hollow",children:m,scopeId:p,tooltipContent:b,queryValue:y})=>null!=a?r.a.createElement(f,{id:`draggable-badge-default-draggable-${e}-${t}-${n}-${a}`,isDraggable:l,isAggregatable:o,fieldType:s,field:n,name:u,value:a,scopeId:p,tooltipContent:b,queryValue:y},r.a.createElement(g,{iconType:i,color:d,title:""},m||(""!==a?a:Object(c.c)()))):null;y.displayName="DraggableBadgeComponent";const h=r.a.memo(y);h.displayName="DraggableBadge"},123:function(e,t,n){"use strict";n.d(t,"g",(function(){return O.d})),n.d(t,"f",(function(){return O.c})),n.d(t,"o",(function(){return T})),n.d(t,"m",(function(){return I})),n.d(t,"d",(function(){return A})),n.d(t,"h",(function(){return R})),n.d(t,"a",(function(){return L})),n.d(t,"c",(function(){return B})),n.d(t,"i",(function(){return _})),n.d(t,"e",(function(){return z})),n.d(t,"b",(function(){return q})),n.d(t,"j",(function(){return Q})),n.d(t,"n",(function(){return G})),n.d(t,"l",(function(){return W})),n.d(t,"k",(function(){return K}));var a=n(40),i=n(2),r=n.n(i),l=n(42),o=n(291),s=n(199),u=n(363),c=n(4),d=n(449),m=n(169),p=n(263),b=n(102),f=n(228),g=n(5),y=n(364);const h=e=>g.i18n.translate("xpack.securitySolution.cases.caseTable.caseDetailsLinkAria",{values:{detailName:e},defaultMessage:"click to visit case with title {detailName}"});var v=n(131),E=n(669),O=n(318),S=n(104),x=n.n(S),j=n(636),k=n(609);const T=()=>{const e=Object(j.a)(),t=Object(k.a)();return Object(i.useCallback)((({deepLinkId:n,path:a,onClick:i})=>{const r=t(n);return e({id:n,path:a,urlState:r,onClick:i})}),[e,t])},C=e=>(e=>r.a.memo((function({deepLinkId:t,...n}){const a=Object(k.a)()(t);return r.a.createElement(e,x()({id:t,urlState:a},n))})))(Object(j.c)(e)),w=({children:e,Component:t,userName:n,isButton:a,onClick:l,title:o,userTab:s})=>{const u=encodeURIComponent(n),{formatUrl:d,search:p}=Object(m.m)(v.a.users),{application:{navigateToApp:f},telemetry:g}=Object(b.j)().services,y=Object(i.useCallback)((e=>{e.preventDefault(),f(c.l,{deepLinkId:v.a.users,path:s?Object(E.a)(u,s,p):Object(E.c)(u,p)})}),[u,f,p,s]),h=Object(i.useMemo)((()=>d(s?Object(E.a)(u,s):Object(E.c)(u))),[d,u,s]),S=Object(i.useCallback)((e=>{g.reportEntityDetailsClicked({entity:"user"}),(null!=l?l:y)(e)}),[y,l,g]);return a?r.a.createElement(O.b,{Component:t,dataTestSubj:"data-grid-user-details",href:h,onClick:S,title:null!=o?o:n},e||n):r.a.createElement(O.c,{"data-test-subj":"users-link-anchor",onClick:S,href:h},e||n)},I=r.a.memo(w),M=({children:e,Component:t,hostName:n,isButton:a,onClick:l,title:o,hostTab:s})=>{const{formatUrl:u,search:d}=Object(m.m)(v.a.hosts),{application:{navigateToApp:p},telemetry:f}=Object(b.j)().services,g=encodeURIComponent(n),y=Object(i.useCallback)((e=>{e.preventDefault(),p(c.l,{deepLinkId:v.a.hosts,path:s?Object(m.j)(g,s,d):Object(m.e)(g,d)})}),[g,p,d,s]),h=Object(i.useMemo)((()=>u(s?Object(m.j)(g,s):Object(m.e)(g))),[u,g,s]),E=Object(i.useCallback)((e=>{f.reportEntityDetailsClicked({entity:"host"}),(null!=l?l:y)(e)}),[y,l,f]);return a?r.a.createElement(O.b,{Component:t,dataTestSubj:"data-grid-host-details",href:h,iconType:"expand",onClick:E,title:null!=o?o:n},e):r.a.createElement(O.c,{onClick:E,href:h,"data-test-subj":"host-details-button"},e||n)},A=r.a.memo(M),N=["http://","https://"],F=r.a.memo((({url:e,children:t,idx:n,overflowIndexStart:i=5,allItemsLimit:o=5})=>{const s=i-1,u=o-1,c=Math.max(0,Math.min(s,u)),d=N.some((t=>0===e.indexOf(t)));return e&&d&&!Object(f.c)(e)&&t?r.a.createElement(a.EuiToolTip,{content:e,position:"top","data-test-subj":"externalLinkTooltip"},r.a.createElement(r.a.Fragment,null,r.a.createElement(a.EuiLink,{href:e,target:"_blank",rel:"noopener","data-test-subj":"externalLink"},t),!Object(l.isNil)(n)&&n<c&&r.a.createElement(O.a,{"data-test-subj":"externalLinkComma"}))):null}));F.displayName="ExternalLink";const D=({Component:e,children:t,ip:n,flowTarget:a=p.a.source,isButton:o,onClick:s,title:u})=>{const c=T(),b=Object(i.useCallback)(((n,i)=>{const{onClick:l,href:p}=c({deepLinkId:v.a.network,path:Object(m.g)(encodeURIComponent(Object(d.c)(n)),a)}),b=null!=s?s:e=>l(e);return o?r.a.createElement(O.b,{Component:e,key:`${n}-${i}`,dataTestSubj:"data-grid-network-details",onClick:b,href:p,title:null!=u?u:n},t):r.a.createElement(O.c,{key:`${n}-${i}`,onClick:b,href:p,"data-test-subj":"network-details"},t||n)}),[t,e,a,c,s,o,u]);return Object(l.isArray)(n)?r.a.createElement(r.a.Fragment,null,n.map(b)):b(n,0)},R=r.a.memo(D),P=({index:e,children:t,detailName:n,title:a})=>{const{formatUrl:l,search:d}=Object(m.m)(v.a.case),{navigateToApp:p}=Object(b.j)().services.application,{activeStep:f,isTourShown:g}=Object(u.b)(),y=Object(i.useMemo)((()=>f===s.a.viewCase&&g(s.b.alertsCases)&&0===e),[f,e,g]),E=Object(i.useCallback)((async e=>(e&&e.preventDefault(),p(c.l,{deepLinkId:v.a.case,path:Object(m.b)({id:n,search:d})}))),[n,p,d]);return Object(i.useEffect)((()=>{var e;y&&(null===(e=document.querySelector('[tour-step="RelatedCases-accordion"]'))||void 0===e||e.scrollIntoView())}),[y]),r.a.createElement(o.a,{onClick:E,isTourAnchor:y,step:s.a.viewCase,tourId:s.b.alertsCases},r.a.createElement(O.c,{onClick:E,href:l(Object(m.b)({id:n})),"data-test-subj":"case-details-link","aria-label":h(null!=a?a:n)},t||n))},L=r.a.memo(P);L.displayName="CaseDetailsLink",r.a.memo((({children:e})=>{const{formatUrl:t,search:n}=Object(m.m)(v.a.case),{navigateToApp:a}=Object(b.j)().services.application,l=Object(i.useCallback)((async e=>(e.preventDefault(),a(c.l,{deepLinkId:v.a.case,path:Object(m.c)(n)}))),[a,n]);return r.a.createElement(O.c,{onClick:l,href:t(Object(m.c)())},e)})).displayName="CreateCaseLink";const B=r.a.memo((({children:e,link:t})=>{const n=Object(i.useMemo)((()=>`https://www.google.com/search?q=${encodeURIComponent(t)}`),[t]);return r.a.createElement(F,{url:n},e||t)}));B.displayName="GoogleLink";const _=r.a.memo((({Component:e,title:t,children:n,portOrServiceName:l})=>{var o;const s=Object(i.useMemo)((()=>`https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=${encodeURIComponent(String(l))}`),[l]);return e?r.a.createElement(e,{href:s,"data-test-subj":"data-grid-port-or-service-name-link",title:t,iconType:"link"},null!==(o=null!=t?t:n)&&void 0!==o?o:l):r.a.createElement(O.e,null,r.a.createElement(a.EuiLink,{"data-test-subj":"port-or-service-name-link",href:s,target:"_blank"},n||l))}));_.displayName="PortOrServiceNameLink";const z=r.a.memo((({children:e,ja3Fingerprint:t})=>{const n=Object(i.useMemo)((()=>`https://sslbl.abuse.ch/ja3-fingerprints/${encodeURIComponent(t)}`),[t]);return r.a.createElement(a.EuiLink,{"data-test-subj":"ja3-fingerprint-link",href:n,target:"_blank"},e||t)}));z.displayName="Ja3FingerprintLink";const q=r.a.memo((({children:e,certificateFingerprint:t})=>{const n=Object(i.useMemo)((()=>`https://sslbl.abuse.ch/ssl-certificates/sha1/${encodeURIComponent(t)}`),[t]);return r.a.createElement(a.EuiLink,{"data-test-subj":"certificate-fingerprint-link",href:n,target:"_blank"},e||t)}));var $;function V(e){return e===$["virustotal.com"]||e===$["talosIntelligence.com"]}q.displayName="CertificateFingerprintLink",function(e){e["virustotal.com"]="virustotal.com",e["talosIntelligence.com"]="talosIntelligence.com"}($||($={}));const H={[$["virustotal.com"]]:y.m,[$["talosIntelligence.com"]]:y.l},U=({overflowIndexStart:e=5,allItemsLimit:t=5,showDomain:n=!1,domain:o,direction:s="row"})=>{const[u]=Object(b.p)(c.Fb),d=Object(i.useMemo)((()=>null==u?void 0:u.slice(0,t).filter((({url_template:e,name:t})=>!Object(l.isNil)(e)&&!Object(l.isNil)(t)&&!Object(f.c)(e))).map((({name:e,url_template:t})=>({name:V(e)?H[e]:e,url_template:t.replace("{{ip}}",encodeURIComponent(o))})))),[u,o,H,t]),m=Object(i.useCallback)((n=>{var a;return(e=>void 0!==e.url_template&&void 0!==e.name)(n)&&r.a.createElement(F,{url:n.url_template,overflowIndexStart:e,allItemsLimit:t},r.a.createElement(r.a.Fragment,null,null!==(a=n.name)&&void 0!==a?a:o))}),[t,o,e]);return(null==d?void 0:d.length)>0?r.a.createElement("section",null,r.a.createElement(a.EuiFlexGroup,{gutterSize:"none",justifyContent:"center",direction:s,alignItems:"center","data-test-subj":"reputationLinkGroup"},r.a.createElement(a.EuiFlexItem,{grow:!0},null==d?void 0:d.slice(0,e).map((({name:t,url_template:a},i)=>r.a.createElement(F,{allItemsLimit:d.length,idx:i,overflowIndexStart:e,url:a,"data-test-subj":"externalLinkComponent",key:`reputationLink-${i}`},r.a.createElement(r.a.Fragment,null,n?o:null!=t?t:o))))),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(O.f,{rowItems:d,render:m,moreMaxHeight:"200px",overflowIndexStart:e})))):null};U.displayName="ReputationLinkComponent";const Q=r.a.memo(U),G=r.a.memo((({children:e,domain:t})=>{const n=Object(i.useMemo)((()=>`https://www.iana.org/whois?q=${encodeURIComponent(t)}`),[t]);return r.a.createElement(F,{url:n},e||t)}));G.displayName="WhoIsLink";const W=C(O.d),K=C(O.c)},124:function(e,t,n){"use strict";n.d(t,"a",(function(){return l}));var a=n(103),i=n(15);const r=Object(i.b)(),l=e=>{const t=o();if(!t||!(e in t))throw new Error(`Invalid enable value ${e}. Allowed values are: ${r.join(", ")}`);return t[e]},o=()=>Object(a.useSelector)((({app:{enableExperimental:e}})=>e))},125:function(e,t,n){"use strict";var a=n(52);n.d(t,"j",(function(){return a.getUseField})),n.d(t,"i",(function(){return a.getFieldValidityAndErrorMessage})),n.d(t,"a",(function(){return a.FIELD_TYPES})),n.d(t,"c",(function(){return a.Form})),n.d(t,"e",(function(){return a.UseField})),n.d(t,"f",(function(){return a.UseMultiFields})),n.d(t,"k",(function(){return a.useForm})),n.d(t,"l",(function(){return a.useFormContext})),n.d(t,"m",(function(){return a.useFormData})),n.d(t,"g",(function(){return a.VALIDATION_TYPES}));var i=n(67);n.d(t,"b",(function(){return i.Field})),n.d(t,"d",(function(){return i.SelectField}));var r=n(75);n.d(t,"h",(function(){return r.fieldValidators}))},132:function(e,t,n){"use strict";n.d(t,"c",(function(){return m})),n.d(t,"d",(function(){return p})),n.d(t,"e",(function(){return f})),n.d(t,"a",(function(){return g})),n.d(t,"b",(function(){return y}));var a=n(76),i=n.n(a),r=n(2),l=n.n(r),o=n(44),s=n(102),u=n(117),c=n(907),d=n(712);const m=l.a.memo((({value:e,dateFormat:t=Object(s.g)()})=>l.a.createElement(l.a.Fragment,null,i.a.tz(e,Object(s.m)()).format(t))));m.displayName="PreferenceFormattedDate";const p=({value:e})=>{if(null==e)return Object(u.f)(e);const t=Object(d.a)(e);if(!t.isValid())return Object(u.f)(e);const n=t.toDate();return l.a.createElement(m,{value:n})};p.displayName="PreferenceFormattedDateFromPrimitive";const b=e=>Array.isArray(e)&&"P1DT"===e[0]&&2===e.length,f=l.a.memo((({value:e})=>{const[t]=Object(s.p)("dateFormat:scaled"),n=Array.isArray(t)?t.find(b):null,a=Array.isArray(n)&&2===n.length?n[1]:"YYYY-MM-DD";return l.a.createElement(m,{dateFormat:a,value:e})}));f.displayName="PreferenceFormattedP1DTDate";const g=l.a.memo((({value:e,fieldName:t,className:n="",dateFormat:a})=>{if(null==e)return Object(u.f)(e);const i=Object(d.a)(e);return i.isValid()?l.a.createElement(c.a,{date:i.toDate(),fieldName:t,className:n},l.a.createElement(m,{value:i.toDate(),dateFormat:a})):Object(u.f)(e)}));g.displayName="FormattedDate";const y=l.a.memo((({value:e,dateFormat:t,tooltipFieldName:n,tooltipAnchorClassName:a,relativeThresholdInHrs:r=1})=>{if(null==e)return Object(u.f)(e);const s=Object(d.a)(e);if(!s.isValid())return Object(u.f)(e);const p=s.toDate(),b=i()(p).add(r,"hours").isBefore(new Date);return l.a.createElement(c.a,{date:p,fieldName:n,className:a},b?l.a.createElement(m,{"data-test-subj":"preference-time",value:p,dateFormat:t}):l.a.createElement(o.FormattedRelative,{"data-test-subj":"relative-time",value:p}))}));y.displayName="FormattedRelativePreferenceDate"},134:function(e,t,n){"use strict";n.d(t,"a",(function(){return c}));var a=n(42),i=n(2),r=n(103),l=n(114),o=n(105),s=n(122),u=n(182);const c=()=>{const e=Object(r.useDispatch)(),{from:t,to:n}=Object(o.a)((e=>Object(a.pick)(["from","to"],s.d.globalTimeRangeSelector(e)))),[c,d]=Object(i.useState)(!0),m=Object(i.useRef)([]),p=Object(i.useCallback)((({id:t,inspect:n,loading:a,refetch:i,searchSessionId:r})=>{m.current=[...m.current,t],e(u.c.setQuery({inputId:l.a.global,id:t,inspect:n,loading:a,refetch:i,searchSessionId:r}))}),[e]),b=Object(i.useCallback)((({id:t})=>e(u.c.deleteOneQuery({inputId:l.a.global,id:t}))),[e]);return Object(i.useEffect)((()=>{d(!1)}),[]),Object(i.useEffect)((()=>()=>{m.current.length>0&&m.current.forEach((e=>b({id:e})))}),[b]),Object(i.useMemo)((()=>({isInitializing:c,from:t,to:n,setQuery:p,deleteQuery:b})),[b,t,c,p,n])}},135:function(e,t,n){"use strict";n.d(t,"H",(function(){return i})),n.d(t,"y",(function(){return r})),n.d(t,"a",(function(){return l})),n.d(t,"U",(function(){return o})),n.d(t,"p",(function(){return s})),n.d(t,"r",(function(){return u})),n.d(t,"q",(function(){return c})),n.d(t,"s",(function(){return d})),n.d(t,"n",(function(){return m})),n.d(t,"o",(function(){return p})),n.d(t,"u",(function(){return b})),n.d(t,"v",(function(){return f})),n.d(t,"t",(function(){return g})),n.d(t,"l",(function(){return y})),n.d(t,"m",(function(){return h})),n.d(t,"h",(function(){return v})),n.d(t,"i",(function(){return E})),n.d(t,"g",(function(){return O})),n.d(t,"e",(function(){return S})),n.d(t,"f",(function(){return x})),n.d(t,"d",(function(){return j})),n.d(t,"A",(function(){return k})),n.d(t,"G",(function(){return T})),n.d(t,"c",(function(){return C})),n.d(t,"z",(function(){return w})),n.d(t,"F",(function(){return I})),n.d(t,"b",(function(){return M})),n.d(t,"E",(function(){return A})),n.d(t,"w",(function(){return N})),n.d(t,"x",(function(){return F})),n.d(t,"J",(function(){return D})),n.d(t,"j",(function(){return R})),n.d(t,"k",(function(){return P})),n.d(t,"D",(function(){return L})),n.d(t,"I",(function(){return B})),n.d(t,"K",(function(){return _})),n.d(t,"L",(function(){return z})),n.d(t,"T",(function(){return q})),n.d(t,"M",(function(){return $})),n.d(t,"N",(function(){return V})),n.d(t,"S",(function(){return H})),n.d(t,"Q",(function(){return U})),n.d(t,"P",(function(){return Q})),n.d(t,"O",(function(){return G})),n.d(t,"R",(function(){return W})),n.d(t,"C",(function(){return K})),n.d(t,"B",(function(){return X}));var a=n(5);a.i18n.translate("xpack.securitySolution.detectionEngine.pageTitle",{defaultMessage:"Detection engine"}),a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.documentTypeTitle",{defaultMessage:"Alerts"});const i=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.openAlertsTitle",{defaultMessage:"Open"}),r=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.closedAlertsTitle",{defaultMessage:"Closed"}),l=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.acknowledgedAlertsTitle",{defaultMessage:"Acknowledged"}),o=(a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.loadingAlertsTitle",{defaultMessage:"Loading Alerts"}),a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.totalCountOfAlertsTitle",{defaultMessage:"alerts"})),s=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.ruleTitle",{defaultMessage:"Rule"}),u=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.ruleNameTitle",{defaultMessage:"Rule name"}),c=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.ruleDescriptionTitle",{defaultMessage:"Rule description"}),d=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.severityTitle",{defaultMessage:"Severity"}),m=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.reasonTitle",{defaultMessage:"Reason"}),p=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.riskScoreTitle",{defaultMessage:"Risk Score"}),b=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.thresholdCount",{defaultMessage:"Event Count"}),f=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.thresholdTerms",{defaultMessage:"Threshold Terms"}),g=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.thresholdCardinality",{defaultMessage:"Event Cardinality"}),y=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.newTerms",{defaultMessage:"New Terms"}),h=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.newTermsFields",{defaultMessage:"New Terms fields"}),v=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.investigateInTimelineTitle",{defaultMessage:"Investigate in timeline"}),E=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.investigateInTimelineAriaLabel",{defaultMessage:"Send alert to timeline"}),O=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addException",{defaultMessage:"Add rule exception"}),S=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addEventFilter",{defaultMessage:"Add Endpoint event filter"}),x=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addEventFilter.disabled.tooltip",{defaultMessage:"Endpoint event filters can be created from the Events section of the Hosts page."}),j=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addEndpointException",{defaultMessage:"Add Endpoint exception"}),k=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.closedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully closed {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}}."}),T=(a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.alertDurationTitle",{defaultMessage:"Alert duration"}),e=>a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.openedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully opened {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}}."})),C=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.acknowledgedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully marked {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}} as acknowledged."}),w=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.closedAlertFailedToastMessage",{defaultMessage:"Failed to close alert(s)."}),I=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.openedAlertFailedToastMessage",{defaultMessage:"Failed to open alert(s)"}),M=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.acknowledgedAlertFailedToastMessage",{defaultMessage:"Failed to mark alert(s) as acknowledged"}),A=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.moreActionsAriaLabel",{defaultMessage:"More actions"}),N=(a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.statusTitle",{defaultMessage:"Status"}),a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.overview.changeAlertStatus",{defaultMessage:"Change alert status"})),F=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.overview.clickToChangeAlertStatus",{defaultMessage:"Click to change alert status"}),D=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.overviewTable.signalStatusTitle",{defaultMessage:"Status"}),R=(a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.triggeredTitle",{defaultMessage:"Triggered"}),a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addToCase",{defaultMessage:"Add to existing case"})),P=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addToNewCase",{defaultMessage:"Add to new case"}),L=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addBulkToTimeline",{defaultMessage:"Investigate in timeline"}),B=a.i18n.translate("xpack.securitySolution.sessionsView.sessionsTitle",{defaultMessage:"Sessions"}),_=(a.i18n.translate("xpack.securitySolution.detectionEngine.groups.additionalActions.takeAction",{defaultMessage:"Take actions"}),a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.alertsCount",{defaultMessage:"Alerts:"})),z=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.hostsCount",{defaultMessage:"Hosts:"}),q=(a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.ipsCount",{defaultMessage:"IP's:"}),a.i18n.translate("xpack.securitySolution.detectionEngine.selectGroup.title",{defaultMessage:"Group alerts by"}),a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.usersCount",{defaultMessage:"Users:"})),$=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.rulesCount",{defaultMessage:"Rules:"}),V=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity",{defaultMessage:"Severity:"}),H=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.multi",{defaultMessage:"Multi"}),U=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.low",{defaultMessage:"Low"}),Q=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.high",{defaultMessage:"High"}),G=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.critical",{defaultMessage:"Critical"}),W=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.medium",{defaultMessage:"Medium"}),K=a.i18n.translate("xpack.securitySolution.detectionsEngine.grouping.inspectTitle",{defaultMessage:"Grouping query"}),X={timestamp:a.i18n.translate("xpack.securitySolution.EventRenderedView.timestampTitle.column",{defaultMessage:"Timestamp"}),rule:a.i18n.translate("xpack.securitySolution.EventRenderedView.ruleTitle.column",{defaultMessage:"Rule"}),eventSummary:a.i18n.translate("xpack.securitySolution.EventRenderedView.eventSummary.column",{defaultMessage:"Event Summary"})}},137:function(e,t,n){"use strict";n.d(t,"cc",(function(){return i})),n.d(t,"Lb",(function(){return r})),n.d(t,"Nb",(function(){return l})),n.d(t,"Zc",(function(){return o})),n.d(t,"d",(function(){return s})),n.d(t,"bc",(function(){return u})),n.d(t,"e",(function(){return c})),n.d(t,"Bb",(function(){return d})),n.d(t,"dc",(function(){return m})),n.d(t,"f",(function(){return p})),n.d(t,"r",(function(){return b})),n.d(t,"p",(function(){return f})),n.d(t,"s",(function(){return g})),n.d(t,"q",(function(){return y})),n.d(t,"m",(function(){return h})),n.d(t,"t",(function(){return v})),n.d(t,"w",(function(){return E})),n.d(t,"g",(function(){return O})),n.d(t,"n",(function(){return S})),n.d(t,"i",(function(){return x})),n.d(t,"o",(function(){return j})),n.d(t,"j",(function(){return k})),n.d(t,"h",(function(){return T})),n.d(t,"v",(function(){return C})),n.d(t,"u",(function(){return w})),n.d(t,"W",(function(){return I})),n.d(t,"U",(function(){return M})),n.d(t,"V",(function(){return A})),n.d(t,"Y",(function(){return N})),n.d(t,"A",(function(){return F})),n.d(t,"l",(function(){return D})),n.d(t,"y",(function(){return R})),n.d(t,"k",(function(){return P})),n.d(t,"z",(function(){return L})),n.d(t,"X",(function(){return B})),n.d(t,"S",(function(){return _})),n.d(t,"K",(function(){return z})),n.d(t,"B",(function(){return q})),n.d(t,"M",(function(){return $})),n.d(t,"C",(function(){return V})),n.d(t,"E",(function(){return H})),n.d(t,"F",(function(){return U})),n.d(t,"D",(function(){return Q})),n.d(t,"L",(function(){return G})),n.d(t,"N",(function(){return W})),n.d(t,"O",(function(){return K})),n.d(t,"G",(function(){return X})),n.d(t,"P",(function(){return Y})),n.d(t,"H",(function(){return J})),n.d(t,"T",(function(){return Z})),n.d(t,"J",(function(){return ee})),n.d(t,"I",(function(){return te})),n.d(t,"Q",(function(){return ne})),n.d(t,"R",(function(){return ae})),n.d(t,"Gb",(function(){return ie})),n.d(t,"Pc",(function(){return re})),n.d(t,"Oc",(function(){return le})),n.d(t,"Uc",(function(){return oe})),n.d(t,"Sc",(function(){return se})),n.d(t,"ab",(function(){return ue})),n.d(t,"Rc",(function(){return ce})),n.d(t,"Cb",(function(){return de})),n.d(t,"Qb",(function(){return me})),n.d(t,"Rb",(function(){return pe})),n.d(t,"Ab",(function(){return be})),n.d(t,"Hb",(function(){return fe})),n.d(t,"xb",(function(){return ge})),n.d(t,"mb",(function(){return ye})),n.d(t,"lb",(function(){return he})),n.d(t,"nb",(function(){return ve})),n.d(t,"gb",(function(){return Ee})),n.d(t,"ib",(function(){return Oe})),n.d(t,"hb",(function(){return Se})),n.d(t,"pb",(function(){return xe})),n.d(t,"bb",(function(){return je})),n.d(t,"ob",(function(){return ke})),n.d(t,"eb",(function(){return Te})),n.d(t,"fb",(function(){return Ce})),n.d(t,"jb",(function(){return we})),n.d(t,"kb",(function(){return Ie})),n.d(t,"cb",(function(){return Me})),n.d(t,"db",(function(){return Ae})),n.d(t,"Eb",(function(){return Ne})),n.d(t,"zb",(function(){return Fe})),n.d(t,"rb",(function(){return De})),n.d(t,"Db",(function(){return Re})),n.d(t,"Xc",(function(){return Pe})),n.d(t,"Qc",(function(){return Le})),n.d(t,"Fc",(function(){return Be})),n.d(t,"Yb",(function(){return _e})),n.d(t,"Hc",(function(){return ze})),n.d(t,"Sb",(function(){return qe})),n.d(t,"Xb",(function(){return $e})),n.d(t,"Tb",(function(){return Ve})),n.d(t,"Ub",(function(){return He})),n.d(t,"Vb",(function(){return Ue})),n.d(t,"Wb",(function(){return Qe})),n.d(t,"sb",(function(){return Ge})),n.d(t,"b",(function(){return We})),n.d(t,"Nc",(function(){return Ke})),n.d(t,"Gc",(function(){return Xe})),n.d(t,"tb",(function(){return Ye})),n.d(t,"a",(function(){return Je})),n.d(t,"Mc",(function(){return Ze})),n.d(t,"c",(function(){return et})),n.d(t,"Zb",(function(){return tt})),n.d(t,"qb",(function(){return nt})),n.d(t,"ub",(function(){return at})),n.d(t,"Mb",(function(){return it})),n.d(t,"Tc",(function(){return rt})),n.d(t,"Ob",(function(){return lt})),n.d(t,"ac",(function(){return ot})),n.d(t,"Wc",(function(){return st})),n.d(t,"Jb",(function(){return ut})),n.d(t,"Kb",(function(){return ct})),n.d(t,"x",(function(){return dt})),n.d(t,"Vc",(function(){return mt})),n.d(t,"wb",(function(){return pt})),n.d(t,"vb",(function(){return bt})),n.d(t,"ec",(function(){return ft})),n.d(t,"Z",(function(){return gt})),n.d(t,"Dc",(function(){return yt})),n.d(t,"Ec",(function(){return ht})),n.d(t,"Cc",(function(){return vt})),n.d(t,"Ac",(function(){return Et})),n.d(t,"Bc",(function(){return Ot})),n.d(t,"pc",(function(){return St})),n.d(t,"qc",(function(){return xt})),n.d(t,"nc",(function(){return jt})),n.d(t,"oc",(function(){return kt})),n.d(t,"hc",(function(){return Tt})),n.d(t,"ic",(function(){return Ct})),n.d(t,"fc",(function(){return wt})),n.d(t,"gc",(function(){return It})),n.d(t,"yc",(function(){return Mt})),n.d(t,"zc",(function(){return At})),n.d(t,"wc",(function(){return Nt})),n.d(t,"xc",(function(){return Ft})),n.d(t,"lc",(function(){return Dt})),n.d(t,"mc",(function(){return Rt})),n.d(t,"jc",(function(){return Pt})),n.d(t,"kc",(function(){return Lt})),n.d(t,"tc",(function(){return Bt})),n.d(t,"vc",(function(){return _t})),n.d(t,"uc",(function(){return zt})),n.d(t,"rc",(function(){return qt})),n.d(t,"sc",(function(){return $t})),n.d(t,"Lc",(function(){return Vt})),n.d(t,"Ic",(function(){return Ht})),n.d(t,"Fb",(function(){return Ut})),n.d(t,"yb",(function(){return Qt})),n.d(t,"Jc",(function(){return Gt})),n.d(t,"Pb",(function(){return Wt})),n.d(t,"Yc",(function(){return Kt})),n.d(t,"Ib",(function(){return Xt})),n.d(t,"Kc",(function(){return Yt}));var a=n(5);const i=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.popoverTooltip.ariaLabel",{defaultMessage:"Tooltip for column: {columnName}",values:{columnName:e}}),r=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.importRuleTitle",{defaultMessage:"Import rules"}),l=a.i18n.translate("xpack.securitySolution.lists.detectionEngine.rules.importValueListsButton",{defaultMessage:"Import value lists"}),o=a.i18n.translate("xpack.securitySolution.lists.detectionEngine.rules.uploadValueListsButtonTooltip",{defaultMessage:"Use value lists to create an exception when a field value matches a value found in a list"}),s=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.addNewRuleTitle",{defaultMessage:"Create new rule"}),u=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.pageTitle",{defaultMessage:"Rules"}),c=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.addPageTitle",{defaultMessage:"Create"}),d=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.editPageTitle",{defaultMessage:"Edit"}),m=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.refreshTitle",{defaultMessage:"Refresh"}),p=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.batchActionsTitle",{defaultMessage:"Bulk actions"}),b=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enableTitle",{defaultMessage:"Enable"}),f=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disableTitle",{defaultMessage:"Disable"}),g=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.exportTitle",{defaultMessage:"Export"}),y=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicateTitle",{defaultMessage:"Duplicate"}),h=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.deleteTitle",{defaultMessage:"Delete"}),v=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.indexPatternsTitle",{defaultMessage:"Index patterns"}),E=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.tagsTitle",{defaultMessage:"Tags"}),O=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addIndexPatternsTitle",{defaultMessage:"Add index patterns"}),S=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.deleteIndexPatternsTitle",{defaultMessage:"Delete index patterns"}),x=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addTagsTitle",{defaultMessage:"Add tags"}),j=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.deleteTagsTitle",{defaultMessage:"Delete tags"}),k=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.applyTimelineTemplateTitle",{defaultMessage:"Apply Timeline template"}),T=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addRuleActionsTitle",{defaultMessage:"Add rule actions"}),C=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.setScheduleTitle",{defaultMessage:"Update rule schedules"}),w=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.contextMenuTitle",{defaultMessage:"Options"}),I=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastTitle",{defaultMessage:"Rules updates are in progress"}),M=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} updating."}),A=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastNotifyButtonLabel",{defaultMessage:"Notify me when done"}),N=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkExportConfirmationDeniedTitle",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule} other {# rules}} cannot be exported"}),F=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditConfirmationDeniedTitle",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule} other {# rules}} cannot be edited"}),D=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkActionConfirmationPartlyTitle",{values:{customRulesCount:e},defaultMessage:"This action can only be applied to {customRulesCount, plural, =1 {# custom rule} other {# custom rules}}"}),R=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmationCancelButtonLabel",{defaultMessage:"Cancel"}),P=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkActionConfirmationCloseButtonLabel",{defaultMessage:"Close"}),L=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmation.confirmButtonLabel",{values:{customRulesCount:e},defaultMessage:"Edit {customRulesCount, plural, =1 {# custom rule} other {# custom rules}}"}),B=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkExportConfirmation.confirmButtonLabel",{values:{customRulesCount:e},defaultMessage:"Export {customRulesCount, plural, =1 {# custom rule} other {# custom rules}}"}),_=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.saveButtonLabel",{defaultMessage:"Save"}),z=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.cancelButtonLabel",{defaultMessage:"Cancel"}),q=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxHelpText",{defaultMessage:"Enter the pattern of Elasticsearch indices that you would like to add. By default, the dropdown includes index patterns defined in Security Solution advanced settings."}),$=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteIndexPatternsComboboxHelpText",{defaultMessage:"Enter the pattern of Elasticsearch indices that you would like to delete. By default, the dropdown includes index patterns defined in Security Solution advanced settings."}),V=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxLabel",{defaultMessage:"Add index patterns for selected rules"}),H=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.indexPatternsRequiredErrorMessage",{defaultMessage:"A minimum of one index pattern is required."}),U=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsTitle",{defaultMessage:"Add index patterns"}),Q=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsOverwriteCheckboxLabel",{defaultMessage:"Overwrite all selected rules' index patterns"}),G=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.dataViewsOverwriteCheckboxLabel",{defaultMessage:"Apply changes to rules configured with data views"}),W=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteIndexPatternsComboboxLabel",{defaultMessage:"Delete index patterns for selected rules"}),K=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteIndexPatternsTitle",{defaultMessage:"Delete index patterns"}),X=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsComboboxHelpText",{defaultMessage:"Add one or more tags for selected rules from the dropdown. You can also enter custom identifying tags and press Enter to begin a new one."}),Y=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteTagsComboboxHelpText",{defaultMessage:"Delete one or more tags for selected rules from the dropdown. You can also enter custom identifying tags and press Enter to begin a new one."}),J=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsComboboxLabel",{defaultMessage:"Add tags for selected rules"}),Z=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.tagsComoboxRequiredErrorMessage",{defaultMessage:"A minimum of one tag is required."}),ee=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsTitle",{defaultMessage:"Add tags"}),te=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsOverwriteCheckboxLabel",{defaultMessage:"Overwrite all selected rules' tags"}),ne=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteTagsComboboxLabel",{defaultMessage:"Delete tags for selected rules"}),ae=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteTagsTitle",{defaultMessage:"Delete tags"}),ie=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.exportFilenameTitle",{defaultMessage:"rules_export"}),re=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.searchAriaLabel",{defaultMessage:"Search rules"}),le=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.searchPlaceholder",{defaultMessage:'Rule name, index pattern (e.g., "filebeat-*"), or MITRE ATT&CK™ tactic or technique (e.g., "Defense Evasion" or "TA0005")'}),oe=(e,t,n)=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.showingRulesTitle",{values:{firstInPage:e,lastOfPage:t,totalRules:n},defaultMessage:"Showing {firstInPage}-{lastOfPage} of {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),se=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.selectAllRulesTitle",{values:{totalRules:e},defaultMessage:"Select all {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),ue=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.clearSelectionTitle",{defaultMessage:"Clear selection"}),ce=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.selectedRulesTitle",{values:{selectedRules:e},defaultMessage:"Selected {selectedRules} {selectedRules, plural, =1 {rule} other {rules}}"}),de=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.editRuleSettingsDescription",{defaultMessage:"Edit rule settings"}),me=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.lackOfKibanaActionsFeaturePrivileges",{defaultMessage:"You do not have Kibana Actions privileges"}),pe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.lackOfKibanaSecurityPrivileges",{defaultMessage:"You do not have Kibana Security privileges"}),be=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.duplicateRuleDescription",{defaultMessage:"Duplicate rule"}),fe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.exportRuleDescription",{defaultMessage:"Export rule"}),ge=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.deleteRuleDescription",{defaultMessage:"Delete rule"}),ye=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.ruleTitle",{defaultMessage:"Rule"}),he=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.riskScoreTitle",{defaultMessage:"Risk score"}),ve=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.severityTitle",{defaultMessage:"Severity"}),Ee=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.lastRunTitle",{defaultMessage:"Last run"}),Oe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.lastUpdateTitle",{defaultMessage:"Last updated"}),Se=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.lastResponseTitle",{defaultMessage:"Last response"}),xe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.tagsTitle",{defaultMessage:"Tags"}),je=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.enabledTitle",{defaultMessage:"Enabled"}),ke=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.snoozeTitle",{defaultMessage:"Notify"}),Te=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.indexingTimes",{defaultMessage:"Indexing Time (ms)"}),Ce=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.indexingTimesTooltip",{defaultMessage:"Total time spent indexing alerts during last Rule execution"}),we=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.queryTimes",{defaultMessage:"Query Time (ms)"}),Ie=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.queryTimesTooltip",{defaultMessage:"Total time spent querying source indices during last Rule execution"}),Me=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.gap",{defaultMessage:"Last Gap (if any)"}),Ae=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.gapTooltipSeeDocsDescription",{defaultMessage:"see documentation"}),Ne=(a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.tabs.rules",{defaultMessage:"Rules"}),a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.tabs.monitoring",{defaultMessage:"Rule Monitoring"}),a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.enabledRulesTitle",{defaultMessage:"Enabled rules"})),Fe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.disabledRulesTitle",{defaultMessage:"Disabled rules"}),De=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.customRulesTitle",{defaultMessage:"Custom rules"}),Re=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.elasticRulesTitle",{defaultMessage:"Elastic rules"}),Pe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.tagsLabel",{defaultMessage:"Tags"}),Le=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.searchTagsPlaceholder",{defaultMessage:"Search tags"}),Be=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.rulesTagSearchText",{defaultMessage:"Rules tag search"}),_e=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.noTagsAvailableDescription",{defaultMessage:"No tags available"}),ze=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.ruleExecutionStatusFilter",{defaultMessage:"Select rule execution status to filter by"}),qe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.noRulesTitle",{defaultMessage:"No rules found"}),$e=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.noRulesBodyTitle",{defaultMessage:"We weren't able to find any rules with the above filters."}),Ve=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.addRules.noRulesTitle",{defaultMessage:"All Elastic rules have been installed"}),He=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.addRules.noRulesBodyTitle",{defaultMessage:"There are no prebuilt detection rules available for installation"}),Ue=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesTitle",{defaultMessage:"All Elastic rules are up to date"}),Qe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesBodyTitle",{defaultMessage:"There are currently no available updates to your installed Elastic rules."}),Ge=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.defineRuleTitle",{defaultMessage:"Define rule"}),We=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.aboutRuleTitle",{defaultMessage:"About rule"}),Ke=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.scheduleRuleTitle",{defaultMessage:"Schedule rule"}),Xe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.ruleActionsTitle",{defaultMessage:"Rule actions"}),Ye=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepDefinitionTitle",{defaultMessage:"Definition"}),Je=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepAboutTitle",{defaultMessage:"About"}),Ze=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepScheduleTitle",{defaultMessage:"Schedule"}),et=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepActionsTitle",{defaultMessage:"Actions"}),tt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.optionalFieldDescription",{defaultMessage:"Optional"}),nt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.continueButtonTitle",{defaultMessage:"Continue"}),at=(a.i18n.translate("xpack.securitySolution.detectionEngine.rules.updateButtonTitle",{defaultMessage:"Update"}),a.i18n.translate("xpack.securitySolution.detectionEngine.rules.deleteDescription",{defaultMessage:"Delete"})),it=a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importRuleTitle",{defaultMessage:"Import"}),rt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.selectRuleDescription",{defaultMessage:"Select rules to import. Associated rule actions and exceptions can be included."}),lt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.initialPromptTextDescription",{defaultMessage:"Select or drag and drop a valid rules_export.ndjson file"}),ot=a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.overwriteDescription",{defaultMessage:'Overwrite existing detection rules with conflicting "rule_id"'}),st=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.successfullyImportedRulesTitle",{values:{totalRules:e},defaultMessage:"Successfully imported {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),ut=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importFailedTitle",{values:{totalRules:e},defaultMessage:"Failed to import {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),ct=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importFailedDetailedTitle",{values:{message:e},defaultMessage:"{message}"}),dt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkDeleteConfirmationTitle",{defaultMessage:"Confirm bulk deletion"}),mt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.singleDeleteConfirmationTitle",{defaultMessage:"Confirm deletion"}),pt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationConfirm",{defaultMessage:"Delete"}),bt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationCancel",{defaultMessage:"Cancel"}),ft=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.refreshRulePopoverDescription",{defaultMessage:"Automatically refresh table"}),gt=(a.i18n.translate("xpack.securitySolution.detectionEngine.rules.refreshRulePopoverLabel",{defaultMessage:"Refresh settings"}),a.i18n.translate("xpack.securitySolution.detectionEngine.rules.clearRulesTableFilters",{defaultMessage:"Clear filters"})),yt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.successToastTitle",{defaultMessage:"Rules exported"}),ht=(e,t)=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.successToastDescription",{values:{totalRules:t,exportedRules:e},defaultMessage:"Successfully exported {exportedRules} of {totalRules} {totalRules, plural, =1 {rule} other {rules}}."}),vt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.prebuiltRulesExcludedToastDescription",{defaultMessage:"Prebuilt rules were excluded from the resulting file."}),Et=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.errorToastTitle",{defaultMessage:"Error exporting rules"}),Ot=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to export."}),St=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.successToastTitle",{defaultMessage:"Rules duplicated"}),xt=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully duplicated {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),jt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.errorToastTitle",{defaultMessage:"Error duplicating rule"}),kt=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to duplicate."}),Tt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.successToastTitle",{defaultMessage:"Rules deleted"}),Ct=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully deleted {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),wt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.errorToastTitle",{defaultMessage:"Error deleting rules"}),It=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to delete."}),Mt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enable.successToastTitle",{defaultMessage:"Rules enabled"}),At=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkAction.enable.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully enabled {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),Nt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enable.errorToastTitle",{defaultMessage:"Error enabling rules"}),Ft=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enable.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to enable."}),Dt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.successToastTitle",{defaultMessage:"Rules disabled"}),Rt=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully disabled {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),Pt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.errorToastTitle",{defaultMessage:"Error disabling rules"}),Lt=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to disable."}),Bt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.successToastTitle",{defaultMessage:"Rules updated"}),_t=(e,t)=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.successToastDescription",{values:{succeededRulesCount:e,skippedRulesCount:t},defaultMessage:"{succeededRulesCount, plural, =0 {} =1 {You've successfully updated # rule. } other {You've successfully updated # rules. }}\n        {skippedRulesCount, plural, =0 {} =1 { # rule was skipped.} other { # rules were skipped.}}\n        "}),zt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.successIndexEditToastDescription",{defaultMessage:"If you did not select to apply changes to rules using Kibana data views, those rules were not updated and will continue using data views."}),qt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.errorToastTitle",{defaultMessage:"Error updating rules"}),$t=(e,t)=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.errorToastDescription",{values:{failedRulesCount:e,skippedRulesCount:t},defaultMessage:"{failedRulesCount, plural, =0 {} =1 {# rule} other {# rules}} failed to update. {skippedRulesCount, plural, =0 {} =1 { # rule was skipped.} other { # rules were skipped.}}"}),Vt=(a.i18n.translate("xpack.securitySolution.detectionEngine.createRule.cancelButtonLabel",{defaultMessage:"Cancel"}),a.i18n.translate("xpack.securitySolution.hooks.useGetSavedQuery.errorToastMessage",{defaultMessage:"Failed to load the saved query"})),Ht=a.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.ruleManagementContextDescription",{defaultMessage:"Selected Detection Rules"}),Ut=a.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.explainThenSummarizeRuleDetails",{defaultMessage:"Please explain the selected rules above. For each rule, highlight why they are relevant, the query as published on Elastic's detection rules repository and an in-depth explanation of it, and what they typically mean for an organization if detected."}),Qt=a.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.detectionRulesConversationId",{defaultMessage:"Detection Rules"}),Gt=a.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.ruleManagementContextTooltip",{defaultMessage:"Add this alert as context"}),Wt=a.i18n.translate("xpack.securitySolution.addRules.installRuleButton",{defaultMessage:"Install rule"}),Kt=a.i18n.translate("xpack.securitySolution.addRules.upgradeRuleButton",{defaultMessage:"Update rule"}),Xt=a.i18n.translate("xpack.securitySolution.addRules.goBackToRulesTableButton",{defaultMessage:"Go back to installed Elastic rules"}),Yt=a.i18n.translate("xpack.securitySolution.ruleUpdates.documentationLink",{defaultMessage:"See what's new in Prebuilt Security Detection Rules"})},140:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"b",(function(){return r})),n.d(t,"c",(function(){return l})),n.d(t,"h",(function(){return o})),n.d(t,"i",(function(){return s})),n.d(t,"k",(function(){return u})),n.d(t,"j",(function(){return c})),n.d(t,"l",(function(){return d})),n.d(t,"m",(function(){return m})),n.d(t,"n",(function(){return p})),n.d(t,"o",(function(){return b})),n.d(t,"q",(function(){return f})),n.d(t,"p",(function(){return g})),n.d(t,"y",(function(){return y})),n.d(t,"A",(function(){return h})),n.d(t,"B",(function(){return v})),n.d(t,"C",(function(){return E})),n.d(t,"D",(function(){return O})),n.d(t,"d",(function(){return S})),n.d(t,"e",(function(){return x})),n.d(t,"f",(function(){return j})),n.d(t,"g",(function(){return k})),n.d(t,"E",(function(){return T})),n.d(t,"F",(function(){return C})),n.d(t,"G",(function(){return w})),n.d(t,"H",(function(){return I})),n.d(t,"J",(function(){return M})),n.d(t,"K",(function(){return A})),n.d(t,"L",(function(){return N})),n.d(t,"M",(function(){return F})),n.d(t,"Y",(function(){return D})),n.d(t,"Z",(function(){return R})),n.d(t,"ab",(function(){return P})),n.d(t,"bb",(function(){return L})),n.d(t,"z",(function(){return B})),n.d(t,"cb",(function(){return _})),n.d(t,"db",(function(){return z})),n.d(t,"N",(function(){return q})),n.d(t,"O",(function(){return $})),n.d(t,"Q",(function(){return V})),n.d(t,"T",(function(){return H})),n.d(t,"U",(function(){return U})),n.d(t,"R",(function(){return Q})),n.d(t,"S",(function(){return G})),n.d(t,"X",(function(){return W})),n.d(t,"W",(function(){return K})),n.d(t,"s",(function(){return X})),n.d(t,"r",(function(){return Y})),n.d(t,"w",(function(){return J})),n.d(t,"P",(function(){return Z})),n.d(t,"x",(function(){return ee})),n.d(t,"I",(function(){return te})),n.d(t,"V",(function(){return ne})),n.d(t,"t",(function(){return ae})),n.d(t,"v",(function(){return ie})),n.d(t,"u",(function(){return re}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.open.timeline.batchActionsTitle",{defaultMessage:"Bulk actions"}),r=a.i18n.translate("xpack.securitySolution.open.timeline.cancelButton",{defaultMessage:"Cancel"}),l=a.i18n.translate("xpack.securitySolution.open.timeline.collapseButton",{defaultMessage:"Collapse"}),o=a.i18n.translate("xpack.securitySolution.open.timeline.deleteButton",{defaultMessage:"Delete"}),s=a.i18n.translate("xpack.securitySolution.open.timeline.deleteSelectedButton",{defaultMessage:"Delete selected"}),u=a.i18n.translate("xpack.securitySolution.open.timeline.deleteWarningLabel",{defaultMessage:"You will not be able to recover this timeline or its notes once deleted."}),c=a.i18n.translate("xpack.securitySolution.open.timeline.deleteTemplateWarningLabel",{defaultMessage:"You will not be able to recover this timeline template or its notes once deleted."}),d=a.i18n.translate("xpack.securitySolution.open.timeline.descriptionTableHeader",{defaultMessage:"Description"}),m=a.i18n.translate("xpack.securitySolution.open.timeline.expandButton",{defaultMessage:"Expand"}),p=a.i18n.translate("xpack.securitySolution.open.timeline.exportFileNameTitle",{defaultMessage:"timelines_export"}),b=a.i18n.translate("xpack.securitySolution.open.timeline.exportSelectedButton",{defaultMessage:"Export selected"}),f=a.i18n.translate("xpack.securitySolution.open.timeline.favoriteSelectedButton",{defaultMessage:"Favorite selected"}),g=a.i18n.translate("xpack.securitySolution.open.timeline.favoritesTooltip",{defaultMessage:"Favorites"}),y=a.i18n.translate("xpack.securitySolution.open.timeline.lastModifiedTableHeader",{defaultMessage:"Last modified"}),h=a.i18n.translate("xpack.securitySolution.open.timeline.missingSavedObjectIdTooltip",{defaultMessage:"Missing savedObjectId"}),v=a.i18n.translate("xpack.securitySolution.open.timeline.modifiedByTableHeader",{defaultMessage:"Modified by"}),E=a.i18n.translate("xpack.securitySolution.open.timeline.notesTooltip",{defaultMessage:"Notes"}),O=a.i18n.translate("xpack.securitySolution.open.timeline.onlyFavoritesButtonLabel",{defaultMessage:"Only favorites"}),S=a.i18n.translate("xpack.securitySolution.open.timeline.createRuleFromTimelineTooltip",{defaultMessage:"Create query rule from timeline"}),x=a.i18n.translate("xpack.securitySolution.open.timeline.createRuleFromTimelineEqlTooltip",{defaultMessage:"Create EQL rule from timeline"}),j=a.i18n.translate("xpack.securitySolution.open.timeline.createTemplateFromTimelineTooltip",{defaultMessage:"Create template from timeline"}),k=a.i18n.translate("xpack.securitySolution.open.timeline.createTimelineFromTemplateTooltip",{defaultMessage:"Create timeline from template"}),T=a.i18n.translate("xpack.securitySolution.open.timeline.openAsDuplicateTooltip",{defaultMessage:"Duplicate timeline"}),C=a.i18n.translate("xpack.securitySolution.open.timeline.openAsDuplicateTemplateTooltip",{defaultMessage:"Duplicate template"}),w=a.i18n.translate("xpack.securitySolution.open.timeline.openTimelineButton",{defaultMessage:"Open Timeline…"}),I=a.i18n.translate("xpack.securitySolution.open.timeline.openTimelineTitle",{defaultMessage:"Open"}),M=a.i18n.translate("xpack.securitySolution.open.timeline.pinnedEventsTooltip",{defaultMessage:"Pinned events"}),A=a.i18n.translate("xpack.securitySolution.open.timeline.refreshTitle",{defaultMessage:"Refresh"}),N=a.i18n.translate("xpack.securitySolution.open.timeline.searchPlaceholder",{defaultMessage:"e.g. timeline name, or description"}),F=a.i18n.translate("xpack.securitySolution.open.timeline.searchTemplatePlaceholder",{defaultMessage:"e.g. template name, or description"}),D=a.i18n.translate("xpack.securitySolution.open.timeline.timelineNameTableHeader",{defaultMessage:"Timeline name"}),R=a.i18n.translate("xpack.securitySolution.open.timeline.timelineTemplateNameTableHeader",{defaultMessage:"Template name"}),P=a.i18n.translate("xpack.securitySolution.open.timeline.untitledTimelineLabel",{defaultMessage:"Untitled timeline"}),L=a.i18n.translate("xpack.securitySolution.open.timeline.withLabel",{defaultMessage:"with"}),B=a.i18n.translate("xpack.securitySolution.open.timeline.loadingLabel",{defaultMessage:"Loading..."}),_=a.i18n.translate("xpack.securitySolution.open.timeline.zeroTimelinesMatchLabel",{defaultMessage:"0 timelines match the search criteria"}),z=a.i18n.translate("xpack.securitySolution.open.timeline.zeroTimelineTemplatesMatchLabel",{defaultMessage:"0 timeline templates match the search criteria"}),q=e=>a.i18n.translate("xpack.securitySolution.open.timeline.selectedTemplatesTitle",{values:{selectedTemplates:e},defaultMessage:"Selected {selectedTemplates} {selectedTemplates, plural, =1 {template} other {templates}}"}),$=e=>a.i18n.translate("xpack.securitySolution.open.timeline.selectedTimelinesTitle",{values:{selectedTimelines:e},defaultMessage:"Selected {selectedTimelines} {selectedTimelines, plural, =1 {timeline} other {timelines}}"}),V=a.i18n.translate("xpack.securitySolution.open.timeline.showingLabel",{defaultMessage:"Showing:"}),H=e=>a.i18n.translate("xpack.securitySolution.open.timeline.successfullyExportedTimelinesTitle",{values:{totalTimelines:e},defaultMessage:"Successfully exported {totalTimelines, plural, =0 {all timelines} =1 {{totalTimelines} timeline} other {{totalTimelines} timelines}}"}),U=e=>a.i18n.translate("xpack.securitySolution.open.timeline.successfullyExportedTimelineTemplatesTitle",{values:{totalTimelineTemplates:e},defaultMessage:"Successfully exported {totalTimelineTemplates, plural, =0 {all timelines} =1 {{totalTimelineTemplates} timeline template} other {{totalTimelineTemplates} timeline templates}}"}),Q=e=>a.i18n.translate("xpack.securitySolution.open.timeline.successfullyDeletedTimelinesTitle",{values:{totalTimelines:e},defaultMessage:"Successfully deleted {totalTimelines, plural, =0 {all timelines} =1 {{totalTimelines} timeline} other {{totalTimelines} timelines}}"}),G=e=>a.i18n.translate("xpack.securitySolution.open.timeline.successfullyDeletedTimelineTemplatesTitle",{values:{totalTimelineTemplates:e},defaultMessage:"Successfully deleted {totalTimelineTemplates, plural, =0 {all timelines} =1 {{totalTimelineTemplates} timeline template} other {{totalTimelineTemplates} timeline templates}}"}),W=a.i18n.translate("xpack.securitySolution.timelines.components.tabs.timelinesTitle",{defaultMessage:"Timelines"}),K=a.i18n.translate("xpack.securitySolution.timelines.components.tabs.templatesTitle",{defaultMessage:"Templates"}),X=a.i18n.translate("xpack.securitySolution.timelines.components.templateFilter.elasticTitle",{defaultMessage:"Elastic templates"}),Y=a.i18n.translate("xpack.securitySolution.timelines.components.templateFilter.customizedTitle",{defaultMessage:"Custom templates"}),J=a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importTimelineTitle",{defaultMessage:"Import"}),Z=a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.selectTimelineDescription",{defaultMessage:"Select a timeline or timeline template file to import"}),ee=a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.initialPromptTextDescription",{defaultMessage:"Select or drag and drop a valid timelines_export.ndjson file"}),te=a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.overwriteDescription",{defaultMessage:"Automatically overwrite saved objects with the same timeline ID"}),ne=e=>a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.successfullyImportedTimelinesTitle",{values:{totalCount:e},defaultMessage:"Successfully imported {totalCount} {totalCount, plural, =1 {item} other {items}}"}),ae=e=>a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importFailedTitle",{values:{totalTimelines:e},defaultMessage:"Failed to import {totalTimelines} {totalTimelines, plural, =1 {timeline} other {timelines}}"}),ie=a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importTitle",{defaultMessage:"Import…"}),re=e=>a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importFailedDetailedTitle",{values:{message:e},defaultMessage:"{message}"})},149:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"c",(function(){return m})),n.d(t,"b",(function(){return b}));var a=n(40),i=n(2),r=n.n(i),l=n(114),o=n(311),s=n(454),u=n(561),c=n(455);const d="inspectButtonComponent",m=({children:e,show:t=!0})=>r.a.createElement(o.a,{show:t,targetClassNames:[d]},e),p=({compact:e=!1,inputId:t=l.a.global,inspectIndex:n=0,isDisabled:i,multiple:o=!1,onCloseInspect:m,queryId:p="",showInspectButton:b=!0,title:f=""})=>{const{additionalRequests:g,additionalResponses:y,handleClick:h,handleCloseModal:v,isButtonDisabled:E,isShowingModal:O,loading:S,request:x,response:j}=Object(u.a)({inputId:t,inspectIndex:n,isDisabled:i,multiple:o,onCloseInspect:m,queryId:p});return r.a.createElement(r.a.Fragment,null,t===l.a.timeline&&!e&&b&&r.a.createElement(a.EuiButtonEmpty,{className:d,"aria-label":c.d,"data-test-subj":"inspect-empty-button",color:"text",iconSide:"left",iconType:"inspect",isDisabled:E,isLoading:S,onClick:h},c.d),(t===l.a.global||e)&&b&&r.a.createElement(a.EuiButtonIcon,{className:d,"aria-label":c.d,"data-test-subj":"inspect-icon-button",iconSize:"m",iconType:"inspect",isDisabled:E,title:c.d,onClick:h}),O&&null!==x&&null!==j&&r.a.createElement(s.a,{additionalRequests:g,additionalResponses:y,closeModal:v,"data-test-subj":"inspect-modal",inputId:t,request:x,response:j,title:f}))};p.displayName="InspectButtonComponent";const b=r.a.memo(p)},152:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a="row-renderer-example"},153:function(e,t,n){"use strict";n.d(t,"d",(function(){return c})),n.d(t,"e",(function(){return d})),n.d(t,"c",(function(){return p})),n.d(t,"n",(function(){return b}));var a=n(42),i=n(109),r=n(119),l=n(176),o=n(115),s=n(182),u=n(434);n.d(t,"f",(function(){return i.g})),n.d(t,"h",(function(){return i.i})),n.d(t,"g",(function(){return i.h})),n.d(t,"l",(function(){return i.m})),n.d(t,"k",(function(){return i.l})),n.d(t,"p",(function(){return i.r})),n.d(t,"o",(function(){return i.q})),n.d(t,"m",(function(){return i.n})),n.d(t,"i",(function(){return i.j})),n.d(t,"q",(function(){return i.w})),n.d(t,"r",(function(){return i.x})),n.d(t,"j",(function(){return i.k})),n.d(t,"a",(function(){return i.b})),n.d(t,"b",(function(){return i.e}));const c=({activeTimelineDataProviders:e,dataProviders:t,dispatch:n,result:a,timelineId:r,noProviderFound:l=s.b.noProviderFound,onAddedToTimeline:o})=>{const c=Object(i.p)(a),d=t[c];d?Object(u.b)({dataProviders:e,destination:a.destination,dispatch:n,onAddedToTimeline:o,providerToAdd:d,timelineId:r}):n(l({id:c}))},d=({isAggregatable:e,fieldType:t,fieldName:n,hideTopN:a})=>{const i=["boolean","geo-point","geo-shape","ip","keyword","number","numeric","string"].includes(t),r=["kibana.alert.ancestors.depth","kibana.alert.ancestors.id","kibana.alert.ancestors.rule","kibana.alert.ancestors.type","kibana.alert.original_event.action","kibana.alert.original_event.category","kibana.alert.original_event.code","kibana.alert.original_event.created","kibana.alert.original_event.dataset","kibana.alert.original_event.duration","kibana.alert.original_event.end","kibana.alert.original_event.hash","kibana.alert.original_event.id","kibana.alert.original_event.kind","kibana.alert.original_event.module","kibana.alert.original_event.original","kibana.alert.original_event.outcome","kibana.alert.original_event.provider","kibana.alert.original_event.risk_score","kibana.alert.original_event.risk_score_norm","kibana.alert.original_event.sequence","kibana.alert.original_event.severity","kibana.alert.original_event.start","kibana.alert.original_event.timezone","kibana.alert.original_event.type","kibana.alert.original_time","kibana.alert.rule.created_by","kibana.alert.rule.description","kibana.alert.rule.enabled","kibana.alert.rule.false_positives","kibana.alert.rule.from","kibana.alert.rule.uuid","kibana.alert.rule.immutable","kibana.alert.rule.interval","kibana.alert.rule.max_signals","kibana.alert.rule.name","kibana.alert.rule.note","kibana.alert.rule.references","kibana.alert.risk_score","kibana.alert.rule.rule_id","kibana.alert.severity","kibana.alert.rule.size","kibana.alert.rule.tags","kibana.alert.rule.threat","kibana.alert.rule.threat.tactic.id","kibana.alert.rule.threat.tactic.name","kibana.alert.rule.threat.tactic.reference","kibana.alert.rule.threat.technique.id","kibana.alert.rule.threat.technique.name","kibana.alert.rule.threat.technique.reference","kibana.alert.rule.timeline_id","kibana.alert.rule.timeline_title","kibana.alert.rule.to","kibana.alert.rule.type","kibana.alert.rule.updated_by","kibana.alert.rule.version","kibana.alert.workflow_status"].includes(n);return!a&&(r||e&&i)},m={"kibana.alert.rule.name":"kibana.alert.rule.uuid","event.module":"rule.reference"},p=({browserFields:e,dispatch:t,result:n,scopeId:s,defaultsHeader:u})=>{var c;const d=Object(i.o)(n),p=(e=>Object(a.keyBy)("name",(e=>Object.values(e).reduce(((e,t)=>[...e,...Object.values(null!=t.fields?t.fields:{})]),[]))(e)))(e)[d],b=s!==r.e.alertsOnAlertsPage&&s!==r.e.alertsOnRuleDetailsPage||null===(c=u.find((e=>e.id===d)))||void 0===c?{}:c,f=Object(o.getScopedActions)(s);var g;null!=p&&f?t(f.upsertColumn({column:{category:p.category,columnHeaderType:"not-filtered",description:Object(a.isString)(p.description)?p.description:void 0,example:Object(a.isString)(p.example)?p.example:void 0,id:d,linkField:null!==(g=m[d])&&void 0!==g?g:void 0,type:p.type,aggregatable:p.aggregatable,initialWidth:l.a,...b},id:s,index:null!=n.destination?n.destination.index:0})):f&&t(f.upsertColumn({column:{columnHeaderType:"not-filtered",id:d,initialWidth:l.a},id:s,index:null!=n.destination?n.destination.index:0}))},b=e=>e.slice(e.lastIndexOf(".")+1)},155:function(e,t,n){"use strict";n.d(t,"C",(function(){return i})),n.d(t,"q",(function(){return r})),n.d(t,"v",(function(){return l})),n.d(t,"l",(function(){return o})),n.d(t,"o",(function(){return s})),n.d(t,"p",(function(){return u})),n.d(t,"m",(function(){return c})),n.d(t,"n",(function(){return d})),n.d(t,"B",(function(){return m})),n.d(t,"r",(function(){return p})),n.d(t,"u",(function(){return b})),n.d(t,"y",(function(){return f})),n.d(t,"k",(function(){return g})),n.d(t,"E",(function(){return y})),n.d(t,"w",(function(){return h})),n.d(t,"b",(function(){return v})),n.d(t,"x",(function(){return E})),n.d(t,"z",(function(){return O})),n.d(t,"t",(function(){return S})),n.d(t,"s",(function(){return x})),n.d(t,"a",(function(){return j})),n.d(t,"c",(function(){return k})),n.d(t,"F",(function(){return T})),n.d(t,"g",(function(){return C})),n.d(t,"A",(function(){return w})),n.d(t,"D",(function(){return I})),n.d(t,"e",(function(){return M})),n.d(t,"d",(function(){return A})),n.d(t,"f",(function(){return N})),n.d(t,"i",(function(){return F})),n.d(t,"h",(function(){return D})),n.d(t,"j",(function(){return R}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.alertDetails.threatIntel",{defaultMessage:"Threat Intel"}),r=a.i18n.translate("xpack.securitySolution.alertDetails.overview.investigationGuide",{defaultMessage:"Investigation guide"}),l=a.i18n.translate("xpack.securitySolution.alertDetails.overview",{defaultMessage:"Overview"}),o=a.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields",{defaultMessage:"Highlighted fields"}),s=a.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.field",{defaultMessage:"Field"}),u=a.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.value",{defaultMessage:"Value"}),c=a.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.alertPrevalence",{defaultMessage:"Alert prevalence"}),d=a.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.alertPrevalenceTooltip",{defaultMessage:"The total count of alerts with the same value within the currently selected timerange. This value is not affected by additional filters."}),m=a.i18n.translate("xpack.securitySolution.eventDetails.table",{defaultMessage:"Table"}),p=a.i18n.translate("xpack.securitySolution.eventDetails.jsonView",{defaultMessage:"JSON"}),b=a.i18n.translate("xpack.securitySolution.eventDetails.osqueryView",{defaultMessage:"Osquery Results"}),f=a.i18n.translate("xpack.securitySolution.eventDetails.responseActionsView",{defaultMessage:"Response Results"}),g=a.i18n.translate("xpack.securitySolution.eventDetails.field",{defaultMessage:"Field"}),y=a.i18n.translate("xpack.securitySolution.eventDetails.value",{defaultMessage:"Value"}),h=(a.i18n.translate("xpack.securitySolution.eventDetails.description",{defaultMessage:"Description"}),a.i18n.translate("xpack.securitySolution.eventDetails.filter.placeholder",{defaultMessage:"Filter by Field, Value, or Description..."})),v=a.i18n.translate("xpack.securitySolution.detections.alerts.agentStatus",{defaultMessage:"Agent status"}),E=a.i18n.translate("xpack.securitySolution.detections.alerts.quarantinedFilePath",{defaultMessage:"Quarantined file path"}),O=a.i18n.translate("xpack.securitySolution.detections.alerts.ruleType",{defaultMessage:"Rule type"}),S=a.i18n.translate("xpack.securitySolution.eventDetails.multiFieldTooltipContent",{defaultMessage:"Multi-fields can have multiple values per field"}),x=a.i18n.translate("xpack.securitySolution.eventDetails.multiFieldBadge",{defaultMessage:"multi-field"}),j=a.i18n.translate("xpack.securitySolution.eventDetails.table.actions",{defaultMessage:"Actions"}),k=a.i18n.translate("xpack.securitySolution.eventDetails.alertReason",{defaultMessage:"Alert reason"}),T=a.i18n.translate("xpack.securitySolution.eventDetails.viewAllFields",{defaultMessage:"View all fields in table"}),C=Object.freeze({tried:e=>a.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.tried",{values:{command:e},defaultMessage:"tried to execute {command} command"}),executed:e=>a.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.executed",{values:{command:e},defaultMessage:"executed {command} command"}),pending:e=>a.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.pending",{values:{command:e},defaultMessage:"is executing {command} command"}),failed:e=>a.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.failed",{values:{command:e},defaultMessage:"failed to execute {command} command"})}),w=a.i18n.translate("xpack.securitySolution.eventDetails.summaryView",{defaultMessage:"summary"}),I=a.i18n.translate("xpack.securitySolution.eventDetails.timelineView",{defaultMessage:"Timeline"}),M=a.i18n.translate("xpack.securitySolution.alertSummaryView.alertSummaryViewConversationId",{defaultMessage:"Alert summary"}),A=e=>a.i18n.translate("xpack.securitySolution.alertSummaryView.alertSummaryViewContextDescription",{defaultMessage:"Alert (from {view})",values:{view:e}}),N=a.i18n.translate("xpack.securitySolution.alertSummaryView.alertSummaryViewContextTooltip",{defaultMessage:"Add this alert as context"}),F=a.i18n.translate("xpack.securitySolution.alertSummaryView.eventSummaryViewConversationId",{defaultMessage:"Event summary"}),D=e=>a.i18n.translate("xpack.securitySolution.alertSummaryView.eventSummaryViewContextDescription",{defaultMessage:"Event (from {view})",values:{view:e}}),R=a.i18n.translate("xpack.securitySolution.alertSummaryView.eventSummaryViewContextTooltip",{defaultMessage:"Add this event as context"})},157:function(e,t,n){const a=n(325),{MAX_LENGTH:i,MAX_SAFE_INTEGER:r}=n(326),{safeRe:l,t:o}=n(310),s=n(451),{compareIdentifiers:u}=n(559);class SemVer{constructor(e,t){if(t=s(t),e instanceof SemVer){if(e.loose===!!t.loose&&e.includePrerelease===!!t.includePrerelease)return e;e=e.version}else if("string"!=typeof e)throw new TypeError(`Invalid version. Must be a string. Got type "${typeof e}".`);if(e.length>i)throw new TypeError(`version is longer than ${i} characters`);a("SemVer",e,t),this.options=t,this.loose=!!t.loose,this.includePrerelease=!!t.includePrerelease;const n=e.trim().match(t.loose?l[o.LOOSE]:l[o.FULL]);if(!n)throw new TypeError(`Invalid Version: ${e}`);if(this.raw=e,this.major=+n[1],this.minor=+n[2],this.patch=+n[3],this.major>r||this.major<0)throw new TypeError("Invalid major version");if(this.minor>r||this.minor<0)throw new TypeError("Invalid minor version");if(this.patch>r||this.patch<0)throw new TypeError("Invalid patch version");n[4]?this.prerelease=n[4].split(".").map((e=>{if(/^[0-9]+$/.test(e)){const t=+e;if(t>=0&&t<r)return t}return e})):this.prerelease=[],this.build=n[5]?n[5].split("."):[],this.format()}format(){return this.version=`${this.major}.${this.minor}.${this.patch}`,this.prerelease.length&&(this.version+=`-${this.prerelease.join(".")}`),this.version}toString(){return this.version}compare(e){if(a("SemVer.compare",this.version,this.options,e),!(e instanceof SemVer)){if("string"==typeof e&&e===this.version)return 0;e=new SemVer(e,this.options)}return e.version===this.version?0:this.compareMain(e)||this.comparePre(e)}compareMain(e){return e instanceof SemVer||(e=new SemVer(e,this.options)),u(this.major,e.major)||u(this.minor,e.minor)||u(this.patch,e.patch)}comparePre(e){if(e instanceof SemVer||(e=new SemVer(e,this.options)),this.prerelease.length&&!e.prerelease.length)return-1;if(!this.prerelease.length&&e.prerelease.length)return 1;if(!this.prerelease.length&&!e.prerelease.length)return 0;let t=0;do{const n=this.prerelease[t],i=e.prerelease[t];if(a("prerelease compare",t,n,i),void 0===n&&void 0===i)return 0;if(void 0===i)return 1;if(void 0===n)return-1;if(n!==i)return u(n,i)}while(++t)}compareBuild(e){e instanceof SemVer||(e=new SemVer(e,this.options));let t=0;do{const n=this.build[t],i=e.build[t];if(a("prerelease compare",t,n,i),void 0===n&&void 0===i)return 0;if(void 0===i)return 1;if(void 0===n)return-1;if(n!==i)return u(n,i)}while(++t)}inc(e,t,n){switch(e){case"premajor":this.prerelease.length=0,this.patch=0,this.minor=0,this.major++,this.inc("pre",t,n);break;case"preminor":this.prerelease.length=0,this.patch=0,this.minor++,this.inc("pre",t,n);break;case"prepatch":this.prerelease.length=0,this.inc("patch",t,n),this.inc("pre",t,n);break;case"prerelease":0===this.prerelease.length&&this.inc("patch",t,n),this.inc("pre",t,n);break;case"major":0===this.minor&&0===this.patch&&0!==this.prerelease.length||this.major++,this.minor=0,this.patch=0,this.prerelease=[];break;case"minor":0===this.patch&&0!==this.prerelease.length||this.minor++,this.patch=0,this.prerelease=[];break;case"patch":0===this.prerelease.length&&this.patch++,this.prerelease=[];break;case"pre":{const e=Number(n)?1:0;if(!t&&!1===n)throw new Error("invalid increment argument: identifier is empty");if(0===this.prerelease.length)this.prerelease=[e];else{let a=this.prerelease.length;for(;--a>=0;)"number"==typeof this.prerelease[a]&&(this.prerelease[a]++,a=-2);if(-1===a){if(t===this.prerelease.join(".")&&!1===n)throw new Error("invalid increment argument: identifier already exists");this.prerelease.push(e)}}if(t){let a=[t,e];!1===n&&(a=[t]),0===u(this.prerelease[0],t)?isNaN(this.prerelease[1])&&(this.prerelease=a):this.prerelease=a}break}default:throw new Error(`invalid increment argument: ${e}`)}return this.raw=this.format(),this.build.length&&(this.raw+=`+${this.build.join(".")}`),this}}e.exports=SemVer},159:function(e,t,n){"use strict";n.d(t,"b",(function(){return l})),n.d(t,"a",(function(){return o}));var a=n(2),i=n(102);const r={managed:!0},l=()=>{const{services:{apm:e}}=Object(i.j)();return{startTransaction:Object(a.useCallback)((({name:t,type:n="user-interaction",options:a})=>e.startTransaction(t,n,null!=a?a:r)),[e])}},o=e=>`Timeline search ${e}`},160:function(e,t,n){"use strict";n.d(t,"b",(function(){return b})),n.d(t,"d",(function(){return f})),n.d(t,"a",(function(){return g})),n.d(t,"c",(function(){return y}));var a=n(2),i=n(42),r=n(103),l=n(246),o=n.n(l),s=n(56),u=n(254),c=n(105),d=n(754),m=n(175),p=n(20);const b=(e,t)=>{const n=Object(r.useDispatch)(),i=Object(u.e)(e);Object(a.useEffect)((()=>{const a=i();return n(d.a.registerUrlParam({key:e,initialValue:a})),t(a),()=>{n(d.a.deregisterUrlParam({key:e}))}}),[])},f=e=>{const t=Object(r.useDispatch)();return Object(a.useCallback)((n=>{t(d.a.updateUrlParam({key:e,value:n}))}),[t,e])},g=()=>{const e=Object(c.b)(d.c.selectGlobalUrlParam);return Object(a.useMemo)((()=>{const t={};return e?(Object.keys(e).forEach((n=>{const a=e[n];if(a&&("object"!=typeof a||!Object(i.isEmpty)(a)))try{t[n]=Object(s.encode)(a)}catch{}})),Object(u.a)(Object(i.pickBy)((e=>!Object(i.isEmpty)(e)),t))):""}),[e])},y=()=>{const[{pageName:e}]=Object(m.a)(),t=Object(c.b)(d.c.selectGlobalUrlParam),n=o()(t),r=Object(u.f)();Object(a.useEffect)((()=>{var a;const l=null!==(a=Object(p.b)(e))&&void 0!==a?a:{skipUrlState:!0},o={...t};l.skipUrlState&&Object.keys(o).forEach((e=>{o[e]=null})),Object(i.difference)(Object.keys(null!=n?n:{}),Object.keys(t)).forEach((e=>{o[e]=null})),Object.keys(o).length>0&&r(o)}),[n,t,e,r])}},164:function(e,t,n){"use strict";n.d(t,"a",(function(){return j})),n.d(t,"e",(function(){return k})),n.d(t,"d",(function(){return T})),n.d(t,"f",(function(){return C})),n.d(t,"g",(function(){return I})),n.d(t,"c",(function(){return $})),n.d(t,"h",(function(){return V})),n.d(t,"b",(function(){return H}));var a=n(388),i=n(42),r=n(47),l=n(343),o=n.n(l),s=n(114),u=n(118),c=n(106),d=n(241),m=n(151),p=n(12),b=n(133),f=n(190),g=n(176),y=n(718),h=n(150),v=n(387),E=n(158),O=n(110),S=n(286),x=n(209);const j="open-timeline",k=({pinnedEventIds:e})=>null!=e?Object.keys(e).length:0,T=({eventIdToNoteIds:e,noteIds:t})=>(null!=e?Object.keys(e).reduce(((t,n)=>t+e[n].length),0):0)+(null!=t?t.length:0),C=({title:e})=>null==e||0===e.trim().length,w=(e,t)=>"__typename"===e?void 0:t,I=e=>JSON.parse(JSON.stringify(e),w),M=e=>{try{return JSON.parse(e)}catch{return e}},A=e=>Object.entries(e).reduce(((e,[t,n])=>"id"!==t&&null!=n?{...e,[t]:n}:e),{columnHeaderType:f.a,id:null!=e.id?e.id:"unknown",initialWidth:"@timestamp"===e.id?g.b:g.a}),N=e=>({$state:{store:"appState"},meta:{...e.meta,...e.meta&&null!=e.meta.field?{params:M(e.meta.field)}:{},...e.meta&&null!=e.meta.params?{params:M(e.meta.params)}:{},...e.meta&&null!=e.meta.value?{value:M(e.meta.value)}:{}},...null!=e.exists?{exists:M(e.exists)}:{},...null!=e.match_all?{exists:M(e.match_all)}:{},...null!=e.missing?{exists:M(e.missing)}:{},...null!=e.query?{query:M(e.query)}:{},...null!=e.range?{range:M(e.range)}:{},...null!=e.script?{exists:M(e.script)}:{}}),F=(e,t)=>e?{}:null!=t?t.reduce(((e,t)=>{if(null!=t.eventId){const n=Object(i.getOr)([],t.eventId,e);return{...e,[t.eventId]:[...n,t.noteId]}}return e}),{}):{},D=(e,t)=>e?{}:null!=t?t.reduce(((e,t)=>({...e,...null!=t.eventId?{[t.eventId]:t}:{}})),{}):{},R=(e,t)=>e?{}:null!=t?t.reduce(((e,t)=>({...e,[t]:!0})),{}):{},P=(e,t,n)=>n===c.l.default&&e.timelineType===c.l.template?e.templateTimelineId:t&&e.timelineType===c.l.template?Object(r.v4)():e.templateTimelineId,L=({and:e,...t})=>t.type===c.a.template?o()(t,{type:c.a.default,enabled:t.queryMatch.operator!==h.d,queryMatch:{value:t.queryMatch.operator===h.d?"":t.queryMatch.value}}):t,B=(e,t,n)=>e&&t&&n===c.l.default?t.map((e=>{var t,n;return{...L(e),and:null!==(t=null===(n=e.and)||void 0===n?void 0:n.map(L))&&void 0!==t?t:[]}})):t,_=(e,t,n)=>n&&e.timelineType!==n?"":t?`${e.title} - Duplicate`:e.title||"",z=(e,t,n)=>n&&e.timelineType!==n?c.k.draft:t?c.k.active:e.status,q=(e,t,n)=>{const i=e.timelineType===c.l.template,r={...e,columns:null!=e.columns?e.columns.map(A):f.b,defaultColumns:f.b,dateRange:e.status===c.k.immutable&&e.timelineType===c.l.template?{start:S.a.toISOString(),end:S.b.toISOString()}:e.dateRange,dataProviders:B(t,e.dataProviders,n),eventIdToNoteIds:F(t,e.eventIdToNoteIds),filters:null!=e.filters?e.filters.map(N):[],isFavorite:!t&&null!=e.favorite&&e.favorite.length>0,noteIds:t?[]:null!=e.noteIds?e.noteIds:[],pinnedEventIds:R(t,e.pinnedEventIds),pinnedEventsSaveObject:D(t,e.pinnedEventsSaveObject),id:t?"":e.savedObjectId,status:z(e,t,n),savedObjectId:t?null:e.savedObjectId,version:t?null:e.version,timelineType:null!=n?n:e.timelineType,title:_(e,t,n),templateTimelineId:P(e,t,n),templateTimelineVersion:t&&i?1:e.templateTimelineVersion};return Object.entries(r).reduce(((e,[t,n])=>null!=n?Object(a.set)(t,n,e):e),{...b.b,id:""})},$=(e,t=!1,n)=>{const{notes:a,...i}=e;return{notes:a,timeline:q(i,t,n)}},V=({activeTimelineTab:e=u.d.query,duplicate:t=!1,graphEventId:n="",timelineId:a,timelineType:r,onError:l,onOpenTimeline:o,openTimeline:s=!0,updateIsLoading:c,updateTimeline:d})=>{c({id:u.c.active,isLoading:!0}),null==a?(d({id:u.c.active,duplicate:!1,notes:[],from:S.a.toISOString(),to:S.b.toISOString(),timeline:{...b.b,id:u.c.active,activeTab:e,show:s,initialized:!0}})(),c({id:u.c.active,isLoading:!1})):Promise.resolve(Object(x.i)(a)).then((a=>{const l=Object(i.getOr)(null,"data",a);if(!l)return;const c=I(l.timeline),{timeline:m,notes:p}=$(c,t,r);if(null!=o)o(m);else if(d){const{from:a,to:r}=Object(v.a)({from:Object(i.getOr)(null,"dateRange.start",m),to:Object(i.getOr)(null,"dateRange.end",m)});d({duplicate:t,from:a,id:u.c.active,notes:p,resolveTimelineConfig:{outcome:l.outcome,alias_target_id:l.alias_target_id,alias_purpose:l.alias_purpose},timeline:{...m,activeTab:e,graphEventId:n,show:s,dateRange:{start:a,end:r}},to:r})()}})).catch((e=>{null!=l&&l(e,a)})).finally((()=>{c({id:u.c.active,isLoading:!1})}))},H=e=>({duplicate:t,id:n,forceNotes:a=!1,from:r,notes:l,resolveTimelineConfig:o,timeline:u,to:b,ruleNote:f,ruleAuthor:g})=>()=>{var h;if(Object(i.isEmpty)(u.indexNames)||e(E.a.setSelectedDataView({id:O.SourcererScopeName.timeline,selectedDataViewId:u.dataViewId,selectedPatterns:u.indexNames})),u.status===c.k.immutable&&u.timelineType===c.l.template?e(Object(m.setRelativeRangeDatePicker)({id:s.a.timeline,fromStr:"now-24h",toStr:"now",from:S.a.toISOString(),to:S.b.toISOString()})):e(Object(m.setTimelineRangeDatePicker)({from:r,to:b})),e(Object(p.addTimeline)({id:n,timeline:u,resolveTimelineConfig:o,savedTimeline:t})),null!=u.kqlQuery&&null!=u.kqlQuery.filterQuery&&null!=u.kqlQuery.filterQuery.kuery&&""!==u.kqlQuery.filterQuery.kuery.expression&&e(Object(p.applyKqlFilterQuery)({id:n,filterQuery:{kuery:{kind:null!==(h=u.kqlQuery.filterQuery.kuery.kind)&&void 0!==h?h:"kuery",expression:u.kqlQuery.filterQuery.kuery.expression||""},serializedQuery:u.kqlQuery.filterQuery.serializedQuery||""}})),t&&null!=f&&!Object(i.isEmpty)(f)){const t=Object(y.a)({newNote:f,user:g||"elastic"});e(Object(d.updateNote)({note:t})),e(Object(p.addNote)({noteId:t.id,id:n}))}t&&!a||e(Object(d.addNotes)({notes:null!=l?l.map((e=>{var t,n;return{created:null!=e.created?new Date(e.created):new Date,id:e.noteId,lastEdit:null!=e.updated?new Date(e.updated):new Date,note:e.note||"",user:e.updatedBy||"unknown",saveObjectId:e.noteId,version:e.version,eventId:null!==(t=e.eventId)&&void 0!==t?t:null,timelineId:null!==(n=e.timelineId)&&void 0!==n?n:null}})):[]}))}},166:function(e,t,n){"use strict";n.d(t,"a",(function(){return g}));var a=n(40),i=n(2),r=n.n(i),l=n(41),o=n.n(l),s=n(53),u=n.n(s),c=n(149),d=n(679),m=n(910);const p=o.a.header.withConfig({displayName:"Header",componentId:"sc-1q9aiyj-0"})(["&.toggle-expand{margin-bottom:",";}.no-margin{margin-top:0 !important;margin-bottom:0 !important;}"," margin-bottom:0;user-select:text;",""],(({theme:e})=>e.eui.euiSizeL),(({height:e})=>e&&Object(l.css)(["height:","px;"],e)),(({border:e})=>e&&Object(l.css)(["border-bottom:",";padding-bottom:",";"],(({theme:e})=>e.eui.euiBorderThin),(({theme:e})=>e.eui.euiSizeL))));p.displayName="Header";const b=({alignHeader:e,stackHeader:t})=>null!=e?e:t?void 0:"center",f=({alignHeader:e,border:t,children:n,outerDirection:l="column",growLeftSplit:o=!0,headerFilters:s,height:f,hideSubtitle:g=!1,id:y,inspectMultiple:h=!1,inspectTitle:v,isInspectDisabled:E,showInspectButton:O=!0,split:S,stackHeader:x,subtitle:j,title:k,titleSize:T="m",toggleQuery:C,toggleStatus:w=!0,tooltip:I,tooltipTitle:M})=>{const A=Object(i.useCallback)((()=>{C&&C(!w)}),[C,w]),N=u()({"toggle-expand":w,siemHeaderSection:!0});return r.a.createElement(p,{"data-test-subj":"header-section",border:t,height:f,className:N,$hideSubtitle:g},r.a.createElement(a.EuiFlexGroup,{"data-test-subj":"headerSectionOuterFlexGroup",direction:l,gutterSize:"xs",responsive:!1},r.a.createElement(a.EuiFlexItem,{grow:o},r.a.createElement(a.EuiFlexGroup,{alignItems:b({alignHeader:e,stackHeader:x}),"data-test-subj":"headerSectionInnerFlexGroup",direction:x?"column":"row",gutterSize:"s"},r.a.createElement(a.EuiFlexItem,{grow:o,className:w?"":"no-margin"},r.a.createElement(a.EuiFlexGroup,{alignItems:"center",responsive:!1,gutterSize:"s"},r.a.createElement(a.EuiFlexItem,null,r.a.createElement(a.EuiFlexGroup,{responsive:!1,gutterSize:"none",className:"header-section-titles"},C&&r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiButtonIcon,{"data-test-subj":"query-toggle-header","aria-label":m.a(w),color:"text",display:"empty",iconType:w?"arrowDown":"arrowRight",onClick:A,size:"s",title:m.a(w)})),r.a.createElement(a.EuiFlexItem,null,r.a.createElement(a.EuiTitle,{size:T},r.a.createElement("h4",{"data-test-subj":"header-section-title"},r.a.createElement("span",{className:"eui-textBreakNormal"},k),I&&r.a.createElement(r.a.Fragment,null," ",r.a.createElement(a.EuiIconTip,{color:"subdued",title:M,content:I,size:"l",type:"iInCircle"}))))))),y&&w&&r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(c.b,{isDisabled:E,queryId:y,multiple:h,showInspectButton:O,title:null!=v?v:k})),s&&w&&r.a.createElement(a.EuiFlexItem,{"data-test-subj":"header-section-filters",grow:!1},s))),n&&w&&r.a.createElement(a.EuiFlexItem,{"data-test-subj":"header-section-supplements",grow:!!S},n))),!g&&w&&r.a.createElement(a.EuiFlexItem,null,r.a.createElement(d.a,{"data-test-subj":"header-section-subtitle",items:j}))))},g=r.a.memo(f)},1662:function(e,t,n){"use strict";n.r(t),n.d(t,"registerActions",(function(){return oe}));var a=n(73),i=n(100),r=n(247),l=n(427),o=n(428),s=n(111),u=n(101),c=n(4);const d=["signal.rule.risk_score","kibana.alert.risk_score","signal.reason","kibana.alert.reason"],m=e=>!!e&&e===c.l,p=e=>e.type===u.LENS_EMBEDDABLE_TYPE,b=e=>!!e&&!d.includes(e),f=(e,t)=>"number"===e&&"value_count"===t;var g=n(142),y=n(115),h=n(289);const v=({store:e,services:t})=>{const n=s.b.getTimelineByIdSelector(),{filterManager:a}=t.data.query,{notifications:i}=t;return Object(r.h)({filterManager:a,notifications:i}).combine({type:h.a.FILTER,isCompatible:async({data:e})=>{var t;const n=null===(t=e[0])||void 0===t?void 0:t.field;return 1===e.length&&b(n.name)&&Object(l.b)(n.type)},execute:async({data:t,metadata:s})=>{var u,c;const d=null===(u=t[0])||void 0===u?void 0:u.field,m=null===(c=t[0])||void 0===c?void 0:c.value,p=Object(l.a)(Object(l.d)(m));if(!Object(l.c)(p))return void i.toasts.addWarning({title:o.a});if(!d)return;const b=!0===(null==s?void 0:s.negateFilters)?r.e:r.d;var f;null!=s&&s.scopeId&&Object(y.isTimelineScope)(s.scopeId)?b({filterManager:null===(f=n(e.getState(),g.f.active))||void 0===f?void 0:f.filterManager,fieldName:d.name,value:p}):b({filterManager:a,fieldName:d.name,value:p})}})},E=({store:e,services:t})=>{const n=s.b.getTimelineByIdSelector(),{filterManager:a}=t.data.query,{notifications:i}=t;return Object(r.i)({filterManager:a,notifications:i}).combine({type:h.a.FILTER,isCompatible:async({data:e})=>{var t;const n=null===(t=e[0])||void 0===t?void 0:t.field;return 1===e.length&&b(n.name)&&Object(l.b)(n.type)},execute:async({data:t,metadata:s})=>{var u,c;const d=null===(u=t[0])||void 0===u?void 0:u.field,m=null===(c=t[0])||void 0===c?void 0:c.value,p=Object(l.a)(Object(l.d)(m));if(!Object(l.c)(p))return void i.toasts.addWarning({title:o.a});if(!d)return;const b=!0===(null==s?void 0:s.negateFilters)?r.d:r.e;var f;null!=s&&s.scopeId&&Object(y.isTimelineScope)(s.scopeId)?b({filterManager:null===(f=n(e.getState(),g.f.active))||void 0===f?void 0:f.filterManager,fieldName:d.name,value:p}):b({filterManager:a,fieldName:d.name,value:p})}})},O=({store:e,services:t})=>{const{application:n}=t;let a;return n.currentAppId$.subscribe((e=>{a=e})),v({store:e,services:t}).combine({isCompatible:async()=>m(a)})},S=({store:e,services:t})=>{const{application:n}=t;let a;return n.currentAppId$.subscribe((e=>{a=e})),E({store:e,services:t}).combine({isCompatible:async()=>m(a)})};var x=n(12),j=n(721),k=n(109),T=n(42),C=n(167),w=n(395),I=n(380),M=n(485),A=n(1387),N=n(188);const F=({field:e,id:t,value:n,operator:a=g.e,excluded:i=!1})=>({and:[],enabled:!0,id:Object(k.j)(t),name:e,excluded:i,kqlQuery:"",queryMatch:{field:e,value:n,operator:a}}),D=({contextId:e,eventId:t,field:n,fieldFormat:a,fieldType:i,values:r,sourceParamType:l,negate:o})=>null==n?null:(Array.isArray(r)?r.length>0?r:[null]:[r]).reduce(((r,s,u)=>{let c="";const d=null!=s?s.toString():s,m=`${e}${t?`-${t}`:""}-${n}-${u}${d?`-${d}`:""}`;if(!R(n,i))return r;if(f(i,l))return c=`value-count-data-provider-${e}-${n}`,r.push(F({field:n,id:c,value:"",excluded:!1,operator:g.a})),r;if(null==d)return c=`empty-value-${m}`,r.push(F({field:n,id:c,value:"",excluded:!0,operator:g.a})),r;if(i===w.b&&(c=`formatted-ip-data-provider-${e}-${n}-${d}${t?`-${t}`:""}`,Object(T.isString)(d)&&!Object(T.isEmpty)(d))){let e=d;try{e=JSON.parse(d)}catch(e){}return Object(T.isArray)(e)?e.forEach((e=>r.push(F({field:n,id:c,value:e})))):r.push(F({field:n,id:c,value:e})),r}return c=P({field:n,fieldFormat:a,appendedUniqueId:m,value:d}),r.push(F({field:n,id:c,value:d,excluded:o})),r}),[]),R=(e,t)=>t!==N.f&&e!==N.i,P=({field:e,fieldFormat:t,appendedUniqueId:n,value:a})=>{let i;return i=I.b.some((t=>e===t))?`port-default-${n}`:e===M.b?`duration-default-${n}`:t===A.a?`bytes-default-${n}`:e===N.o?`alert-field-default-${n}`:[N.m,N.l,N.e,C.j,N.n,N.c].includes(e)?`event-field-default-${n}-${a}`:`event-field-default-${n}`,i},L=Object(r.f)((({store:e,services:t})=>{const{notifications:n}=t;return{type:h.a.ADD_TO_TIMELINE,getIconType:()=>j.d,getDisplayName:()=>j.a,getDisplayNameTooltip:()=>j.a,isCompatible:async({data:e})=>{var t;const n=null===(t=e[0])||void 0===t?void 0:t.field;return 1===e.length&&b(n.name)&&R(n.name,n.type)&&Object(l.b)(n.type)},execute:async({data:t,metadata:a})=>{var i,r,s;const{name:u,type:c}=null===(i=t[0])||void 0===i?void 0:i.field,d=null===(r=t[0])||void 0===r?void 0:r.value,m=Object(l.a)(Object(l.d)(d));if(!Object(l.c)(m))return void n.toasts.addWarning({title:o.a});const[p,...b]=m,[f]=null!==(s=D({contextId:g.f.active,fieldType:c,values:p,field:u,negate:!0===(null==a?void 0:a.negateFilters)}))&&void 0!==s?s:[];if(f&&b.forEach((e=>{var t;const[n]=null!==(t=D({contextId:g.f.active,fieldType:c,values:e,field:u,negate:!0===(null==a?void 0:a.negateFilters)}))&&void 0!==t?t:[];n&&f.and.push(n)})),f){e.dispatch(Object(x.addProvider)({id:g.f.active,providers:[f]}));const t=m.join(", ");n.toasts.addSuccess({title:Object(j.e)(t)})}else n.toasts.addWarning({title:j.c,text:j.b})}}}));var B=n(133);const _=Object(r.f)((({store:e,services:t})=>{const{notifications:n}=t;return{type:h.a.INVESTIGATE_IN_NEW_TIMELINE,getIconType:()=>j.d,getDisplayName:()=>j.f,getDisplayNameTooltip:()=>j.f,isCompatible:async({data:e})=>{var t;const n=null===(t=e[0])||void 0===t?void 0:t.field;return 1===e.length&&b(n.name)&&R(n.name,n.type)&&Object(l.b)(n.type)},execute:async({data:t,metadata:a})=>{var i,r,u;const c=null===(i=t[0])||void 0===i?void 0:i.field,d=null===(r=t[0])||void 0===r?void 0:r.value,m=Object(l.a)(Object(l.d)(d));if(!Object(l.c)(m))return void n.toasts.addWarning({title:o.a});const p=null!==(u=D({contextId:g.f.active,fieldType:c.type,values:m,field:c.name,negate:!0===(null==a?void 0:a.negateFilters)}))&&void 0!==u?u:[];for(const e of null!==(b=null==a?void 0:a.andFilters)&&void 0!==b?b:[]){var b,f;const t=null!==(f=D({contextId:g.f.active,field:e.field,values:e.value}))&&void 0!==f?f:[];if(t)for(const e of p)e.and.push(...t)}p.length>0?(e.dispatch(s.a.createTimeline({...B.b,id:g.f.active})),e.dispatch(Object(x.showTimeline)({id:g.f.active,show:!0})),e.dispatch(Object(x.addProvider)({id:g.f.active,providers:p}))):n.toasts.addWarning({title:j.c,text:j.b})}}}));var z=n(91),q=n(102);const $="embeddable_addToTimeline",V=({store:e,services:t})=>{const{application:n}=t;let a;return n.currentAppId$.subscribe((e=>{a=e})),L({store:e,services:t}).combine({isCompatible:async()=>m(a)})};var H=n(5),U=n(49),Q=n(921);const G=e=>H.i18n.translate("xpack.securitySolution.actions.showTopTooltip",{values:{fieldName:e},defaultMessage:"Show top {fieldName}"}),W=Object(r.f)((({services:e})=>({type:h.a.SHOW_TOP_N,getIconType:()=>"visBarVertical",getDisplayName:({data:e})=>{var t;return G(null===(t=e[0])||void 0===t?void 0:t.field.name)},getDisplayNameTooltip:({data:e})=>{var t;return G(null===(t=e[0])||void 0===t?void 0:t.field.name)},isCompatible:async({data:e})=>{var t;const n=null===(t=e[0])||void 0===t?void 0:t.field;return 1===e.length&&b(n.name)&&Object(Q.a)(n.type)&&!Object(U.isDataViewFieldSubtypeNested)(n)&&!!n.aggregatable},execute:async t=>{var n;const a=Object(T.first)(t.data);t.nodeRef.current&&a&&e.topValuesPopover.showPopover({fieldName:a.field.name,scopeId:null===(n=t.metadata)||void 0===n?void 0:n.scopeId,nodeRef:t.nodeRef.current})}})));var K=n(516),X=n.n(K);const Y=H.i18n.translate("xpack.securitySolution.actions.cellValue.copyToClipboard.displayName",{defaultMessage:"Copy to Clipboard"}),J=H.i18n.translate("xpack.securitySolution.actions.cellValue.copyToClipboard.successMessage",{defaultMessage:"Copied to the clipboard"}),Z="embeddable_copyToClipboard",ee=({services:e})=>{const{notifications:t}=e;return Object(r.g)({notifications:t}).combine({type:h.a.COPY,isCompatible:async({data:e})=>{var t;const n=null===(t=e[0])||void 0===t?void 0:t.field;return b(n.name)}})},te=({services:e})=>{const{application:t}=e;let n;return t.currentAppId$.subscribe((e=>{n=e})),ee({services:e}).combine({isCompatible:async()=>m(n)})};var ne=n(119),ae=n(176);const ie=H.i18n.translate("xpack.securitySolution.actions.toggleColumnToggle.label",{defaultMessage:"Toggle column in table"}),re=Object(r.f)((({store:e})=>({type:h.a.TOGGLE_COLUMN,getIconType:()=>"listAdd",getDisplayName:()=>ie,getDisplayNameTooltip:({data:e,metadata:t})=>{var n,a;return null!=t&&t.isObjectArray?(a=null===(n=e[0])||void 0===n?void 0:n.field.name,H.i18n.translate("xpack.securitySolution.actions.toggleColumnToggle.nestedLabel",{values:{field:a},defaultMessage:"The {field} field is an object, and is broken down into nested fields which can be added as columns"})):ie},isCompatible:async({data:e,metadata:t})=>{var n;const a=null===(n=e[0])||void 0===n?void 0:n.field;return 1===e.length&&b(a.name)&&!(null==t||!t.scopeId)&&(Object(y.isTimelineScope)(t.scopeId)||Object(y.isInTableScope)(t.scopeId))},execute:async({metadata:t,data:n})=>{var a,i;const r=null===(a=n[0])||void 0===a?void 0:a.field,l=null==t?void 0:t.scopeId;if(!l)return;const o=Object(y.getScopedActions)(l);if(!o)return;const u=Object(y.isTimelineScope)(l)?s.b.getTimelineByIdSelector():ne.j.getTableByIdSelector(),c=Object(y.isTimelineScope)(l)?B.b:ne.q,{columns:d}=null!==(i=u(e.getState(),l))&&void 0!==i?i:c;d.some((e=>e.id===r.name))?e.dispatch(o.removeColumn({columnId:r.name,id:l})):e.dispatch(o.upsertColumn({column:{columnHeaderType:ne.k,id:r.name,initialWidth:ae.a},id:l,index:1}))}}))),le=(e,t)=>{const{telemetry:n}=t,{execute:a,...i}=e;return{...i,execute:e=>(n.reportCellActionClicked({actionId:i.id,displayName:i.getDisplayName(e),fieldName:e.data.map((({field:e})=>e.name)).join(", "),metadata:e.metadata}),a(e))}},oe=(e,t,n)=>{se(e,n),ue(e,n),ce(e,t,n)},se=(e,t)=>{const{uiActions:n}=t,i=(({store:e,order:t})=>{const{application:n,notifications:{toasts:i}}=q.b.get();let r;return n.currentAppId$.subscribe((e=>{r=e})),Object(z.createAction)({id:$,type:$,order:t,getIconType:()=>j.d,getDisplayName:()=>j.a,isCompatible:async({embeddable:e,data:t})=>!Object(a.isErrorEmbeddable)(e)&&p(e)&&Object(a.isFilterableEmbeddable)(e)&&function(e){return!!e&&e.length>0&&e.every((({columnMeta:e})=>{var t;return e&&b(e.field)&&"esaggs"===e.source&&(null===(t=e.sourceParams)||void 0===t?void 0:t.indexPatternId)}))}(t)&&m(r),execute:async({data:t})=>{const n=t.reduce(((e,{columnMeta:t,value:n,eventId:a})=>{var i;const r=D({contextId:g.f.active,fieldType:null==t?void 0:t.type,values:n,field:null==t?void 0:t.field,eventId:a,sourceParamType:null==t||null===(i=t.sourceParams)||void 0===i?void 0:i.type});return r&&e.push(...r),e}),[]);if(n.length>0){e.dispatch(Object(x.addProvider)({id:g.f.active,providers:n}));const t=(e=>e.reduce(((e,{queryMatch:{value:t,operator:n,field:a}})=>{if(null!=t)if(n===g.a)e.push(a);else{const n=Array.isArray(t)?t.join(", "):t.toString();e.push(n)}return e}),[]).join(", "))(n);t.length>0&&i.addSuccess({title:Object(j.e)(t)})}else i.addWarning({title:j.c,text:j.b})}})})({store:e,order:1});n.addTriggerAction(a.CELL_VALUE_TRIGGER,i);const r=(({order:e})=>{const{application:t}=q.b.get();let n;return t.currentAppId$.subscribe((e=>{n=e})),Object(z.createAction)({id:Z,type:Z,order:e,getIconType:()=>"copyClipboard",getDisplayName:()=>Y,isCompatible:async({embeddable:e,data:t})=>!Object(a.isErrorEmbeddable)(e)&&p(e)&&function(e){return!!e&&e.length>0&&e.every((({columnMeta:e})=>e&&b(e.field)))}(t)&&m(n),execute:async({data:e})=>{const{notifications:{toasts:t}}=q.b.get(),n=e.map((({columnMeta:e,value:t})=>{var n;return f(null==e?void 0:e.type,null==e||null===(n=e.sourceParams)||void 0===n?void 0:n.type)?`${null==e?void 0:e.field}: *`:`${null==e?void 0:e.field}${null!=t?`: "${t}"`:""}`})).join(" | ");X()(n,{debug:!0})&&t.addSuccess({title:J,toastLifeTimeMs:800})}})})({order:2});n.addTriggerAction(a.CELL_VALUE_TRIGGER,r)},ue=(e,t)=>{const{uiActions:n}=t,a={filterIn:O({store:e,services:t}),filterOut:S({store:e,services:t}),addToTimeline:V({store:e,services:t}),copyToClipboard:te({services:t})};var r;r=i.SEARCH_EMBEDDABLE_CELL_ACTIONS_TRIGGER_ID,["filterIn","filterOut","addToTimeline","copyToClipboard"].forEach(((e,i)=>{const l=a[e];if(l){const a=l({id:`${r}-${e}`,order:i}),o=le(a,t);n.addTriggerAction(r,o)}}))},ce=(e,t,n)=>{const{uiActions:a}=n,i={filterIn:v({store:e,services:n}),filterOut:E({store:e,services:n}),addToTimeline:L({store:e,services:n}),investigateInNewTimeline:_({store:e,services:n}),showTopN:W({services:n}),copyToClipboard:ee({services:n}),toggleColumn:re({store:e})},r=(e,t)=>{a.registerTrigger({id:e}),t.forEach(((t,r)=>{const l=i[t];if(l){const i=l({id:`${e}-${t}`,order:r}),o=le(i,n);a.addTriggerAction(e,o)}}))};r(h.b.DEFAULT,["filterIn","filterOut","addToTimeline","showTopN","copyToClipboard"]),r(h.b.DETAILS_FLYOUT,["filterIn","filterOut","addToTimeline","toggleColumn","showTopN","copyToClipboard"]),r(h.b.ALERTS_COUNT,["investigateInNewTimeline"])}},169:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"d",(function(){return c.a})),n.d(t,"i",(function(){return c.d})),n.d(t,"e",(function(){return d.a})),n.d(t,"j",(function(){return d.b})),n.d(t,"f",(function(){return m})),n.d(t,"h",(function(){return p.b})),n.d(t,"g",(function(){return p.a})),n.d(t,"k",(function(){return b})),n.d(t,"l",(function(){return f})),n.d(t,"b",(function(){return g})),n.d(t,"c",(function(){return y})),n.d(t,"m",(function(){return h})),n.d(t,"n",(function(){return v}));var a=n(42),i=n(2),r=n(636),l=n(609),o=n(323),s=(n(4),n(195));const u=(e,t)=>`/${e}/summary${Object(s.a)(t)}`;var c=n(201),d=n(259);const m=(e,t)=>`/${e}${Object(s.a)(t)}`;var p=n(411);const b=(e,t)=>`/${e}${Object(s.a)(t)}`,f=(e,t)=>`?timeline=(id:'${e}',isOpen:!t${Object(a.isEmpty)(t)?")":`,graphEventId:'${t}')`}`,g=({id:e,search:t})=>`/${encodeURIComponent(e)}${Object(s.a)(null!=t?t:void 0)}`,y=e=>`/create${Object(s.a)(null!=e?e:void 0)}`,h=e=>{const{getAppUrl:t}=Object(o.a)(),n=Object(l.b)(e);return{formatUrl:Object(i.useCallback)(((i,{absolute:r=!1,skipSearch:l=!1}={})=>{const o=function(e,t,n){const[i,r]=e.split("?");return`${i}${n?Object(a.isEmpty)(r)?"":`?${r}`:Object(a.isEmpty)(r)?t:`?${r}${Object(a.isEmpty)(t)?"":`&${t}`}`}`}(i,n,l);return t({deepLinkId:e,path:o,absolute:r})}),[t,e,n]),search:n}},v=()=>{const e=Object(r.b)(),t=Object(l.a)();return Object(i.useCallback)((({deepLinkId:n,path:a="",absolute:i=!1,skipSearch:r=!1})=>{const l=r?"":t(n);return e({id:n,path:a,urlState:l,absolute:i})}),[e,t])}},175:function(e,t,n){"use strict";n.d(t,"a",(function(){return r}));var a=n(2),i=n(901);const r=()=>Object(a.useContext)(i.a)},177:function(e,t,n){"use strict";n.d(t,"a",(function(){return l}));var a=n(2),i=n(102),r=n(175);const l=e=>{var t;const[{pageName:n}]=Object(r.a)(),{services:{storage:l}}=Object(i.j)(),o=((e,t)=>t&&e.length>0?`kibana.siem:${t}.query.toggle:${e}`:null)(n,e),[s,u]=Object(a.useState)(null==o||null===(t=l.get(o))||void 0===t||t);Object(a.useEffect)((()=>{var e;null!=o&&u(null===(e=l.get(o))||void 0===e||e)}),[l,o]);const c=Object(a.useCallback)((e=>{null!=o&&(l.set(o,e),u(e))}),[l,o]);return e?{toggleStatus:s,setToggleStatus:c}:{toggleStatus:!0,setToggleStatus:()=>{}}}},181:function(e,t,n){"use strict";n.d(t,"b",(function(){return d})),n.d(t,"a",(function(){return m})),n.d(t,"c",(function(){return p}));var a=n(42),i=n(2),r=n.n(i),l=n(285),o=n(299);const s={canUserCRUD:null,canUserREAD:null,hasIndexManage:null,hasIndexMaintenance:null,hasIndexWrite:null,hasIndexRead:null,hasIndexUpdateDelete:null,isSignalIndexExists:null,isAuthenticated:null,hasEncryptionKey:null,loading:!0,signalIndexName:null,signalIndexMappingOutdated:null},u=(e,t)=>{switch(t.type){case"updateLoading":return{...e,loading:t.loading};case"updateHasIndexManage":return{...e,hasIndexManage:t.hasIndexManage};case"updateHasIndexMaintenance":return{...e,hasIndexMaintenance:t.hasIndexMaintenance};case"updateHasIndexWrite":return{...e,hasIndexWrite:t.hasIndexWrite};case"updateHasIndexRead":return{...e,hasIndexRead:t.hasIndexRead};case"updateHasIndexUpdateDelete":return{...e,hasIndexUpdateDelete:t.hasIndexUpdateDelete};case"updateIsSignalIndexExists":return{...e,isSignalIndexExists:t.isSignalIndexExists};case"updateIsAuthenticated":return{...e,isAuthenticated:t.isAuthenticated};case"updateHasEncryptionKey":return{...e,hasEncryptionKey:t.hasEncryptionKey};case"updateSignalIndexName":return{...e,signalIndexName:t.signalIndexName};case"updateSignalIndexMappingOutdated":return{...e,signalIndexMappingOutdated:t.signalIndexMappingOutdated};case"updateCanUserCRUD":return{...e,canUserCRUD:t.canUserCRUD};case"updateCanUserREAD":return{...e,canUserREAD:t.canUserREAD};default:return e}},c=Object(i.createContext)([s,()=>a.noop]),d=()=>Object(i.useContext)(c),m=({children:e})=>r.a.createElement(c.Provider,{value:Object(i.useReducer)(u,s)},e),p=()=>{const[{canUserCRUD:e,canUserREAD:t,hasIndexManage:n,hasIndexMaintenance:a,hasIndexWrite:r,hasIndexRead:s,hasIndexUpdateDelete:u,isSignalIndexExists:c,isAuthenticated:m,hasEncryptionKey:p,loading:b,signalIndexName:f,signalIndexMappingOutdated:g},y]=d(),{loading:h,isAuthenticated:v,hasEncryptionKey:E,hasIndexManage:O,hasIndexMaintenance:S,hasIndexUpdateDelete:x,hasIndexWrite:j,hasIndexRead:k,hasKibanaCRUD:T,hasKibanaREAD:C}=Object(l.a)(),{loading:w,signalIndexExists:I,signalIndexName:M,signalIndexMappingOutdated:A,createDeSignalIndex:N}=Object(o.a)();return Object(i.useEffect)((()=>{b||e===T||y({type:"updateCanUserCRUD",canUserCRUD:T})}),[y,b,e,T]),Object(i.useEffect)((()=>{b||t===C||y({type:"updateCanUserREAD",canUserREAD:C})}),[y,b,t,C]),Object(i.useEffect)((()=>{b!==(h||w)&&y({type:"updateLoading",loading:h||w})}),[y,b,h,w]),Object(i.useEffect)((()=>{b||n===O||null==O||y({type:"updateHasIndexManage",hasIndexManage:O})}),[y,b,n,O]),Object(i.useEffect)((()=>{b||r===j||null==j||y({type:"updateHasIndexWrite",hasIndexWrite:j})}),[y,b,r,j]),Object(i.useEffect)((()=>{b||s===k||null==k||y({type:"updateHasIndexRead",hasIndexRead:k})}),[y,b,s,k]),Object(i.useEffect)((()=>{b||u===x||null==x||y({type:"updateHasIndexUpdateDelete",hasIndexUpdateDelete:x})}),[y,b,u,x]),Object(i.useEffect)((()=>{b||a===S||null==S||y({type:"updateHasIndexMaintenance",hasIndexMaintenance:S})}),[y,b,a,S]),Object(i.useEffect)((()=>{b||c===I||null==I||y({type:"updateIsSignalIndexExists",isSignalIndexExists:I})}),[y,b,c,I]),Object(i.useEffect)((()=>{b||m===v||null==v||y({type:"updateIsAuthenticated",isAuthenticated:v})}),[y,b,m,v]),Object(i.useEffect)((()=>{b||p===E||null==E||y({type:"updateHasEncryptionKey",hasEncryptionKey:E})}),[y,b,p,E]),Object(i.useEffect)((()=>{b||f===M||null==M||y({type:"updateSignalIndexName",signalIndexName:M})}),[y,b,f,M]),Object(i.useEffect)((()=>{b||g===A||null==A||y({type:"updateSignalIndexMappingOutdated",signalIndexMappingOutdated:A})}),[y,b,g,A]),Object(i.useEffect)((()=>{m&&p&&n&&(null!=c&&!c||null!=g&&g)&&null!=N&&N()}),[N,m,p,c,n,g]),{loading:b,isSignalIndexExists:c,isAuthenticated:m,hasEncryptionKey:p,canUserCRUD:e,canUserREAD:t,hasIndexManage:n,hasIndexMaintenance:a,hasIndexWrite:r,hasIndexRead:s,hasIndexUpdateDelete:u,signalIndexName:f,signalIndexMappingOutdated:g}}},183:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return f}));var a=n(42),i=n(240),r=n.n(i),l=n(2),o=n(102),s=n(513),u=n(377),c=n(108);const d=e=>Object(a.keyBy)("name",function(e){const t=[];for(const n of Object.values(e))n.fields&&t.push(...Object.values(n.fields));return t}(e)),m=r()(((e,t)=>t&&t.length>0?{fields:t.map((e=>Object(a.pick)(["name","searchable","type","aggregatable","esTypes","subType","conflictDescriptions"],e))),title:e}:{fields:[],title:e}),((e,t)=>e[0]===t[0]&&e[1].length===t[1].length)),p={},b={fields:[],title:""},f=(e,t=!1,n="indexFields")=>{const{data:i}=Object(o.j)().services,r=Object(l.useRef)(new AbortController),d=Object(l.useRef)([]),[f,g]=Object(l.useState)({browserFields:p,indexes:e,indexExists:!0,indexPatterns:b,dataView:void 0,loading:!1}),{addError:y}=Object(c.a)(),h=Object(l.useCallback)((t=>{(async()=>{try{g({...f,loading:!0}),r.current=new AbortController;const e=await i.dataViews.create({title:t.join(","),allowNoIndex:!0}),n=e.toSpec(),{browserFields:a}=Object(u.a)(t,n.fields);d.current=e.getIndexPattern().split(","),g({loading:!1,dataView:n,browserFields:a,indexes:e.getIndexPattern().split(","),indexExists:e.getIndexPattern().split(",").length>0,indexPatterns:m(e.getIndexPattern(),e.fields)})}catch(t){g({browserFields:p,indexes:e,indexExists:!0,indexPatterns:b,dataView:void 0,loading:!1}),y(null==t?void 0:t.message,{title:s.a})}})()}),[y,i.dataViews,e,f]);return Object(l.useEffect)((()=>(Object(a.isEmpty)(e)||Object(a.isEqual)(d.current,e)||h(e),()=>{r.current.abort()})),[e,d]),[f.loading,f]}},187:function(e,t,n){"use strict";n.d(t,"g",(function(){return c})),n.d(t,"a",(function(){return d})),n.d(t,"e",(function(){return m})),n.d(t,"i",(function(){return p})),n.d(t,"b",(function(){return b})),n.d(t,"c",(function(){return f})),n.d(t,"j",(function(){return g})),n.d(t,"d",(function(){return y})),n.d(t,"h",(function(){return h})),n.d(t,"f",(function(){return v}));var a=n(8),i=n(139),r=n(114);const l=e=>e.policy,o=e=>e.timerange,s=e=>e.queries,u=(e,t)=>{const n=e.inputs[t];return Object(a.isEmpty)(n.linkTo)?n.queries:n.linkTo.reduce(((t,n)=>{if(n===r.a.socTrends)return t;const a=e.inputs[n];return[...t,...a.queries]}),n.queries)},c=()=>Object(i.createSelector)(l,(e=>e.kind)),d=()=>Object(i.createSelector)(l,(e=>e.duration)),m=()=>Object(i.createSelector)(o,(e=>e.kind)),p=()=>Object(i.createSelector)(o,(e=>e.from)),b=()=>Object(i.createSelector)(o,(e=>e.to)),f=()=>Object(i.createSelector)(o,(e=>e.fromStr)),g=()=>Object(i.createSelector)(o,(e=>e.toStr)),y=()=>Object(i.createSelector)(s,(e=>e.some((e=>!0===e.loading)))),h=()=>Object(i.createSelector)(u,(e=>e.filter((e=>"kql"!==e.id)))),v=()=>Object(i.createSelector)(s,(e=>e.find((e=>"kql"===e.id))))},189:function(e,t,n){"use strict";n.d(t,"d",(function(){return c})),n.d(t,"c",(function(){return d})),n.d(t,"e",(function(){return m})),n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return b}));var a=n(104),i=n.n(a),r=n(2),l=n.n(r),o=n(40),s=n(16),u=n(21);const c=()=>{const{getAppUrl:e}=Object(s.a)();return Object(r.useCallback)((({id:t,path:n="",absolute:a=!1,urlState:i})=>{const{appId:r,deepLinkId:l,path:o=""}=f(t),s=g(o,n),u=i?y(s,i):s;return e({deepLinkId:l,appId:r,path:u,absolute:a})}),[e])},d=()=>{const e=c(),{navigateTo:t}=Object(s.b)();return Object(r.useCallback)((({id:n,path:a,urlState:i,onClick:r,overrideNavigation:l=!0})=>{const o=e({id:n,path:a,urlState:i});return{href:o,onClick:e=>{h(e)||(r&&r(e),l&&(e.preventDefault(),t({url:o})))}}}),[e,t])},m=e=>l.a.memo((function({id:t,path:n,urlState:a,onClick:r,...l}){const o=d(),{onClick:s,href:c}=o({id:t,path:n,urlState:a,onClick:r,..."_blank"===l.target&&{overrideNavigation:!1}});return Object(u.jsx)(e,i()({onClick:s,href:c},l))})),p=(m(o.EuiButton),m(o.EuiLink)),b=e=>!e.includes(":"),f=e=>{const[t,n]=e.split(/\/(.*)/),a=n?`/${n}`:"";if(!b(t)){const[e,n]=t.split(":");return{appId:e,deepLinkId:n,path:a}}return{deepLinkId:t,path:a}},g=(e,t)=>e&&t?`${e.replace(/\/$/,"")}/${t.replace(/^\//,"")}`:e||t||"",y=(e,t)=>{const n=t.replace("?",""),[a,i]=e.split("?");let r="";return n&&i?r=`?${i}&${n}`:i?r=`?${i}`:n&&(r=`?${n}`),`${a}${r}`},h=e=>e.metaKey||e.altKey||e.ctrlKey||e.shiftKey},196:function(e,t,n){"use strict";n.d(t,"e",(function(){return i})),n.d(t,"b",(function(){return r})),n.d(t,"d",(function(){return l})),n.d(t,"f",(function(){return o})),n.d(t,"a",(function(){return s})),n.d(t,"c",(function(){return u}));var a=n(4);const i={ENABLE:`${a.l} singleRuleActions enable`,DISABLE:`${a.l} singleRuleActions disable`,DUPLICATE:`${a.l} singleRuleActions duplicate`,EXPORT:`${a.l} singleRuleActions export`,DELETE:`${a.l} singleRuleActions delete`,PREVIEW:`${a.l} singleRuleActions preview`,SAVE:`${a.l} singleRuleActions save`},r={ENABLE:`${a.l} bulkRuleActions enable`,DISABLE:`${a.l} bulkRuleActions disable`,DUPLICATE:`${a.l} bulkRuleActions duplicate`,EXPORT:`${a.l} bulkRuleActions export`,DELETE:`${a.l} bulkRuleActions delete`,EDIT:`${a.l} bulkRuleActions edit`},l={REFRESH:`${a.l} rulesTable refresh`,FILTER:`${a.l} rulesTable filter`,LOAD_PREBUILT:`${a.l} rulesTable loadPrebuilt`},o={SAVE:`${a.l} timeline save`,DUPLICATE:`${a.l} timeline duplicate`,DELETE:`${a.l} timeline delete`,BULK_DELETE:`${a.l} timeline bulkDelete`},s={OPEN_ANALYZER:`${a.l} alerts openAnalyzer`,OPEN_SESSION_VIEW:`${a.l} alerts openSessionView`,INVESTIGATE_IN_TIMELINE:`${a.l} alerts investigateInTimeline`},u={FIELD_SAVED:`${a.l} fieldBrowser fieldSaved`,FIELD_DELETED:`${a.l} fieldBrowser fieldDeleted`}},199:function(e,t,n){"use strict";n.d(t,"b",(function(){return i})),n.d(t,"a",(function(){return r})),n.d(t,"c",(function(){return o})),n.d(t,"d",(function(){return u})),n.d(t,"e",(function(){return c}));var a=n(5);let i,r;!function(e){e.rules="rules",e.alertsCases="alertsCases"}(i||(i={})),function(e){e[e.none=0]="none",e[e.pointToAlertName=1]="pointToAlertName",e[e.expandEvent=2]="expandEvent",e[e.reviewAlertDetailsFlyout=3]="reviewAlertDetailsFlyout",e[e.addAlertToCase=4]="addAlertToCase",e[e.createCase=5]="createCase",e[e.submitCase=6]="submitCase",e[e.viewCase=7]="viewCase"}(r||(r={}));const l={minWidth:360,maxWidth:360,offset:10,repositionOnScroll:!0,ownFocus:!0,initialFocus:'[tour-step="nextButton"]'},o=(e,t)=>`tourStepAnchor-${t}-${e}`,s=[{...l,step:r.pointToAlertName,title:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.ruleNameStep.tourTitle",{defaultMessage:"Examine the Alerts Table"}),content:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.ruleNameStep.tourContent",{defaultMessage:"To help you practice triaging alerts, here is the alert from the rule that we enabled in the previous step."}),anchorPosition:"downCenter",dataTestSubj:o(r.pointToAlertName,i.alertsCases),initialFocus:'button[tour-step="nextButton"]'},{...l,step:r.expandEvent,title:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.openFlyout.tourTitle",{defaultMessage:"Review the alert details"}),content:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.openFlyout.tourContent",{defaultMessage:"Some information is provided at-a-glance in the table, but for full details, you'll want to open the alert."}),anchorPosition:"rightUp",dataTestSubj:o(r.expandEvent,i.alertsCases)},{...l,step:r.reviewAlertDetailsFlyout,title:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.flyoutOverview.tourTitle",{defaultMessage:"Explore alert details"}),content:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.flyoutOverview.tourContent",{defaultMessage:"Learn more about alerts by checking out all the information available."}),anchor:`[tour-step="${o(r.reviewAlertDetailsFlyout,i.alertsCases)}"] span.euiTab__content`,offset:20,anchorPosition:"leftUp",dataTestSubj:o(r.reviewAlertDetailsFlyout,i.alertsCases)},{...l,step:r.addAlertToCase,title:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.addToCase.tourTitle",{defaultMessage:"Create a case"}),content:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.addToCase.tourContent",{defaultMessage:'From the Take action menu, select "Add to new case".'}),anchorPosition:"upRight",dataTestSubj:o(r.addAlertToCase,i.alertsCases)},{...l,step:r.createCase,title:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.createCase.tourTitle",{defaultMessage:"Add Case details"}),content:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.createCase.tourContent",{defaultMessage:"Provide the relevant information to create the case. We have included sample text for you."}),anchor:'[tour-step="create-case-flyout"] label',anchorPosition:"leftUp",dataTestSubj:o(r.createCase,i.alertsCases),offset:20,repositionOnScroll:!1},{...l,step:r.submitCase,title:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.submitCase.tourTitle",{defaultMessage:"Create a case"}),content:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.submitCase.tourContent",{defaultMessage:'Press "Create case" to continue.'}),anchor:'[tour-step="create-case-flyout"] [tour-step="create-case-submit"]',anchorPosition:"leftUp",hideNextButton:!0,dataTestSubj:o(r.submitCase,i.alertsCases),offset:20,ownFocus:!1,initialFocus:'[tour-step="create-case-flyout"] [tour-step="create-case-submit"]'},{...l,step:r.viewCase,title:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.viewCase.tourTitle",{defaultMessage:"View the case"}),content:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.viewCase.tourContent",{defaultMessage:"Cases are shown under Insights, in the alert details."}),anchorPosition:"rightUp",dataTestSubj:o(r.viewCase,i.alertsCases)}],u={title:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.createCase.title",{defaultMessage:"This is a test case"}),description:a.i18n.translate("xpack.securitySolution.guided_onboarding.tour.createCase.description",{defaultMessage:"Add a description and other relevant information. The alert will be added to the case."})},c={[i.rules]:[],[i.alertsCases]:s}},200:function(e,t,n){"use strict";let a,i;n.r(t),n.d(t,"HostsType",(function(){return a})),n.d(t,"HostsTableType",(function(){return i})),function(e){e.page="page",e.details="details"}(a||(a={})),function(e){e.authentications="authentications",e.hosts="allHosts",e.events="events",e.uncommonProcesses="uncommonProcesses",e.anomalies="anomalies",e.risk="hostRisk",e.sessions="sessions"}(i||(i={}))},201:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"e",(function(){return r})),n.d(t,"d",(function(){return l})),n.d(t,"c",(function(){return o})),n.d(t,"b",(function(){return s}));var a=n(195);const i=e=>`${Object(a.a)(e)}`,r=e=>`${Object(a.a)(e)}`,l=(e,t)=>`/id/${e}${Object(a.a)(t)}`,o=(e,t,n)=>`/id/${e}/${t}${Object(a.a)(n)}`,s=(e,t)=>`/id/${e}/edit${Object(a.a)(t)}`},211:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"c",(function(){return l})),n.d(t,"b",(function(){return o})),n.d(t,"e",(function(){return s})),n.d(t,"h",(function(){return u})),n.d(t,"d",(function(){return c})),n.d(t,"f",(function(){return d})),n.d(t,"g",(function(){return m}));var a=n(4);const i="histogram-actions-trigger",r={[a.wc.hosts]:"host",[a.wc.users]:"user"},l=(e,t)=>{const n=r[e];return n&&t?[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:`${n}.name`,params:{query:t}},query:{match_phrase:{[`${n}.name`]:t}}}]:[]},o=e=>{const t=r[e];return t&&e?[{query:{bool:{should:[{exists:{field:`${t}.name`}}],minimum_should_match:1}},meta:{alias:"",disabled:!1,key:"bool",negate:!1,type:"custom",value:`{"query": {"bool": {"filter": [{"bool": {"should": [{"exists": {"field": "${t}.name"}}],"minimum_should_match": 1}}]}}}`}}]:[]},s=e=>e?[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:"source.ip",params:{query:e}},query:{bool:{should:[{match_phrase:{"source.ip":e}},{match_phrase:{"destination.ip":e}}],minimum_should_match:1}}}]:[],u=[{query:{bool:{should:[{exists:{field:"source.ip"}},{exists:{field:"destination.ip"}}],minimum_should_match:1}},meta:{alias:"",disabled:!1,key:"bool",negate:!1,type:"custom",value:'{"bool":{"filter":[{"bool":{"should":[{"bool":{"should":[{"exists":{"field": "source.ip"}}],"minimum_should_match":1}},{"bool":{"should":[{"exists":{"field": "destination.ip"}}],"minimum_should_match":1}}],"minimum_should_match":1}}]}}'}}],c=e=>e.length>=1?[{meta:{type:"phrases",key:"_index",params:e,alias:null,negate:!1,disabled:!1},query:{bool:{should:e.map((e=>({match_phrase:{_index:e}}))),minimum_should_match:1}}}]:[],d=e=>(null!=e?e:[]).reduce(((e,t)=>{var n,a,i,r,l,o;return{requests:[...e.requests,JSON.stringify({body:null==t?void 0:t.json,index:(null!==(n=null==t||null===(a=t.stats)||void 0===a||null===(i=a.indexFilter)||void 0===i?void 0:i.value)&&void 0!==n?n:"").split(",")},null,2)],responses:[...e.responses,JSON.stringify(null!==(r=null==t||null===(l=t.response)||void 0===l||null===(o=l.json)||void 0===o?void 0:o.rawResponse)&&void 0!==r?r:{},null,2)]}}),{requests:[],responses:[]}),m=e=>e.reduce(((e,t)=>{try{return[...e,JSON.parse(t)]}catch(t){return e}}),[])},216:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(42);const i=e=>Object(a.isString)(e)?e:JSON.stringify(e)},221:function(e,t,n){"use strict";n.d(t,"b",(function(){return C})),n.d(t,"a",(function(){return w}));var a=n(160),i=n(103),r=n(2),l=n(114),o=n(102),s=n(122),u=n(138),c=n(42),d=n(124),m=n(387),p=n(378);var b=n(246),f=n.n(b),g=n(254),y=n(175);var h=n(164),v=n(111),E=n(142),O=n(105),S=n(45),x=n(56);const j=({search:e,urlKey:t})=>Object(g.b)(Object(g.c)(e),t);var k=n(119),T=n(4);const C=()=>{Object(a.c)(),(()=>{const e=Object(i.useDispatch)(),{filterManager:t,savedQueries:n}=Object(o.j)().services.data.query,c=Object(r.useMemo)((()=>s.d.globalFiltersQuerySelector()),[]),d=Object(i.useSelector)(c),m=Object(r.useCallback)((t=>{null!=t&&e(u.b.setFilterQuery({id:l.a.global,query:t.query,language:t.language}))}),[e]),p=Object(r.useCallback)((n=>{null!=n?(t.setFilters(n),e(u.b.setSearchBarFilter({id:l.a.global,filters:n}))):(t.setAppFilters(d),e(u.b.setSearchBarFilter({id:l.a.global,filters:t.getFilters()})))}),[t,e,d]),b=Object(r.useCallback)((a=>{null!=a&&""!==a&&n.getSavedQuery(a).then((n=>{const a=n.attributes.filters||[],i=n.attributes.query;t.setFilters(a),e(u.b.setSearchBarFilter({id:l.a.global,filters:a})),e(u.b.setFilterQuery({id:l.a.global,...i})),e(u.b.setSavedQuery({id:l.a.global,savedQuery:n}))}))}),[e,t,n]);Object(a.b)(w.appQuery,m),Object(a.b)(w.filters,p),Object(a.b)(w.savedQuery,b)})(),(()=>{const e=Object(i.useDispatch)(),t=Object(d.a)("socTrendsEnabled"),n=Object(r.useCallback)((n=>((e,t,n)=>{if(null!=e){const a={linkTo:Object(c.get)("global.linkTo",e)},i=Object(c.get)("global.timerange.kind",e),r={linkTo:Object(c.get)("timeline.linkTo",e)},o=Object(c.get)("timeline.timerange.kind",e),s={linkTo:Object(c.get)("socTrends.linkTo",e)},d=Object(c.get)("socTrends.timerange.kind",e);if(n&&(Object(c.isEmpty)(s.linkTo)?t(u.b.removeLinkTo([l.a.global,l.a.socTrends])):t(u.b.addLinkTo([l.a.global,l.a.socTrends]))),Object(c.isEmpty)(a.linkTo)?(t(u.b.removeLinkTo([l.a.global,l.a.timeline])),n&&t(u.b.removeLinkTo([l.a.global,l.a.socTrends]))):(t(u.b.addLinkTo([l.a.global,l.a.timeline])),n&&t(u.b.addLinkTo([l.a.global,l.a.socTrends]))),Object(c.isEmpty)(r.linkTo)?t(u.b.removeLinkTo([l.a.global,l.a.timeline])):t(u.b.addLinkTo([l.a.global,l.a.timeline])),o){if("absolute"===o){const n=Object(m.a)(Object(c.get)("timeline.timerange",e));t(u.b.setAbsoluteRangeDatePicker({...n,id:l.a.timeline}))}if("relative"===o){const n=Object(m.a)(Object(c.get)("timeline.timerange",e));n.from=Object(p.c)(n.fromStr),n.to=Object(p.c)(n.toStr,{roundUp:!0}),t(u.b.setRelativeRangeDatePicker({...n,id:l.a.timeline}))}}if(i){if("absolute"===i){const n=Object(m.a)(Object(c.get)("global.timerange",e));t(u.b.setAbsoluteRangeDatePicker({...n,id:l.a.global}))}if("relative"===i){const n=Object(m.a)(Object(c.get)("global.timerange",e));n.from=Object(p.c)(n.fromStr),n.to=Object(p.c)(n.toStr,{roundUp:!0}),t(u.b.setRelativeRangeDatePicker({...n,id:l.a.global}))}}if(n&&d){if("absolute"===d){const n=Object(m.a)(Object(c.get)("socTrends.timerange",e));t(u.b.setAbsoluteRangeDatePicker({...n,id:l.a.socTrends}))}if("relative"===d){const n=Object(m.a)(Object(c.get)("socTrends.timerange",e));n.from=Object(p.c)(n.fromStr),n.to=Object(p.c)(n.toStr,{roundUp:!0}),t(u.b.setRelativeRangeDatePicker({...n,id:l.a.socTrends}))}}}})(n,e,t)),[e,t]);Object(a.b)(w.timerange,n)})(),(()=>{const[{pageName:e}]=Object(y.a)(),t=Object(i.useDispatch)(),n=f()(e),a=Object(r.useMemo)((()=>s.d.inputsSelector()),[]),o=Object(i.useSelector)(a),{timerange:c}=o.global,{timerange:d}=o.timeline;Object(r.useEffect)((()=>{((e,t)=>e&&t&&t!==e&&Object(g.d)(e))(e,n)&&("relative"===d.kind&&t(u.b.setRelativeRangeDatePicker({...d,from:Object(p.c)(d.fromStr),to:Object(p.c)(d.toStr,{roundUp:!0}),id:l.a.timeline})),"relative"===c.kind&&t(u.b.setRelativeRangeDatePicker({...c,from:Object(p.c)(c.fromStr),to:Object(p.c)(c.toStr,{roundUp:!0}),id:l.a.global})))}),[e,n,t,d,c])})(),(()=>{const e=Object(i.useDispatch)(),t=Object(r.useCallback)((t=>{null!=t&&Object(h.h)({activeTimelineTab:t.activeTab,duplicate:!1,graphEventId:t.graphEventId,timelineId:t.id,openTimeline:t.isOpen,updateIsLoading:t=>e(v.a.updateIsLoading(t)),updateTimeline:Object(h.b)(e)})}),[e]);Object(a.b)(w.timeline,t)})(),(()=>{const e=Object(a.d)(w.timeline),t=Object(r.useMemo)((()=>v.b.getTimelineByIdSelector()),[]),{activeTab:n,graphEventId:i,show:l,savedObjectId:o}=Object(O.b)((e=>{var n;return null!==(n=t(e,E.f.active))&&void 0!==n?n:{}}));Object(r.useEffect)((()=>{const t={...o?{id:o}:{},isOpen:l,activeTab:n,graphEventId:null!=i?i:""};e(t)}),[n,i,o,l,e])})(),(()=>{var e;const t=Object(r.useMemo)((()=>v.b.getTimelineByIdSelector()),[]),n=Object(O.b)((e=>t(e,E.f.active))),{search:a}=Object(S.useLocation)(),l=f()(a),o=null!==(e=null==n?void 0:n.savedObjectId)&&void 0!==e?e:"",s=Object(i.useDispatch)(),[u,c]=Object(r.useMemo)((()=>{const e=j({urlKey:w.timeline,search:null!=l?l:""}),t=j({urlKey:w.timeline,search:a});return null!=e&&null!=t?[Object(x.safeDecode)(e),Object(x.safeDecode)(t)]:[null,null]}),[l,a]),d=null==u?void 0:u.id,{id:m,activeTab:p,graphEventId:b}=c||{};Object(r.useEffect)((()=>{m&&m!==d&&m!==o&&Object(h.h)({activeTimelineTab:null!=p?p:E.g.query,duplicate:!1,graphEventId:b,timelineId:m,openTimeline:!0,updateIsLoading:e=>s(v.a.updateIsLoading(e)),updateTimeline:Object(h.b)(s)})}),[o,s,d,m,p,b])})(),(()=>{const[e]=Object(o.p)(T.lb),[t,n]=Object(r.useState)(null),[l,s]=Object(r.useState)(!1),u=Object(i.useDispatch)(),c=k.j.getTableByIdSelector(),d=Object(O.b)((e=>{var t;return null!==(t=c(e,k.e.alertsOnAlertsPage))&&void 0!==t?t:k.q})),m=Object(r.useCallback)((t=>{!e&&null!=t&&t.panelView&&n(t)}),[e]),p=Object(r.useCallback)((()=>{const{initialized:n,isLoading:a,totalCount:i,additionalFilters:r}=d,l=n&&!a&&i>0;!e&&t&&(r&&r.showBuildingBlockAlerts||u(k.h.updateShowBuildingBlockAlertsFilter({id:k.e.alertsOnAlertsPage,showBuildingBlockAlerts:!0})),l&&(s(!0),u(k.h.toggleDetailPanel({id:k.e.alertsOnAlertsPage,...t}))))}),[d,u,e,t]);Object(r.useEffect)((()=>{l||p()}),[l,p]);const b=e?"":w.eventFlyout;Object(a.b)(b,m)})(),(()=>{const e=Object(a.d)(w.eventFlyout),{pathname:t}=Object(S.useLocation)(),n=Object(i.useDispatch)(),l=k.j.getTableByIdSelector(),{expandedDetail:o}=Object(O.b)((e=>{var t;return null!==(t=l(e,k.e.alertsOnAlertsPage))&&void 0!==t?t:k.q}));Object(r.useEffect)((()=>{var a;const i=t===T.d;i&&null!=o&&null!=o&&o.query?e(o.query.panelView?o.query:null):!i&&null!=o&&null!==(a=o.query)&&void 0!==a&&a.panelView&&(n(k.h.toggleDetailPanel({id:k.e.alertsOnAlertsPage})),e(null))}),[n,o,t,e])})()};let w;!function(e){e.appQuery="query",e.eventFlyout="eventFlyout",e.filters="filters",e.savedQuery="savedQuery",e.sourcerer="sourcerer",e.timeline="timeline",e.timerange="timerange",e.pageFilter="pageFilters",e.rulesTable="rulesTable"}(w||(w={}))},228:function(e,t,n){"use strict";n.d(t,"b",(function(){return i})),n.d(t,"c",(function(){return l})),n.d(t,"a",(function(){return o}));var a=n(42);const i=e=>{var t;return Boolean(null===(t=e.Endpoint.state)||void 0===t?void 0:t.isolation)},r=["http:","https:"],l=e=>{try{if(null!=e){if(""===e)return!1;{const t=new URL(e);if(r.includes(t.protocol)&&e.startsWith(`${t.protocol}//`))return!1}}}catch(e){}return!0};function o(e){return Object(a.isNumber)(e)||!Object(a.isEmpty)(e)}},229:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(2),i=n.n(a),r=n(40),l=n(41);const o=n.n(l)()(r.EuiText).withConfig({displayName:"CodeBlock",componentId:"sc-s548fn-0"})(["font-family:",";"],(e=>e.theme.eui.euiCodeFontFamily)),s=Object(a.memo)((({children:e,inline:t=!1,textColor:n="default",bold:a=!1})=>i.a.createElement(o,{size:"relative",color:n,className:t?"eui-displayInline":""},a?i.a.createElement("strong",null,e):e)));s.displayName="ConsoleCodeBlock"},230:function(e,t,n){"use strict";n.d(t,"k",(function(){return i})),n.d(t,"j",(function(){return r})),n.d(t,"l",(function(){return l})),n.d(t,"c",(function(){return o})),n.d(t,"b",(function(){return s})),n.d(t,"a",(function(){return u})),n.d(t,"m",(function(){return c})),n.d(t,"h",(function(){return d})),n.d(t,"n",(function(){return m})),n.d(t,"e",(function(){return p})),n.d(t,"i",(function(){return b})),n.d(t,"d",(function(){return f})),n.d(t,"p",(function(){return g})),n.d(t,"o",(function(){return y})),n.d(t,"f",(function(){return h})),n.d(t,"g",(function(){return v}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.visualizationActions.moreActions",{defaultMessage:"More actions"}),r=a.i18n.translate("xpack.securitySolution.visualizationActions.inspect",{defaultMessage:"Inspect"}),l=a.i18n.translate("xpack.securitySolution.visualizationActions.openInLens",{defaultMessage:"Open in Lens"}),o=a.i18n.translate("xpack.securitySolution.visualizationActions.addToNewCase",{defaultMessage:"Add to new case"}),s=a.i18n.translate("xpack.securitySolution.visualizationActions.addToExistingCase",{defaultMessage:"Add to existing case"}),u=a.i18n.translate("xpack.securitySolution.visualizationActions.addToCaseSuccessContent",{defaultMessage:"Successfully added visualization to the case"}),c=a.i18n.translate("xpack.securitySolution.visualizationActions.uniqueIps.sourceChartLabel",{defaultMessage:"Src."}),d=a.i18n.translate("xpack.securitySolution.visualizationActions.uniqueIps.destinationChartLabel",{defaultMessage:"Dest."}),m=a.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.successChartLabel",{defaultMessage:"Succ."}),p=a.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.authentication.successChartLabel",{defaultMessage:"Success"}),b=a.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.failChartLabel",{defaultMessage:"Fail"}),f=a.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.authentication.failureChartLabel",{defaultMessage:"Failure"}),g=e=>a.i18n.translate("xpack.securitySolution.visualizationActions.uniqueCountLabel",{values:{field:e},defaultMessage:"Unique count of {field}"}),y=e=>a.i18n.translate("xpack.securitySolution.visualizationActions.topValueLabel",{values:{field:e},defaultMessage:"Top values of {field}"}),h=a.i18n.translate("xpack.securitySolution.visualizationActions.countLabel",{defaultMessage:"Count of records"}),v=e=>a.i18n.translate("xpack.securitySolution.visualizationActions.countOfFieldLabel",{values:{field:e},defaultMessage:"Count of {field}"})},232:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(4);const i={ADD_EXCEPTION_FLYOUT:`${a.l} fetchAlerts addExceptionFlyout`,ALERTS_COUNT_BY_STATUS:`${a.l} fetchAlerts byRulebyCount`,ALERTS_GROUPING:`${a.l} fetchAlerts grouping`,BY_ID:`${a.l} fetchAlerts byId`,BY_RULE_BY_STATUS:`${a.l} fetchAlerts byRulebyStatus`,BY_RULE_ID:`${a.l} fetchAlerts byRuleId`,BY_SEVERITY:`${a.l} fetchAlerts bySeverity`,BY_STATUS:`${a.l} fetchAlerts byStatus`,CASES:`${a.l} fetchAlerts cases`,COUNT:`${a.l} fetchAlerts count`,HISTOGRAM:`${a.l} fetchAlerts histogram`,PREVALENCE:`${a.l} fetchAlerts prevalence`,SOC_TRENDS:`${a.l} fetchAlerts socTrends`,TREE_MAP:`${a.l} fetchAlerts treeMap`,VULNERABLE_HOSTS:`${a.l} fetchAlerts vulnerableHosts`,VULNERABLE_USERS:`${a.l} fetchAlerts vulnerableUsers`}},233:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(8),i=n(2),r=n(239),l=n(303);const o=({fetchMethod:e=r.e,query:t,indexName:n,skip:o,queryName:s})=>{const[u,c]=Object(i.useState)(t),[d,m]=Object(i.useState)({data:null,response:"",request:"",setQuery:c,refetch:null}),[p,b]=Object(i.useState)(!1),f=((e,t)=>{const{startTracking:n}=Object(l.a)();return Object(i.useMemo)((()=>async a=>{const{endTracking:i}=n({name:t});let r;try{r=await e(a),i("success")}catch(e){throw i(a.signal.aborted?"aborted":"error"),e}return r}),[e,t,n])})(e,s);return Object(i.useEffect)((()=>{let e=!0;const t=new AbortController,i=async()=>{try{b(!0);const r=await f({query:u,signal:t.signal});var a;e&&m({data:r,response:JSON.stringify(r,null,2),request:JSON.stringify({index:null!==(a=[n])&&void 0!==a?a:[""],body:u},null,2),setQuery:c,refetch:i})}catch(t){e&&m({data:null,response:"",request:"",setQuery:c,refetch:i})}e&&b(!1)};return Object(a.isEmpty)(u)||o||i(),o&&(b(!1),e=!1,t.abort()),()=>{e=!1,t.abort()}}),[u,n,o,f]),{loading:p,...d}}},242:function(e,t,n){"use strict";n.d(t,"a",(function(){return E})),n.d(t,"b",(function(){return O}));var a=n(104),i=n.n(a),r=n(2),l=n.n(r),o=n(103),s=n(40),u=n(114),c=n(190),d=n(111),m=n(178),p=n(118),b=n(106),f=n(105),g=n(138),y=n(158),h=n(110),v=n(179);const E=({timelineId:e,timelineType:t,closeGearMenu:n})=>{const a=Object(o.useDispatch)(),i=Object(r.useMemo)((()=>y.d.defaultDataViewSelector()),[]),{id:l,patternList:s}=Object(f.a)(i),{timelineFullScreen:b,setTimelineFullScreen:E}=Object(m.c)(),O=Object(f.a)(g.d.globalTimeRangeSelector),S=Object(r.useCallback)((({id:e,show:n,timeRange:i})=>{const r=null!=i?i:O;e===p.c.active&&b&&E(!1),a(y.a.setSelectedDataView({id:h.SourcererScopeName.timeline,selectedDataViewId:l,selectedPatterns:s})),a(d.a.createTimeline({columns:c.b,dataViewId:l,id:e,indexNames:s,show:n,timelineType:t})),a(d.a.setTimelineUpdatedAt({id:p.c.active,updated:void 0})),a(g.b.addLinkTo([u.a.global,u.a.timeline])),a(v.a.addNotes({notes:[]})),i&&a(g.b.removeLinkTo([u.a.timeline,u.a.global])),"absolute"===r.kind?a(g.b.setAbsoluteRangeDatePicker({...r,id:u.a.timeline})):"relative"===r.kind&&a(g.b.setRelativeRangeDatePicker({...r,id:u.a.timeline}))}),[a,O,l,s,E,b,t]);return Object(r.useCallback)((a=>{S({id:e,show:!0,timelineType:t,timeRange:null==a?void 0:a.timeRange}),"function"==typeof n&&n()}),[S,e,t,n])},O=({timelineId:e,timelineType:t,closeGearMenu:n})=>{const a=E({timelineId:e,timelineType:t,closeGearMenu:n});return{getButton:Object(r.useCallback)((({outline:e,title:n,iconType:r="plusInCircle",fill:o=!0,isDisabled:u=!1})=>{const c={iconType:r,onClick:()=>a(),fill:o},d=t===b.l.template?"template-timeline-new":"timeline-new",{fill:m,...p}=c;return e?l.a.createElement(s.EuiButton,i()({"data-test-subj":`${d}-with-border`},c),n):l.a.createElement(s.EuiButtonEmpty,i()({"data-test-subj":d,color:"text"},p),n)}),[a,t])}}},248:function(e,t,n){"use strict";n.d(t,"b",(function(){return i})),n.d(t,"j",(function(){return r})),n.d(t,"l",(function(){return l})),n.d(t,"k",(function(){return o})),n.d(t,"f",(function(){return s})),n.d(t,"i",(function(){return u})),n.d(t,"h",(function(){return c})),n.d(t,"g",(function(){return d})),n.d(t,"a",(function(){return m})),n.d(t,"c",(function(){return p})),n.d(t,"e",(function(){return b})),n.d(t,"d",(function(){return f}));var a=n(5);a.i18n.translate("xpack.securitySolution.timeline.properties.timelineDescription",{defaultMessage:"Timeline Description"});const i=a.i18n.translate("xpack.securitySolution.timeline.properties.addToFavoriteButtonLabel",{defaultMessage:"Add to favorites"}),r=a.i18n.translate("xpack.securitySolution.timeline.properties.removeFromFavoritesButtonLabel",{defaultMessage:"Remove from favorites"}),l=a.i18n.translate("xpack.securitySolution.timeline.properties.untitledTimelinePlaceholder",{defaultMessage:"Untitled timeline"}),o=a.i18n.translate("xpack.securitySolution.timeline.properties.untitledTemplatePlaceholder",{defaultMessage:"Untitled template"}),s=a.i18n.translate("xpack.securitySolution.timeline.properties.descriptionPlaceholder",{defaultMessage:"Add a description"}),u=a.i18n.translate("xpack.securitySolution.timeline.properties.notesButtonLabel",{defaultMessage:"Notes"}),c=a.i18n.translate("xpack.securitySolution.timeline.properties.newTimelineButtonLabel",{defaultMessage:"Create new timeline"}),d=a.i18n.translate("xpack.securitySolution.timeline.properties.newTemplateTimelineButtonLabel",{defaultMessage:"Create new timeline template"}),m=a.i18n.translate("xpack.securitySolution.timeline.properties.addTimelineButtonLabel",{defaultMessage:"Add new timeline or template"}),p=a.i18n.translate("xpack.securitySolution.timeline.properties.attachToCaseButtonLabel",{defaultMessage:"Attach to case"}),b=a.i18n.translate("xpack.securitySolution.timeline.properties.attachToNewCaseButtonLabel",{defaultMessage:"Attach to new case"}),f=a.i18n.translate("xpack.securitySolution.timeline.properties.attachToExistingCaseButtonLabel",{defaultMessage:"Attach to existing case"})},254:function(e,t,n){"use strict";n.d(t,"d",(function(){return u})),n.d(t,"c",(function(){return c})),n.d(t,"b",(function(){return d})),n.d(t,"e",(function(){return m})),n.d(t,"a",(function(){return p})),n.d(t,"f",(function(){return b}));var a=n(56),i=n(478),r=n(14),l=n(45),o=n(2),s=n(131);const u=e=>e===s.a.alerts||e===s.a.rules||e===s.a.rulesAdd||e===s.a.rulesCreate||e===s.a.exceptions,c=e=>e.substring(1),d=(e,t)=>{const n=Object(i.parse)(e,{sort:!1})[t];return Array.isArray(n)?n[0]:n},m=e=>Object(o.useCallback)((()=>{const t=d(c(window.location.search),e);return Object(a.safeDecode)(null!=t?t:"")}),[e]),p=e=>Object(i.stringify)(r.url.encodeQuery(e),{sort:!1,encode:!1}),b=()=>{const e=Object(l.useHistory)();return Object(o.useCallback)((t=>{const n=window.location.search,r=Object(i.parse)(n,{sort:!1});Object.keys(t).forEach((e=>{const n=t[e];if(null!=n&&""!==n)try{r[e]=Object(a.encode)(n)}catch{console.error("Unable to encode url param value")}else delete r[e]}));const l=p(r);c(n)!==l&&e.replace({search:l})}),[e])}},255:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(8);const i=(e,t=!1)=>{if(Array.isArray(e))return e;const n={};return Object.entries(e).forEach((([e,i])=>{const r=t&&Array.isArray(i)&&1===i.length;Object(a.merge)(n,Object(a.setWith)({},e,r?i[0]:i,Object))})),n}},258:function(e,t,n){e.exports=n(33)(284)},259:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"a",(function(){return r})),n.d(t,"b",(function(){return l})),n(4);var a=n(195);const i=(e,t)=>`/${e}${Object(a.a)(t)}`,r=(e,t)=>`/name/${e}${Object(a.a)(t)}`,l=(e,t,n)=>`/name/${e}/${t}${Object(a.a)(n)}`},270:function(e,t,n){"use strict";let a,i,r;n.r(t),n.d(t,"NetworkType",(function(){return a})),n.d(t,"NetworkTableType",(function(){return i})),n.d(t,"NetworkDetailsTableType",(function(){return r})),function(e){e.page="page",e.details="details"}(a||(a={})),function(e){e.alerts="alerts",e.dns="dns",e.http="http",e.topCountriesDestination="topCountriesDestination",e.topCountriesSource="topCountriesSource",e.topNFlowDestination="topNFlowDestination",e.topNFlowSource="topNFlowSource",e.tls="tls",e.anomalies="anomalies"}(i||(i={})),function(e){e.http="http",e.tls="tls",e.topCountriesDestination="topCountriesDestination",e.topCountriesSource="topCountriesSource",e.topNFlowDestination="topNFlowDestination",e.topNFlowSource="topNFlowSource",e.users="users",e.anomalies="anomalies"}(r||(r={}))},271:function(e,t,n){"use strict";n.d(t,"a",(function(){return E}));var a=n(104),i=n.n(a),r=n(2),l=n.n(r),o=n(40),s=n(103),u=n(122),c=n(114),d=n(138),m=n(12),p=n(182),b=n(110),f=n(118),g=n(106),y=n(242),h=n(135),v=n(105);const E=({asEmptyButton:e,children:t,dataProviders:n,filters:a,timeRange:E,keepDataView:O,iconType:S,...x})=>{const j=Object(s.useDispatch)(),k=Object(r.useMemo)((()=>u.e.getSourcererDataViewsSelector()),[]),{defaultDataView:T,signalIndexName:C}=Object(v.a)((e=>k(e))),w=n&&n.find((e=>"template"===e.type)),I=Object(y.a)({timelineId:f.c.active,timelineType:w?g.l.template:g.l.default}),M=Object(r.useCallback)((()=>{(n||a)&&(E?I({timeRange:E}):I(),n&&j(Object(m.updateProviders)({id:f.c.active,providers:n})),a&&j(Object(m.setFilters)({id:f.c.active,filters:a})),O||j(p.d.setSelectedDataView({id:b.SourcererScopeName.timeline,selectedDataViewId:T.id,selectedPatterns:[C||""]})),j(d.b.removeLinkTo([c.a.timeline,c.a.global])))}),[n,I,j,T.id,C,a,E,O]);return e?l.a.createElement(o.EuiButtonEmpty,{"aria-label":h.h,onClick:M,flush:"right",size:"xs",iconType:S},t):l.a.createElement(o.EuiButton,i()({"aria-label":h.h,onClick:M},x),t)};E.displayName="InvestigateInTimelineButton"},272:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"c",(function(){return b})),n.d(t,"d",(function(){return y})),n.d(t,"b",(function(){return h}));var a=n(129),i=n(119),r=n(118),l=n(110),o=n(641);const s=[i.e.alertsOnAlertsPage,i.e.alertsOnRuleDetailsPage,i.e.alertsOnCasePage,r.c.casePage],u=[{value:"all",inputDisplay:o.b,"data-test-subj":"option-all"}],c=[{value:"raw",inputDisplay:o.d,"data-test-subj":"option-raw"}],d=[{value:"alert",inputDisplay:o.a,"data-test-subj":"option-alert"}],m=[...c,...d],p=e=>{switch(e){case"all":return u;case"raw":return c;case"alert":return d;default:return m}},b=e=>!!e&&s.includes(e),f=[a.a,a.b,a.e,a.f,a.g,a.h,a.l,a.o,a.E,a.t,a.H,a.p,a.q,a.W,a.ib,a.jb,a.lb,a.r,a.u,a.v,a.w,a.x,a.A,a.B,a.C,a.D,a.F,a.G,a.I,a.K,a.L,a.M,a.N,a.O,a.P,a.Q,a.R,a.S,a.s,a.T,a.U,a.V,a.eb,a.hb,"signal.rule.building_block_type","signal.rule.id","signal.rule.name","signal.rule.threat_mapping","signal.status"],g=({tableId:e,view:t})=>"raw"===t&&b(e),y=({filters:e,tableId:t,view:n})=>g({tableId:t,view:n})?e.filter((e=>!f.includes(`${e.meta.key}`))):e,h=({scopeId:e,view:t})=>g({tableId:e,view:t})?l.SourcererScopeName.default:b(e)?l.SourcererScopeName.detections:e===r.c.active?l.SourcererScopeName.timeline:l.SourcererScopeName.default},273:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n(103),r=n(122),l=n(179),o=n(108),s=n(105);const u=({id:e,filterQuery:t,kqlError:n,query:u,startDate:c,endDate:d})=>{const{addError:m}=Object(o.a)(),p=Object(i.useDispatch)(),b=Object(a.useMemo)((()=>r.a.errorsSelector()),[]),f=Object(s.a)(b),g=null==n?void 0:n.name,y=null==n?void 0:n.message;Object(a.useEffect)((()=>{if(!t&&y&&g){const t=y.split("").reduce(((e,t)=>(e<<5)-e+t.charCodeAt(0)|0),0).toString();p(l.a.addErrorHash({id:e,hash:t,title:g,message:[y]}))}}),[e,t,m,u,c,d,p,y,g]),Object(a.useEffect)((()=>{const t=f.find((t=>t.id===e));null!=t&&t.displayError&&null!=n&&(delete n.stack,m(n,{title:n.name}))}),[m,f,e,n])}},285:function(e,t,n){"use strict";n.d(t,"a",(function(){return r}));var a=n(2),i=n(126);const r=()=>{const[e,t]=Object(a.useState)({isAuthenticated:null,hasEncryptionKey:null,hasIndexManage:null,hasIndexRead:null,hasIndexWrite:null,hasIndexUpdateDelete:null,hasIndexMaintenance:null,hasKibanaCRUD:!1,hasKibanaREAD:!1}),{detectionEnginePrivileges:n,kibanaSecuritySolutionsPrivileges:{crud:r,read:l}}=Object(i.a)();return Object(a.useEffect)((()=>{null!=n.error&&t({isAuthenticated:!1,hasEncryptionKey:!1,hasIndexManage:!1,hasIndexRead:!1,hasIndexWrite:!1,hasIndexUpdateDelete:!1,hasIndexMaintenance:!1,hasKibanaCRUD:r,hasKibanaREAD:l})}),[n.error,r,l]),Object(a.useEffect)((()=>{if(null!=n.result){const e=n.result;if(null!=e.index&&Object.keys(e.index).length>0){const n=Object.keys(e.index)[0];t({isAuthenticated:e.is_authenticated,hasEncryptionKey:e.has_encryption_key,hasIndexManage:e.index[n].manage&&e.cluster.manage,hasIndexMaintenance:e.index[n].maintenance,hasIndexRead:e.index[n].read,hasIndexWrite:e.index[n].create||e.index[n].create_doc||e.index[n].index||e.index[n].write,hasIndexUpdateDelete:e.index[n].write,hasKibanaCRUD:r,hasKibanaREAD:l})}}}),[n.result,r,l]),{loading:n.loading,...e}}},288:function(e,t,n){e.exports=n(33)(1654)},291:function(e,t,n){"use strict";n.d(t,"a",(function(){return E}));var a=n(104),i=n.n(a),r=n(2),l=n.n(r),o=n(40),s=n(44),u=n(41),c=n.n(u),d=n(105),m=n(142),p=n(133),b=n(111),f=n(345),g=n(199);const y=(e,t)=>(t===g.a.createCase||t===g.a.submitCase)&&e===g.b.alertsCases,h=c()(o.EuiTourStep).withConfig({displayName:"StyledTourStep",componentId:"sc-1l8wop5-0"})(["&.euiPopover__panel[data-popover-open]{z-index:",";}"],(({step:e,tourId:t})=>y(t,e)?"9000 !important":"1000 !important")),v=({children:e,onClick:t,step:n,tourId:a})=>{const{activeStep:u,incrementStep:c,isTourShown:v}=Object(f.b)(),E=Object(r.useMemo)((()=>g.e[a].find((e=>e.step===n))),[n,a]),O=Object(r.useMemo)((()=>b.b.getTimelineByIdSelector()),[]),S=Object(d.b)((e=>{var t;return(null!==(t=O(e,m.f.active))&&void 0!==t?t:p.b).show})),x=Object(r.useCallback)((()=>t?t():c(a)),[c,t,a]),j=Object(r.useCallback)((e=>{"Enter"===e.key&&e.stopPropagation()}),[]),k=y(a,n);if(null==E||(n!==u||!v(a))&&!k||S)return e||null;const{anchor:T,content:C,imageConfig:w,dataTestSubj:I,hideNextButton:M=!1,...A}=E,N=M?l.a.createElement(l.a.Fragment,null):l.a.createElement(o.EuiButtonEmpty,{onClick:x,onKeyDown:j,size:"xs",color:"text",flush:"right","data-test-subj":"onboarding--securityTourNextStepButton","tour-step":"nextButton"},l.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.guided_onboarding.nextStep.buttonLabel",defaultMessage:"Next"})),F={...A,content:l.a.createElement(l.a.Fragment,null,l.a.createElement(o.EuiText,{size:"s"},l.a.createElement("p",null,C)),w&&l.a.createElement(l.a.Fragment,null,l.a.createElement(o.EuiSpacer,{size:"m"}),l.a.createElement(o.EuiImage,{alt:w.altText,src:w.src,size:"fullWidth"}))),footerAction:N,isStepOpen:!0,onFinish:()=>null,stepsTotal:g.e[a].length,panelProps:{"data-test-subj":I}};return null!=T?l.a.createElement(l.a.Fragment,null,l.a.createElement(h,i()({tourId:a},F,{anchor:T})),l.a.createElement(l.a.Fragment,null,e)):null!=e?l.a.createElement(h,i()({tourId:a},F),e):null},E=({children:e,isTourAnchor:t=!0,...n})=>t?l.a.createElement(v,n,e):l.a.createElement(l.a.Fragment,null,e)},292:function(e,t,n){const a=n(157);e.exports=(e,t,n=!1)=>{if(e instanceof a)return e;try{return new a(e,t)}catch(e){if(!n)return null;throw e}}},293:function(e,t,n){"use strict";n.d(t,"a",(function(){return c})),n.d(t,"b",(function(){return d})),n.d(t,"c",(function(){return m}));var a=n(42),i=n(2),r=n(1038),l=n.n(r),o=n(57),s=n(76),u=n.n(s);const c=(e,t)=>{const n=null!=t?t:((e,t)=>{const n=t.diff(e,"days");return n<=1&&!e.isSame(t)?2:n})(u()(e[0]),u()(e[1])),a=Object(o.niceTimeFormatByDay)(n);return Object(o.timeFormatter)(a)},d=(e=100)=>{const[t,n]=Object(i.useState)({width:0,height:0}),r=Object(i.useMemo)((()=>Object(a.throttle)(e,n)),[e]),{ref:o}=l()({onResize:r});return{ref:o,...t}},m=(e,t,n,a)=>{Object(i.useEffect)((()=>{!async function(){const i=await(null==e?void 0:e.getVariation(t,n));i&&a(i)}()}),[e,t,n,a])}},294:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(40),i=n(5),r=n(44),l=n(2),o=n.n(l);const s=({count:e})=>{const[t,n,s]=Object(l.useMemo)((()=>function(e){var t;if(!Number.isFinite(e))return[e,"",""];const n=Math.pow(10,3*Math.min(Math.floor(Math.floor(Math.log10(e))/3),4)),a={compactThousands:i.i18n.translate("xpack.securitySolution.formattedNumber.compactThousands",{defaultMessage:"k"}),compactMillions:i.i18n.translate("xpack.securitySolution.formattedNumber.compactMillions",{defaultMessage:"M"}),compactBillions:i.i18n.translate("xpack.securitySolution.formattedNumber.compactBillions",{defaultMessage:"B"}),compactTrillions:i.i18n.translate("xpack.securitySolution.formattedNumber.compactTrillions",{defaultMessage:"T"})},r=new Map([[1,""],[1e3,a.compactThousands],[1e6,a.compactMillions],[1e9,a.compactBillions],[1e12,a.compactTrillions]]),l=i.i18n.translate("xpack.securitySolution.formattedNumber.compactOverflow",{defaultMessage:"+"}),o=null!==(t=r.get(n))&&void 0!==t?t:"";return[Math.floor(e/n),o,e/n%1>Number.EPSILON?l:""]}(e||0)),[e]);return null==e?null:0===e?o.a.createElement(o.a.Fragment,null,0):o.a.createElement(r.FormattedMessage,{id:"xpack.securitySolution.formattedNumber.countsLabel",description:"",defaultMessage:"{mantissa}{scale}{hasRemainder}",values:{mantissa:o.a.createElement(a.EuiI18nNumber,{value:t}),scale:n,hasRemainder:s}})},u=o.a.memo(s)},295:function(e,t,n){"use strict";n.d(t,"a",(function(){return L})),n.d(t,"b",(function(){return B})),n.d(t,"c",(function(){return _})),n.d(t,"d",(function(){return z}));var a=n(104),i=n.n(a),r=n(2),l=n.n(r),o=n(5),s=n(40),u=n(44),c=n(41),d=n.n(c),m=n(53),p=n.n(m),b=n(107);const f=d()(s.EuiPanel).withConfig({displayName:"EuiPanelStyled",componentId:"sc-n74boe-0"})(["&.full-height,.full-height{height:100%;}.is-not-scrollable{overflow:hidden;}.is-scrollable{overflow:auto;}"]),g=Object(r.memo)((({pageTitle:e,pageDescription:t,pageBody:n,actions:a,headerHasBottomBorder:i,restrictWidth:o,paddingSize:u="l",scrollableBody:c=!1,headerBackComponent:d,children:m,"data-test-subj":g})=>{const y=!(e||t||a||d),h=Object(b.a)(g),v=Object(r.useMemo)((()=>Array.isArray(a)?a:a?[a]:void 0),[a]),E=Object(r.useMemo)((()=>({gutterSize:"s"})),[]),O=Object(r.useMemo)((()=>p()({"is-scrollable":c,"is-not-scrollable":!c,"full-height":!0})),[c]),S=Object(r.useMemo)((()=>y?null:l.a.createElement(s.EuiFlexGroup,{direction:"column",gutterSize:"none",alignItems:"flexStart",wrap:!1,responsive:!1},d&&l.a.createElement(s.EuiFlexItem,{grow:!1},d),l.a.createElement(s.EuiSpacer,{size:"m"}),l.a.createElement(s.EuiFlexItem,{grow:!1},l.a.createElement(s.EuiTitle,{size:"l"},l.a.createElement("span",{"data-test-subj":h("titleHolder")},e))))),[h,d,y,e]);return l.a.createElement(f,{hasShadow:!1,paddingSize:u,"data-test-subj":g,className:"full-height",color:"transparent"},l.a.createElement(s.EuiFlexGroup,{direction:"column",responsive:!1,gutterSize:"none",className:"full-height","data-test-subj":h("root")},!y&&l.a.createElement(s.EuiFlexItem,{grow:!1,"data-test-subj":h("headerContainer")},l.a.createElement(s.EuiPageHeader,{pageTitle:S,description:t,bottomBorder:i,rightSideItems:v,rightSideGroupProps:E,restrictWidth:o,alignItems:"bottom","data-test-subj":h("header")}),l.a.createElement(s.EuiSpacer,{size:"l"})),l.a.createElement(s.EuiFlexItem,{grow:!1},n),l.a.createElement(s.EuiFlexItem,{grow:!0,className:O,"data-test-subj":h("consoleBody")},l.a.createElement("div",{role:"main",className:"full-height"},m))))}));g.displayName="PageLayout";var y=n(45),h=n(141),v=n(178),E=n(168);const O=d.a.div.withConfig({displayName:"OverlayRootContainer",componentId:"sc-vostrz-0"})(["border:none;display:block;position:fixed;overflow:hidden;top:calc(("," * 2));bottom:0;right:0;height:calc(100% - "," * 2);width:100%;z-index:",";background-color:",";&.scrolling{overflow:auto;}&.hidden{display:none;}&.padding-xs{padding:",";}&.padding-s{padding:",";}&.padding-m{padding:",";}&.padding-l{padding:",";}&.padding-xl{padding:",";}&.fullScreen{top:0;height:100%;}.fullHeight{height:100%;}"],(({theme:{eui:e}})=>e.euiHeaderHeightCompensation),(({theme:{eui:e}})=>e.euiHeaderHeightCompensation),(({theme:{eui:e}})=>e.euiZFlyout),(({theme:{eui:e}})=>e.euiColorEmptyShade),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiSizeM),(({theme:{eui:e}})=>e.euiSizeL),(({theme:{eui:e}})=>e.euiSizeXL)),S="securitySolution-pageOverlay",x=`${S}-isVisible`,j=`${S}-lock`,k=`${S}-fullScreen`,T=`${S}-overSecuritySolutionPageWrapper`,C=Object(c.createGlobalStyle)(["body.","{overflow:hidden;}body.","{","}body.kbnBody.kbnBody--projectLayout:not(.",") .","{top:",";height:calc(100% - (","));}"],j,k,E.e,k,S,(({theme:{eui:e}})=>e.euiHeaderHeightCompensation),(({theme:{eui:e}})=>e.euiHeaderHeightCompensation)),w=()=>{document.body.classList.remove(x)},I=()=>{document.body.classList.remove(j)},M=()=>{document.body.classList.remove(k)},A=()=>{document.body.classList.remove(T)},N=Object(r.memo)((({children:e,onHide:t,isHidden:n=!1,enableScrolling:a=!0,hideOnUrlPathnameChange:i=!0,lockDocumentBody:o=!0,appendAsBodyLastNode:u=!0,paddingSize:c,zIndex:d,"data-test-subj":m})=>{const{pathname:b}=Object(y.useLocation)(),f=Object(h.b)(),g=Object(v.b)(),[E,N]=Object(r.useState)(null),F=Object(r.useRef)(),D=Object(r.useCallback)((e=>{F.current=e}),[]),R=Object(r.useMemo)((()=>{const e={};return d&&(e.zIndex=d),e}),[d]),P=Object(r.useMemo)((()=>p()({[S]:!0,scrolling:a,hidden:n,fullScreen:g,"eui-scrollBar":a,"padding-xs":"xs"===c,"padding-s":"s"===c,"padding-m":"m"===c,"padding-l":"l"===c,"padding-xl":"xl"===c})),[a,n,c,g]);return Object(r.useEffect)((()=>{f()&&N((e=>n?null:e||(u&&F.current&&document.body.appendChild(F.current),b)))}),[u,n,f,b]),Object(r.useEffect)((()=>{f()&&t&&i&&!n&&E&&E!==b&&t()}),[i,n,f,t,E,b]),Object(r.useEffect)((()=>{if(f()){const e=Boolean(document.querySelector(".securitySolutionWrapper"));n?(w(),I(),M(),A()):(document.body.classList.add(x),o&&document.body.classList.add(j),g&&document.body.classList.add(k),e&&document.body.classList.add(T))}return()=>{I(),w(),M(),A()}}),[n,f,o,g]),l.a.createElement(s.EuiPortal,{portalRef:D},l.a.createElement(O,{"data-test-subj":m,className:P,style:R},l.a.createElement(s.EuiFocusTrap,{"data-test-subj":"trap-focus",className:"fullHeight"},e)),l.a.createElement(C,null))}));N.displayName="PageOverlay";const F=o.i18n.translate("xpack.securitySolution.consolePageOverlay.backButtonLabel",{defaultMessage:"Back"}),D=Object(r.memo)((({console:e,onHide:t,isHidden:n,body:a,actions:i,pageTitle:o="",showCloseButton:c=!1})=>{const d=Object(b.a)("consolePageOverlay"),m=Object(r.useCallback)((e=>{e.preventDefault(),t()}),[t]),p=Object(r.useMemo)((()=>n?{}:{pageTitle:o,pageBody:a,headerHasBottomBorder:!1,"data-test-subj":d("layout"),headerBackComponent:l.a.createElement(s.EuiButtonEmpty,{flush:"left",size:"s",iconType:"arrowLeft",onClick:m,"data-test-subj":d("header-back-link")},F),actions:c?[l.a.createElement(s.EuiButton,{fill:!0,onClick:m,minWidth:"auto","data-test-subj":d("doneButton")},l.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.consolePageOverlay.doneButtonLabel",defaultMessage:"Done"})),...null!=i?i:[]]:[...null!=i?i:[]]}),[i,a,d,m,n,o,c]);return l.a.createElement(N,{isHidden:n,"data-test-subj":"consolePageOverlay",onHide:t,paddingSize:"l",enableScrolling:!1},l.a.createElement(g,p,e))}));D.displayName="ConsolePageOverlay";var R=n(865);const P=l.a.createContext(void 0),L=Object(r.memo)((({storage:e={},children:t})=>{const[n,a]=Object(r.useState)(e),[o]=Object(r.useState)(new Map),s=Object(r.useRef)();s.current=n;const u=Object(r.useCallback)((e=>{var t;if(null===(t=s.current)||void 0===t||!t[e])throw new Error(`Console with id ${e} not found`)}),[]),c=Object(r.useCallback)((e=>{u(e),a((t=>{const n={...t};return Object.entries(n).forEach((([e,t])=>{t.isOpen&&(n[e]={...t,isOpen:!1})})),n[e]={...n[e],isOpen:!0},n}))}),[u]),d=Object(r.useCallback)((e=>{u(e),a((t=>({...t,[e]:{...t[e],isOpen:!1}})))}),[u]),m=Object(r.useCallback)((e=>{u(e),a((t=>{const n={...t};return delete n[e],n}))}),[u]),p=Object(r.useCallback)((e=>{var t;if(null!==(t=s.current)&&void 0!==t&&t[e])return s.current[e].client}),[]),b=Object(r.useCallback)((()=>Object.values(n).map((e=>e.client))),[n]),f=Object(r.useCallback)((e=>{var t;return!(null===(t=s.current)||void 0===t||!t[e])&&s.current[e].isOpen}),[]),g=Object(r.useCallback)((({id:e,meta:t,consoleProps:r,...o})=>{if(n[e])throw new Error(`Console with id ${e} already registered`);const s=Symbol(e),u=c.bind(null,e),p=d.bind(null,e),b=m.bind(null,e),g=f.bind(null,e),y={PageBodyComponent:void 0,PageTitleComponent:void 0,ActionComponents:void 0,...o,client:{id:e,meta:t,show:()=>{setTimeout(u,0)},hide:()=>{setTimeout(p,0)},terminate:()=>{setTimeout(b,0)},isVisible:()=>g()},consoleProps:r,console:l.a.createElement(R.a,i()({},r,{managedKey:s,key:e})),isOpen:!1,key:s};return a((t=>({...t,[e]:y}))),y.client}),[n,d,f,c,m]),y=Object(r.useMemo)((()=>({register:g,show:c,hide:d,terminate:m,getOne:p,getList:b})),[b,p,d,g,c,m]),h=Object(r.useMemo)((()=>({client:y,internal:{getManagedConsole:e=>Object.values(n).find((t=>t.key===e)),getManagedConsoleState:e=>o.get(e),storeManagedConsoleState(e,t){o.set(e,t)}}})),[y,o,n]),v=Object(r.useMemo)((()=>Object.values(n).find((e=>e.isOpen))),[n]),E=Object(r.useMemo)((()=>{var e;return null!==(e=null==v?void 0:v.client.meta)&&void 0!==e?e:{}}),[null==v?void 0:v.client.meta]),O=Object(r.useCallback)((()=>{v&&y.hide(v.client.id)}),[y,v]);return l.a.createElement(P.Provider,{value:h},t,v&&l.a.createElement(D,{onHide:O,console:l.a.createElement(R.a,i()({},v.consoleProps,{managedKey:v.key,key:v.client.id})),isHidden:!v,pageTitle:v.PageTitleComponent&&l.a.createElement(v.PageTitleComponent,{meta:E}),body:v.PageBodyComponent&&l.a.createElement(v.PageBodyComponent,{meta:E}),actions:v.ActionComponents&&v.ActionComponents.map((e=>l.a.createElement(e,{meta:E}))),showCloseButton:v.showCloseButton}))}));L.displayName="ConsoleManager";const B=()=>{const e=Object(r.useContext)(P);if(!e)throw new Error("ConsoleManagerContext not found");return e.client},_=e=>{const t=Object(r.useContext)(P);if(e&&t)return t.internal.getManagedConsole(e)},z=e=>{const t=Object(r.useContext)(P);return Object(r.useMemo)((()=>e&&t?[()=>t.internal.getManagedConsoleState(e),n=>{t.internal.getManagedConsole(e)&&t.internal.storeManagedConsoleState(e,n)}]:[void 0,void 0]),[t,e])}},297:function(e,t,n){"use strict";n.d(t,"c",(function(){return p})),n.d(t,"i",(function(){return g})),n.d(t,"e",(function(){return y})),n.d(t,"g",(function(){return h})),n.d(t,"h",(function(){return v})),n.d(t,"f",(function(){return E})),n.d(t,"d",(function(){return O})),n.d(t,"b",(function(){return S})),n.d(t,"a",(function(){return x}));var a=n(57),i=n(40),r=n(2),l=n.n(r),o=n(41),s=n.n(o),u=n(4),c=n(102);const d="100%",m=s.a.div.withConfig({displayName:"WrappedByAutoSizerComponent",componentId:"sc-1gxuxf9-0"})([""," position:relative;&:hover{z-index:100;}"],(e=>`\n    height: ${null!=e.height?e.height:d};\n  `));m.displayName="WrappedByAutoSizer";const p=l.a.memo(m);let b;!function(e){e.BAR="bar",e.AREA="area",e.LINE="line"}(b||(b={}));const f={chartMargins:{left:0,right:0,top:4,bottom:0},chartPaddings:{left:0,right:0,top:0,bottom:0},scales:{barsPadding:.05}},g=()=>({baseTheme:Object(c.o)(u.B)?a.DARK_THEME:a.LIGHT_THEME,theme:f}),y={rotation:0,rendering:"canvas",showLegend:!1,showLegendExtra:!1,debug:!1,legendPosition:a.Position.Bottom},h=(e,t)=>{const n=e||t;return n?`${n}px`:d},v=(e,t)=>{const n=e||t;return n?`${n}px`:"100%"},E=e=>Array.isArray(e)&&e.every((e=>Array.isArray(e.value)&&e.value.every((({y:e})=>0===e)))),O=s.a.div.withConfig({displayName:"Wrapper",componentId:"sc-1gxuxf9-1"})(["position:relative;"]),S=s()(i.EuiFlexGroup).withConfig({displayName:"ChartWrapper",componentId:"sc-1gxuxf9-2"})(["z-index:0;"]),x=s()(i.EuiFlexGroup).withConfig({displayName:"BarChartWrapper",componentId:"sc-1gxuxf9-3"})(["z-index:0;padding-right:20px;"])},299:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n(109),r=n(108),l=n(239),o=n(375),s=n(285);const u=()=>{const[e,t]=Object(a.useState)(!0),[n,u]=Object(a.useState)({signalIndexExists:null,signalIndexName:null,signalIndexMappingOutdated:null,createDeSignalIndex:null}),{addError:c}=Object(r.a)(),{hasIndexRead:d}=Object(s.a)();return Object(a.useEffect)((()=>{let e=!0;const n=new AbortController,a=async()=>{try{t(!0);const a=await Object(l.h)({signal:n.signal});e&&null!=a&&u({signalIndexExists:!0,signalIndexName:a.name,signalIndexMappingOutdated:a.index_mapping_outdated,createDeSignalIndex:r})}catch(t){e&&(u({signalIndexExists:!1,signalIndexName:null,signalIndexMappingOutdated:null,createDeSignalIndex:r}),Object(i.v)(t)&&404!==t.body.status_code&&c(t,{title:o.c}))}e&&t(!1)},r=async()=>{let s=!1;try{t(!0),await Object(l.d)({signal:n.signal}),e&&(s=!0,a())}catch(t){e&&(Object(i.v)(t)&&409===t.body.status_code?a():(u({signalIndexExists:!1,signalIndexName:null,signalIndexMappingOutdated:null,createDeSignalIndex:r}),c(t,{title:o.d})))}e&&!s&&t(!1)};return d?a():t(!1),()=>{e=!1,n.abort()}}),[c,d]),{loading:e,...n}}},303:function(e,t,n){"use strict";n.d(t,"a",(function(){return r}));var a=n(2),i=n(159);const r=()=>{const{startTransaction:e}=Object(i.b)();return{startTracking:Object(a.useCallback)((({name:t,spanName:n="fetch"})=>{const a=e({name:t,type:"http-request",options:{managed:!1}}),i=null==a?void 0:a.startSpan(n,"http-request",{blocking:!0});return{endTracking:e=>{null==a||a.addLabels({result:e}),null==i||i.end()}}}),[e])}}},310:function(e,t,n){const{MAX_SAFE_COMPONENT_LENGTH:a,MAX_SAFE_BUILD_LENGTH:i,MAX_LENGTH:r}=n(326),l=n(325),o=(t=e.exports={}).re=[],s=t.safeRe=[],u=t.src=[],c=t.t={};let d=0;const m="[a-zA-Z0-9-]",p=[["\\s",1],["\\d",r],[m,i]],b=(e,t,n)=>{const a=(e=>{for(const[t,n]of p)e=e.split(`${t}*`).join(`${t}{0,${n}}`).split(`${t}+`).join(`${t}{1,${n}}`);return e})(t),i=d++;l(e,i,t),c[e]=i,u[i]=t,o[i]=new RegExp(t,n?"g":void 0),s[i]=new RegExp(a,n?"g":void 0)};b("NUMERICIDENTIFIER","0|[1-9]\\d*"),b("NUMERICIDENTIFIERLOOSE","\\d+"),b("NONNUMERICIDENTIFIER",`\\d*[a-zA-Z-]${m}*`),b("MAINVERSION",`(${u[c.NUMERICIDENTIFIER]})\\.(${u[c.NUMERICIDENTIFIER]})\\.(${u[c.NUMERICIDENTIFIER]})`),b("MAINVERSIONLOOSE",`(${u[c.NUMERICIDENTIFIERLOOSE]})\\.(${u[c.NUMERICIDENTIFIERLOOSE]})\\.(${u[c.NUMERICIDENTIFIERLOOSE]})`),b("PRERELEASEIDENTIFIER",`(?:${u[c.NUMERICIDENTIFIER]}|${u[c.NONNUMERICIDENTIFIER]})`),b("PRERELEASEIDENTIFIERLOOSE",`(?:${u[c.NUMERICIDENTIFIERLOOSE]}|${u[c.NONNUMERICIDENTIFIER]})`),b("PRERELEASE",`(?:-(${u[c.PRERELEASEIDENTIFIER]}(?:\\.${u[c.PRERELEASEIDENTIFIER]})*))`),b("PRERELEASELOOSE",`(?:-?(${u[c.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${u[c.PRERELEASEIDENTIFIERLOOSE]})*))`),b("BUILDIDENTIFIER",`${m}+`),b("BUILD",`(?:\\+(${u[c.BUILDIDENTIFIER]}(?:\\.${u[c.BUILDIDENTIFIER]})*))`),b("FULLPLAIN",`v?${u[c.MAINVERSION]}${u[c.PRERELEASE]}?${u[c.BUILD]}?`),b("FULL",`^${u[c.FULLPLAIN]}$`),b("LOOSEPLAIN",`[v=\\s]*${u[c.MAINVERSIONLOOSE]}${u[c.PRERELEASELOOSE]}?${u[c.BUILD]}?`),b("LOOSE",`^${u[c.LOOSEPLAIN]}$`),b("GTLT","((?:<|>)?=?)"),b("XRANGEIDENTIFIERLOOSE",`${u[c.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`),b("XRANGEIDENTIFIER",`${u[c.NUMERICIDENTIFIER]}|x|X|\\*`),b("XRANGEPLAIN",`[v=\\s]*(${u[c.XRANGEIDENTIFIER]})(?:\\.(${u[c.XRANGEIDENTIFIER]})(?:\\.(${u[c.XRANGEIDENTIFIER]})(?:${u[c.PRERELEASE]})?${u[c.BUILD]}?)?)?`),b("XRANGEPLAINLOOSE",`[v=\\s]*(${u[c.XRANGEIDENTIFIERLOOSE]})(?:\\.(${u[c.XRANGEIDENTIFIERLOOSE]})(?:\\.(${u[c.XRANGEIDENTIFIERLOOSE]})(?:${u[c.PRERELEASELOOSE]})?${u[c.BUILD]}?)?)?`),b("XRANGE",`^${u[c.GTLT]}\\s*${u[c.XRANGEPLAIN]}$`),b("XRANGELOOSE",`^${u[c.GTLT]}\\s*${u[c.XRANGEPLAINLOOSE]}$`),b("COERCE",`(^|[^\\d])(\\d{1,${a}})(?:\\.(\\d{1,${a}}))?(?:\\.(\\d{1,${a}}))?(?:$|[^\\d])`),b("COERCERTL",u[c.COERCE],!0),b("LONETILDE","(?:~>?)"),b("TILDETRIM",`(\\s*)${u[c.LONETILDE]}\\s+`,!0),t.tildeTrimReplace="$1~",b("TILDE",`^${u[c.LONETILDE]}${u[c.XRANGEPLAIN]}$`),b("TILDELOOSE",`^${u[c.LONETILDE]}${u[c.XRANGEPLAINLOOSE]}$`),b("LONECARET","(?:\\^)"),b("CARETTRIM",`(\\s*)${u[c.LONECARET]}\\s+`,!0),t.caretTrimReplace="$1^",b("CARET",`^${u[c.LONECARET]}${u[c.XRANGEPLAIN]}$`),b("CARETLOOSE",`^${u[c.LONECARET]}${u[c.XRANGEPLAINLOOSE]}$`),b("COMPARATORLOOSE",`^${u[c.GTLT]}\\s*(${u[c.LOOSEPLAIN]})$|^$`),b("COMPARATOR",`^${u[c.GTLT]}\\s*(${u[c.FULLPLAIN]})$|^$`),b("COMPARATORTRIM",`(\\s*)${u[c.GTLT]}\\s*(${u[c.LOOSEPLAIN]}|${u[c.XRANGEPLAIN]})`,!0),t.comparatorTrimReplace="$1$2$3",b("HYPHENRANGE",`^\\s*(${u[c.XRANGEPLAIN]})\\s+-\\s+(${u[c.XRANGEPLAIN]})\\s*$`),b("HYPHENRANGELOOSE",`^\\s*(${u[c.XRANGEPLAINLOOSE]})\\s+-\\s+(${u[c.XRANGEPLAINLOOSE]})\\s*$`),b("STAR","(<|>)?=?\\s*\\*"),b("GTE0","^\\s*>=\\s*0\\.0\\.0\\s*$"),b("GTE0PRE","^\\s*>=\\s*0\\.0\\.0-0\\s*$")},311:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),r=n(41),l=n.n(r),o=n(42);const s=l.a.div.withConfig({displayName:"StyledDiv",componentId:"sc-we8ln-0"})(["width:100%;display:flex;flex-grow:1;> *{max-width:100%;}",""],(({targetClassNames:e})=>Object(r.css)(["","{pointer-events:none;opacity:0;transition:opacity "," ease;}","{pointer-events:auto;opacity:1;}"],e.map((e=>`.${e}`)).join(", "),(e=>Object(o.getOr)(250,"theme.eui.euiAnimSpeedNormal",e)),e.map((e=>`&:hover .${e}`)).join(", ")))),u=i.a.memo((({show:e=!0,targetClassNames:t,children:n})=>e?i.a.createElement(s,{"data-test-subj":"hoverVisibilityContainer",targetClassNames:t},n):i.a.createElement(i.a.Fragment,null,n)));u.displayName="HoverVisibilityContainer"},312:function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return o})),n.d(t,"c",(function(){return s})),n.d(t,"d",(function(){return u})),n.d(t,"e",(function(){return c})),n.d(t,"f",(function(){return d})),n.d(t,"g",(function(){return m})),n.d(t,"h",(function(){return p}));var a=n(129),i=n(119),r=n(328);const l=e=>{const t="acknowledged"===e?{bool:{should:[{term:{[a.jb]:e}},{term:{[a.jb]:"in-progress"}}]}}:{term:{[a.jb]:e}};return[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:a.jb,params:{query:e}},query:t}]},o=e=>[{meta:{alias:null,negate:!1,disabled:!1},query:{bool:{should:e.map((e=>({term:{[a.jb]:e}})))}}}],s=e=>e?[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:a.K,params:{query:e}},query:{match_phrase:{[a.K]:e}}}]:[],u=e=>e?[]:[{meta:{alias:null,negate:!0,disabled:!1,type:"exists",key:a.b,value:"exists"},query:{exists:{field:a.b}}}],c=e=>e?[{meta:{alias:null,disabled:!1,negate:!1,key:"kibana.alert.rule.type",type:"term"},query:{term:{"kibana.alert.rule.type":"threat_match"}}}]:[],d=e=>({...i.q,columns:Object(r.b)(e),showCheckboxes:!0}),m=e=>({...d(e),columns:Object(r.b)(e),defaultColumns:Object(r.c)(e),sort:[{columnId:"kibana.alert.original_time",columnType:"date",esTypes:["date"],sortDirection:"desc"}],showCheckboxes:!1}),p=["@timestamp","kibana.alert.workflow_status","kibana.alert.workflow_tags","kibana.alert.group.id","kibana.alert.original_time","kibana.alert.building_block_type","kibana.alert.rule.from","kibana.alert.rule.name","kibana.alert.rule.to","kibana.alert.rule.uuid","kibana.alert.rule.rule_id","kibana.alert.rule.type","kibana.alert.suppression.docs_count","kibana.alert.original_event.kind","kibana.alert.original_event.module","file.path","file.Ext.code_signature.subject_name","file.Ext.code_signature.trusted","file.hash.sha256","host.os.family","event.code","process.entry_leader.entity_id"]},317:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return h})),n.d(t,"c",(function(){return v})),n.d(t,"d",(function(){return E})),n.d(t,"e",(function(){return O}));var a=n(2),i=n.n(a),r=n(41),l=n.n(r);const o=l.a.aside.attrs({className:"siemUtilityBar"}).withConfig({displayName:"Bar",componentId:"sc-yj1vvr-0"})(["",""],(({border:e,theme:t})=>Object(r.css)([""," @media only screen and (min-width:","){display:flex;justify-content:space-between;}"],e&&Object(r.css)(["border-bottom:",";padding-bottom:",";align-items:center;"],t.eui.euiBorderThin,t.eui.euiSizeXS),t.eui.euiBreakpoints.l)));o.displayName="Bar";const s=l.a.div.attrs({className:"siemUtilityBar__section"}).withConfig({displayName:"BarSection",componentId:"sc-yj1vvr-1"})(["",""],(({grow:e,theme:t})=>Object(r.css)(["& + &{margin-top:",";align-items:center;}@media only screen and (min-width:","){display:flex;flex-wrap:wrap;}@media only screen and (min-width:","){& + &{margin-top:0;margin-left:",";}}",""],t.eui.euiSizeS,t.eui.euiBreakpoints.m,t.eui.euiBreakpoints.l,t.eui.euiSize,e&&Object(r.css)(["flex:1;"]))));s.displayName="BarSection";const u=l.a.div.attrs({className:"siemUtilityBar__group"}).withConfig({displayName:"BarGroup",componentId:"sc-yj1vvr-2"})(["",""],(({grow:e,theme:t})=>Object(r.css)(["align-items:flex-start;display:flex;flex-wrap:wrap;& + &{margin-top:",";}@media only screen and (min-width:","){border-right:",";flex-wrap:nowrap;margin-right:",";padding-right:",";& + &{margin-top:0;}&:last-child{border-right:none;margin-right:0;padding-right:0;}}& > *{margin-right:",";&:last-child{margin-right:0;}}",""],t.eui.euiSizeS,t.eui.euiBreakpoints.m,t.eui.euiBorderThin,t.eui.euiSizeM,t.eui.euiSizeM,t.eui.euiSize,e&&Object(r.css)(["flex:1;"]))));u.displayName="BarGroup";const c=l.a.p.attrs((({className:e})=>({className:e||"siemUtilityBar__text"}))).withConfig({displayName:"BarText",componentId:"sc-yj1vvr-3"})(["",""],(({shouldWrap:e,theme:t})=>Object(r.css)(["color:",";font-size:",";line-height:",";white-space:",";"],t.eui.euiTextSubduedColor,t.eui.euiFontSizeXS,t.eui.euiLineHeight,e?"normal":"nowrap")));c.displayName="BarText";const d=l.a.div.attrs({className:"siemUtilityBar__action"}).withConfig({displayName:"BarAction",componentId:"sc-yj1vvr-4"})(["",""],(({theme:e})=>Object(r.css)(["font-size:",";"],e.eui.euiFontSizeXS)));d.displayName="BarAction";const m=l.a.div.attrs({className:"siemUtilityBar__spacer"}).withConfig({displayName:"BarSpacer",componentId:"sc-yj1vvr-5"})(["",""],(()=>Object(r.css)(["flex:1;"])));m.displayName="BarSpacer";const p=i.a.memo((({border:e,children:t})=>i.a.createElement(o,{border:e},t)));p.displayName="UtilityBar";var b=n(40),f=n(674);const g=l()(b.EuiButtonEmpty).withConfig({displayName:"LoadingButtonEmpty",componentId:"sc-ou55gk-0"})(["",""],(({theme:e})=>Object(r.css)(["&.euiButtonEmpty{height:",";}"],e.eui.euiSize))),y=i.a.memo((({children:e,color:t,iconSide:n,iconSize:r,iconType:l,popoverContent:o,disabled:s,ownFocus:u,dataTestSubj:c,popoverPanelPaddingSize:d,onClick:m})=>{const[p,g]=Object(a.useState)(!1),y=Object(a.useCallback)((()=>g(!1)),[g]),h=Object(a.useCallback)((()=>{null==m||m(),g(!p)}),[p,m]);return i.a.createElement(b.EuiPopover,{ownFocus:u,panelPaddingSize:d,button:i.a.createElement(f.a,{dataTestSubj:c,color:t,iconSide:n,iconSize:r,iconType:l,disabled:s,onClick:h},e),closePopover:y,isOpen:p,repositionOnScroll:!0},null==o?void 0:o(y))}));y.displayName="Popover";const h=i.a.memo((({children:e,color:t,dataTestSubj:n,disabled:a,href:r,iconSide:l,iconSize:o,iconType:s,ownFocus:u,onClick:c,popoverContent:m,popoverPanelPaddingSize:p,inProgress:b})=>b?i.a.createElement(d,null,i.a.createElement(g,{"data-test-subj":`${n}-progress`,size:"xs",className:"eui-alignTop",isLoading:!0,iconSide:"right",flush:"both"},e)):i.a.createElement(d,{"data-test-subj":n},m?i.a.createElement(y,{dataTestSubj:`${n}-popover`,disabled:a,color:t,iconSide:l,iconSize:o,iconType:s,ownFocus:u,popoverPanelPaddingSize:p,popoverContent:m,onClick:c},e):i.a.createElement(f.a,{color:t,dataTestSubj:`${n}-linkIcon`,disabled:a,href:r,iconSide:l,iconSize:o,iconType:s,onClick:c},e))));h.displayName="UtilityBarAction";const v=i.a.memo((({grow:e,children:t})=>i.a.createElement(u,{grow:e},t)));v.displayName="UtilityBarGroup";const E=i.a.memo((({grow:e,children:t,dataTestSubj:n})=>i.a.createElement(s,{grow:e,"data-test-subj":n},t)));E.displayName="UtilityBarSection",i.a.memo((({dataTestSubj:e})=>i.a.createElement(m,{"data-test-subj":e}))).displayName="UtilityBarSpacer";const O=i.a.memo((({children:e,dataTestSubj:t,shouldWrap:n=!1,className:a})=>i.a.createElement(c,{"data-test-subj":t,shouldWrap:n,className:a},e)));O.displayName="UtilityBarText"},318:function(e,t,n){"use strict";n.d(t,"d",(function(){return c})),n.d(t,"c",(function(){return d})),n.d(t,"a",(function(){return m})),n.d(t,"b",(function(){return b})),n.d(t,"e",(function(){return f})),n.d(t,"f",(function(){return g}));var a=n(2),i=n.n(a),r=n(40),l=n(41),o=n.n(l),s=n(44),u=n(117);const c=({children:e,...t})=>i.a.createElement(r.EuiButton,t,e),d=({children:e,...t})=>i.a.createElement(r.EuiLink,t,e),m=o()("span").withConfig({displayName:"Comma",componentId:"sc-11tqw5g-0"})(["margin-right:5px;margin-left:5px;&::after{content:' ,';}"]);m.displayName="Comma";const p=({children:e,Component:t,dataTestSubj:n,href:a,onClick:r,title:l,iconType:o="expand"})=>t?i.a.createElement(t,{"data-test-subj":n,href:a,iconType:o,onClick:r,title:l},null!=l?l:e):i.a.createElement(c,{"data-test-subj":n,href:a,onClick:r},null!=l?l:e),b=i.a.memo(p),f=o.a.div.withConfig({displayName:"PortContainer",componentId:"sc-11tqw5g-1"})(["& svg{position:relative;top:-1px;}"]),g=i.a.memo((({moreMaxHeight:e,overflowIndexStart:t=5,render:n,rowItems:l})=>{const[o,u]=Object(a.useState)(!1),c=Object(a.useCallback)((()=>u((e=>!e))),[]),d=Object(a.useMemo)((()=>i.a.createElement(i.a.Fragment,null," ,",i.a.createElement(r.EuiButtonEmpty,{size:"xs",onClick:c},`+${l.length-t} `,i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.reputationLinks.moreLabel",defaultMessage:"More"})))),[c,t,l.length]);return i.a.createElement(r.EuiFlexItem,{grow:!1},l.length>t&&i.a.createElement(r.EuiPopover,{id:"popover",button:d,isOpen:o,closePopover:c,repositionOnScroll:!0,panelClassName:"withHoverActions__popover"},i.a.createElement(y,{render:n,rowItems:l,moreMaxHeight:e,overflowIndexStart:t})))}));g.displayName="ReputationLinksOverflow";const y=i.a.memo((({moreMaxHeight:e,overflowIndexStart:t,render:n,rowItems:l})=>{const o=Object(a.useMemo)((()=>l.slice(t).map(((e,t)=>{var a;return i.a.createElement(r.EuiFlexItem,{grow:1,key:`${e}-${t}`},null!==(a=n&&n(e))&&void 0!==a?a:Object(u.a)(e))}))),[t,n,l]);return i.a.createElement("div",{"data-test-subj":"more-container",className:"eui-yScroll",style:{maxHeight:e,paddingRight:"2px"}},i.a.createElement(r.EuiFlexGroup,{gutterSize:"s",direction:"column","data-test-subj":"overflow-items"},o))}));y.displayName="MoreReputationLinksContainer"},321:function(e,t,n){"use strict";n.d(t,"a",(function(){return W})),n.d(t,"c",(function(){return X})),n.d(t,"b",(function(){return ee}));var a=n(104),i=n.n(a),r=n(40),l=n(109),o=n(2),s=n.n(o),u=n(70),c=n(103),d=n(41),m=n.n(d),p=n(119),b=n(227),f=n(152),g=n(339),y=n(637),h=n(153),v=n(638),E=n(670),O=n(658),S=n(5),x=n(59),j=n(118),k=n(8),T=n(13),C=n(115),w=n(111),I=n(102),M=n(958),A=n(110),N=n(116),F=n(699);const D=({field:e,value:t})=>null==t?e:Array.isArray(t)?`${e} ${t.join(" ")}`:`${e} ${t}`;var R=n(272);const P=s.a.memo((({className:e,Component:t,enablePopOver:n,field:a,flush:i,iconSide:l,iconType:u,isExpandable:c,onClick:d,onFilterAdded:m,ownFocus:p,paddingSize:b,showLegend:f,showTooltip:g=!0,showTopN:y,scopeId:h,title:v,value:E,globalFilters:O})=>{const x=Object(C.isActiveTimeline)(null!=h?h:"")?A.SourcererScopeName.timeline:null!=h&&Object(R.c)(h)?A.SourcererScopeName.detections:A.SourcererScopeName.default,{browserFields:j,indexPattern:k}=Object(N.d)(x),T=null!=u?u:"visBarVertical",w=null!=l?l:"left",I=null!=v?v:(P=a,S.i18n.translate("xpack.securitySolution.hoverActions.showTopTooltip",{values:{fieldName:P},defaultMessage:"Show top {fieldName}"}));var P;const L=Object(o.useMemo)((()=>t?s.a.createElement(t,{"aria-label":I,className:e,"data-test-subj":"show-top-field",icon:T,iconType:T,iconSide:w,flush:i,onClick:d,title:I},I):s.a.createElement(r.EuiButtonIcon,{"aria-label":I,className:"securitySolution__hoverActionButton","data-test-subj":"show-top-field",iconSize:"s",iconType:T,onClick:d})),[t,I,e,i,T,d,w]),B=Object(o.useMemo)((()=>g&&!y?s.a.createElement(r.EuiToolTip,{content:s.a.createElement(F.a,{additionalScreenReaderOnlyContext:D({field:a,value:E}),content:I,shortcut:"t",showShortcut:p})},L):L),[L,I,a,p,g,y,E]),_=Object(o.useMemo)((()=>s.a.createElement(M.a,{browserFields:j,field:a,indexPattern:k,onFilterAdded:m,paddingSize:b,showLegend:f,scopeId:null!=h?h:void 0,toggleTopN:d,globalFilters:O})),[j,a,k,m,b,f,h,d,O]);return c?s.a.createElement(s.a.Fragment,null,L,y&&_):y?n?s.a.createElement(r.EuiPopover,{button:L,isOpen:y,closePopover:d,panelClassName:"withHoverActions__popover","data-test-subj":"showTopNContainer"},_):_:B}));P.displayName="ShowTopNButton";var L=n(12),B=n(105),_=n(131);const z=m.a.div.withConfig({displayName:"AdditionalContent",componentId:"sc-hbiy4s-0"})(["padding:2px;"]);z.displayName="AdditionalContent";const q=m.a.div.withConfig({displayName:"StyledHoverActionsContainer",componentId:"sc-hbiy4s-1"})(["display:flex;"," ",""],(e=>e.$isActive?"\n    .hoverActions-active {\n      .timelines__hoverActionButton,\n      .securitySolution__hoverActionButton {\n        opacity: 1;\n      }\n    }\n  ":""),(e=>e.$showOwnFocus?`\n    &:focus-within {\n      .timelines__hoverActionButton,\n      .securitySolution__hoverActionButton {\n        opacity: 1;\n      }\n    }\n\n    &:hover {\n      .timelines__hoverActionButton,\n      .securitySolution__hoverActionButton {\n        opacity: 1;\n      }\n    }\n\n  .timelines__hoverActionButton,\n  .securitySolution__hoverActionButton {\n    opacity: ${e.$showTopN?1:0};\n\n      &:focus {\n        opacity: 1;\n      }\n    }\n  `:"")),$=m()(q).withConfig({displayName:"StyledHoverActionsContainerWithPaddingsAndMinWidth",componentId:"sc-hbiy4s-2"})(["min-width:",";padding:",";position:relative;"],(({$hiddenActionsCount:e})=>138-26*e+"px"),(e=>`0 ${e.theme.eui.euiSizeS}`)),V=({ownFocus:e,showTopN:t})=>!t&&!e,H=s.a.memo((({additionalContent:e=null,closePopOver:t,closeTopN:n,dataProvider:a,dataType:i,draggableId:l,enableOverflowButton:u=!1,applyWidthAndPadding:d=!0,field:m,fieldType:p,isAggregatable:b,goGetTimelineId:f,isObjectArray:g,hideAddToTimeline:y=!1,hideTopN:v=!1,onFilterAdded:E,ownFocus:O,showOwnFocus:M=!0,showTopN:A,scopeId:N,toggleColumn:F,toggleTopN:D,values:R})=>{const[H,U]=Object(o.useState)(),[Q,G]=Object(o.useState)(!1),[W,K]=Object(o.useState)(!1),X=Object(o.useCallback)((()=>{G((e=>!e)),K(!W)}),[W,K]),Y=Object(o.useCallback)((()=>{n&&n(),G(!1),K(!1),t&&t()}),[t,n]),J=Object(o.useRef)(!0),Z=Object(o.useRef)(null);Object(o.useEffect)((()=>{J.current&&null!=f&&null==N&&(J.current=!1,f(!0))}),[f,N]),Object(o.useEffect)((()=>{O&&setTimeout((()=>{var e;null===(e=Z.current)||void 0===e||e.focus()}),0)}),[O]);const ee=Object(o.useCallback)((e=>{if(O)switch(e.key){case"t":Object(x.stopPropagationAndPreventDefault)(e),D();break;case"Enter":break;case"Escape":Object(x.stopPropagationAndPreventDefault)(e);break;default:U(e)}}),[O,D]),te=N===j.c.casePage,ne=N===j.c.active,ae=N===j.c.detectionsAlertDetailsPage,ie=N===_.a.entityAnalytics,re=Object(o.useMemo)((()=>(ae||ie)&&!ne),[ne,ae,ie]),le=Object(o.useMemo)((()=>(v?1:0)+(re?2:0)),[re,v]),{overflowActionItems:oe,allActionItems:se}=(({dataProvider:e,dataType:t,defaultFocusedButtonRef:n,draggableId:a,enableOverflowButton:i,field:l,fieldType:u,isAggregatable:d,handleHoverActionClicked:m,hideFilters:p,hideTopN:b,hideAddToTimeline:f,isCaseView:g,isObjectArray:y,isOverflowPopoverOpen:v,itemsToShow:E=2,onFilterAdded:O,onOverflowButtonClick:S,ownFocus:x,showTopN:M,stKeyboardEvent:A,scopeId:N,toggleColumn:F,toggleTopN:D,values:R})=>{const _=Object(I.j)(),z=Object(c.useDispatch)(),{timelines:q,uiSettings:$}=_.services,{getAddToTimelineButton:V,getColumnToggleButton:H,getCopyButton:U,getFilterForValueButton:Q,getFilterOutValueButton:G,getOverflowButton:W}=q.getHoverActions(),K=Object(o.useMemo)((()=>_.services.data.query.filterManager),[_.services.data.query.filterManager]),X=Object(o.useMemo)((()=>w.b.getTimelineByIdSelector()),[]),Y=Object(B.a)((e=>{var t;return Object(C.isActiveTimeline)(null!=N?N:"")?null===(t=X(e,null!=N?N:""))||void 0===t?void 0:t.filterManager:void 0})),J=Object(o.useMemo)((()=>Object(C.isActiveTimeline)(null!=N?N:"")?null!=Y?Y:new T.FilterManager($):K),[N,Y,$,K]),Z=Object(o.useCallback)((()=>{e&&!Object(k.isEmpty)(e)&&z(Object(L.addProvider)({id:j.c.active,providers:e instanceof Array?e:[e]}))}),[e,z]),ee=Object(o.useCallback)((()=>{m&&m(),Z()}),[m,Z]),te=Object(o.useMemo)((()=>!p&&null!=R&&(i||!M&&!i)&&!g),[i,p,g,M,R]),ne=y&&"geo_point"!==l||g,ae=Object(o.useMemo)((()=>s.a.createElement(P,{Component:i?r.EuiContextMenuItem:void 0,"data-test-subj":"hover-actions-show-top-n",enablePopOver:!i&&g,field:l,key:"hover-actions-show-top-n",onClick:D,onFilterAdded:O,ownFocus:x,showTopN:M,showTooltip:!i,scopeId:N,value:R})),[i,g,l,D,O,x,M,N,R]),ie=Object(o.useMemo)((()=>[te?s.a.createElement("div",{"data-test-subj":"hover-actions-filter-for",key:"hover-actions-filter-for"},Q({defaultFocusedButtonRef:n,field:l,filterManager:J,keyboardEvent:A,onClick:m,onFilterAdded:O,ownFocus:x,showTooltip:!i,value:R})):null,te?s.a.createElement("div",{"data-test-subj":"hover-actions-filter-out",key:"hover-actions-filter-out"},G({field:l,filterManager:J,keyboardEvent:A,onFilterAdded:O,ownFocus:x,onClick:m,showTooltip:!i,value:R})):null,F&&!ne?s.a.createElement("div",{"data-test-subj":"hover-actions-toggle-column",key:"hover-actions-toggle-column"},H({Component:i?r.EuiContextMenuItem:void 0,field:l,isDisabled:y&&"geo_point"!==t,isObjectArray:y,keyboardEvent:A,ownFocus:x,onClick:m,showTooltip:!i,toggleColumn:F,value:R})):null,null==R||null==a&&Object(k.isEmpty)(e)||f?null:s.a.createElement("div",{"data-test-subj":"hover-actions-add-timeline",key:"hover-actions-add-timeline"},V({Component:i?r.EuiContextMenuItem:void 0,dataProvider:e,draggableId:a,field:l,keyboardEvent:A,ownFocus:x,onClick:ee,showTooltip:!i,value:R})),Object(h.e)({fieldType:u,isAggregatable:d,fieldName:l,hideTopN:b})?ae:null,null!=l?s.a.createElement("div",{"data-test-subj":"hover-actions-copy-button",key:"hover-actions-copy-button"},U({Component:i?r.EuiContextMenuItem:void 0,field:l,isHoverAction:!0,keyboardEvent:A,ownFocus:x,onClick:m,showTooltip:!i,value:R})):null].filter((e=>null!=e))),[e,t,n,a,i,l,u,d,J,V,H,U,Q,G,m,ee,f,b,y,O,x,ne,te,ae,A,F,R]);return{overflowActionItems:Object(o.useMemo)((()=>[...ie.slice(0,E),...i&&E>0&&E<ie.length?[W({closePopOver:m,field:l,keyboardEvent:A,ownFocus:x,onClick:S,showTooltip:!i,value:R,items:M?[ae]:ie.slice(E),isOverflowPopoverOpen:!!v})]:[]].filter((e=>null!=e))),[ie,i,l,W,m,v,E,S,ae,x,M,A,R]),allActionItems:Object(o.useMemo)((()=>!M||i||g?ie:[ae]),[M,i,g,ae,ie])}})({dataProvider:a,dataType:i,defaultFocusedButtonRef:Z,draggableId:l,enableOverflowButton:u&&!te,field:m,fieldType:p,hideFilters:re,isAggregatable:b,handleHoverActionClicked:Y,hideAddToTimeline:y,hideTopN:v,isCaseView:te,isObjectArray:g,isOverflowPopoverOpen:W,onFilterAdded:E,onOverflowButtonClick:X,ownFocus:O,showTopN:A,stKeyboardEvent:H,toggleColumn:F,toggleTopN:D,values:R,scopeId:N}),ue=d?$:q;return s.a.createElement(r.EuiFocusTrap,{disabled:V({ownFocus:O,showTopN:A})},s.a.createElement(ue,{"data-test-subj":"hover-actions-container",onKeyDown:ee,$showTopN:A,$showOwnFocus:M,$hiddenActionsCount:le,$isActive:Q,className:Q?"hoverActions-active":""},s.a.createElement(r.EuiScreenReaderOnly,null,s.a.createElement("p",null,(ce=m,S.i18n.translate("xpack.securitySolution.dragAndDrop.youAreInADialogContainingOptionsScreenReaderOnly",{values:{fieldName:ce},defaultMessage:"You are in a dialog, containing options for field {fieldName}. Press tab to navigate options. Press escape to exit."})))),null!=e&&s.a.createElement(z,null,e),u&&!te?oe:se));var ce}));H.displayName="HoverActions";var U=n(922);const Q=({dataProvider:e,isAggregatable:t,fieldType:n,hideTopN:a,isDraggable:i,onFilterAdded:r,render:l,scopeId:u})=>{const{timelineId:c}=Object(o.useContext)(O.b),{tableId:d}=Object(o.useContext)(U.b),m=Object(o.useRef)(null),p=Object(o.useRef)(null),[b,f]=Object(o.useState)(!1),[g,y]=Object(o.useState)(!1),v=Object(o.useMemo)((()=>u||(null!=c?c:d)),[u,d,c]),E=Object(o.useCallback)((()=>{f((e=>!e)),y((e=>(e&&setTimeout((()=>{var e;null===(e=p.current)||void 0===e||e.focus()}),0),!1))),setTimeout((()=>{y(!1)}),0)}),[p]),{closeTopN:S,toggleTopN:x,isShowingTopN:j}=(e=>{const[t,n]=Object(o.useState)(!1),a=Object(o.useCallback)((()=>{n((t=>{const n=!t;return e&&e(n),n}))}),[e]);return{closeTopN:Object(o.useCallback)((()=>{n(!1)}),[]),toggleTopN:a,isShowingTopN:t}})(E),k=Object(o.useMemo)((()=>{const t=e.queryMatch.value;return"number"==typeof t||"boolean"==typeof t?t.toString():Array.isArray(t)?t.map((e=>String(e))):t}),[e.queryMatch.value]),T=Object(o.useMemo)((()=>{const o=g&&!j&&(null!==(c=null==(u=m.current)?void 0:u.querySelectorAll(".euiLink"))&&void 0!==c?c:[]).length>0?s.a.createElement(X,{"data-test-subj":`draggable-link-content-${e.queryMatch.field}`},l(e,null,{isDragging:!1,isDropAnimating:!1,isClone:!1,dropAnimation:null,draggingOver:null,combineWith:null,combineTargetFor:null,mode:null})):null;var u,c;return s.a.createElement(H,{additionalContent:o,closeTopN:S,closePopOver:E,dataProvider:e,draggableId:i?Object(h.l)(e.id):void 0,field:e.queryMatch.field,isAggregatable:t,fieldType:n,hideTopN:a,isObjectArray:!1,onFilterAdded:r,ownFocus:g,showOwnFocus:!1,showTopN:j,scopeId:v,toggleTopN:x,values:k})}),[g,j,e,l,S,E,i,t,n,a,r,v,x,k]),C=Object(o.useCallback)((e=>{m.current=e}),[]),w=Object(o.useCallback)((()=>{var e;g||null===(e=p.current)||void 0===e||e.focus()}),[g,p]),I=Object(o.useCallback)((()=>{S(),g&&(y(!1),setTimeout((()=>{w()}),0))}),[w,g,S]),M=Object(o.useCallback)((()=>{y(!0)}),[]);return Object(o.useMemo)((()=>({closePopOverTrigger:b,handleClosePopOverTrigger:E,hoverActionsOwnFocus:g,hoverContent:T,keyboardHandlerRef:p,onCloseRequested:I,onFocus:w,openPopover:M,setContainerRef:C,isShowingTopN:j})),[b,E,g,T,I,w,M,C,j])};var G=n(662);const W=m.a.div.withConfig({displayName:"DragEffects",componentId:"sc-1n4vnmw-0"})([""]);W.displayName="DragEffects";class draggable_wrapper_DragDropErrorBoundary extends s.a.PureComponent{componentDidCatch(){this.forceUpdate()}render(){return this.props.children}}const K=m.a.div.withConfig({displayName:"Wrapper",componentId:"sc-1n4vnmw-1"})(["display:inline-block;max-width:100%;[data-rbd-placeholder-context-id]{display:none !important;}",""],(({disabled:e})=>e&&"\n    [data-rbd-draggable-id]:hover,\n    .euiBadge:hover,\n    .euiBadge__text:hover {\n      cursor: default;\n    }\n  "));K.displayName="Wrapper";const X=m.a.span.withConfig({displayName:"ProviderContentWrapper",componentId:"sc-1n4vnmw-2"})(["> span.euiToolTipAnchor{display:block;}> span.euiToolTipAnchor.eui-textTruncate{display:inline-block;}"]),Y=(e,t)=>t.isDropAnimating?{...e,transitionDuration:"0.00000001s"}:e,J=({dataProvider:e,hideTopN:t=!1,onFilterAdded:n,render:a,fieldType:d="",isAggregatable:m=!1,scopeId:p,truncate:O})=>{const[S,x]=Object(o.useState)(!1),j=e.id.includes(`-${f.a}-`),k=Object(c.useDispatch)(),{closePopOverTrigger:T,handleClosePopOverTrigger:C,hoverActionsOwnFocus:w,hoverContent:I,keyboardHandlerRef:M,onCloseRequested:A,openPopover:N,onFocus:F,setContainerRef:D,isShowingTopN:R}=Q({dataProvider:e,hideTopN:t,onFilterAdded:n,render:a,fieldType:d,isAggregatable:m,scopeId:p,truncate:O}),P=Object(o.useCallback)((()=>{j||(k(b.a.registerProvider({provider:e})),x(!0))}),[j,k,e]),L=Object(o.useCallback)((()=>S&&k(b.a.unRegisterProvider({id:e.id}))),[S,k,e.id]);Object(o.useEffect)((()=>()=>{L()}),[L]);const B=Object(o.useCallback)(((t,n)=>s.a.createElement(te,{registerProvider:P},s.a.createElement("div",i()({},t.draggableProps,t.dragHandleProps,{style:Y(t.draggableProps.style,n),ref:t.innerRef,"data-test-subj":"providerContainer",tabIndex:-1}),s.a.createElement(X,{"data-test-subj":`draggable-content-${e.queryMatch.field}`},a(e,t,n))))),[e,P,a]),_=Object(o.useCallback)(((t,n)=>s.a.createElement(v.a,i()({},t.draggableProps,t.dragHandleProps,{ref:e=>{t.innerRef(e),D(e)},"data-test-subj":"providerContainer",isDragging:n.isDragging,registerProvider:P,tabIndex:-1}),s.a.createElement(r.EuiScreenReaderOnly,{"data-test-subj":"screenReaderOnlyField"},s.a.createElement("p",null,e.queryMatch.field)),O&&!n.isDragging?s.a.createElement(g.b,{"data-test-subj":"draggable-truncatable-content"},a(e,t,n)):s.a.createElement(X,{"data-test-subj":`draggable-content-${e.queryMatch.field}`},a(e,t,n)),!n.isDragging&&s.a.createElement(r.EuiScreenReaderOnly,{"data-test-subj":"draggableKeyboardInstructionsNotDragging"},s.a.createElement("p",null,E.b)))),[e,P,a,D,O]),{onBlur:z,onKeyDown:q}=Object(G.a)({closePopover:C,draggableId:Object(h.l)(e.id),fieldName:e.queryMatch.field,keyboardHandlerRef:M,openPopover:N}),$=Object(o.useCallback)((t=>s.a.createElement("div",i()({ref:t.innerRef},t.droppableProps),s.a.createElement("div",{className:l.a,"data-test-subj":"draggableWrapperKeyboardHandler",onClick:F,onBlur:z,onKeyDown:q,ref:M,role:"button",tabIndex:0},s.a.createElement(u.Draggable,{draggableId:Object(h.l)(e.id),index:0,key:Object(h.l)(e.id),isDragDisabled:j},_)),t.placeholder)),[_,e.id,j,M,z,F,q]),V=Object(o.useMemo)((()=>s.a.createElement(K,{"data-test-subj":"draggableWrapperDiv",disabled:j},s.a.createElement(draggable_wrapper_DragDropErrorBoundary,null,s.a.createElement(u.Droppable,{isDropDisabled:!0,droppableId:Object(h.m)(e.id),renderClone:B},$)))),[$,B,e.id,j]),H=Object(o.useCallback)((()=>V),[V]);return j?s.a.createElement(s.a.Fragment,null,V):s.a.createElement(y.a,{alwaysShow:R||w,closePopOverTrigger:T,hoverContent:I,onCloseRequested:A,render:H})},Z=({dataProvider:e,hideTopN:t=!1,isDraggable:n=!1,onFilterAdded:a,render:i,isAggregatable:r=!1,fieldType:l="",scopeId:u,truncate:c})=>{const{closePopOverTrigger:d,hoverActionsOwnFocus:m,hoverContent:b,onCloseRequested:v,setContainerRef:E,isShowingTopN:O}=Q({dataProvider:e,hideTopN:t,isDraggable:n,isAggregatable:r,fieldType:l,onFilterAdded:a,render:i,scopeId:u,truncate:c}),S=Object(o.useCallback)((()=>s.a.createElement("div",{ref:e=>{E(e)},tabIndex:-1,"data-provider-id":Object(h.l)(e.id)},c?s.a.createElement(g.b,{"data-test-subj":"render-truncatable-content"},i(e,null,{isDragging:!1,isDropAnimating:!1,isClone:!1,dropAnimation:null,draggingOver:null,combineWith:null,combineTargetFor:null,mode:null})):s.a.createElement(X,{"data-test-subj":`render-content-${e.queryMatch.field}`},i(e,null,{isDragging:!1,isDropAnimating:!1,isClone:!1,dropAnimation:null,draggingOver:null,combineWith:null,combineTargetFor:null,mode:null})))),[e,i,E,c]);return n?s.a.createElement(J,{dataProvider:e,hideTopN:t,onFilterAdded:a,fieldType:l,isAggregatable:r,render:i,scopeId:u,truncate:c}):s.a.createElement(y.a,{alwaysShow:O||m,closePopOverTrigger:d,hoverContent:(x=u,[p.e.rulePreview,f.a].includes(null!=x?x:"")?void 0:b),onCloseRequested:v,render:S});var x},ee=s.a.memo(Z);ee.displayName="DraggableWrapper";const te=s.a.memo((({children:e,registerProvider:t})=>(Object(o.useEffect)((()=>{t()}),[t]),s.a.createElement(s.a.Fragment,null,e))));te.displayName="ConditionalPortal"},325:function(e,t,n){(function(t){const n="object"==typeof t&&Object({IS_KIBANA_DISTRIBUTABLE:"true"})&&Object({IS_KIBANA_DISTRIBUTABLE:"true"}).NODE_DEBUG&&/\bsemver\b/i.test(Object({IS_KIBANA_DISTRIBUTABLE:"true"}).NODE_DEBUG)?(...e)=>console.error("SEMVER",...e):()=>{};e.exports=n}).call(this,n(404))},326:function(e,t){const n=Number.MAX_SAFE_INTEGER||9007199254740991;e.exports={MAX_LENGTH:256,MAX_SAFE_COMPONENT_LENGTH:16,MAX_SAFE_BUILD_LENGTH:250,MAX_SAFE_INTEGER:n,RELEASE_TYPES:["major","premajor","minor","preminor","patch","prepatch","prerelease"],SEMVER_SPEC_VERSION:"2.0.0",FLAG_INCLUDE_PRERELEASE:1,FLAG_LOOSE:2}},327:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"b",(function(){return r})),n.d(t,"c",(function(){return l}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.chart.dataAllValuesZerosTitle",{defaultMessage:"All values returned zero"}),r=a.i18n.translate("xpack.securitySolution.chart.dataNotAvailableTitle",{defaultMessage:"Chart Data Not Available"}),l=a.i18n.translate("xpack.securitySolution.chart.emptyValueLabel",{defaultMessage:"empty value"})},328:function(e,t,n){"use strict";n.d(t,"b",(function(){return s})),n.d(t,"c",(function(){return u})),n.d(t,"a",(function(){return c}));var a=n(190),i=n(176),r=n(135),l=n(682);const o=e=>{var t,n;const i=null!==(t=null==e||null===(n=e.isPlatinumPlus)||void 0===n?void 0:n.call(e))&&void 0!==t&&t;return[{columnHeaderType:a.a,displayAsText:r.s,id:"kibana.alert.severity",initialWidth:105},{columnHeaderType:a.a,displayAsText:r.o,id:"kibana.alert.risk_score",initialWidth:100},{columnHeaderType:a.a,displayAsText:r.n,id:"kibana.alert.reason",initialWidth:450},{columnHeaderType:a.a,id:"host.name"},i?{columnHeaderType:a.a,id:"host.risk.calculated_level"}:null,{columnHeaderType:a.a,id:"user.name"},i?{columnHeaderType:a.a,id:"user.risk.calculated_level"}:null,{columnHeaderType:a.a,id:"process.name"},{columnHeaderType:a.a,id:"file.name"},{columnHeaderType:a.a,id:"source.ip"},{columnHeaderType:a.a,id:"destination.ip"}].filter((e=>null!=e))},s=e=>[{columnHeaderType:a.a,id:"@timestamp",initialWidth:i.b+10},{columnHeaderType:a.a,displayAsText:r.p,id:"kibana.alert.rule.name",initialWidth:i.a,linkField:"kibana.alert.rule.uuid"},...o(e)],u=e=>[{columnHeaderType:a.a,id:"kibana.alert.original_time",initialWidth:i.b+10},...o(e)],c=[{columnHeaderType:a.a,id:"@timestamp",displayAsText:r.B.timestamp,initialWidth:l.b+50,actions:!1,isExpandable:!1,isResizable:!1},{columnHeaderType:a.a,displayAsText:r.B.rule,id:"kibana.alert.rule.name",initialWidth:l.a+50,linkField:"kibana.alert.rule.uuid",actions:!1,isExpandable:!1,isResizable:!1},{columnHeaderType:a.a,id:"eventSummary",displayAsText:r.B.eventSummary,actions:!1,isExpandable:!1,isResizable:!1}]},339:function(e,t,n){"use strict";n.d(t,"a",(function(){return c})),n.d(t,"b",(function(){return d}));var a=n(104),i=n.n(a),r=n(2),l=n.n(r),o=n(41),s=n.n(o),u=n(40);const c=s.a.span.withConfig({displayName:"EllipsisText",componentId:"sc-saif2w-0"})(["&,& *{display:inline-block;max-width:100%;overflow:hidden;text-overflow:ellipsis;vertical-align:top;white-space:nowrap;}"]);function d({tooltipContent:e,children:t,dataTestSubj:n,...a}){return e?l.a.createElement(u.EuiToolTip,{display:"block",content:e},l.a.createElement(c,i()({"data-test-subj":n},a),t)):l.a.createElement(c,i()({"data-test-subj":n},a),t)}c.displayName="EllipsisText"},341:function(e,t,n){var a=n(436),i=n(437);e.exports=function(e){return function(){var t=arguments;switch(t.length){case 0:return new e;case 1:return new e(t[0]);case 2:return new e(t[0],t[1]);case 3:return new e(t[0],t[1],t[2]);case 4:return new e(t[0],t[1],t[2],t[3]);case 5:return new e(t[0],t[1],t[2],t[3],t[4]);case 6:return new e(t[0],t[1],t[2],t[3],t[4],t[5]);case 7:return new e(t[0],t[1],t[2],t[3],t[4],t[5],t[6])}var n=a(e.prototype),r=e.apply(n,t);return i(r)?r:n}}},342:function(e,t,n){e.exports=n(33)(315)},343:function(e,t,n){"use strict";var a=function(e){return function(e){return!!e&&"object"==typeof e}(e)&&!function(e){var t=Object.prototype.toString.call(e);return"[object RegExp]"===t||"[object Date]"===t||function(e){return e.$$typeof===i}(e)}(e)},i="function"==typeof Symbol&&Symbol.for?Symbol.for("react.element"):60103;function r(e,t){return!1!==t.clone&&t.isMergeableObject(e)?u((n=e,Array.isArray(n)?[]:{}),e,t):e;var n}function l(e,t,n){return e.concat(t).map((function(e){return r(e,n)}))}function o(e){return Object.keys(e).concat(function(e){return Object.getOwnPropertySymbols?Object.getOwnPropertySymbols(e).filter((function(t){return e.propertyIsEnumerable(t)})):[]}(e))}function s(e,t){try{return t in e}catch(e){return!1}}function u(e,t,n){(n=n||{}).arrayMerge=n.arrayMerge||l,n.isMergeableObject=n.isMergeableObject||a,n.cloneUnlessOtherwiseSpecified=r;var i=Array.isArray(t);return i===Array.isArray(e)?i?n.arrayMerge(e,t,n):function(e,t,n){var a={};return n.isMergeableObject(e)&&o(e).forEach((function(t){a[t]=r(e[t],n)})),o(t).forEach((function(i){(function(e,t){return s(e,t)&&!(Object.hasOwnProperty.call(e,t)&&Object.propertyIsEnumerable.call(e,t))})(e,i)||(s(e,i)&&n.isMergeableObject(t[i])?a[i]=function(e,t){if(!t.customMerge)return u;var n=t.customMerge(e);return"function"==typeof n?n:u}(i,n)(e[i],t[i],n):a[i]=r(t[i],n))})),a}(e,t,n):r(t,n)}u.all=function(e,t){if(!Array.isArray(e))throw new Error("first argument should be an array");return e.reduce((function(e,n){return u(e,n,t)}),{})};var c=u;e.exports=c},345:function(e,t,n){"use strict";n.d(t,"a",(function(){return g})),n.d(t,"b",(function(){return y}));var a=n(2),i=n.n(a),r=n(10),l=n.n(r),o=n(3),s=n(45),u=n(908),c=n(115),d=n(102),m=n(199);const p={activeStep:0,endTourStep:()=>{},incrementStep:()=>{},isTourShown:()=>!1,setStep:()=>{}},b=Object(a.createContext)(p),f=({children:e})=>{var t,n;const{guidedOnboardingApi:r}=Object(d.j)().services.guidedOnboarding,s=l()(null!==(t=null==r?void 0:r.isGuideStepActive$(u.a,m.b.rules).pipe(Object(o.timeout)(3e4),Object(o.catchError)((e=>Object(o.of)(!1)))))&&void 0!==t?t:Object(o.of)(!1),!1),c=l()(null!==(n=null==r?void 0:r.isGuideStepActive$(u.a,m.b.alertsCases).pipe(Object(o.timeout)(3e4),Object(o.catchError)((e=>Object(o.of)(!1)))))&&void 0!==n?n:Object(o.of)(!1),!1),p=Object(a.useMemo)((()=>({[m.b.rules]:s,[m.b.alertsCases]:c})),[s,c]),f=Object(a.useCallback)((e=>p[e]),[p]),[g,y]=Object(a.useState)(1),h=Object(a.useCallback)((e=>{y((t=>(t>=m.e[e].length?0:t)+1))}),[]),v=Object(a.useCallback)(((e,t)=>{t<=m.e[e].length&&y(t)}),[]),[E,O]=Object(a.useState)(null);Object(a.useEffect)((()=>{if(!E||!r)return;let e=!1;return(async()=>{await r.completeGuideStep(u.a,E),e||(O(null),y(1))})(),()=>{e=!0}}),[E,r]);const S=Object(a.useCallback)((e=>{O(e)}),[]),x=Object(a.useMemo)((()=>({activeStep:g,endTourStep:S,incrementStep:h,isTourShown:f,setStep:v})),[g,S,h,f,v]);return i.a.createElement(b.Provider,{value:x},e)},g=({children:e})=>{const{pathname:t}=Object(s.useLocation)(),n=Object(a.useMemo)((()=>Object(c.isTourPath)(t)?f:b.Provider),[t]);return i.a.createElement(n,{value:p},e)},y=()=>{const e=Object(a.useContext)(b);if(!e)throw new Error("useTourContext can only be called inside of TourContext!");return e}},346:function(e,t,n){"use strict";n.d(t,"i",(function(){return l})),n.d(t,"b",(function(){return o})),n.d(t,"g",(function(){return s})),n.d(t,"c",(function(){return u})),n.d(t,"f",(function(){return c})),n.d(t,"d",(function(){return d})),n.d(t,"h",(function(){return m})),n.d(t,"e",(function(){return p})),n.d(t,"a",(function(){return b}));var a=n(42),i=n(106),r=n(389);const l=(e,t)=>"__typename"!==e&&null!=t?t:void 0,o=e=>!Object(a.isEmpty)(e),s=({isAlert:e,isPinned:t,eventHasNotes:n,timelineType:a})=>a===i.l.template?r.b(e):t&&n?r.d(e):t?r.c(e):r.g(e),u=({eventId:e,pinnedEventIds:t})=>!0===t[e],c=({allowUnpinning:e,eventId:t,onPinEvent:n,onUnPinEvent:a,isEventPinned:i})=>{e&&(i?a(t):n(t))},d=(e,t,n)=>e.reduce(((e,a)=>({...e,...t.includes(a._id)?{[a._id]:a.data.filter((e=>n.includes(e.field)))}:{}})),{}),m=e=>{var t;if(!Object(a.isEmpty)(null===(t=e.eql)||void 0===t?void 0:t.sequenceNumber))try{var n,i;const t=(null!==(n=null===(i=e.eql)||void 0===i?void 0:i.sequenceNumber)&&void 0!==n?n:"").split("-")[0];return parseInt(t,10)%2==0}catch{return!1}return!1},p=e=>{var t,n,i,r;return Object(a.isEmpty)(null===(t=e.kibana)||void 0===t||null===(n=t.alert)||void 0===n||null===(i=n.rule)||void 0===i?void 0:i.uuid)?Object(a.isEmpty)(null===(r=e.eql)||void 0===r?void 0:r.parentId)?"raw":"eql":"signal"},b="note-content"},363:function(e,t,n){"use strict";var a=n(345);n.d(t,"b",(function(){return a.b})),n.d(t,"a",(function(){return a.a}))},364:function(e,t,n){"use strict";n.d(t,"i",(function(){return i})),n.d(t,"c",(function(){return r})),n.d(t,"j",(function(){return l})),n.d(t,"d",(function(){return o})),n.d(t,"h",(function(){return s})),n.d(t,"e",(function(){return u})),n.d(t,"f",(function(){return c})),n.d(t,"o",(function(){return d})),n.d(t,"n",(function(){return m})),n.d(t,"k",(function(){return p})),n.d(t,"m",(function(){return b})),n.d(t,"l",(function(){return f})),n.d(t,"b",(function(){return g})),n.d(t,"a",(function(){return y})),n.d(t,"g",(function(){return h}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.locationTitle",{defaultMessage:"Location"}),r=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.autonomousSystemTitle",{defaultMessage:"Autonomous system"}),l=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.maxAnomalyScoreByJobTitle",{defaultMessage:"Max anomaly score by job"}),o=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.firstSeenTitle",{defaultMessage:"First seen"}),s=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.lastSeenTitle",{defaultMessage:"Last seen"}),u=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.hostIdTitle",{defaultMessage:"Host ID"}),c=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.hostNameTitle",{defaultMessage:"Host name"}),d=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.whoIsTitle",{defaultMessage:"WhoIs"}),m=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.viewWhoisTitle",{defaultMessage:"iana.org"}),p=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.ipReputationTitle",{defaultMessage:"Reputation"}),b=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.viewVirusTotalTitle.",{defaultMessage:"virustotal.com"}),f=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.viewTalosIntelligenceTitle",{defaultMessage:"talosIntelligence.com"}),g=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.asSourceDropDownOptionLabel",{defaultMessage:"As Source"}),y=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.asDestinationDropDownOptionLabel",{defaultMessage:"As Destination"}),h=a.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.inspectTitle",{defaultMessage:"IP overview"})},365:function(e,t,n){"use strict";n.d(t,"c",(function(){return m})),n.d(t,"a",(function(){return c})),n.d(t,"b",(function(){return d}));var a,i=n(2),r=n(64),l=(a=function(e,t){return a=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])},a(e,t)},function(e,t){function n(){this.constructor=e}a(e,t),e.prototype=null===t?Object.create(t):(n.prototype=t.prototype,new n)}),o="html",s="svg",u=function(e,t){var n,a,i,r={};if(e===o)i=document.createElement("div");else{if(e!==s)throw new Error('Invalid element type "'+e+'" for createPortalNode: must be "html" or "svg".');i=document.createElementNS("http://www.w3.org/2000/svg","g")}if(t&&"object"==typeof t)for(var l=0,u=Object.entries(t.attributes);l<u.length;l++){var c=u[l],d=c[0],m=c[1];i.setAttribute(d,m)}var p={element:i,elementType:e,setPortalProps:function(e){r=e},getInitialPortalProps:function(){return r},mount:function(t,i){if(i!==a){if(p.unmount(),t!==n&&!function(e,t){if(t===o)return e instanceof HTMLElement;if(t===s)return e instanceof SVGElement;throw new Error('Unrecognized element type "'+t+'" for validateElementType.')}(t,e))throw new Error('Invalid element type for portal: "'+e+'" portalNodes must be used with '+e+" elements, but OutPortal is within <"+t.tagName+">.");t.replaceChild(p.element,i),n=t,a=i}},unmount:function(e){e&&e!==a||n&&a&&(n.replaceChild(a,p.element),n=void 0,a=void 0)}};return p},c=function(e){function t(t){var n=e.call(this,t)||this;return n.addPropsChannel=function(){Object.assign(n.props.node,{setPortalProps:function(e){n.setState({nodeProps:e})}})},n.state={nodeProps:n.props.node.getInitialPortalProps()},n}return l(t,e),t.prototype.componentDidMount=function(){this.addPropsChannel()},t.prototype.componentDidUpdate=function(){this.addPropsChannel()},t.prototype.render=function(){var e=this,t=this.props,n=t.children,a=t.node;return r.createPortal(i.Children.map(n,(function(t){return i.isValidElement(t)?i.cloneElement(t,e.state.nodeProps):t})),a.element)},t}(i.PureComponent),d=function(e){function t(t){var n=e.call(this,t)||this;return n.placeholderNode=i.createRef(),n.passPropsThroughPortal(),n}return l(t,e),t.prototype.passPropsThroughPortal=function(){var e=Object.assign({},this.props,{node:void 0});this.props.node.setPortalProps(e)},t.prototype.componentDidMount=function(){var e=this.props.node;this.currentPortalNode=e;var t=this.placeholderNode.current,n=t.parentNode;e.mount(n,t),this.passPropsThroughPortal()},t.prototype.componentDidUpdate=function(){var e=this.props.node;this.currentPortalNode&&e!==this.currentPortalNode&&(this.currentPortalNode.unmount(this.placeholderNode.current),this.currentPortalNode=e);var t=this.placeholderNode.current,n=t.parentNode;e.mount(n,t),this.passPropsThroughPortal()},t.prototype.componentWillUnmount=function(){this.props.node.unmount(this.placeholderNode.current)},t.prototype.render=function(){return i.createElement("div",{ref:this.placeholderNode})},t}(i.PureComponent),m=u.bind(null,o);u.bind(null,s)},375:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"d",(function(){return r})),n.d(t,"b",(function(){return l})),n.d(t,"a",(function(){return o}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.containers.detectionEngine.alerts.errorGetAlertDescription",{defaultMessage:"Failed to get signal index name"}),r=a.i18n.translate("xpack.securitySolution.containers.detectionEngine.alerts.errorPostAlertDescription",{defaultMessage:"Failed to create signal index"}),l=a.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.failedToIsolate.title",{defaultMessage:"Failed to isolate host"}),o=a.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.casesFromAlerts.title",{defaultMessage:"Failed to find associated cases"})},378:function(e,t,n){"use strict";n.d(t,"c",(function(){return E})),n.d(t,"b",(function(){return O})),n.d(t,"a",(function(){return S}));var a=n(62),i=n.n(a),r=n(40),l=n(42),o=n(2),s=n.n(o),u=n(103),c=n(130),d=n.n(c),m=n(707),p=n(4),b=n(111),f=n(102),g=n(182),y=n(114),h=n(187);const v=s.a.memo((({duration:e,end:t,fromStr:n,id:a,isLoading:i,kqlQuery:u,policy:c,queries:d,setDuration:m,showUpdateButton:b=!0,start:g,startAutoReload:y,stopAutoReload:h,timelineId:v,toStr:O,updateReduxTime:S,disabled:x,width:j="restricted",compressed:k=!1})=>{const[T,C]=Object(o.useState)([]),w=Object(o.useCallback)((({start:e,end:n})=>{const i=e.includes("now")||n.includes("now"),{kqlHaveBeenUpdated:r}=S({end:n,id:a,isInvalid:!1,isQuickSelection:i,kql:u,start:e,timelineId:v}),l=E(e),o=i?E(n,{roundUp:!0}):E(n);!d||r||i&&(g!==l||t!==o)||M(d)}),[t,a,u,d,g,v,S]),I=Object(o.useCallback)((({isPaused:t,refreshInterval:i})=>{const r=null!=n&&n.includes("now")||null!=O&&O.includes("now");e!==i&&m({id:a,duration:i}),t&&"interval"===c?h({id:a}):t||"manual"!==c||y({id:a}),d&&!t&&(!r||r&&"now"!==O)&&M(d)}),[n,O,e,c,m,a,h,y,d]),M=e=>{e.forEach((e=>e.refetch&&e.refetch()))},A=Object(o.useCallback)((({start:e,end:t,isInvalid:n})=>{const i=e.includes("now")||t.includes("now");if(!n){S({end:t,id:a,isInvalid:n,isQuickSelection:i,kql:u,start:e,timelineId:v});const r=[{start:e,end:t},...Object(l.take)(9,T.filter((n=>!(n.start===e&&n.end===t))))];C(r)}}),[S,a,u,v,T]),N=null!=O?O:new Date(t).toISOString(),F=null!=n?n:new Date(g).toISOString(),[D]=Object(f.p)(p.V),R=Object(l.isEmpty)(D)?[]:D.map((({from:e,to:t,display:n})=>({start:e,end:t,label:n})));return s.a.createElement(r.EuiSuperDatePicker,{commonlyUsedRanges:R,end:N,isLoading:i,isPaused:"manual"===c,onRefresh:w,onRefreshChange:I,onTimeChange:A,recentlyUsedRanges:T,refreshInterval:e,showUpdateButton:b,start:F,isDisabled:x,width:j,compressed:k})}),((e,t)=>e.duration===t.duration&&e.end===t.end&&e.fromStr===t.fromStr&&e.id===t.id&&e.isLoading===t.isLoading&&e.policy===t.policy&&e.setDuration===t.setDuration&&e.start===t.start&&e.startAutoReload===t.startAutoReload&&e.stopAutoReload===t.stopAutoReload&&e.timelineId===t.timelineId&&e.disabled===t.disabled&&e.toStr===t.toStr&&e.updateReduxTime===t.updateReduxTime&&d()(e.kqlQuery,t.kqlQuery)&&d()(e.queries,t.queries))),E=(e,t)=>{const n=i.a.parse(e,t);return null!=n&&n.isValid()?n.toISOString():""},O=e=>({end:t,id:n,isQuickSelection:a,kql:i,start:r,timelineId:l})=>{const o=E(r);let s=E(t,{roundUp:!0});var u;return a?e(t===r?g.c.setAbsoluteRangeDatePicker({id:n,fromStr:r,toStr:t,from:o,to:s}):g.c.setRelativeRangeDatePicker({id:n,fromStr:r,toStr:t,from:o,to:s})):(s=E(t),e(g.c.setAbsoluteRangeDatePicker({id:n,from:E(r),to:E(t)}))),null!=l&&e(b.a.updateRange({id:l,start:o,end:s})),i&&i.refetch?{kqlHaveBeenUpdated:null!==(u=i.refetch(e))&&void 0!==u&&u}:{kqlHaveBeenUpdated:!1}};v.displayName="SuperDatePickerComponent";const S=Object(u.connect)((()=>{const e=Object(h.a)(),t=Object(h.b)(),n=Object(h.c)(),a=Object(h.d)(),i=Object(h.e)(),r=Object(h.f)(),o=Object(h.g)(),s=Object(h.h)(),u=Object(h.i)(),c=Object(h.j)();return(d,{id:p})=>{const b=Object(l.getOr)({},`inputs.${p}`,d);return{duration:e(b),end:t(b),fromStr:n(b),kind:i(b),policy:o(b),start:u(b),toStr:c(b),isLoading:!1,...Object(m.c)(b)&&(p===y.a.timeline||p===y.a.global)&&{isLoading:a(b),kqlQuery:r(b),queries:s(d,p)}}}}),(e=>({startAutoReload:({id:t})=>e(g.c.startAutoReload({id:t})),stopAutoReload:({id:t})=>e(g.c.stopAutoReload({id:t})),setDuration:({id:t,duration:n})=>e(g.c.setDuration({id:t,duration:n})),updateReduxTime:O(e)})))(v)},379:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(42),i=n(2),r=n.n(i),l=n(150),o=n(950);const s=r.a.memo((({dataProvider:e})=>{var t;const[n,s]=Object(i.useState)(!1);return r.a.createElement(o.a,{deleteProvider:a.noop,field:e.queryMatch.displayField||e.queryMatch.field,kqlQuery:e.kqlQuery,isEnabled:e.enabled,isExcluded:e.excluded,providerId:e.id,isPopoverOpen:n,setIsPopoverOpen:s,toggleExcludedProvider:a.noop,toggleEnabledProvider:a.noop,toggleTypeProvider:a.noop,displayValue:String(null!==(t=e.queryMatch.displayValue)&&void 0!==t?t:e.queryMatch.value),val:e.queryMatch.value,operator:e.queryMatch.operator||l.d,type:e.type||l.a.default})}));s.displayName="Provider"},383:function(e,t,n){"use strict";n.d(t,"b",(function(){return O})),n.d(t,"a",(function(){return S.a}));var a=n(104),i=n.n(a),r=n(2),l=n.n(r),o=n(42),s=n(40),u=n(496),c=n.n(u),d=n(44),m=n(654);const p=({disableLinks:e,href:t,target:n,children:a,...i})=>l.a.createElement(s.EuiToolTip,{content:t},l.a.createElement(s.EuiLink,{href:e?void 0:t,"data-test-subj":"markdown-link",rel:"nofollow",target:"_blank"},a)),b=Object(r.memo)(p);var f=n(102),g=n(17),y=n(5);const h=y.i18n.translate("xpack.securitySolution.markdown.platinumWarning",{defaultMessage:"The following markdown may make use of subscription features"}),v=y.i18n.translate("xpack.securitySolution.markdown.invalid",{defaultMessage:"Invalid markdown detected"}),E=({children:e,disableLinks:t,textSize:n="m"})=>{const a=Object(r.useMemo)((()=>e=>l.a.createElement(b,i()({},e,{disableLinks:t}))),[t]),u=Object(o.cloneDeep)(m.c);u[1][1].components.a=a;const p=Object(g.b)().isAtLeast("platinum"),{application:y}=Object(f.j)().services,E=Object(r.useMemo)((()=>{if(!1===p){const t=String(e);return m.b.some((e=>new RegExp(e).test(t)))}return!1}),[e,p]),O=Object(r.useMemo)((()=>c()().use(m.a).use(u)),[u]),S=Object(r.useMemo)((()=>{try{return O.processSync(e),null}catch(e){return String(e.message)}}),[e,O]);return l.a.createElement(l.a.Fragment,null,E&&l.a.createElement(l.a.Fragment,null,l.a.createElement(s.EuiCallOut,{title:h,color:"primary",iconType:"lock"},l.a.createElement(d.FormattedMessage,{id:"xpack.securitySolution.markdown.premiumPluginLinkPrefix",defaultMessage:"To use these interactive markdown features, you must {link}.",values:{link:l.a.createElement(s.EuiLink,{href:y.getUrlForApp("management",{path:"stack/license_management/home"})},l.a.createElement(d.FormattedMessage,{id:"xpack.securitySolution.markdown.premiumPluginLinkSuffix",defaultMessage:"start a trial or upgrade your subscription"}))}})),l.a.createElement(s.EuiSpacer,{size:"s"})),null!==S&&l.a.createElement(l.a.Fragment,null,l.a.createElement(s.EuiCallOut,{title:v,color:"danger",iconType:"error"},S),l.a.createElement(s.EuiSpacer,{size:"s"})),l.a.createElement(s.EuiMarkdownFormat,{parsingPluginList:m.a,processingPluginList:u,textSize:n},e))};E.displayName="MarkdownRendererComponent";const O=Object(r.memo)(E);var S=n(452);n(481)},388:function(e,t,n){t.set=t.assoc=t.assocPath=n(972),t.setWith=n(1030)},389:function(e,t,n){"use strict";n.d(t,"g",(function(){return i})),n.d(t,"c",(function(){return r})),n.d(t,"d",(function(){return l})),n.d(t,"e",(function(){return o})),n.d(t,"f",(function(){return s})),n.d(t,"b",(function(){return u})),n.d(t,"a",(function(){return c}));var a=n(5);const i=e=>a.i18n.translate("xpack.securitySolution.timeline.body.pinning.pinTooltip",{values:{isAlert:e},defaultMessage:"Pin {isAlert, select, true{alert} other{event}}"}),r=e=>a.i18n.translate("xpack.securitySolution.timeline.body.pinning.unpinTooltip",{values:{isAlert:e},defaultMessage:"Unpin {isAlert, select, true{alert} other{event}}"}),l=e=>a.i18n.translate("xpack.securitySolution.timeline.body.pinning.pinnnedWithNotesTooltip",{values:{isAlert:e},defaultMessage:"This {isAlert, select, true{alert} other{event}} cannot be unpinned because it has notes"}),o=a.i18n.translate("xpack.securitySolution.timeline.body.sort.sortedAscendingTooltip",{defaultMessage:"Sorted ascending"}),s=a.i18n.translate("xpack.securitySolution.timeline.body.sort.sortedDescendingTooltip",{defaultMessage:"Sorted descending"}),u=e=>a.i18n.translate("xpack.securitySolution.timeline.body.pinning.disablePinnnedTooltip",{values:{isAlert:e},defaultMessage:"This {isAlert, select, true{alert} other{event}} may not be pinned while editing a template timeline"}),c=({ariaRowindex:e,columnValues:t})=>a.i18n.translate("xpack.securitySolution.timeline.body.actions.attachAlertToCaseForRowAriaLabel",{values:{ariaRowindex:e,columnValues:t},defaultMessage:"Attach the alert or event in row {ariaRowindex} to a case, with columns {columnValues}"})},390:function(e,t,n){"use strict";n.d(t,"a",(function(){return E}));var a=n(40),i=n(2),r=n.n(i),l=n(41),o=n.n(l),s=n(114),u=n(407),c=n(454),d=n(561),m=n(642),p=n(643),b=n(644),f=n(230),g=n(211),y=n(110);const h=o.a.div.withConfig({displayName:"Wrapper",componentId:"sc-9cci34-0"})(["&.viz-actions{position:absolute;top:0;right:0;z-index:1;}&.histogram-viz-actions{padding:",";}"],(({theme:e})=>e.eui.euiSizeS)),v=({applyGlobalQueriesAndFilters:e=!0,className:t,extraActions:n,extraOptions:l,getLensAttributes:o,inputId:v=s.a.global,inspectIndex:E=0,isInspectButtonDisabled:O,isMultipleQuery:S,lensAttributes:x,onCloseInspect:j,queryId:k,timerange:T,title:C,scopeId:w=y.SourcererScopeName.default,stackByField:I,withDefaultActions:M=!0})=>{const{lens:A}=Object(u.b)().services,{canUseEditor:N,navigateToPrefilledEditor:F}=A,[D,R]=Object(i.useState)(!1),[P,L]=Object(i.useState)(!1),B=Object(i.useCallback)((()=>{R(!D)}),[D]),_=()=>{R(!1)},z=Object(m.a)({applyGlobalQueriesAndFilters:e,extraOptions:l,getLensAttributes:o,lensAttributes:x,scopeId:w,stackByField:I,title:""}),q=`stat-${k}`,{disabled:$,onAddToExistingCaseClicked:V}=Object(p.a)({onAddToCaseClicked:_,lensAttributes:z,timeRange:T}),{onAddToNewCaseClicked:H,disabled:U}=Object(b.a)({onClick:_,timeRange:T,lensAttributes:z}),Q=Object(i.useCallback)((()=>{_(),T&&z&&F({id:"",timeRange:T,attributes:z},{openInNewTab:!0})}),[z,F,T]),G=Object(i.useCallback)((()=>{_(),L(!0)}),[]),W=Object(i.useCallback)((()=>{L(!1),j&&j()}),[j]),{additionalRequests:K,additionalResponses:X,handleClick:Y,handleCloseModal:J,isButtonDisabled:Z,request:ee,response:te}=Object(d.a)({inputId:v,inspectIndex:E,isDisabled:O,multiple:S,onCloseInspect:W,onClick:G,queryId:k}),ne=Object(i.useMemo)((()=>!N()||null==z),[z,N]),ae=Object(i.useMemo)((()=>{var e;const t={};return[...(null!==(e=null==n?void 0:n.map((e=>r.a.createElement(a.EuiContextMenuItem,{icon:null==e?void 0:e.getIconType(t),key:e.id,onClick:()=>e.execute(t),"data-test-subj":`viz-actions-${e.id}`},e.getDisplayName(t)))))&&void 0!==e?e:[])||[],...M?[r.a.createElement(a.EuiContextMenuItem,{icon:"inspect",key:"visualizationActionsInspect",onClick:Y,disabled:Z,"data-test-subj":"viz-actions-inspect"},f.j),r.a.createElement(a.EuiContextMenuItem,{disabled:U,icon:"plusInCircle",key:"visualizationActionsAddToNewCase",onClick:H,"data-test-subj":"viz-actions-add-to-new-case"},f.c),r.a.createElement(a.EuiContextMenuItem,{disabled:$,"data-test-subj":"viz-actions-add-to-existing-case",icon:"plusInCircle",key:"visualizationActionsAddToExistingCase",onClick:V},f.b),r.a.createElement(a.EuiContextMenuItem,{icon:"visArea",key:"visualizationActionsOpenInLens","data-test-subj":"viz-actions-open-in-lens",disabled:ne,onClick:Q},f.l)]:[]]}),[Z,ne,n,Y,$,U,V,H,Q,M]),ie=Object(i.useMemo)((()=>r.a.createElement(a.EuiButtonIcon,{"aria-label":f.k,className:g.a,"data-test-subj":q,iconType:"boxesHorizontal",onClick:B})),[q,B]);return r.a.createElement(h,{className:t},ae.length>0&&r.a.createElement(a.EuiPopover,{button:ie,isOpen:D,closePopover:_,panelPaddingSize:"none",anchorPosition:"downLeft",panelClassName:"withHoverActions__popover","data-test-subj":"viz-actions-popover"},r.a.createElement(a.EuiContextMenuPanel,{"data-test-subj":"viz-actions-panel",size:"s",items:ae})),P&&null!==ee&&null!==te&&r.a.createElement(c.a,{additionalRequests:K,additionalResponses:X,closeModal:J,inputId:v,request:ee,response:te,title:C}))};v.displayName="VisualizationActionsComponent";const E=r.a.memo(v)},391:function(e,t,n){"use strict";n.d(t,"a",(function(){return s})),n.d(t,"b",(function(){return d}));var a=n(2),i=n(45),r=n(116),l=n(183),o=n(921);const s=({setQuery:e,response:t,request:n,refetch:i,uniqueQueryId:r,deleteQuery:l,loading:o,searchSessionId:s})=>{Object(a.useEffect)((()=>(null!=i&&null!=e&&e({id:r,inspect:{dsl:[n],response:[t]},loading:o,refetch:i,searchSessionId:s}),()=>{l&&l({id:r})})),[e,o,t,n,i,r,l,s])};function u(e){var t;const n=null==e?void 0:e.subType;return!(null==n||null===(t=n.nested)||void 0===t||!t.path)}function c(e,t){const n=[];for(const[a,i]of Object.entries(e))t?i.aggregatable&&Object(o.a)(i.type)&&!u(i)&&n.push({label:a,value:a}):!0===i.aggregatable&&n.push({label:a,value:a});return n}const d=e=>{const{pathname:t}=Object(i.useLocation)(),{browserFields:n}=Object(r.d)(Object(r.a)(t)),o=Object(a.useMemo)((()=>Object(l.a)(n)),[n]),[s,u]=Object(a.useState)((()=>c(o,e)));return Object(a.useEffect)((()=>{u(c(o,e))}),[o,e]),Object(a.useMemo)((()=>s),[s])}},402:function(e,t,n){"use strict";n.d(t,"a",(function(){return E})),n.d(t,"b",(function(){return S}));var a=n(40),i=n(2),r=n.n(i),l=n(41),o=n.n(l),s=n(155),u=n(383),c=n(639),d=n(5);const m=d.i18n.translate("xpack.securitySolution.alertDetails.summary.readMore",{defaultMessage:"Read More"}),p=d.i18n.translate("xpack.securitySolution.alertDetails.summary.readLess",{defaultMessage:"Read Less"}),b=o()(a.EuiButtonEmpty).withConfig({displayName:"ReadMore",componentId:"sc-1cdn95f-0"})(["span.euiButtonContent{padding:0;}"]),f=o.a.div.withConfig({displayName:"ExpandedContent",componentId:"sc-1cdn95f-1"})(["max-height:33vh;overflow-wrap:break-word;overflow-x:hidden;overflow-y:auto;"]),g=o.a.div.withConfig({displayName:"StyledLineClamp",componentId:"sc-1cdn95f-2"})(["display:-webkit-box;-webkit-line-clamp:",";-webkit-box-orient:vertical;overflow:hidden;max-height:","em;height:","em;"],3,(({lineClampHeight:e})=>e),(({lineClampHeight:e})=>e)),y=({children:e,lineClampHeight:t=5.5})=>{const[n,a]=Object(i.useState)(null),[l,o]=Object(c.a)(e),s=Object(i.useCallback)((()=>{a((e=>!e))}),[]);return n?r.a.createElement(r.a.Fragment,null,r.a.createElement(f,{"data-test-subj":"expanded-line-clamp"},r.a.createElement("p",null,e)),l&&r.a.createElement(b,{onClick:s,size:"s","data-test-subj":"summary-view-readmore"},p)):r.a.createElement(r.a.Fragment,null,null==l||!0===l?r.a.createElement(g,{"data-test-subj":"styled-line-clamp",ref:o,lineClampHeight:t},e):e,l&&r.a.createElement(b,{onClick:s,size:"s","data-test-subj":"summary-view-readmore"},m))},h=r.a.memo(y),v=o.a.div.withConfig({displayName:"Indent",componentId:"sc-1pv3muo-0"})(["padding:0 8px;word-break:break-word;"]),E=Object(i.createContext)({}),O=({basicData:e,ruleNote:t,showFullView:n=!1,showTitle:i=!0})=>r.a.createElement(E.Provider,{value:e},i&&r.a.createElement(r.a.Fragment,null,r.a.createElement(a.EuiSpacer,{size:"l"}),r.a.createElement(a.EuiTitle,{size:"xxxs","data-test-subj":"summary-view-guide"},r.a.createElement("h5",null,s.q)),r.a.createElement(a.EuiSpacer,{size:"s"})),r.a.createElement(v,null,n?r.a.createElement(a.EuiText,{size:"xs","data-test-subj":"investigation-guide-full-view"},r.a.createElement(u.b,null,t)):r.a.createElement(a.EuiText,{size:"xs","data-test-subj":"investigation-guide-clamped"},r.a.createElement(h,{lineClampHeight:4.5},r.a.createElement(u.b,null,t))))),S=r.a.memo(O)},403:function(e,t,n){"use strict";n.d(t,"a",(function(){return H}));var a=n(104),i=n.n(a),r=n(2),l=n.n(r),o=n(103),s=n(41),u=n.n(s),c=n(723),d=n(105),m=n(138),p=n(724),b=n(114),f=n(482),g=n(44),y=n(73),h=n(40),v=n(151),E=n(102),O=n(642),S=n(407),x=n(643),j=n(644),k=n(230),T=n(455);const C=({callback:e})=>({id:"openInLens",getDisplayName:e=>k.l,getIconType:e=>"visArea",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},order:1}),w=({callback:e,disabled:t})=>({id:"addToNewCase",getDisplayName:e=>k.c,getIconType:e=>"casesApp",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},disabled:t,order:3}),I=({callback:e,disabled:t})=>({id:"inspect",getDisplayName:e=>T.d,getIconType:e=>"inspect",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},disabled:t,order:4}),M=({callback:e,disabled:t})=>({id:"addToExistingCase",getDisplayName:e=>k.b,getIconType:e=>"casesApp",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},disabled:t,order:2});var A=n(122),N=n(454),F=n(211),D=n(110),R=n(390);const P=u.a.div.withConfig({displayName:"LensComponentWrapper",componentId:"sc-1ajgxgj-0"})(["height:",";width:",";"," .embPanel__header{z-index:2;position:absolute;right:0;}.expExpressionRenderer__expression{padding:2px 0 0 0 !important;}.legacyMtrVis__container{padding:0;}"],(({$height:e})=>e?`${e}px`:"auto"),(({width:e})=>null!=e?e:"auto"),(({$addHoverActionsPadding:e})=>e?".embPanel__header { top: -24px; }":"")),L={requests:void 0,responses:void 0,isLoading:!0},B=({applyGlobalQueriesAndFilters:e=!0,extraActions:t,extraOptions:n,getLensAttributes:a,height:i,id:s,inputsModelId:u=b.a.global,inspectTitle:c,lensAttributes:m,onLoad:p,scopeId:f=D.SourcererScopeName.default,stackByField:k,timerange:T,width:B,withActions:z=!0})=>{var q,$,V,H;const U=Object(r.useMemo)((()=>({height:null!=i?i:"100%",minWidth:"100px",width:null!=B?B:"100%"})),[i,B]),{lens:Q,data:{actions:{createFiltersFromValueClickAction:G}}}=Object(E.j)().services,W=Object(o.useDispatch)(),[K,X]=Object(r.useState)(!1),[Y,J]=Object(r.useState)(L),Z=A.d.globalQueryByIdSelector(),{searchSessionId:ee}=Object(d.a)((e=>Z(e,s))),te=Object(O.a)({applyGlobalQueriesAndFilters:e,extraOptions:n,getLensAttributes:a,lensAttributes:m,scopeId:f,stackByField:k,title:""}),ne=null==te||null===(q=te.state)||void 0===q||null===($=q.visualization)||void 0===$?void 0:$.preferredSeriesType,ae="lnsLegacyMetric"!==(null==te?void 0:te.visualizationType)&&"lnsPie"!==(null==te?void 0:te.visualizationType),ie=Q.EmbeddableComponent,re=Object(r.useMemo)((()=>({onInspectActionClicked:()=>{X(!0)},isDisabled:Y.isLoading})),[Y.isLoading]),le=(({attributes:e,extraActions:t,inspectActionProps:n,timeRange:a,withActions:i})=>{const{lens:l}=Object(S.b)().services,{navigateToPrefilledEditor:o}=l,[s,u]=Object(r.useState)(["inspect","addToNewCase","addToExistingCase","openInLens"]);Object(r.useEffect)((()=>{!1===i&&u([])}),[i]);const c=Object(r.useCallback)((()=>{a&&e&&o({id:"",timeRange:a,attributes:e},{openInNewTab:!0})}),[e,o,a]),{disabled:d,onAddToExistingCaseClicked:m}=Object(x.a)({lensAttributes:e,timeRange:a}),{onAddToNewCaseClicked:p,disabled:b}=Object(j.a)({timeRange:a,lensAttributes:e});return Object(r.useMemo)((()=>null==s?void 0:s.reduce(((e,t)=>"inspect"===t&&null!=n?[...e,I({callback:null==n?void 0:n.onInspectActionClicked,disabled:null==n?void 0:n.isDisabled})]:"addToExistingCase"===t?[...e,M({callback:m,disabled:d})]:"addToNewCase"===t?[...e,w({callback:p,disabled:b})]:"openInLens"===t?[...e,C({callback:c})]:e),[])),[s,n,m,d,p,b,c]).concat(null!=t?t:[])})({attributes:te,extraActions:t,inspectActionProps:re,timeRange:T,withActions:z}),oe=Object(r.useCallback)((()=>{X(!1)}),[]),se=Object(r.useCallback)((({range:e})=>{const[t,n]=e;W(Object(v.setAbsoluteRangeDatePicker)({id:u,from:new Date(t).toISOString(),to:new Date(n).toISOString()}))}),[W,u]),ue=Object(r.useMemo)((()=>{var e;const[t,...n]=null!==(e=Y.requests)&&void 0!==e?e:[];return{request:t,additionalRequests:n}}),[Y.requests]),ce=Object(r.useMemo)((()=>{var e;const[t,...n]=null!==(e=Y.responses)&&void 0!==e?e:[];return{response:t,additionalResponses:n}}),[Y.responses]),de=Object(r.useCallback)(((e,t)=>{var n;if(!t)return;const a=Object(F.f)(null==t||null===(n=t.requests)||void 0===n?void 0:n.getRequests());J({requests:a.requests,responses:a.responses,isLoading:e}),null!=p&&p({requests:a.requests,responses:a.responses,isLoading:e})}),[p]),me=Object(r.useCallback)((async e=>{if(!_(e)||"area"!==ne)return;const[{query:t}]=await G({data:e.data,negate:e.negate}),n=null==t?void 0:t.range["@timestamp"];null!=n&&n.gte&&null!=n&&n.lt&&se({range:[n.gte,n.lt]})}),[G,se,ne]),pe=Object(r.useMemo)((()=>{var e,t;return null!=(null==te||null===(e=te.state)||void 0===e?void 0:e.adHocDataViews)?Object.values(null==te||null===(t=te.state)||void 0===t?void 0:t.adHocDataViews).reduce(((e,t)=>(null!=(null==t?void 0:t.name)&&e.push(null==t?void 0:t.name),e)),[]):null}),[null==te||null===(V=te.state)||void 0===V?void 0:V.adHocDataViews]);return ee?!te||null!=(null==Y?void 0:Y.responses)&&0===(null==Y||null===(H=Y.responses)||void 0===H?void 0:H.length)?l.a.createElement(h.EuiFlexGroup,null,l.a.createElement(h.EuiFlexItem,{grow:1},l.a.createElement(h.EuiEmptyPrompt,{body:l.a.createElement(h.EuiText,{size:"xs"},l.a.createElement(g.FormattedMessage,{id:"xpack.securitySolution.lensEmbeddable.NoDataToDisplay.title",defaultMessage:"No data to display"}))})),l.a.createElement(h.EuiFlexItem,{grow:!1},l.a.createElement(R.a,{extraActions:t,getLensAttributes:a,inputId:u,isInspectButtonDisabled:!0,lensAttributes:te,queryId:s,stackByField:k,timerange:T,title:c,withDefaultActions:!1}))):l.a.createElement(l.a.Fragment,null,te&&ee&&l.a.createElement(P,{$height:i,width:B,$addHoverActionsPadding:ae},l.a.createElement(ie,{id:s,style:U,timeRange:T,attributes:te,onLoad:de,onBrushEnd:se,onFilter:me,viewMode:y.ViewMode.VIEW,withDefaultActions:!1,extraActions:le,searchSessionId:ee,showInspector:!1,syncTooltips:!1,syncCursor:!1})),K&&null!=ue.request&&null!=ce.response&&l.a.createElement(N.a,{adHocDataViews:pe,additionalRequests:ue.additionalRequests,additionalResponses:ce.additionalResponses,closeModal:oe,"data-test-subj":"inspect-modal",inputId:u,request:ue.request,response:ce.response,title:c})):null},_=e=>Array.isArray(e.data)&&"column"in e.data[0],z=l.a.memo(B);var q=n(116),$=n(413);const V=e=>{var t,n;const a=Object(o.useDispatch)(),{inputId:u=b.a.global,id:g,isDonut:y,label:h,donutTextWrapperClassName:v,onLoad:E,...O}=e,{session:S,refetchByRestartingSession:x,refetchByDeletingSession:j}=Object(f.a)({inputId:u,queryId:g}),{indicesExist:k}=Object(q.d)(O.scopeId),T=Object(r.useRef)(O.timerange),C=m.d.globalQueryByIdSelector(),{searchSessionId:w}=Object(d.a)((e=>C(e,g))),I=Object($.a)({visualizationId:g}),M=null!=I&&0!==(null===(t=I[0])||void 0===t||null===(n=t.hits)||void 0===n?void 0:n.total),A=M?Object(s.css)(["top:40%;right:12%;"]):Object(s.css)(["top:66%;right:12%;"]),N=Object(r.useCallback)((({requests:e,responses:t,isLoading:n})=>{a(m.b.setQuery({inputId:u,id:g,searchSessionId:S.current.start(),refetch:x,loading:n,inspect:{dsl:e,response:t}})),"function"==typeof E&&E({requests:e,responses:t,isLoading:n})}),[a,u,g,S,x,E]);return Object(r.useEffect)((()=>{var e,t;(!k&&(null===(e=T.current)||void 0===e?void 0:e.from)!==O.timerange.from||(null===(t=T.current)||void 0===t?void 0:t.to)!==O.timerange.to)&&(T.current=O.timerange,a(m.b.deleteOneQuery({inputId:u,id:g})))}),[a,g,k,u,O.timerange]),Object(r.useEffect)((()=>{w||setTimeout((()=>{a(m.b.setQuery({inputId:u,id:g,searchSessionId:S.current.start(),refetch:M?x:j,loading:!1,inspect:null}))}),200)}),[a,u,g,S,M,x,w,j]),Object(r.useEffect)((()=>()=>{a(m.b.deleteOneQuery({inputId:u,id:g}))}),[a,g,u]),(O.getLensAttributes||O.lensAttributes)&&O.timerange?y?l.a.createElement(p.b,{isChartEmbeddablesEnabled:!0,dataExists:M,label:h,title:M?l.a.createElement(c.a,{count:null===(F=I[0])||void 0===F||null===(D=F.hits)||void 0===D?void 0:D.total}):null,donutTextWrapperClassName:v,donutTextWrapperStyles:A},l.a.createElement(z,i()({},O,{id:g,onLoad:N}))):l.a.createElement(z,i()({},O,{id:g,onLoad:N})):null;var F,D},H=l.a.memo(V)},411:function(e,t,n){"use strict";n.d(t,"b",(function(){return l})),n.d(t,"a",(function(){return o}));var a=n(263),i=n(668),r=n(195);const l=e=>`${Object(r.a)(e)}`,o=(e,t,n,l=i.a.flows)=>`/ip/${e}/${t||a.a.source}/${l}${Object(r.a)(n)}`},412:function(e,t,n){"use strict";n.d(t,"a",(function(){return g})),n.d(t,"c",(function(){return y})),n.d(t,"b",(function(){return h})),n.d(t,"d",(function(){return E}));var a=n(40),i=n(2),r=n.n(i),l=n(41),o=n.n(l),s=n(103),u=n(106),c=n(111),d=n(105),m=n(248),p=n(242),b=n(133);o()(a.EuiBadge).withConfig({displayName:"NotesCountBadge",componentId:"sc-v4xtfs-0"})(["margin-left:5px;"]).displayName="NotesCountBadge";const f=({timelineId:e})=>{const t=Object(s.useDispatch)(),n=Object(i.useMemo)((()=>c.b.getTimelineByIdSelector()),[]),l=Object(d.b)((t=>{var a;return(null!==(a=n(t,e))&&void 0!==a?a:b.b).isFavorite})),o=Object(d.b)((t=>{var a;return(null!==(a=n(t,e))&&void 0!==a?a:b.b).status}))===u.k.immutable,p=Object(i.useCallback)((()=>t(c.a.updateIsFavorite({id:e,isFavorite:!l}))),[t,e,l]);return r.a.createElement(a.EuiButton,{isSelected:l,fill:l,iconType:l?"starFilled":"starEmpty",onClick:p,"data-test-subj":`timeline-favorite-${l?"filled":"empty"}-star`,disabled:o},l?m.j:m.b)};f.displayName="AddToFavoritesButtonComponent";const g=r.a.memo(f),y=r.a.memo((({closeGearMenu:e,outline:t=!1,timelineId:n,title:a=m.h})=>{const{getButton:i}=Object(p.b)({timelineId:n,timelineType:u.l.default,closeGearMenu:e});return i({outline:t,title:a})}));y.displayName="NewTimeline";const h="notes-button",v=r.a.memo((({ariaLabel:e=m.i,isDisabled:t,toggleShowNotes:n,timelineType:i})=>{const l=i===u.l.template;return r.a.createElement(a.EuiButtonIcon,{"aria-label":e,className:h,"data-test-subj":"timeline-notes-button-small",disabled:t,iconType:"editorComment",onClick:n,size:"s",isDisabled:l})}));v.displayName="SmallNotesButton";const E=r.a.memo((({ariaLabel:e,isDisabled:t,showNotes:n,timelineType:i,toggleShowNotes:l,toolTip:o})=>n?r.a.createElement(v,{ariaLabel:e,isDisabled:t,toggleShowNotes:l,timelineType:i}):r.a.createElement(a.EuiToolTip,{content:o||"","data-test-subj":"timeline-notes-tool-tip"},r.a.createElement(v,{ariaLabel:e,isDisabled:t,toggleShowNotes:l,timelineType:i}))));E.displayName="NotesButton"},413:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(2),i=n(211),r=n(105),l=n(122);const o=({visualizationId:e})=>{const t=l.d.globalQueryByIdSelector(),{inspect:n}=Object(r.a)((n=>t(n,e)));return Object(a.useMemo)((()=>n?Object(i.g)(null==n?void 0:n.response):null),[n])}},424:function(e,t,n){"use strict";n.d(t,"a",(function(){return S}));var a=n(40),i=n(287),r=n(2),l=n.n(r),o=n(41),s=n.n(o),u=n(55),c=n.n(u),d=n(4),m=n(121),p=n(102),b=n(327),f=n(228);const g=s()(a.EuiFlexItem).withConfig({displayName:"CountFlexItem",componentId:"sc-1yje3m6-0"})(["",""],(({theme:e})=>`margin-right: ${e.eui.euiSizeS};`)),y=l.a.memo((({value:e})=>Object(f.a)(e)?l.a.createElement(l.a.Fragment,null,e):l.a.createElement("em",{"data-test-subj":"value-wrapper-empty"},b.c)));y.displayName="ValueWrapper";const h=({legendItem:e})=>{const[t]=Object(p.p)(d.O),{color:n,count:i,dataProviderId:r,field:o,scopeId:s,value:u}=e;return l.a.createElement(a.EuiText,{size:"xs"},l.a.createElement(a.EuiFlexGroup,{alignItems:"center",gutterSize:"none",responsive:!1},null!=n&&l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiHealth,{"data-test-subj":"legend-color",color:n})),l.a.createElement(a.EuiFlexItem,{grow:!0},l.a.createElement(a.EuiFlexGroup,{alignItems:"center",justifyContent:"spaceBetween",gutterSize:"none",responsive:!1},l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(m.b,{"data-test-subj":`legend-item-${r}`,field:o,hideTopN:!0,id:r,isDraggable:!1,scopeId:s,value:u},null==e.render?l.a.createElement(y,{value:u}):e.render({field:o,value:u}))),null!=i&&l.a.createElement(g,{"data-test-subj":"legendItemCount",grow:!1},c()(i).format(t))))))};h.displayName="DraggableLegendItemComponent";const v=l.a.memo(h),E=s.a.div.withConfig({displayName:"DraggableLegendContainer",componentId:"sc-94chus-0"})(["height:",";overflow:auto;scrollbar-width:thin;width:100%;@media only screen and (min-width:","){width:165px;}min-width:",";&::-webkit-scrollbar{height:",";width:",";}&::-webkit-scrollbar-thumb{background-clip:content-box;background-color:",";border:"," solid transparent;}&::-webkit-scrollbar-corner,&::-webkit-scrollbar-track{background-color:transparent;}"],(({height:e})=>`${e}px`),(({theme:e})=>e.eui.euiBreakpoints.m),(({$minWidth:e})=>`${e}px`),(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>Object(i.rgba)(e.eui.euiColorDarkShade,.5)),(({theme:e})=>e.eui.euiScrollBarCorner)),O=({className:e,height:t=0,legendItems:n,minWidth:i=165})=>0===n.length?null:l.a.createElement(E,{className:e,"data-test-subj":"draggable-legend",height:0===t?175:t,$minWidth:i},l.a.createElement(a.EuiText,{size:"xs"},l.a.createElement(a.EuiFlexGroup,{direction:"column",gutterSize:"none"},n.map((e=>l.a.createElement(a.EuiFlexItem,{key:e.dataProviderId,grow:!1},l.a.createElement(v,{legendItem:e}),l.a.createElement(a.EuiSpacer,{"data-test-subj":"draggable-legend-spacer",size:"s"})))))));O.displayName="DraggableLegendComponent";const S=l.a.memo(O)},435:function(e,t,n){var a=n(613),i=n(977),r=n(978),l=n(617),o=n(996),s=n(621),u=n(997),c=n(623),d=n(624),m=n(627),p=Math.max;e.exports=function(e,t,n,b,f,g,y,h){var v=2&t;if(!v&&"function"!=typeof e)throw new TypeError("Expected a function");var E=b?b.length:0;if(E||(t&=-97,b=f=void 0),y=void 0===y?y:p(m(y),0),h=void 0===h?h:m(h),E-=f?f.length:0,64&t){var O=b,S=f;b=f=void 0}var x=v?void 0:s(e),j=[e,t,n,b,f,O,S,g,y,h];if(x&&u(j,x),e=j[0],t=j[1],n=j[2],b=j[3],f=j[4],!(h=j[9]=void 0===j[9]?v?0:e.length:p(j[9]-E,0))&&24&t&&(t&=-25),t&&1!=t)k=8==t||16==t?r(e,t,h):32!=t&&33!=t||f.length?l.apply(void 0,j):o(e,t,n,b);else var k=i(e,t,n);return d((x?a:c)(k,j),e,t)}},436:function(e,t,n){e.exports=n(33)(3657)},437:function(e,t,n){e.exports=n(33)(360)},438:function(e,t,n){var a=n(436),i=n(439),r=4294967295;function l(e){this.__wrapped__=e,this.__actions__=[],this.__dir__=1,this.__filtered__=!1,this.__iteratees__=[],this.__takeCount__=r,this.__views__=[]}l.prototype=a(i.prototype),l.prototype.constructor=l,e.exports=l},439:function(e,t){e.exports=function(){}},440:function(e,t,n){e.exports=n(33)(282)},441:function(e,t,n){e.exports=n(33)(3647)},442:function(e,t,n){e.exports=n(33)(1609)},443:function(e,t){var n="__lodash_placeholder__";e.exports=function(e,t){for(var a=-1,i=e.length,r=0,l=[];++a<i;){var o=e[a];o!==t&&o!==n||(e[a]=n,l[r++]=a)}return l}},449:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"b",(function(){return r})),n.d(t,"a",(function(){return l}));var a=n(42);const i=e=>e.replace(/:/g,"-"),r=e=>e.replace(/-/g,":"),l=e=>Object(a.isUndefined)(e)?void 0:Object(a.castArray)(e)},450:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var a,i=(a=n(2))&&"object"==typeof a&&"default"in a?a:{default:a},r=e=>"checkbox"===e.type,l=e=>e instanceof Date,o=e=>null==e;const s=e=>"object"==typeof e;var u=e=>!o(e)&&!Array.isArray(e)&&s(e)&&!l(e),c=e=>u(e)&&e.target?r(e.target)?e.target.checked:e.target.value:e,d=(e,t)=>e.has((e=>e.substring(0,e.search(/\.\d+(\.|$)/))||e)(t)),m="undefined"!=typeof window&&void 0!==window.HTMLElement&&"undefined"!=typeof document;function p(e){let t;const n=Array.isArray(e);if(e instanceof Date)t=new Date(e);else if(e instanceof Set)t=new Set(e);else{if(m&&(e instanceof Blob||e instanceof FileList)||!n&&!u(e))return e;if(t=n?[]:{},n||(e=>{const t=e.constructor&&e.constructor.prototype;return u(t)&&t.hasOwnProperty("isPrototypeOf")})(e))for(const n in e)e.hasOwnProperty(n)&&(t[n]=p(e[n]));else t=e}return t}var b=e=>Array.isArray(e)?e.filter(Boolean):[],f=e=>void 0===e,g=(e,t,n)=>{if(!t||!u(e))return n;const a=b(t.split(/[,[\].]+?/)).reduce(((e,t)=>o(e)?e:e[t]),e);return f(a)||a===e?f(e[t])?n:e[t]:a};const y="blur",h="focusout",v="change",E="onChange",O="onSubmit",S="all",x="pattern",j="required",k=i.default.createContext(null),T=()=>i.default.useContext(k);var C=(e,t,n,a=!0)=>{const i={defaultValues:t._defaultValues};for(const r in e)Object.defineProperty(i,r,{get:()=>{const i=r;return t._proxyFormState[i]!==S&&(t._proxyFormState[i]=!a||S),n&&(n[i]=!0),e[i]}});return i},w=e=>u(e)&&!Object.keys(e).length,I=(e,t,n,a)=>{n(e);const{name:i,...r}=e;return w(r)||Object.keys(r).length>=Object.keys(t).length||Object.keys(r).find((e=>t[e]===(!a||S)))},M=e=>Array.isArray(e)?e:[e],A=(e,t,n)=>n&&t?e===t:!e||!t||e===t||M(e).some((e=>e&&(e.startsWith(t)||t.startsWith(e))));function N(e){const t=i.default.useRef(e);t.current=e,i.default.useEffect((()=>{const n=!e.disabled&&t.current.subject&&t.current.subject.subscribe({next:t.current.next});return()=>{n&&n.unsubscribe()}}),[e.disabled])}function F(e){const t=T(),{control:n=t.control,disabled:a,name:r,exact:l}=e||{},[o,s]=i.default.useState(n._formState),u=i.default.useRef(!0),c=i.default.useRef({isDirty:!1,isLoading:!1,dirtyFields:!1,touchedFields:!1,isValidating:!1,isValid:!1,errors:!1}),d=i.default.useRef(r);return d.current=r,N({disabled:a,next:e=>u.current&&A(d.current,e.name,l)&&I(e,c.current,n._updateFormState)&&s({...n._formState,...e}),subject:n._subjects.state}),i.default.useEffect((()=>(u.current=!0,c.current.isValid&&n._updateValid(!0),()=>{u.current=!1})),[n]),C(o,n,c.current,!1)}var D=e=>"string"==typeof e,R=(e,t,n,a,i)=>D(e)?(a&&t.watch.add(e),g(n,e,i)):Array.isArray(e)?e.map((e=>(a&&t.watch.add(e),g(n,e)))):(a&&(t.watchAll=!0),n);function P(e){const t=T(),{control:n=t.control,name:a,defaultValue:r,disabled:l,exact:o}=e||{},s=i.default.useRef(a);s.current=a,N({disabled:l,subject:n._subjects.values,next:e=>{A(s.current,e.name,o)&&c(p(R(s.current,n._names,e.values||n._formValues,!1,r)))}});const[u,c]=i.default.useState(n._getWatch(a,r));return i.default.useEffect((()=>n._removeUnmounted())),u}var L=e=>/^\w*$/.test(e),B=e=>b(e.replace(/["|']|\]/g,"").split(/\.|\[/));function _(e,t,n){let a=-1;const i=L(t)?[t]:B(t),r=i.length,l=r-1;for(;++a<r;){const t=i[a];let r=n;if(a!==l){const n=e[t];r=u(n)||Array.isArray(n)?n:isNaN(+i[a+1])?{}:[]}e[t]=r,e=e[t]}return e}function z(e){const t=T(),{name:n,control:a=t.control,shouldUnregister:r}=e,l=d(a._names.array,n),o=P({control:a,name:n,defaultValue:g(a._formValues,n,g(a._defaultValues,n,e.defaultValue)),exact:!0}),s=F({control:a,name:n}),u=i.default.useRef(a.register(n,{...e.rules,value:o}));return u.current=a.register(n,e.rules),i.default.useEffect((()=>{const e=a._options.shouldUnregister||r,t=(e,t)=>{const n=g(a._fields,e);n&&(n._f.mount=t)};if(t(n,!0),e){const e=p(g(a._options.defaultValues,n));_(a._defaultValues,n,e),f(g(a._formValues,n))&&_(a._formValues,n,e)}return()=>{(l?e&&!a._state.action:e)?a.unregister(n):t(n,!1)}}),[n,a,l,r]),{field:{name:n,value:o,onChange:i.default.useCallback((e=>u.current.onChange({target:{value:c(e),name:n},type:v})),[n]),onBlur:i.default.useCallback((()=>u.current.onBlur({target:{value:g(a._formValues,n),name:n},type:y})),[n,a]),ref:e=>{const t=g(a._fields,n);t&&e&&(t._f.ref={focus:()=>e.focus(),select:()=>e.select(),setCustomValidity:t=>e.setCustomValidity(t),reportValidity:()=>e.reportValidity()})}},formState:s,fieldState:Object.defineProperties({},{invalid:{enumerable:!0,get:()=>!!g(s.errors,n)},isDirty:{enumerable:!0,get:()=>!!g(s.dirtyFields,n)},isTouched:{enumerable:!0,get:()=>!!g(s.touchedFields,n)},error:{enumerable:!0,get:()=>g(s.errors,n)}})}}const q="post";var $=(e,t,n,a,i)=>t?{...n[e],types:{...n[e]&&n[e].types?n[e].types:{},[a]:i||!0}}:{};const V=(e,t,n)=>{for(const a of n||Object.keys(e)){const n=g(e,a);if(n){const{_f:e,...a}=n;if(e&&t(e.name)){if(e.ref.focus){e.ref.focus();break}if(e.refs&&e.refs[0].focus){e.refs[0].focus();break}}else u(a)&&V(a,t)}}};var H=()=>{const e="undefined"==typeof performance?Date.now():1e3*performance.now();return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,(t=>{const n=(16*Math.random()+e)%16|0;return("x"==t?n:3&n|8).toString(16)}))},U=(e,t,n={})=>n.shouldFocus||f(n.shouldFocus)?n.focusName||`${e}.${f(n.focusIndex)?t:n.focusIndex}.`:"",Q=e=>({isOnSubmit:!e||e===O,isOnBlur:"onBlur"===e,isOnChange:e===E,isOnAll:e===S,isOnTouch:"onTouched"===e}),G=(e,t,n)=>!n&&(t.watchAll||t.watch.has(e)||[...t.watch].some((t=>e.startsWith(t)&&/^\.\w+/.test(e.slice(t.length))))),W=(e,t,n)=>{const a=b(g(e,n));return _(a,"root",t[n]),_(e,n,a),e},K=e=>"boolean"==typeof e,X=e=>"file"===e.type,Y=e=>"function"==typeof e,J=e=>{if(!m)return!1;const t=e?e.ownerDocument:0;return e instanceof(t&&t.defaultView?t.defaultView.HTMLElement:HTMLElement)},Z=e=>D(e),ee=e=>"radio"===e.type,te=e=>e instanceof RegExp;const ne={value:!1,isValid:!1},ae={value:!0,isValid:!0};var ie=e=>{if(Array.isArray(e)){if(e.length>1){const t=e.filter((e=>e&&e.checked&&!e.disabled)).map((e=>e.value));return{value:t,isValid:!!t.length}}return e[0].checked&&!e[0].disabled?e[0].attributes&&!f(e[0].attributes.value)?f(e[0].value)||""===e[0].value?ae:{value:e[0].value,isValid:!0}:ae:ne}return ne};const re={isValid:!1,value:null};var le=e=>Array.isArray(e)?e.reduce(((e,t)=>t&&t.checked&&!t.disabled?{isValid:!0,value:t.value}:e),re):re;function oe(e,t,n="validate"){if(Z(e)||Array.isArray(e)&&e.every(Z)||K(e)&&!e)return{type:n,message:Z(e)?e:"",ref:t}}var se=e=>u(e)&&!te(e)?e:{value:e,message:""},ue=async(e,t,n,a,i)=>{const{ref:l,refs:s,required:c,maxLength:d,minLength:m,min:p,max:b,pattern:y,validate:h,name:v,valueAsNumber:E,mount:O,disabled:S}=e._f,k=g(t,v);if(!O||S)return{};const T=s?s[0]:l,C=e=>{a&&T.reportValidity&&(T.setCustomValidity(K(e)?"":e||""),T.reportValidity())},I={},M=ee(l),A=r(l),N=M||A,F=(E||X(l))&&f(l.value)&&f(k)||J(l)&&""===l.value||""===k||Array.isArray(k)&&!k.length,R=$.bind(null,v,n,I),P=(e,t,n,a="maxLength",i="minLength")=>{const r=e?t:n;I[v]={type:e?a:i,message:r,ref:l,...R(e?a:i,r)}};if(i?!Array.isArray(k)||!k.length:c&&(!N&&(F||o(k))||K(k)&&!k||A&&!ie(s).isValid||M&&!le(s).isValid)){const{value:e,message:t}=Z(c)?{value:!!c,message:c}:se(c);if(e&&(I[v]={type:j,message:t,ref:T,...R(j,t)},!n))return C(t),I}if(!(F||o(p)&&o(b))){let e,t;const a=se(b),i=se(p);if(o(k)||isNaN(k)){const n=l.valueAsDate||new Date(k),r=e=>new Date((new Date).toDateString()+" "+e),o="time"==l.type,s="week"==l.type;D(a.value)&&k&&(e=o?r(k)>r(a.value):s?k>a.value:n>new Date(a.value)),D(i.value)&&k&&(t=o?r(k)<r(i.value):s?k<i.value:n<new Date(i.value))}else{const n=l.valueAsNumber||(k?+k:k);o(a.value)||(e=n>a.value),o(i.value)||(t=n<i.value)}if((e||t)&&(P(!!e,a.message,i.message,"max","min"),!n))return C(I[v].message),I}if((d||m)&&!F&&(D(k)||i&&Array.isArray(k))){const e=se(d),t=se(m),a=!o(e.value)&&k.length>+e.value,i=!o(t.value)&&k.length<+t.value;if((a||i)&&(P(a,e.message,t.message),!n))return C(I[v].message),I}if(y&&!F&&D(k)){const{value:e,message:t}=se(y);if(te(e)&&!k.match(e)&&(I[v]={type:x,message:t,ref:l,...R(x,t)},!n))return C(t),I}if(h)if(Y(h)){const e=oe(await h(k,t),T);if(e&&(I[v]={...e,...R("validate",e.message)},!n))return C(e.message),I}else if(u(h)){let e={};for(const a in h){if(!w(e)&&!n)break;const i=oe(await h[a](k,t),T,a);i&&(e={...i,...R(a,i.message)},C(i.message),n&&(I[v]=e))}if(!w(e)&&(I[v]={ref:T,...e},!n))return I}return C(!0),I};function ce(e,t){return[...e,...M(t)]}var de=e=>Array.isArray(e)?e.map((()=>{})):void 0;function me(e,t,n){return[...e.slice(0,t),...M(n),...e.slice(t)]}var pe=(e,t,n)=>Array.isArray(e)?(f(e[n])&&(e[n]=void 0),e.splice(n,0,e.splice(t,1)[0]),e):[];function be(e,t){return[...M(t),...M(e)]}var fe=(e,t)=>f(t)?[]:function(e,t){let n=0;const a=[...e];for(const e of t)a.splice(e-n,1),n++;return b(a).length?a:[]}(e,M(t).sort(((e,t)=>e-t))),ge=(e,t,n)=>{e[t]=[e[n],e[n]=e[t]][0]};function ye(e,t){const n=Array.isArray(t)?t:L(t)?[t]:B(t),a=1===n.length?e:function(e,t){const n=t.slice(0,-1).length;let a=0;for(;a<n;)e=f(e)?a++:e[t[a++]];return e}(e,n),i=n.length-1,r=n[i];return a&&delete a[r],0!==i&&(u(a)&&w(a)||Array.isArray(a)&&function(e){for(const t in e)if(e.hasOwnProperty(t)&&!f(e[t]))return!1;return!0}(a))&&ye(e,n.slice(0,-1)),e}var he=(e,t,n)=>(e[t]=n,e);function ve(){let e=[];return{get observers(){return e},next:t=>{for(const n of e)n.next&&n.next(t)},subscribe:t=>(e.push(t),{unsubscribe:()=>{e=e.filter((e=>e!==t))}}),unsubscribe:()=>{e=[]}}}var Ee=e=>o(e)||!s(e);function Oe(e,t){if(Ee(e)||Ee(t))return e===t;if(l(e)&&l(t))return e.getTime()===t.getTime();const n=Object.keys(e),a=Object.keys(t);if(n.length!==a.length)return!1;for(const i of n){const n=e[i];if(!a.includes(i))return!1;if("ref"!==i){const e=t[i];if(l(n)&&l(e)||u(n)&&u(e)||Array.isArray(n)&&Array.isArray(e)?!Oe(n,e):n!==e)return!1}}return!0}var Se=e=>"select-multiple"===e.type,xe=e=>J(e)&&e.isConnected,je=e=>{for(const t in e)if(Y(e[t]))return!0;return!1};function ke(e,t={}){const n=Array.isArray(e);if(u(e)||n)for(const n in e)Array.isArray(e[n])||u(e[n])&&!je(e[n])?(t[n]=Array.isArray(e[n])?[]:{},ke(e[n],t[n])):o(e[n])||(t[n]=!0);return t}function Te(e,t,n){const a=Array.isArray(e);if(u(e)||a)for(const a in e)Array.isArray(e[a])||u(e[a])&&!je(e[a])?f(t)||Ee(n[a])?n[a]=Array.isArray(e[a])?ke(e[a],[]):{...ke(e[a])}:Te(e[a],o(t)?{}:t[a],n[a]):n[a]=!Oe(e[a],t[a]);return n}var Ce=(e,t)=>Te(e,t,ke(t)),we=(e,{valueAsNumber:t,valueAsDate:n,setValueAs:a})=>f(e)?e:t?""===e?NaN:e?+e:e:n&&D(e)?new Date(e):a?a(e):e;function Ie(e){const t=e.ref;if(!(e.refs?e.refs.every((e=>e.disabled)):t.disabled))return X(t)?t.files:ee(t)?le(e.refs).value:Se(t)?[...t.selectedOptions].map((({value:e})=>e)):r(t)?ie(e.refs).value:we(f(t.value)?e.ref.value:t.value,e)}var Me=e=>f(e)?e:te(e)?e.source:u(e)?te(e.value)?e.value.source:e.value:e;function Ae(e,t,n){const a=g(e,n);if(a||L(n))return{error:a,name:n};const i=n.split(".");for(;i.length;){const a=i.join("."),r=g(t,a),l=g(e,a);if(r&&!Array.isArray(r)&&n!==a)return{name:n};if(l&&l.type)return{name:a,error:l};i.pop()}return{name:n}}const Ne={mode:O,reValidateMode:E,shouldFocusError:!0};function Fe(e={},t){let n,a={...Ne,...e},i={submitCount:0,isDirty:!1,isLoading:Y(a.defaultValues),isValidating:!1,isSubmitted:!1,isSubmitting:!1,isSubmitSuccessful:!1,isValid:!1,touchedFields:{},dirtyFields:{},errors:{}},s={},v=(u(a.defaultValues)||u(a.values))&&p(a.defaultValues||a.values)||{},E=a.shouldUnregister?{}:p(v),O={action:!1,mount:!1,watch:!1},x={mount:new Set,unMount:new Set,array:new Set,watch:new Set},j=0;const k={isDirty:!1,dirtyFields:!1,touchedFields:!1,isValidating:!1,isValid:!1,errors:!1},T={values:ve(),array:ve(),state:ve()},C=e.resetOptions&&e.resetOptions.keepDirtyValues,I=Q(a.mode),A=Q(a.reValidateMode),N=a.criteriaMode===S,F=async e=>{if(k.isValid||e){const e=a.resolver?w((await q()).errors):await $(s,!0);e!==i.isValid&&T.state.next({isValid:e})}},P=e=>k.isValidating&&T.state.next({isValidating:e}),L=(e,t,n,a)=>{const i=g(s,e);if(i){const r=g(E,e,f(n)?g(v,e):n);f(r)||a&&a.defaultChecked||t?_(E,e,t?r:Ie(i._f)):Z(e,r),O.mount&&F()}},B=(e,t,n,a,r)=>{let l=!1,o=!1;const s={name:e};if(!n||a){k.isDirty&&(o=i.isDirty,i.isDirty=s.isDirty=H(),l=o!==s.isDirty);const n=Oe(g(v,e),t);o=g(i.dirtyFields,e),n?ye(i.dirtyFields,e):_(i.dirtyFields,e,!0),s.dirtyFields=i.dirtyFields,l=l||k.dirtyFields&&o!==!n}if(n){const t=g(i.touchedFields,e);t||(_(i.touchedFields,e,n),s.touchedFields=i.touchedFields,l=l||k.touchedFields&&t!==n)}return l&&r&&T.state.next(s),l?s:{}},z=(t,a,r,l)=>{const o=g(i.errors,t),s=k.isValid&&K(a)&&i.isValid!==a;var u;if(e.delayError&&r?(u=()=>((e,t)=>{_(i.errors,e,t),T.state.next({errors:i.errors})})(t,r),n=e=>{clearTimeout(j),j=setTimeout(u,e)},n(e.delayError)):(clearTimeout(j),n=null,r?_(i.errors,t,r):ye(i.errors,t)),(r?!Oe(o,r):o)||!w(l)||s){const e={...l,...s&&K(a)?{isValid:a}:{},errors:i.errors,name:t};i={...i,...e},T.state.next(e)}P(!1)},q=async e=>a.resolver(E,a.context,((e,t,n,a)=>{const i={};for(const n of e){const e=g(t,n);e&&_(i,n,e._f)}return{criteriaMode:n,names:[...e],fields:i,shouldUseNativeValidation:a}})(e||x.mount,s,a.criteriaMode,a.shouldUseNativeValidation)),$=async(e,t,n={valid:!0})=>{for(const r in e){const l=e[r];if(l){const{_f:e,...r}=l;if(e){const r=x.array.has(e.name),o=await ue(l,E,N,a.shouldUseNativeValidation&&!t,r);if(o[e.name]&&(n.valid=!1,t))break;!t&&(g(o,e.name)?r?W(i.errors,o,e.name):_(i.errors,e.name,o[e.name]):ye(i.errors,e.name))}r&&await $(r,t,n)}}return n.valid},H=(e,t)=>(e&&t&&_(E,e,t),!Oe(re(),v)),U=(e,t,n)=>R(e,x,{...O.mount?E:f(t)?v:D(e)?{[e]:t}:t},n,t),Z=(e,t,n={})=>{const a=g(s,e);let i=t;if(a){const n=a._f;n&&(!n.disabled&&_(E,e,we(t,n)),i=J(n.ref)&&o(t)?"":t,Se(n.ref)?[...n.ref.options].forEach((e=>e.selected=i.includes(e.value))):n.refs?r(n.ref)?n.refs.length>1?n.refs.forEach((e=>(!e.defaultChecked||!e.disabled)&&(e.checked=Array.isArray(i)?!!i.find((t=>t===e.value)):i===e.value))):n.refs[0]&&(n.refs[0].checked=!!i):n.refs.forEach((e=>e.checked=e.value===i)):X(n.ref)?n.ref.value="":(n.ref.value=i,n.ref.type||T.values.next({name:e,values:{...E}})))}(n.shouldDirty||n.shouldTouch)&&B(e,i,n.shouldTouch,n.shouldDirty,!0),n.shouldValidate&&ie(e)},te=(e,t,n)=>{for(const a in t){const i=t[a],r=`${e}.${a}`,o=g(s,r);!x.array.has(e)&&Ee(i)&&(!o||o._f)||l(i)?Z(r,i,n):te(r,i,n)}},ne=(e,n,a={})=>{const r=g(s,e),l=x.array.has(e),u=p(n);_(E,e,u),l?(T.array.next({name:e,values:{...E}}),(k.isDirty||k.dirtyFields)&&a.shouldDirty&&T.state.next({name:e,dirtyFields:Ce(v,E),isDirty:H(e,u)})):!r||r._f||o(u)?Z(e,u,a):te(e,u,a),G(e,x)&&T.state.next({...i}),T.values.next({name:e,values:{...E}}),!O.mount&&t()},ae=async e=>{const t=e.target;let r=t.name,l=!0;const o=g(s,r);if(o){let d,m;const p=t.type?Ie(o._f):c(e),b=e.type===y||e.type===h,f=!((u=o._f).mount&&(u.required||u.min||u.max||u.maxLength||u.minLength||u.pattern||u.validate)||a.resolver||g(i.errors,r)||o._f.deps)||((e,t,n,a,i)=>!i.isOnAll&&(!n&&i.isOnTouch?!(t||e):(n?a.isOnBlur:i.isOnBlur)?!e:!(n?a.isOnChange:i.isOnChange)||e))(b,g(i.touchedFields,r),i.isSubmitted,A,I),v=G(r,x,b);_(E,r,p),b?(o._f.onBlur&&o._f.onBlur(e),n&&n(0)):o._f.onChange&&o._f.onChange(e);const O=B(r,p,b,!1),S=!w(O)||v;if(!b&&T.values.next({name:r,type:e.type,values:{...E}}),f)return k.isValid&&F(),S&&T.state.next({name:r,...v?{}:O});if(!b&&v&&T.state.next({...i}),P(!0),a.resolver){const{errors:e}=await q([r]),t=Ae(i.errors,s,r),n=Ae(e,s,t.name||r);d=n.error,r=n.name,m=w(e)}else d=(await ue(o,E,N,a.shouldUseNativeValidation))[r],l=isNaN(p)||p===g(E,r,p),l&&(d?m=!1:k.isValid&&(m=await $(s,!0)));l&&(o._f.deps&&ie(o._f.deps),z(r,m,d,O))}var u},ie=async(e,t={})=>{let n,r;const l=M(e);if(P(!0),a.resolver){const t=await(async e=>{const{errors:t}=await q();if(e)for(const n of e){const e=g(t,n);e?_(i.errors,n,e):ye(i.errors,n)}else i.errors=t;return t})(f(e)?e:l);n=w(t),r=e?!l.some((e=>g(t,e))):n}else e?(r=(await Promise.all(l.map((async e=>{const t=g(s,e);return await $(t&&t._f?{[e]:t}:t)})))).every(Boolean),(r||i.isValid)&&F()):r=n=await $(s);return T.state.next({...!D(e)||k.isValid&&n!==i.isValid?{}:{name:e},...a.resolver||!e?{isValid:n}:{},errors:i.errors,isValidating:!1}),t.shouldFocus&&!r&&V(s,(e=>e&&g(i.errors,e)),e?l:x.mount),r},re=e=>{const t={...v,...O.mount?E:{}};return f(e)?t:D(e)?g(t,e):e.map((e=>g(t,e)))},le=(e,t)=>({invalid:!!g((t||i).errors,e),isDirty:!!g((t||i).dirtyFields,e),isTouched:!!g((t||i).touchedFields,e),error:g((t||i).errors,e)}),oe=(e,t,n)=>{const a=(g(s,e,{_f:{}})._f||{}).ref;_(i.errors,e,{...t,ref:a}),T.state.next({name:e,errors:i.errors,isValid:!1}),n&&n.shouldFocus&&a&&a.focus&&a.focus()},se=(e,t={})=>{for(const n of e?M(e):x.mount)x.mount.delete(n),x.array.delete(n),t.keepValue||(ye(s,n),ye(E,n)),!t.keepError&&ye(i.errors,n),!t.keepDirty&&ye(i.dirtyFields,n),!t.keepTouched&&ye(i.touchedFields,n),!a.shouldUnregister&&!t.keepDefaultValue&&ye(v,n);T.values.next({values:{...E}}),T.state.next({...i,...t.keepDirty?{isDirty:H()}:{}}),!t.keepIsValid&&F()},ce=(e,t={})=>{let n=g(s,e);const i=K(t.disabled);return _(s,e,{...n||{},_f:{...n&&n._f?n._f:{ref:{name:e}},name:e,mount:!0,...t}}),x.mount.add(e),n?i&&_(E,e,t.disabled?void 0:g(E,e,Ie(n._f))):L(e,!0,t.value),{...i?{disabled:t.disabled}:{},...a.progressive?{required:!!t.required,min:Me(t.min),max:Me(t.max),minLength:Me(t.minLength),maxLength:Me(t.maxLength),pattern:Me(t.pattern)}:{},name:e,onChange:ae,onBlur:ae,ref:i=>{if(i){ce(e,t),n=g(s,e);const a=f(i.value)&&i.querySelectorAll&&i.querySelectorAll("input,select,textarea")[0]||i,l=(e=>ee(e)||r(e))(a),o=n._f.refs||[];if(l?o.find((e=>e===a)):a===n._f.ref)return;_(s,e,{_f:{...n._f,...l?{refs:[...o.filter(xe),a,...Array.isArray(g(v,e))?[{}]:[]],ref:{type:a.type,name:e}}:{ref:a}}}),L(e,!1,void 0,a)}else n=g(s,e,{}),n._f&&(n._f.mount=!1),(a.shouldUnregister||t.shouldUnregister)&&(!d(x.array,e)||!O.action)&&x.unMount.add(e)}}},de=()=>a.shouldFocusError&&V(s,(e=>e&&g(i.errors,e)),x.mount),me=(e,t)=>async n=>{n&&(n.preventDefault&&n.preventDefault(),n.persist&&n.persist());let r=p(E);if(T.state.next({isSubmitting:!0}),a.resolver){const{errors:e,values:t}=await q();i.errors=e,r=t}else await $(s);ye(i.errors,"root"),w(i.errors)?(T.state.next({errors:{}}),await e(r,n)):(t&&await t({...i.errors},n),de(),setTimeout(de)),T.state.next({isSubmitted:!0,isSubmitting:!1,isSubmitSuccessful:w(i.errors),submitCount:i.submitCount+1,errors:i.errors})},pe=(n,a={})=>{const r=n||v,l=p(r),o=n&&!w(n)?l:v;if(a.keepDefaultValues||(v=r),!a.keepValues){if(a.keepDirtyValues||C)for(const e of x.mount)g(i.dirtyFields,e)?_(o,e,g(E,e)):ne(e,g(o,e));else{if(m&&f(n))for(const e of x.mount){const t=g(s,e);if(t&&t._f){const e=Array.isArray(t._f.refs)?t._f.refs[0]:t._f.ref;if(J(e)){const t=e.closest("form");if(t){t.reset();break}}}}s={}}E=e.shouldUnregister?a.keepDefaultValues?p(v):{}:p(o),T.array.next({values:{...o}}),T.values.next({values:{...o}})}x={mount:new Set,unMount:new Set,array:new Set,watch:new Set,watchAll:!1,focus:""},!O.mount&&t(),O.mount=!k.isValid||!!a.keepIsValid,O.watch=!!e.shouldUnregister,T.state.next({submitCount:a.keepSubmitCount?i.submitCount:0,isDirty:a.keepDirty?i.isDirty:!(!a.keepDefaultValues||Oe(n,v)),isSubmitted:!!a.keepIsSubmitted&&i.isSubmitted,dirtyFields:a.keepDirtyValues?i.dirtyFields:a.keepDefaultValues&&n?Ce(v,n):{},touchedFields:a.keepTouched?i.touchedFields:{},errors:a.keepErrors?i.errors:{},isSubmitting:!1,isSubmitSuccessful:!1})},be=(e,t)=>pe(Y(e)?e(E):e,t);return{control:{register:ce,unregister:se,getFieldState:le,handleSubmit:me,setError:oe,_executeSchema:q,_getWatch:U,_getDirty:H,_updateValid:F,_removeUnmounted:()=>{for(const e of x.unMount){const t=g(s,e);t&&(t._f.refs?t._f.refs.every((e=>!xe(e))):!xe(t._f.ref))&&se(e)}x.unMount=new Set},_updateFieldArray:(e,t=[],n,a,r=!0,l=!0)=>{if(a&&n){if(O.action=!0,l&&Array.isArray(g(s,e))){const t=n(g(s,e),a.argA,a.argB);r&&_(s,e,t)}if(l&&Array.isArray(g(i.errors,e))){const t=n(g(i.errors,e),a.argA,a.argB);r&&_(i.errors,e,t),((e,t)=>{!b(g(e,t)).length&&ye(e,t)})(i.errors,e)}if(k.touchedFields&&l&&Array.isArray(g(i.touchedFields,e))){const t=n(g(i.touchedFields,e),a.argA,a.argB);r&&_(i.touchedFields,e,t)}k.dirtyFields&&(i.dirtyFields=Ce(v,E)),T.state.next({name:e,isDirty:H(e,t),dirtyFields:i.dirtyFields,errors:i.errors,isValid:i.isValid})}else _(E,e,t)},_getFieldArray:t=>b(g(O.mount?E:v,t,e.shouldUnregister?g(v,t,[]):[])),_reset:pe,_resetDefaultValues:()=>Y(a.defaultValues)&&a.defaultValues().then((e=>{be(e,a.resetOptions),T.state.next({isLoading:!1})})),_updateFormState:e=>{i={...i,...e}},_subjects:T,_proxyFormState:k,get _fields(){return s},get _formValues(){return E},get _state(){return O},set _state(e){O=e},get _defaultValues(){return v},get _names(){return x},set _names(e){x=e},get _formState(){return i},set _formState(e){i=e},get _options(){return a},set _options(e){a={...a,...e}}},trigger:ie,register:ce,handleSubmit:me,watch:(e,t)=>Y(e)?T.values.subscribe({next:n=>e(U(void 0,t),n)}):U(e,t,!0),setValue:ne,getValues:re,reset:be,resetField:(e,t={})=>{g(s,e)&&(f(t.defaultValue)?ne(e,g(v,e)):(ne(e,t.defaultValue),_(v,e,t.defaultValue)),t.keepTouched||ye(i.touchedFields,e),t.keepDirty||(ye(i.dirtyFields,e),i.isDirty=t.defaultValue?H(e,g(v,e)):H()),t.keepError||(ye(i.errors,e),k.isValid&&F()),T.state.next({...i}))},clearErrors:e=>{e&&M(e).forEach((e=>ye(i.errors,e))),T.state.next({errors:e?i.errors:{}})},unregister:se,setError:oe,setFocus:(e,t={})=>{const n=g(s,e),a=n&&n._f;if(a){const e=a.refs?a.refs[0]:a.ref;e.focus&&(e.focus(),t.shouldSelect&&e.select())}},getFieldState:le}}t.Controller=e=>e.render(z(e)),t.Form=function(e){const t=T(),[n,a]=i.default.useState(!1),{control:r=t.control,onSubmit:l,children:o,action:s,method:u=q,headers:c,encType:d,onError:m,render:p,onSuccess:b,validateStatus:f,...y}=e,h=async t=>{let n=!1,a="";await r.handleSubmit((async e=>{const i=new FormData;let o="";try{o=JSON.stringify(e)}catch(e){}for(const t of r._names.mount)i.append(t,g(e,t));if(l&&l({data:e,event:t,method:u,formData:i,formDataJson:o}),s)try{const e=[c&&c["Content-Type"],d].some((e=>e&&e.includes("json"))),t=await fetch(s,{method:u,headers:{...c,...d?{"Content-Type":d}:{}},body:e?o:i});t&&(f?!f(t.status):t.status<200||t.status>=300)?(n=!0,m&&m({response:t}),a=String(t.status)):b&&b({response:t})}catch(e){n=!0,m&&m({error:e})}}))(t),n&&e.control&&(e.control._subjects.state.next({isSubmitSuccessful:!1}),e.control.setError("root.server",{type:a}))};return i.default.useEffect((()=>{a(!0)}),[]),p?i.default.createElement(i.default.Fragment,null,p({submit:h})):i.default.createElement("form",{noValidate:n,action:s,method:u,encType:d,onSubmit:h,...y},o)},t.FormProvider=e=>{const{children:t,...n}=e;return i.default.createElement(k.Provider,{value:n},t)},t.appendErrors=$,t.get=g,t.set=_,t.useController=z,t.useFieldArray=function(e){const t=T(),{control:n=t.control,name:a,keyName:r="id",shouldUnregister:l}=e,[o,s]=i.default.useState(n._getFieldArray(a)),u=i.default.useRef(n._getFieldArray(a).map(H)),c=i.default.useRef(o),d=i.default.useRef(a),m=i.default.useRef(!1);d.current=a,c.current=o,n._names.array.add(a),e.rules&&n.register(a,e.rules),N({next:({values:e,name:t})=>{if(t===d.current||!t){const t=g(e,d.current);Array.isArray(t)&&(s(t),u.current=t.map(H))}},subject:n._subjects.array});const b=i.default.useCallback((e=>{m.current=!0,n._updateFieldArray(a,e)}),[n,a]);return i.default.useEffect((()=>{if(n._state.action=!1,G(a,n._names)&&n._subjects.state.next({...n._formState}),m.current&&(!Q(n._options.mode).isOnSubmit||n._formState.isSubmitted))if(n._options.resolver)n._executeSchema([a]).then((e=>{const t=g(e.errors,a),i=g(n._formState.errors,a);(i?!t&&i.type||t&&(i.type!==t.type||i.message!==t.message):t&&t.type)&&(t?_(n._formState.errors,a,t):ye(n._formState.errors,a),n._subjects.state.next({errors:n._formState.errors}))}));else{const e=g(n._fields,a);e&&e._f&&ue(e,n._formValues,n._options.criteriaMode===S,n._options.shouldUseNativeValidation,!0).then((e=>!w(e)&&n._subjects.state.next({errors:W(n._formState.errors,e,a)})))}n._subjects.values.next({name:a,values:{...n._formValues}}),n._names.focus&&V(n._fields,(e=>!!e&&e.startsWith(n._names.focus||""))),n._names.focus="",n._updateValid()}),[o,a,n]),i.default.useEffect((()=>(!g(n._formValues,a)&&n._updateFieldArray(a),()=>{(n._options.shouldUnregister||l)&&n.unregister(a)})),[a,n,r,l]),{swap:i.default.useCallback(((e,t)=>{const i=n._getFieldArray(a);ge(i,e,t),ge(u.current,e,t),b(i),s(i),n._updateFieldArray(a,i,ge,{argA:e,argB:t},!1)}),[b,a,n]),move:i.default.useCallback(((e,t)=>{const i=n._getFieldArray(a);pe(i,e,t),pe(u.current,e,t),b(i),s(i),n._updateFieldArray(a,i,pe,{argA:e,argB:t},!1)}),[b,a,n]),prepend:i.default.useCallback(((e,t)=>{const i=M(p(e)),r=be(n._getFieldArray(a),i);n._names.focus=U(a,0,t),u.current=be(u.current,i.map(H)),b(r),s(r),n._updateFieldArray(a,r,be,{argA:de(e)})}),[b,a,n]),append:i.default.useCallback(((e,t)=>{const i=M(p(e)),r=ce(n._getFieldArray(a),i);n._names.focus=U(a,r.length-1,t),u.current=ce(u.current,i.map(H)),b(r),s(r),n._updateFieldArray(a,r,ce,{argA:de(e)})}),[b,a,n]),remove:i.default.useCallback((e=>{const t=fe(n._getFieldArray(a),e);u.current=fe(u.current,e),b(t),s(t),n._updateFieldArray(a,t,fe,{argA:e})}),[b,a,n]),insert:i.default.useCallback(((e,t,i)=>{const r=M(p(t)),l=me(n._getFieldArray(a),e,r);n._names.focus=U(a,e,i),u.current=me(u.current,e,r.map(H)),b(l),s(l),n._updateFieldArray(a,l,me,{argA:e,argB:de(t)})}),[b,a,n]),update:i.default.useCallback(((e,t)=>{const i=p(t),r=he(n._getFieldArray(a),e,i);u.current=[...r].map(((t,n)=>t&&n!==e?u.current[n]:H())),b(r),s([...r]),n._updateFieldArray(a,r,he,{argA:e,argB:i},!0,!1)}),[b,a,n]),replace:i.default.useCallback((e=>{const t=M(p(e));u.current=t.map(H),b([...t]),s([...t]),n._updateFieldArray(a,[...t],(e=>e),{},!0,!1)}),[b,a,n]),fields:i.default.useMemo((()=>o.map(((e,t)=>({...e,[r]:u.current[t]||H()})))),[o,r])}},t.useForm=function(e={}){const t=i.default.useRef(),[n,a]=i.default.useState({isDirty:!1,isValidating:!1,isLoading:Y(e.defaultValues),isSubmitted:!1,isSubmitting:!1,isSubmitSuccessful:!1,isValid:!1,submitCount:0,dirtyFields:{},touchedFields:{},errors:{},defaultValues:Y(e.defaultValues)?void 0:e.defaultValues});t.current||(t.current={...Fe(e,(()=>a((e=>({...e}))))),formState:n});const r=t.current.control;return r._options=e,N({subject:r._subjects.state,next:e=>{I(e,r._proxyFormState,r._updateFormState,!0)&&a({...r._formState})}}),i.default.useEffect((()=>{e.values&&!Oe(e.values,r._defaultValues)?r._reset(e.values,r._options.resetOptions):r._resetDefaultValues()}),[e.values,r]),i.default.useEffect((()=>{r._state.mount||(r._updateValid(),r._state.mount=!0),r._state.watch&&(r._state.watch=!1,r._subjects.state.next({...r._formState})),r._removeUnmounted()})),t.current.formState=C(n,r),t.current},t.useFormContext=T,t.useFormState=F,t.useWatch=P},451:function(e,t){const n=Object.freeze({loose:!0}),a=Object.freeze({});e.exports=e=>e?"object"!=typeof e?n:e:a},452:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),r=n(40),l=n(654),o=n(453);const s=Object(a.forwardRef)((({onChange:e,value:t,ariaLabel:n,editorId:s,dataTestSubj:u,height:c,autoFocusDisabled:d,setIsMarkdownInvalid:m},p)=>{const[b,f]=Object(a.useState)([]),g=Object(a.useCallback)(((e,{messages:t})=>{f(e?[e]:t),m(!!e)}),[m]),y=Object(a.useRef)(null);Object(a.useEffect)((()=>{var e,t;d||null===(e=y.current)||void 0===e||null===(t=e.textarea)||void 0===t||t.focus()}),[d]);const h=Object(o.b)("investigation_guide"),v=Object(a.useMemo)((()=>Object(l.d)({insightsUpsellingMessage:h})),[h]);return Object(a.useImperativeHandle)(p,(()=>{var e,t;if(!y.current)return null;const n=null===(e=y.current)||void 0===e||null===(t=e.textarea)||void 0===t?void 0:t.closest(".euiMarkdownEditor");return{...y.current,toolbar:null==n?void 0:n.querySelector(".euiMarkdownEditorToolbar")}})),i.a.createElement(r.EuiMarkdownEditor,{ref:y,"aria-label":n,editorId:s,onChange:e,value:t,uiPlugins:v,parsingPluginList:l.a,processingPluginList:l.c,onParse:g,errors:b,"data-test-subj":u,height:c})}));s.displayName="MarkdownEditorComponent";const u=Object(a.memo)(s)},453:function(e,t,n){"use strict";n.d(t,"a",(function(){return o})),n.d(t,"b",(function(){return s})),n.d(t,"c",(function(){return u}));var a=n(2),i=n(10),r=n.n(i),l=n(535);const o=e=>{const t=Object(l.b)(),n=r()(t.sections$,t.getSectionsValue());return Object(a.useMemo)((()=>{var t;return null!==(t=null==n?void 0:n.get(e))&&void 0!==t?t:null}),[e,n])},s=e=>{const t=Object(l.b)(),n=r()(t.messages$,t.getMessagesValue());return Object(a.useMemo)((()=>{var t;return null!==(t=null==n?void 0:n.get(e))&&void 0!==t?t:null}),[e,n])},u=e=>{const t=Object(l.b)(),n=Object(a.useMemo)((()=>t.getPageUpselling(e)),[e,t]);return null!=n?n:null}},454:function(e,t,n){"use strict";n.d(t,"a",(function(){return v}));var a=n(40),i=n(55),r=n.n(i),l=n(2),o=n.n(l),s=n(41),u=n.n(s),c=n(45),d=n(4),m=n(455),p=n(116),b=n(110);const f=u()(a.EuiDescriptionList).withConfig({displayName:"DescriptionListStyled",componentId:"sc-67qpo8-0"})(["@media only screen and (min-width:","){.euiDescriptionList__title{width:30% !important;}.euiDescriptionList__description{width:70% !important;}}"],(e=>e.theme.eui.euiBreakpoints.s));f.displayName="DescriptionListStyled";const g=u()(a.EuiModal).withConfig({displayName:"MyEuiModal",componentId:"sc-67qpo8-1"})(["width:min(768px,calc(100vw - 16px));min-height:41vh;.euiModal__flex{width:60vw;}.euiCodeBlock{height:auto !important;max-width:718px;}"]);g.displayName="MyEuiModal";const y=function(e){try{return e.map((e=>JSON.parse(e)))}catch{return[]}},h=(e=[])=>1===e.length&&e[0]===d.Sb?o.a.createElement("i",null,m.f):e.length>0?e.filter((e=>e!==d.Sb)).join(", "):m.k,v=({adHocDataViews:e,additionalRequests:t,additionalResponses:n,closeModal:i,inputId:s,request:u,response:d,title:v})=>{var E,O,S,x;const{pathname:j}=Object(c.useLocation)(),{selectedPatterns:k}=Object(p.d)("timeline"===s?b.SourcererScopeName.timeline:Object(p.a)(j)),T=[u,...null!=t?t:[]],C=[d,...null!=n?n:[]],w=y(T),I=y(C),M=Object(l.useMemo)((()=>{var e,t;return(null!==(e=null===(t=w[0])||void 0===t?void 0:t.index)&&void 0!==e?e:[]).every((e=>k.includes(e.trim())))}),[w,k]),A=[{title:o.a.createElement("span",{"data-test-subj":"index-pattern-title"},m.b," ",o.a.createElement(a.EuiIconTip,{color:"subdued",content:m.c,type:"iInCircle"})),description:o.a.createElement("span",{"data-test-subj":"index-pattern-description"},o.a.createElement("p",null,h(null!=e&&e.length>0?e:null!==(E=null===(O=w[0])||void 0===O?void 0:O.index)&&void 0!==E?E:[])),!M&&o.a.createElement("p",null,o.a.createElement("small",null,o.a.createElement("i",{"data-test-subj":"not-sourcerer-msg"},m.e))))},{title:o.a.createElement("span",{"data-test-subj":"query-time-title"},m.g," ",o.a.createElement(a.EuiIconTip,{color:"subdued",content:m.h,type:"iInCircle"})),description:o.a.createElement("span",{"data-test-subj":"query-time-description"},0===(null===(S=I[0])||void 0===S?void 0:S.took)?"0ms":null!==(x=I[0])&&void 0!==x&&x.took?`${r()(I[0].took).format("0,0")}ms`:m.k)},{title:o.a.createElement("span",{"data-test-subj":"request-timestamp-title"},m.i," ",o.a.createElement(a.EuiIconTip,{color:"subdued",content:m.j,type:"iInCircle"})),description:o.a.createElement("span",{"data-test-subj":"request-timestamp-description"},(new Date).toISOString())}],N=[{id:"statistics",name:"Statistics",content:o.a.createElement(o.a.Fragment,null,o.a.createElement(a.EuiSpacer,null),o.a.createElement(f,{listItems:A,type:"column"}))},{id:"request",name:"Request",content:w.length>0?w.map(((e,t)=>o.a.createElement(l.Fragment,{key:t},o.a.createElement(a.EuiSpacer,null),o.a.createElement(a.EuiCodeBlock,{language:"js",fontSize:"m",paddingSize:"m",color:"dark",overflowHeight:300,isCopyable:!0},(e=>{try{return JSON.stringify(e,null,2)}catch{return m.k}})(e.body))))):o.a.createElement(a.EuiCodeBlock,null,m.k)},{id:"response",name:"Response",content:I.length>0?C.map(((e,t)=>o.a.createElement(l.Fragment,{key:t},o.a.createElement(a.EuiSpacer,null),o.a.createElement(a.EuiCodeBlock,{language:"js",fontSize:"m",paddingSize:"m",color:"dark",overflowHeight:300,isCopyable:!0},e)))):o.a.createElement(a.EuiCodeBlock,null,m.k)}];return o.a.createElement(g,{onClose:i,"data-test-subj":"modal-inspect-euiModal"},o.a.createElement(a.EuiModalHeader,null,o.a.createElement(a.EuiModalHeaderTitle,null,m.d," ",v)),o.a.createElement(a.EuiModalBody,null,o.a.createElement(a.EuiTabbedContent,{tabs:N,initialSelectedTab:N[0],autoFocus:"selected"})),o.a.createElement(a.EuiModalFooter,null,o.a.createElement(a.EuiButton,{onClick:i,fill:!0,"data-test-subj":"modal-inspect-close"},m.a)))}},455:function(e,t,n){"use strict";n.d(t,"d",(function(){return i})),n.d(t,"a",(function(){return r})),n.d(t,"k",(function(){return l})),n.d(t,"b",(function(){return o})),n.d(t,"c",(function(){return s})),n.d(t,"e",(function(){return u})),n.d(t,"g",(function(){return c})),n.d(t,"h",(function(){return d})),n.d(t,"i",(function(){return m})),n.d(t,"j",(function(){return p})),n.d(t,"f",(function(){return b}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.inspectDescription",{defaultMessage:"Inspect"}),r=a.i18n.translate("xpack.securitySolution.inspect.modal.closeTitle",{defaultMessage:"Close"}),l=a.i18n.translate("xpack.securitySolution.inspect.modal.somethingWentWrongDescription",{defaultMessage:"Sorry about that, something went wrong."}),o=a.i18n.translate("xpack.securitySolution.inspect.modal.indexPatternLabel",{defaultMessage:"Index pattern"}),s=a.i18n.translate("xpack.securitySolution.inspect.modal.indexPatternDescription",{defaultMessage:"The index pattern that connected to the Elasticsearch indices. These indices can be configured in Kibana > Advanced Settings."}),u=a.i18n.translate("xpack.securitySolution.inspectPatternDifferent",{defaultMessage:"This element has a unique index pattern separate from the data view setting."}),c=a.i18n.translate("xpack.securitySolution.inspect.modal.queryTimeLabel",{defaultMessage:"Query time"}),d=a.i18n.translate("xpack.securitySolution.inspect.modal.queryTimeDescription",{defaultMessage:"The time it took to process the query. Does not include the time to send the request or parse it in the browser."}),m=a.i18n.translate("xpack.securitySolution.inspect.modal.reqTimestampLabel",{defaultMessage:"Request timestamp"}),p=a.i18n.translate("xpack.securitySolution.inspect.modal.reqTimestampDescription",{defaultMessage:"Time when the start of the request has been logged"}),b=a.i18n.translate("xpack.securitySolution.inspect.modal.noAlertIndexFound",{defaultMessage:"No alert index found"})},456:function(e,t,n){"use strict";n.d(t,"b",(function(){return o})),n.d(t,"a",(function(){return s})),n.d(t,"c",(function(){return c}));var a=n(57),i=n(42),r=n(293);const l=e=>e.toLocaleString(),o=({chartHeight:e,from:t,legendPosition:n,to:i,onBrushEnd:o,yTickFormatter:s,showLegend:u})=>({series:{xScaleType:a.ScaleType.Time,yScaleType:a.ScaleType.Linear,stackAccessors:["g"]},axis:{xTickFormatter:Object(r.a)([t,i]),yTickFormatter:null!=s?s:l,tickSize:8},settings:{legendPosition:null!=n?n:a.Position.Right,onBrushEnd:o,showLegend:null==u||u,showLegendExtra:!0,theme:{scales:{barsPadding:.08},chartMargins:{left:0,right:0,top:0,bottom:0},chartPaddings:{left:0,right:0,top:0,bottom:0}}},customHeight:null!=e?e:174}),s=["#1EA593","#2B70F7","#CE0060","#38007E","#FCA5D3","#F37020","#E49E29","#B0916F","#7B000B","#34130C","#GGGGGG"],u=([e,t])=>({key:e,value:t}),c=(e,t)=>{if(!e)return[];const n=Object(i.groupBy)("g",e),a=Object(i.toPairs)(n);return Object(i.map)(u,a).map(((e,n)=>{var a;const r=Object(i.get)(e.key,t);return{...e,color:null!==(a=null==r?void 0:r.color)&&void 0!==a?a:s[n]}}))}},457:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"c",(function(){return r})),n.d(t,"d",(function(){return l})),n.d(t,"f",(function(){return o})),n.d(t,"g",(function(){return s})),n.d(t,"h",(function(){return u})),n.d(t,"i",(function(){return c})),n.d(t,"j",(function(){return d})),n.d(t,"b",(function(){return m})),n.d(t,"k",(function(){return p})),n.d(t,"l",(function(){return b})),n.d(t,"m",(function(){return f})),n.d(t,"n",(function(){return g})),n.d(t,"o",(function(){return y})),n.d(t,"e",(function(){return h}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.dataQualityDashboard.addToCaseSuccessToast",{defaultMessage:"Successfully added data quality results to the case"}),r=(a.i18n.translate("xpack.securitySolution.dataQualityDashboard.betaBadge",{defaultMessage:"Beta"}),a.i18n.translate("xpack.securitySolution.overview.ilmPhaseCold",{defaultMessage:"cold"})),l=a.i18n.translate("xpack.securitySolution.dataQualityDashboard.pageTitle",{defaultMessage:"Data Quality"}),o=a.i18n.translate("xpack.securitySolution.dataQualityDashboard.elasticCommonSchemaReferenceLink",{defaultMessage:"Elastic Common Schema (ECS)"}),s=(a.i18n.translate("xpack.securitySolution.overview.eventsTitle",{defaultMessage:"Event count"}),a.i18n.translate("xpack.securitySolution.overview.ilmPhaseFrozen",{defaultMessage:"frozen"})),u=a.i18n.translate("xpack.securitySolution.overview.ilmPhaseHot",{defaultMessage:"hot"}),c=a.i18n.translate("xpack.securitySolution.overview.newsFeedSidebarTitle",{defaultMessage:"Security news"}),d=a.i18n.translate("xpack.securitySolution.overview.recentTimelinesSidebarTitle",{defaultMessage:"Recent timelines"}),m=a.i18n.translate("xpack.securitySolution.overview.signalCountTitle",{defaultMessage:"Alert trend"}),p=e=>a.i18n.translate("xpack.securitySolution.overview.topNLabel",{values:{fieldName:e},defaultMessage:"Top {fieldName}"}),b=a.i18n.translate("xpack.securitySolution.overview.ilmPhaseUnmanaged",{defaultMessage:"unmanaged"}),f=a.i18n.translate("xpack.securitySolution.overview.viewAlertsButtonLabel",{defaultMessage:"View alerts"}),g=a.i18n.translate("xpack.securitySolution.overview.viewEventsButtonLabel",{defaultMessage:"View events"}),y=a.i18n.translate("xpack.securitySolution.overview.ilmPhaseWarm",{defaultMessage:"warm"}),h=a.i18n.translate("xpack.securitySolution.detectionResponse.pageTitle",{defaultMessage:"Detection & Response"});a.i18n.translate("xpack.securitySolution.entityAnalytics.technicalPreviewLabel",{defaultMessage:"Technical Preview"})},476:function(e,t,n){"use strict";n.d(t,"a",(function(){return x})),n.d(t,"c",(function(){return j})),n.d(t,"d",(function(){return k})),n.d(t,"b",(function(){return C}));var a=n(40),i=n(220),r=n(2),l=n.n(r),o=n(104),s=n.n(o),u=n(103),c=n(105),d=n(122),m=n(182),p=n(138),b=n(114),f=n(110),g=n(118),y=n(106),h=n(135),v=n(242),E=n(12);const O=({asEmptyButton:e,children:t,dataProviders:n,filters:i,timeRange:o,keepDataView:O,...S})=>{const x=Object(u.useDispatch)(),j=Object(r.useMemo)((()=>d.e.getSourcererDataViewsSelector()),[]),{defaultDataView:k,signalIndexName:T}=Object(c.a)((e=>j(e))),C=n&&n.find((e=>"template"===e.type)),w=Object(v.a)({timelineId:g.c.active,timelineType:C?y.l.template:y.l.default}),I=Object(r.useCallback)((()=>{if(n||i){if(o?w({timeRange:o}):w(),n)switch(x(Object(E.updateDataView)({id:g.c.active,dataViewId:"security-solution-default",indexNames:["logs-*"]})),n[0].queryType){case"eql":x(Object(E.updateEqlOptions)({id:g.c.active,field:"query",value:n[0].kqlQuery})),x(Object(E.setActiveTabTimeline)({id:g.c.active,activeTab:g.d.eql}));break;case"kql":x(Object(E.applyKqlFilterQuery)({id:g.c.active,filterQuery:{kuery:{kind:"kuery",expression:n[0].kqlQuery},serializedQuery:n[0].kqlQuery}})),x(Object(E.setActiveTabTimeline)({id:g.c.active,activeTab:g.d.query}));break;case"dsl":const e={meta:{type:"custom",disabled:!1,negate:!1,alias:n[0].name,key:"query",value:n[0].kqlQuery},query:JSON.parse(n[0].kqlQuery)};x(Object(E.setFilters)({id:g.c.active,filters:[e]})),x(Object(E.setActiveTabTimeline)({id:g.c.active,activeTab:g.d.query}))}i&&x(Object(E.setFilters)({id:g.c.active,filters:i})),O||x(m.d.setSelectedDataView({id:f.SourcererScopeName.timeline,selectedDataViewId:k.id,selectedPatterns:[T||""]})),x(p.b.removeLinkTo([b.a.timeline,b.a.global]))}}),[n,w,x,k.id,T,i,o,O]);return e?l.a.createElement(a.EuiButtonEmpty,{"aria-label":h.h,onClick:I,color:"text",flush:"both",size:"xs"},t):l.a.createElement(a.EuiButton,s()({"aria-label":h.h,onClick:I},S),t)};O.displayName="SendToTimelineButton";var S=n(721);const x="securityAssistant",j=e=>e.map((e=>`Rule Name:${e.name}\nRule Description:${e.description}`)).join("\n\n"),k=e=>e.filter((({field:e})=>!e.startsWith("signal."))).reduce(((e,{field:t,values:n})=>({...e,[t]:null!=n?n:[]})),{}),T=["kql","dsl","eql"],C=e=>e.messages.map((({content:t})=>Object(i.i)((({messageContent:e,replacements:t})=>null!=t?Object.keys(t).reduce(((e,n)=>e.replaceAll(n,t[n])),e):e)({messageContent:t,replacements:e.replacements})))).map(((t,n)=>t.map(((t,i)=>{var r;return{...t,getControlContainer:()=>document.querySelectorAll(`.message-${n} .euiCodeBlock__controls`)[i],button:T.includes(t.type)?l.a.createElement(O,{asEmptyButton:!0,dataProviders:[{id:"assistant-data-provider",name:`Assistant Query from conversation ${e.id}`,enabled:!0,excluded:!1,queryType:t.type,kqlQuery:null!==(r=t.content)&&void 0!==r?r:"",queryMatch:{field:"host.name",operator:":",value:"test"},and:[]}],keepDataView:!0},l.a.createElement(a.EuiToolTip,{position:"right",content:S.f},l.a.createElement(a.EuiIcon,{type:"timeline"}))):null}}))))},480:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=function(){const e=this.Parser,t=e.prototype.blockTokenizers,n=e.prototype.blockMethods;t.osquery=function(e,t,n){if(!1===t.startsWith("!{osquery"))return!1;const a=t[9];if("{"!==a&&"}"!==a)return!1;if(n)return!0;let i="!{osquery",r={};if("{"===a){let n="",a=0;for(let e=9;e<t.length;e++){const i=t[e];if("{"===i)a++,n+=i;else if("}"===i){if(a--,-1===a)break;n+=i}else n+=i}i+=n;try{r=JSON.parse(n)}catch(t){const n=e.now();this.file.fail(`Unable to parse osquery JSON configuration: ${t}`,{line:n.line,column:n.column+9})}}return i+="}",e(i)({type:"osquery",configuration:r})},n.splice(n.indexOf("text"),0,"osquery")}},481:function(e,t,n){"use strict";n.d(t,"a",(function(){return d}));var a=n(2),i=n.n(a),r=n(41),l=n.n(r),o=n(40),s=n(125),u=n(452);const c=l()(o.EuiFlexGroup).withConfig({displayName:"BottomContentWrapper",componentId:"sc-1819ayg-0"})(["",""],(({theme:e})=>`\n    padding: ${e.eui.euiSizeM} 0;\n  `)),d=i.a.memo(Object(a.forwardRef)((({id:e,field:t,dataTestSubj:n,idAria:r,bottomRightContent:l},d)=>{const{isInvalid:m,errorMessage:p}=Object(s.i)(t),[b,f]=Object(a.useState)(!1);return i.a.createElement(o.EuiFormRow,{"data-test-subj":n,describedByIds:r?[r]:void 0,error:p,fullWidth:!0,helpText:t.helpText,isInvalid:m||b,label:t.label,labelAppend:t.labelAppend},i.a.createElement(i.a.Fragment,null,i.a.createElement(u.a,{ref:d,ariaLabel:r,editorId:e,onChange:t.setValue,value:t.value,"data-test-subj":`${n}-markdown-editor`,setIsMarkdownInvalid:f}),l&&i.a.createElement(c,{justifyContent:"flexEnd"},i.a.createElement(o.EuiFlexItem,{grow:!1},l))))})));d.displayName="MarkdownEditorForm"},482:function(e,t,n){"use strict";n.d(t,"a",(function(){return c}));var a=n(2),i=n(103),r=n(105),l=n(102),o=n(122),s=n(182),u=n(114);const c=({inputId:e,queryId:t,skip:n})=>{const c=Object(i.useDispatch)(),{data:d}=Object(l.j)().services,m=Object(a.useRef)(d.search.session),p=o.d.globalQueryByIdSelector(),b=o.d.timelineQueryByIdSelector(),{selectedInspectIndex:f}=Object(r.a)((n=>e===u.a.global?p(n,t):b(n,t))),g=Object(a.useCallback)((()=>{const e=m.current.start();c(s.c.setInspectionParameter({id:t,selectedInspectIndex:f,isInspected:!1,inputId:u.a.global,searchSessionId:n?void 0:e}))}),[c,t,f,n]),y=Object(a.useCallback)((()=>{c(s.c.deleteOneQuery({inputId:u.a.global,id:t}))}),[c,t]);return{session:m,refetchByRestartingSession:g,refetchByDeletingSession:y}}},483:function(e,t,n){"use strict";n.d(t,"d",(function(){return i})),n.d(t,"a",(function(){return r})),n.d(t,"e",(function(){return l})),n.d(t,"c",(function(){return o})),n.d(t,"b",(function(){return s}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.stackByLabel",{defaultMessage:"Stack by"}),r=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.groupByLabel",{defaultMessage:"Group by"}),l=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.stackByPlaceholder",{defaultMessage:"Select a field to stack by"}),o=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.stackByAriaLabel",{defaultMessage:"Stack the alerts histogram by a field value"}),s=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.groupByTopLabel",{defaultMessage:"Group by top"})},484:function(e,t,n){"use strict";n.d(t,"e",(function(){return i})),n.d(t,"f",(function(){return r})),n.d(t,"g",(function(){return l})),n.d(t,"h",(function(){return o})),n.d(t,"i",(function(){return s})),n.d(t,"j",(function(){return u})),n.d(t,"k",(function(){return c})),n.d(t,"c",(function(){return d})),n.d(t,"d",(function(){return m})),n.d(t,"n",(function(){return p})),n.d(t,"m",(function(){return b})),n.d(t,"o",(function(){return f})),n.d(t,"p",(function(){return g})),n.d(t,"q",(function(){return y})),n.d(t,"t",(function(){return h})),n.d(t,"s",(function(){return v})),n.d(t,"u",(function(){return E})),n.d(t,"w",(function(){return O})),n.d(t,"a",(function(){return S})),n.d(t,"b",(function(){return x})),n.d(t,"v",(function(){return j})),n.d(t,"r",(function(){return k})),n.d(t,"l",(function(){return T}));var a=n(5);a.i18n.translate("xpack.securitySolution.dataProviders.and",{defaultMessage:"AND"});const i=a.i18n.translate("xpack.securitySolution.dataProviders.deleteDataProvider",{defaultMessage:"Delete"}),r=a.i18n.translate("xpack.securitySolution.dataProviders.dropAnything",{defaultMessage:"Drop anything"}),l=(a.i18n.translate("xpack.securitySolution.dataProviders.edit",{defaultMessage:"Edit"}),a.i18n.translate("xpack.securitySolution.dataProviders.editMenuItem",{defaultMessage:"Edit filter"})),o=a.i18n.translate("xpack.securitySolution.dataProviders.editTitle",{defaultMessage:"EDIT FILTER"}),s=a.i18n.translate("xpack.securitySolution.dataProviders.excludeDataProvider",{defaultMessage:"Exclude results"}),u=a.i18n.translate("xpack.securitySolution.dataProviders.existsLabel",{defaultMessage:"exists"}),c=(a.i18n.translate("xpack.securitySolution.dataProviders.fieldLabel",{defaultMessage:"Field"}),a.i18n.translate("xpack.securitySolution.dataProviders.filterForFieldPresentLabel",{defaultMessage:"Filter for field present"})),d=a.i18n.translate("xpack.securitySolution.dataProviders.convertToFieldLabel",{defaultMessage:"Convert to field"}),m=a.i18n.translate("xpack.securitySolution.dataProviders.convertToTemplateFieldLabel",{defaultMessage:"Convert to template field"}),p=a.i18n.translate("xpack.securitySolution.dataProviders.highlighted",{defaultMessage:"highlighted"}),b=a.i18n.translate("xpack.securitySolution.dataProviders.hereToBuildAn",{defaultMessage:"here to build an"}),f=a.i18n.translate("xpack.securitySolution.dataProviders.includeDataProvider",{defaultMessage:"Include results"}),g=a.i18n.translate("xpack.securitySolution.dataProviders.not",{defaultMessage:"NOT"}),y=(a.i18n.translate("xpack.securitySolution.dataProviders.or",{defaultMessage:"or"}),a.i18n.translate("xpack.securitySolution.dataProviders.query",{defaultMessage:"query"})),h=(a.i18n.translate("xpack.securitySolution.dataProviders.toggle",{defaultMessage:"toggle"}),a.i18n.translate("xpack.securitySolution.dataProviders.reEnableDataProvider",{defaultMessage:"Re-enable"})),v=a.i18n.translate("xpack.securitySolution.dataProviders.removeDataProvider",{defaultMessage:"Remove Data Provider"}),E=({field:e,value:t})=>a.i18n.translate("xpack.securitySolution.dataProviders.showOptionsDataProviderAriaLabel",{values:{field:e,value:t},defaultMessage:"{field} {value} Press enter for options, or press space to begin dragging"}),O=a.i18n.translate("xpack.securitySolution.dataProviders.temporaryDisableDataProvider",{defaultMessage:"Temporarily disable"}),S=(a.i18n.translate("xpack.securitySolution.dataProviders.valuePlaceholder",{defaultMessage:"value"}),a.i18n.translate("xpack.securitySolution.dataProviders.addFieldPopoverButtonLabel",{defaultMessage:"Add field"})),x=a.i18n.translate("xpack.securitySolution.dataProviders.addTemplateFieldPopoverButtonLabel",{defaultMessage:"Add template field"}),j=a.i18n.translate("xpack.securitySolution.dataProviders.templateFieldLabel",{defaultMessage:"Template field"}),k=a.i18n.translate("xpack.securitySolution.dataProviders.queryAreaAriaLabel",{defaultMessage:"You are in the timeline query area, which contains groups of data providers that query for events"}),T=e=>a.i18n.translate("xpack.securitySolution.dataProviders.groupAreaAriaLabel",{values:{group:e},defaultMessage:"You are in group {group}"})},495:function(e,t,n){"use strict";n.d(t,"a",(function(){return l}));var a=n(2),i=n(13),r=n(102);const l=()=>{const e=Object(r.j)(),{http:t}=e.services,[n,l]=Object(a.useState)(Object(i.createSavedQueryService)(t));return Object(a.useEffect)((()=>{l(Object(i.createSavedQueryService)(t))}),[t]),n}},496:function(e,t,n){e.exports=n(33)(1061)},497:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=n(5).i18n.translate("xpack.securitySolution.exitFullScreenButton",{defaultMessage:"Exit full screen"})},511:function(e,t,n){"use strict";n.d(t,"a",(function(){return g}));var a=n(2),i=n.n(a),r=n(41),l=n.n(r),o=n(40),s=n(46),u=n(102),c=n(44);const d=({handleClick:e})=>i.a.createElement(o.EuiFlexGroup,{justifyContent:"flexEnd"},i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(o.EuiButtonEmpty,{onClick:e,"data-test-subj":"osquery-empty-button"},i.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.footer.cancel",defaultMessage:"Cancel"})))),m=i.a.memo(d);var p=n(677);const b=l.a.div.withConfig({displayName:"OsqueryActionWrapper",componentId:"sc-flf6q3-0"})(["padding:8px;"]),f=({agentId:e,defaultValues:t,onClose:n,ecsData:r})=>{const{services:{osquery:l}}=Object(u.j)(),c=Object(s.useQueryClient)(),d=Object(a.useCallback)((()=>{var e;c.invalidateQueries({queryKey:["actions",{alertId:null==t||null===(e=t.alertIds)||void 0===e?void 0:e[0]}]})}),[null==t?void 0:t.alertIds,c]);return null!=l&&l.OsqueryAction?i.a.createElement(o.EuiFlyout,{size:"m",onClose:n},i.a.createElement(o.EuiFlyoutHeader,{hasBorder:!0,"data-test-subj":"flyout-header-osquery"},i.a.createElement(o.EuiTitle,null,i.a.createElement("h2",null,p.a))),i.a.createElement(o.EuiFlyoutBody,null,i.a.createElement(b,{"data-test-subj":"flyout-body-osquery"},i.a.createElement(l.OsqueryAction,{agentId:e,formType:"steps",defaultValues:t,ecsData:r,onSuccess:d}))),i.a.createElement(o.EuiFlyoutFooter,null,i.a.createElement(m,{handleClick:n,"data-test-subj":"flyout-footer-osquery"}))):null},g=i.a.memo(f)},519:function(e,t,n){"use strict";n.d(t,"d",(function(){return s})),n.d(t,"b",(function(){return u})),n.d(t,"c",(function(){return c})),n.d(t,"a",(function(){return d}));var a=n(2),i=n.n(a),r=n(365);const l=Object(r.c)(),o=Object(r.c)(),s=()=>{const[e]=Object(a.useState)(l);return{portalNode:e}},u=i.a.memo((()=>{const{portalNode:e}=s();return i.a.createElement(r.b,{node:e})}));u.displayName="TimelineEventsCountBadge";const c=()=>{const[e]=Object(a.useState)(o);return{portalNode:e}},d=i.a.memo((()=>{const{portalNode:e}=c();return i.a.createElement(r.b,{node:e})}));d.displayName="EqlEventsCountBadge"},520:function(e,t,n){"use strict";n.d(t,"a",(function(){return c}));var a=n(104),i=n.n(a),r=n(41),l=n.n(r),o=n(2),s=n.n(o),u=n(40);const c=l()((({loading:e,...t})=>s.a.createElement(u.EuiPanel,i()({},t,{hasBorder:!0})))).withConfig({displayName:"Panel",componentId:"sc-h09jgf-0"})(["position:relative;",""],(({loading:e})=>e&&"\n    overflow: hidden;\n  "));c.displayName="Panel"},521:function(e,t,n){"use strict";n.d(t,"a",(function(){return a})),n.d(t,"b",(function(){return i})),n.d(t,"d",(function(){return r})),n.d(t,"c",(function(){return l}));const a="kibana.alert.rule.name",i="host.name",r=300,l=500},535:function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return o}));var a=n(2),i=n.n(a);const r=i.a.createContext(null),l=Object(a.memo)((({upsellingService:e,children:t})=>i.a.createElement(r.Provider,{value:e},t)));l.displayName="UpsellingProvider";const o=()=>{const e=Object(a.useContext)(r);if(!e)throw new Error("UpsellingProviderContext not found");return e}},549:function(e,t,n){var a=n(973),i=n(974);e.exports=function(e,t,n){return a(i,e,t,n)}},550:function(e,t,n){e.exports=n(33)(3824)},551:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"d",(function(){return r})),n.d(t,"e",(function(){return l})),n.d(t,"f",(function(){return o})),n.d(t,"b",(function(){return s})),n.d(t,"g",(function(){return u})),n.d(t,"h",(function(){return c})),n.d(t,"c",(function(){return d}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.notes.addNoteButtonLabel",{defaultMessage:"Add Note"}),r=a.i18n.translate("xpack.securitySolution.notes.noteLabel",{defaultMessage:"Note"}),l=a.i18n.translate("xpack.securitySolution.notes.notesTitle",{defaultMessage:"Notes"}),o=a.i18n.translate("xpack.securitySolution.notes.search.FilterByUserOrNotePlaceholder",{defaultMessage:"Filter by User or Note"}),s=a.i18n.translate("xpack.securitySolution.notes.cancelButtonLabel",{defaultMessage:"Cancel"}),u=a.i18n.translate("xpack.securitySolution.notes.youAreEditingANoteScreenReaderOnly",{defaultMessage:"You are editing a note. Click Add Note when finished, or press escape to cancel."}),c=e=>a.i18n.translate("xpack.securitySolution.notes.youAreViewingNotesScreenReaderOnly",{values:{row:e},defaultMessage:"You are viewing notes for the event in row {row}. Press the up arrow key when finished to return to the event."}),d=a.i18n.translate("xpack.securitySolution.notes.createdByLabel",{defaultMessage:"Created by"})},559:function(e,t){const n=/^[0-9]+$/,a=(e,t)=>{const a=n.test(e),i=n.test(t);return a&&i&&(e=+e,t=+t),e===t?0:a&&!i?-1:i&&!a?1:e<t?-1:1};e.exports={compareIdentifiers:a,rcompareIdentifiers:(e,t)=>a(t,e)}},560:function(e,t,n){"use strict";n.d(t,"b",(function(){return r})),n.d(t,"a",(function(){return l})),n.d(t,"f",(function(){return o})),n.d(t,"k",(function(){return s})),n.d(t,"l",(function(){return u})),n.d(t,"j",(function(){return c})),n.d(t,"g",(function(){return d})),n.d(t,"h",(function(){return m})),n.d(t,"d",(function(){return p})),n.d(t,"e",(function(){return b})),n.d(t,"c",(function(){return f})),n.d(t,"p",(function(){return g})),n.d(t,"o",(function(){return y})),n.d(t,"n",(function(){return h})),n.d(t,"m",(function(){return v})),n.d(t,"i",(function(){return E}));var a=n(5),i=n(106);const r=a.i18n.translate("xpack.securitySolution.timeline.callOut.unauthorized.message.description",{defaultMessage:"You can use Timeline to investigate events, but you do not have the required permissions to save timelines for future use. If you need to save timelines, contact your Kibana administrator."}),l=a.i18n.translate("xpack.securitySolution.timeline.callOut.immutable.message.description",{defaultMessage:"This prebuilt timeline template cannot be modified. To make changes, please duplicate this template and make modifications to the duplicate template."}),o=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.button",{defaultMessage:"Edit timeline name and description"}),s=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.header",{defaultMessage:"Save Timeline"}),u=a.i18n.translate("xpack.securitySolution.timeline.saveTimelineTemplate.modal.header",{defaultMessage:"Save Timeline Template"}),c=a.i18n.translate("xpack.securitySolution.timeline.nameTimeline.save.title",{defaultMessage:"Save"}),d=a.i18n.translate("xpack.securitySolution.timeline.nameTimeline.modal.header",{defaultMessage:"Name Timeline"}),m=a.i18n.translate("xpack.securitySolution.timeline.nameTimelineTemplate.modal.header",{defaultMessage:"Name Timeline Template"}),p=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.discard.title",{defaultMessage:"Discard Timeline"}),b=a.i18n.translate("xpack.securitySolution.timeline.saveTimelineTemplate.modal.discard.title",{defaultMessage:"Discard Timeline Template"}),f=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.close.title",{defaultMessage:"Close"}),g=e=>a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.warning.title",{values:{timeline:e===i.l.template?"timeline template":"timeline"},defaultMessage:"You have an unsaved {timeline}. Do you wish to save it?"}),y=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.titleTitle",{defaultMessage:"Title"}),h=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.titleAriaLabel",{defaultMessage:"Title"}),v=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.descriptionLabel",{defaultMessage:"Description"}),E=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.optionalLabel",{defaultMessage:"Optional"})},561:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n(103),r=n(114),l=n(105),o=n(122),s=n(182);const u=({inputId:e=r.a.global,inspectIndex:t=0,isDisabled:n,multiple:u=!1,onClick:c,onCloseInspect:d,queryId:m})=>{const p=Object(i.useDispatch)(),b=o.d.globalQueryByIdSelector(),f=o.d.timelineQueryByIdSelector(),{loading:g,inspect:y,selectedInspectIndex:h,isInspected:v}=Object(l.a)((t=>e===r.a.global?b(t,m):f(t,m))),E=Object(a.useCallback)((()=>{c&&c(),p(s.c.setInspectionParameter({id:m,inputId:e,isInspected:!0,selectedInspectIndex:t}))}),[c,p,m,e,t]),O=Object(a.useCallback)((()=>{null!=d&&d(),p(s.c.setInspectionParameter({id:m,inputId:e,isInspected:!1,selectedInspectIndex:t}))}),[d,p,m,e,t]);let S=null,x=null;null!=y&&y.dsl.length>0&&(u?[S,...x]=y.dsl:S=y.dsl[t]);let j=null,k=null;null!=y&&y.response.length>0&&(u?[j,...k]=y.response:j=y.response[t]);const T=Object(a.useMemo)((()=>!g&&h===t&&v),[t,v,g,h]);return{additionalRequests:x,additionalResponses:k,handleClick:E,handleCloseModal:O,isButtonDisabled:Object(a.useMemo)((()=>g||n||null==S||null==j||null==m),[n,g,m,S,j]),isShowingModal:T,loading:g,request:S,response:j}}},562:function(e,t,n){"use strict";let a;n.d(t,"a",(function(){return a})),function(e){e.flows="flows",e.dns="dns",e.anomalies="anomalies",e.tls="tls",e.http="http",e.events="events"}(a||(a={}))},604:function(e,t,n){"use strict";n.d(t,"d",(function(){return m})),n.d(t,"c",(function(){return p})),n.d(t,"b",(function(){return b})),n.d(t,"a",(function(){return g}));var a=n(55),i=n.n(a),r=n(338),l=n(230),o=n(47);const s=Object(o.v4)();var u,c,d=n(918);const m=(e,t)=>n=>`${d.g}: ${i()(n).format(e)} ${t?d.f(n):d.e(n)}`,p=[{text:"event.action",value:"event.action"},{text:"event.dataset",value:"event.dataset"},{text:"event.module",value:"event.module"}],b={defaultStackByOption:null!==(u=p.find((e=>"event.action"===e.text)))&&void 0!==u?u:p[0],errorMessage:d.c,histogramType:r.j.events,stackByOptions:p,subtitle:void 0,title:d.d,getLensAttributes:(e="event.action",t={})=>{var n;return{title:"Events",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:s,accessors:["e09e0380-0740-4105-becc-0a4ca12e3944"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"aac9d7d0-13a3-480a-892b-08207a787926",splitAccessor:"34919782-4546-43a5-b668-06ac934d3acd"}],yRightExtent:{mode:"full"},yLeftExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},valuesInLegend:!0},query:{query:"",language:"kuery"},filters:null!==(n=t.filters)&&void 0!==n?n:[],datasourceStates:{formBased:{layers:{[s]:{columns:{"aac9d7d0-13a3-480a-892b-08207a787926":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"e09e0380-0740-4105-becc-0a4ca12e3944":{label:"Count of records",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___"},"34919782-4546-43a5-b668-06ac934d3acd":{label:`Top values of ${e}`,dataType:"string",operationType:"terms",scale:"ordinal",sourceField:`${e}`,isBucketed:!0,params:{size:10,orderBy:{type:"column",columnId:"e09e0380-0740-4105-becc-0a4ca12e3944"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"}}}},columnOrder:["34919782-4546-43a5-b668-06ac934d3acd","aac9d7d0-13a3-480a-892b-08207a787926","e09e0380-0740-4105-becc-0a4ca12e3944"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:`indexpattern-datasource-layer-${s}`}]}}},f=[{text:"event.category",value:"event.category"},{text:"event.module",value:"event.module"}],g={defaultStackByOption:null!==(c=f.find((e=>"event.module"===e.text)))&&void 0!==c?c:f[0],errorMessage:d.b,histogramType:r.j.alerts,stackByOptions:f,subtitle:void 0,title:d.a,getLensAttributes:(e="event.module")=>({title:"External alerts",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:"a3c54471-615f-4ff9-9fda-69b5b2ea3eef",accessors:["0a923af2-c880-4aa3-aa93-a0b9c2801f6d"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"37bdf546-3c11-4b08-8c5d-e37debc44f1d",splitAccessor:"42334c6e-98d9-47a2-b4cb-a445abb44c93"}],yRightExtent:{mode:"full"},yLeftExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},valuesInLegend:!0},query:{query:"",language:"kuery"},filters:[{meta:{index:"a04472fc-94a3-4b8d-ae05-9d30ea8fbd6a",alias:null,negate:!1,disabled:!1,type:"phrase",key:"event.kind",params:{query:"alert"}},query:{match_phrase:{"event.kind":"alert"}},$state:{store:"appState"}}],datasourceStates:{formBased:{layers:{"a3c54471-615f-4ff9-9fda-69b5b2ea3eef":{columns:{"37bdf546-3c11-4b08-8c5d-e37debc44f1d":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"0a923af2-c880-4aa3-aa93-a0b9c2801f6d":{label:l.f,dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___"},"42334c6e-98d9-47a2-b4cb-a445abb44c93":{label:Object(l.o)(`${e}`),dataType:"string",operationType:"terms",scale:"ordinal",sourceField:`${e}`,isBucketed:!0,params:{size:10,orderBy:{type:"column",columnId:"0a923af2-c880-4aa3-aa93-a0b9c2801f6d"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"}}}},columnOrder:["42334c6e-98d9-47a2-b4cb-a445abb44c93","37bdf546-3c11-4b08-8c5d-e37debc44f1d","0a923af2-c880-4aa3-aa93-a0b9c2801f6d"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-a3c54471-615f-4ff9-9fda-69b5b2ea3eef"},{type:"index-pattern",name:"723c4653-681b-4105-956e-abef287bf025",id:"{dataViewId}"},{type:"index-pattern",name:"a04472fc-94a3-4b8d-ae05-9d30ea8fbd6a",id:"{dataViewId}"}]})}},606:function(e,t,n){"use strict";n.d(t,"a",(function(){return m}));var a=n(680),i=n(476),r=n(220),l=n(795),o=n(137),s=n(155),u=n(914),c=n(640);const d={[s.e]:{id:s.e,isDefault:!0,messages:[],apiConfig:{}},[l.a]:{id:l.a,isDefault:!0,messages:[],apiConfig:{}},[o.yb]:{id:o.yb,isDefault:!0,messages:[],apiConfig:{}},[s.i]:{id:s.i,isDefault:!0,messages:[],apiConfig:{}},[c.a]:{excludeFromLastConversationStorage:!0,id:c.a,isDefault:!0,messages:[],apiConfig:{}},[r.h]:{id:r.h,isDefault:!0,theme:{title:r.e,titleIcon:"logoSecurity",assistant:{name:u.f,icon:"logoSecurity"},system:{icon:"logoElastic"},user:{}},messages:[],apiConfig:{}}},m=()=>{const[e,t]=Object(a.a)({defaultValue:d,key:i.a,isInvalidDefault:e=>!e});return{conversations:e,setConversations:t}}},609:function(e,t,n){"use strict";n.d(t,"b",(function(){return l})),n.d(t,"a",(function(){return o}));var a=n(2),i=n(160),r=n(20);const l=e=>{const t=o();return Object(a.useMemo)((()=>t(e)),[t,e])},o=()=>{const e=Object(i.a)();return Object(a.useCallback)((t=>((e,t)=>Object(r.d)(e)&&t.length>0?`?${t}`:"")(t,e)),[e])}},613:function(e,t,n){var a=n(614),i=n(615),r=i?function(e,t){return i.set(e,t),e}:a;e.exports=r},614:function(e,t,n){e.exports=n(33)(1650)},615:function(e,t,n){var a=n(976),i=a&&new a;e.exports=i},616:function(e,t,n){e.exports=n(33)(3673)},617:function(e,t,n){var a=n(618),i=n(619),r=n(979),l=n(341),o=n(620),s=n(626),u=n(995),c=n(443),d=n(342);e.exports=function e(t,n,m,p,b,f,g,y,h,v){var E=128&n,O=1&n,S=2&n,x=24&n,j=512&n,k=S?void 0:l(t);return function T(){for(var C=arguments.length,w=Array(C),I=C;I--;)w[I]=arguments[I];if(x)var M=s(T),A=r(w,M);if(p&&(w=a(w,p,b,x)),f&&(w=i(w,f,g,x)),C-=A,x&&C<v){var N=c(w,M);return o(t,n,e,T.placeholder,m,w,N,y,h,v-C)}var F=O?m:this,D=S?F[t]:t;return C=w.length,y?w=u(w,y):j&&C>1&&w.reverse(),E&&h<C&&(w.length=h),this&&this!==d&&this instanceof T&&(D=k||l(D)),D.apply(F,w)}}},618:function(e,t){var n=Math.max;e.exports=function(e,t,a,i){for(var r=-1,l=e.length,o=a.length,s=-1,u=t.length,c=n(l-o,0),d=Array(u+c),m=!i;++s<u;)d[s]=t[s];for(;++r<o;)(m||r<l)&&(d[a[r]]=e[r]);for(;c--;)d[s++]=e[r++];return d}},619:function(e,t){var n=Math.max;e.exports=function(e,t,a,i){for(var r=-1,l=e.length,o=-1,s=a.length,u=-1,c=t.length,d=n(l-s,0),m=Array(d+c),p=!i;++r<d;)m[r]=e[r];for(var b=r;++u<c;)m[b+u]=t[u];for(;++o<s;)(p||r<l)&&(m[b+a[o]]=e[r++]);return m}},620:function(e,t,n){var a=n(980),i=n(623),r=n(624);e.exports=function(e,t,n,l,o,s,u,c,d,m){var p=8&t;t|=p?32:64,4&(t&=~(p?64:32))||(t&=-4);var b=[e,t,o,p?s:void 0,p?u:void 0,p?void 0:s,p?void 0:u,c,d,m],f=n.apply(void 0,b);return a(e)&&i(f,b),f.placeholder=l,r(f,e,t)}},621:function(e,t,n){var a=n(615),i=n(667),r=a?function(e){return a.get(e)}:i;e.exports=r},622:function(e,t,n){var a=n(436),i=n(439);function r(e,t){this.__wrapped__=e,this.__actions__=[],this.__chain__=!!t,this.__index__=0,this.__values__=void 0}r.prototype=a(i.prototype),r.prototype.constructor=r,e.exports=r},623:function(e,t,n){var a=n(613),i=n(985)(a);e.exports=i},624:function(e,t,n){var a=n(986),i=n(987),r=n(988),l=n(989);e.exports=function(e,t,n){var o=t+"";return r(e,i(o,l(a(o),n)))}},625:function(e,t,n){e.exports=n(33)(3641)},626:function(e,t){e.exports=function(e){return e.placeholder}},627:function(e,t,n){e.exports=n(33)(3629)},628:function(e,t,n){e.exports=n(33)(3640)},629:function(e,t,n){e.exports=n(33)(938)},630:function(e,t,n){e.exports=n(33)(3303)},631:function(e,t,n){var a=n(437);e.exports=function(e){return e==e&&!a(e)}},632:function(e,t){e.exports=function(e,t){return function(n){return null!=n&&n[e]===t&&(void 0!==t||e in Object(n))}}},633:function(e,t,n){e.exports=n(33)(1234)},634:function(e,t,n){e.exports=n(33)(3635)},635:function(e,t,n){var a=n(1029),i=n(633),r=n(629),l=n(442),o=n(437),s=n(288);e.exports=function(e,t,n,u){if(!o(e))return e;for(var c=-1,d=(t=i(t,e)).length,m=d-1,p=e;null!=p&&++c<d;){var b=s(t[c]),f=n;if("prototype"==b&&r(p))throw new Error("Illegal access of function prototype");if(c!=m){var g=hasOwnProperty.call(p,b)?p[b]:void 0;void 0===(f=u?u(g,b,p):void 0)&&(f=o(g)?g:l(t[c+1])?[]:{})}a(p,b,f),p=p[b]}return e}},636:function(e,t,n){"use strict";var a=n(189);n.d(t,"b",(function(){return a.d})),n.d(t,"a",(function(){return a.c})),n.d(t,"c",(function(){return a.e}))},637:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(40),i=n(109),r=n(2),l=n.n(r),o=n(41);const s=n.n(o)()(a.EuiPopover).withConfig({displayName:"WithHoverActionsPopover",componentId:"sc-1w6un7x-0"})([".euiPopover__anchor{width:100%;}"]),u=l.a.memo((({alwaysShow:e=!1,closePopOverTrigger:t,hoverContent:n,onCloseRequested:a,render:o})=>{const[u,c]=Object(r.useState)(null!=n&&e),[d,m]=Object(r.useState)(!1),[,p]=Object(r.useState)(void 0),b=Object(r.useRef)(null),f=Object(r.useCallback)((()=>{p((e=>{clearTimeout(e)})),m(!1),null!=a&&setTimeout((()=>{a()}))}),[a]),g=Object(r.useCallback)((()=>{p(Number(setTimeout((()=>{document.body.classList.contains(i.d)||m(!0)}),100)))}),[p,m]),y=Object(r.useCallback)((()=>{e||f()}),[e,f]),h=Object(r.useCallback)((e=>{u&&"Escape"===e.key&&y()}),[u,y]),v=Object(r.useMemo)((()=>l.a.createElement("div",{"data-test-subj":"withHoverActionsButton",onMouseEnter:g},o(d))),[g,o,d]);return Object(r.useEffect)((()=>{c(null!=n&&(d||e))}),[n,d,e]),Object(r.useEffect)((()=>{m(!1)}),[t]),Object(r.useEffect)((()=>{var e;u&&(null==b||null===(e=b.current)||void 0===e||e.positionPopoverFluid())}),[n,u]),l.a.createElement("div",{className:e?i.c:"",onMouseLeave:y},l.a.createElement(s,{ref:b,anchorPosition:"downCenter",button:v,closePopover:f,hasArrow:!1,isOpen:u,ownFocus:!1,panelPaddingSize:"none",panelClassName:"withHoverActions__popover",repositionOnScroll:!0},u?l.a.createElement("div",{onKeyDown:h},n):null))}));u.displayName="WithHoverActions"},638:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),r=n(41),l=n.n(r),o=n(148);const s=l.a.div.withConfig({displayName:"ProviderContainerComponent",componentId:"sc-11ewwh0-0"})([""," ",""],(({isDragging:e})=>!e&&Object(r.css)(["&{border-radius:2px;padding:0 4px 0 8px;position:relative;z-index:"," !important;&::before{background-image:linear-gradient( 135deg,"," 25%,transparent 25% ),linear-gradient( -135deg,"," 25%,transparent 25% ),linear-gradient( 135deg,transparent 75%,"," 75% ),linear-gradient( -135deg,transparent 75%,"," 75% );background-position:0 0,1px 0,1px -1px,0px 1px;background-size:2px 2px;bottom:2px;content:'';display:block;left:2px;position:absolute;top:2px;width:4px;}}&:hover{&,& .euiBadge,& .euiBadge__text{cursor:move;cursor:grab;}}.",":hover &,tr:hover &{&::before{background-image:linear-gradient( 135deg,"," 25%,transparent 25% ),linear-gradient( -135deg,"," 25%,transparent 25% ),linear-gradient( 135deg,transparent 75%,"," 75% ),linear-gradient( -135deg,transparent 75%,"," 75% );}}&:hover,&:focus,.",":hover &:hover,.",":focus &:focus,tr:hover &:hover,tr:hover &:focus{background-color:",";&,& a,& a:hover{color:",";}&::before{background-image:linear-gradient( 135deg,"," 25%,transparent 25% ),linear-gradient( -135deg,"," 25%,transparent 25% ),linear-gradient( 135deg,transparent 75%,"," 75% ),linear-gradient( -135deg,transparent 75%,"," 75% );}}"],(({theme:e})=>e.eui.euiZLevel0),(({theme:e})=>e.eui.euiColorMediumShade),(({theme:e})=>e.eui.euiColorMediumShade),(({theme:e})=>e.eui.euiColorMediumShade),(({theme:e})=>e.eui.euiColorMediumShade),o.f,(({theme:e})=>e.eui.euiColorDarkShade),(({theme:e})=>e.eui.euiColorDarkShade),(({theme:e})=>e.eui.euiColorDarkShade),(({theme:e})=>e.eui.euiColorDarkShade),o.f,o.f,(({theme:e})=>e.eui.euiColorPrimary),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade))),(({isDragging:e})=>e&&Object(r.css)(["&{z-index:9999 !important;}"])));s.displayName="ProviderContainerComponent";const u=i.a.memo(s);u.displayName="ProviderContainer"},639:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(2);const i=e=>{const[t,n]=Object(a.useState)(null),i=Object(a.useRef)(null);return Object(a.useEffect)((()=>{var e,t,a,r,l,o,s,u,c;null!=(null===(e=i.current)||void 0===e?void 0:e.clientHeight)&&((null!==(t=null==i||null===(a=i.current)||void 0===a?void 0:a.scrollHeight)&&void 0!==t?t:0)>(null!==(r=null==i||null===(l=i.current)||void 0===l?void 0:l.clientHeight)&&void 0!==r?r:0)&&n(!0),(null!==(o=null===(s=i.current)||void 0===s?void 0:s.scrollHeight)&&void 0!==o?o:0)<=(null!==(u=null==i||null===(c=i.current)||void 0===c?void 0:c.clientHeight)&&void 0!==u?u:0)&&n(!1))}),[i,e]),[t,i]}},640:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=n(5).i18n.translate("xpack.securitySolution.assistant.conversations.timelineConversationTitle",{defaultMessage:"Timeline"})},641:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"b",(function(){return r})),n.d(t,"d",(function(){return l})),n.d(t,"a",(function(){return o}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.topN.closeButtonLabel",{defaultMessage:"Close"}),r=a.i18n.translate("xpack.securitySolution.topN.allEventsSelectLabel",{defaultMessage:"Alerts and events"}),l=a.i18n.translate("xpack.securitySolution.topN.rawEventsSelectLabel",{defaultMessage:"Raw events"}),o=a.i18n.translate("xpack.securitySolution.topN.alertEventsSelectLabel",{defaultMessage:"Detection alerts"})},642:function(e,t,n){"use strict";n.d(t,"a",(function(){return m}));var a=n(2),i=n(4),r=n(562),l=n(116),o=n(105),s=n(122),u=n(110),c=n(175),d=n(211);const m=({applyGlobalQueriesAndFilters:e=!0,extraOptions:t,getLensAttributes:n,lensAttributes:m,scopeId:p=u.SourcererScopeName.default,stackByField:b,title:f})=>{var g,y;const{selectedPatterns:h,dataViewId:v,indicesExist:E}=Object(l.d)(p),O=Object(a.useMemo)((()=>s.d.globalQuerySelector()),[]),S=Object(a.useMemo)((()=>s.d.globalFiltersQuerySelector()),[]),x=Object(o.a)(O),j=Object(o.a)(S),[{detailName:k,pageName:T,tabName:C}]=Object(c.a)(),w=Object(a.useMemo)((()=>C===r.a.events?T===i.wc.network?d.h:Object(d.b)(T):[]),[T,C]),I=Object(a.useMemo)((()=>[i.wc.hosts,i.wc.users].indexOf(T)>=0&&null!=k?Object(d.c)(T,k):i.wc.network===T?Object(d.e)(k):[]),[k,T]),M=Object(a.useMemo)((()=>null!=m?m:n&&b&&n(b,t)),[t,n,m,b]),A=Object.values(null!==(g=null==M||null===(y=M.state)||void 0===y?void 0:y.adHocDataViews)&&void 0!==g?g:{}).length>0,N=Object(a.useMemo)((()=>{var t;if(null==m&&(null==n||null==b||0===(null==b?void 0:b.length)))return null;const a=A?[]:Object(d.d)(h);return{...M,...null!=f?{title:f}:{},state:{...M.state,...e?{query:x}:{},filters:[...M.state.filters,...I,...w,...a,...e?j:[]]},references:null==M||null===(t=M.references)||void 0===t?void 0:t.map((e=>({...e,id:v})))}}),[e,M,v,j,n,A,m,I,x,h,b,w,f]);return A||!A&&E?N:null}},643:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(2),i=n(63),r=n(102),l=n(230);const o=({onAddToCaseClicked:e,lensAttributes:t,timeRange:n})=>{const o=Object(r.h)(),{cases:s}=Object(r.j)().services,u=Object(a.useMemo)((()=>[{persistableStateAttachmentState:{attributes:t,timeRange:n},persistableStateAttachmentTypeId:i.LENS_ATTACHMENT_TYPE,type:i.AttachmentType.persistableState}]),[t,n]),c=s.hooks.useCasesAddToExistingCaseModal({onClose:e,successToaster:{title:l.a}});return{onAddToExistingCaseClicked:Object(a.useCallback)((()=>{e&&e(),c.open({getAttachments:()=>u})}),[u,e,c]),disabled:null==t||null==n||!o.create||!o.read}}},644:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(2),i=n(63),r=n(102),l=n(230);const o=({onClick:e,timeRange:t,lensAttributes:n})=>{const o=Object(r.h)(),{cases:s}=Object(r.j)().services,u=Object(a.useMemo)((()=>[{persistableStateAttachmentState:{attributes:n,timeRange:t},persistableStateAttachmentTypeId:i.LENS_ATTACHMENT_TYPE,type:i.AttachmentType.persistableState}]),[n,t]),c=s.hooks.useCasesAddToNewCaseFlyout({toastContent:l.a});return{onAddToNewCaseClicked:Object(a.useCallback)((()=>{e&&e(),c.open({attachments:u})}),[u,c,e]),disabled:null==n||null==t||!o.create||!o.read}}},645:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),r=n(40),l=n(41);const o=n.n(l)()(r.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-1tb0fg5-0"})(["flex:1;"]),s=()=>i.a.createElement(o,{alignItems:"center",justifyContent:"center",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiLoadingSpinner,{size:"xl"}))),u=i.a.memo(s)},646:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return p}));var a=n(40),i=n(41),r=n.n(i),l=n(2),o=n.n(l),s=n(521),u=n(391),c=n(483);const d=r()(a.EuiPanel).withConfig({displayName:"KpiPanel",componentId:"sc-12zc7xr-0"})(["display:flex;flex-direction:column;position:relative;overflow-x:hidden;overflow-y:",";@media only screen and (min-width:","){","}",""],(({$overflowY:e})=>null!=e?e:"hidden"),(e=>e.theme.eui.euiBreakpoints.m),(({height:e,$toggleStatus:t})=>t&&`\n      height: ${null!=e?e:s.d}px;\n  `),(({$toggleStatus:e})=>e&&`\n    height: ${s.c}px;\n  `)),m=r.a.div.withConfig({displayName:"StackByComboBoxWrapper",componentId:"sc-12zc7xr-1"})(["max-width:400px;width:","px;"],(({width:e})=>e)),p=o.a.forwardRef((({"aria-label":e=c.c,"data-test-subj":t,isDisabled:n=!1,onSelect:i,prepend:r=c.d,selected:s,inputRef:d,width:p=400,dropDownoptions:b,useLensCompatibleFields:f},g)=>{const y=Object(l.useCallback)((e=>{e&&e.length>0?i(e[0].value):i("")}),[i]),h=Object(l.useMemo)((()=>[{label:s,value:s}]),[s]),v=Object(u.b)(f),E=Object(l.useMemo)((()=>({asPlainText:!0})),[]);return o.a.createElement(m,{width:p},o.a.createElement(a.EuiComboBox,{"data-test-subj":t,"aria-label":e,inputRef:d,isDisabled:n,placeholder:c.e,prepend:r,ref:g,singleSelection:E,isClearable:!1,sortMatchesBy:"startsWith",options:null!=b?b:v,selectedOptions:h,compressed:!0,onChange:y}))}));p.displayName="StackByComboBox"},654:function(e,t,n){"use strict";n.d(t,"a",(function(){return we})),n.d(t,"c",(function(){return Ie})),n.d(t,"b",(function(){return Me})),n.d(t,"d",(function(){return Ae}));var a=n(40),i=n(942),r=n(450),l=n(2),o=n.n(l),s=n(8),u=n(44),c=n(5),d=n(104),m=n.n(d);const p=({euiFieldProps:e})=>{const{field:{onChange:t,value:n,name:i},fieldState:{error:s}}=Object(r.useController)({name:"label",defaultValue:""}),u=Object(l.useMemo)((()=>!(null==s||!s.message)),[null==s?void 0:s.message]);return o.a.createElement(a.EuiFormRow,{label:c.i18n.translate("xpack.securitySolution.markdown.osquery.labelFieldText",{defaultMessage:"Label"}),error:null==s?void 0:s.message,isInvalid:u,fullWidth:!0},o.a.createElement(a.EuiFieldText,m()({isInvalid:u,onChange:t,value:n,name:i,fullWidth:!0,"data-test-subj":"input"},e)))},b=o.a.memo(p),f=c.i18n.translate("xpack.securitySolution.markdown.osquery.permissionDenied",{defaultMessage:"Permission denied"}),g=()=>o.a.createElement(a.EuiEmptyPrompt,{iconType:"logoOsquery",title:o.a.createElement("h2",null,f),titleSize:"xs",body:o.a.createElement("p",null,o.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.missingPrivileges",defaultMessage:"To access this page, ask your administrator for {osquery} Kibana privileges.",values:{osquery:o.a.createElement(a.EuiCode,null,"osquery")}}))});var y=n(102);const h=({node:e,onSave:t,onCancel:n})=>{var i,d,m;const p=null!=e,{osquery:f,application:{capabilities:{osquery:h}}}=Object(y.j)().services,v=Object(r.useForm)({defaultValues:{label:null==e||null===(i=e.configuration)||void 0===i?void 0:i.label,query:null==e||null===(d=e.configuration)||void 0===d?void 0:d.query,ecs_mapping:null==e||null===(m=e.configuration)||void 0===m?void 0:m.ecs_mapping}}),E=Object(l.useCallback)((e=>{t(`!{osquery${JSON.stringify(Object(s.pickBy)({query:e.query,label:e.label,ecs_mapping:e.ecs_mapping},(e=>!Object(s.isEmpty)(e))))}}`,{block:!0})}),[t]),O=Object(l.useMemo)((()=>!(h.runSavedQueries&&h.readSavedQueries||h.writeLiveQueries)),[h.readSavedQueries,h.runSavedQueries,h.writeLiveQueries]),S=Object(l.useMemo)((()=>{if(null!=f&&f.LiveQueryField){const{LiveQueryField:e}=f;return o.a.createElement(r.FormProvider,v,o.a.createElement(b,null),o.a.createElement(a.EuiSpacer,{size:"m"}),o.a.createElement(e,{formMethods:v}))}return null}),[v,f]);return O?o.a.createElement(g,null):o.a.createElement(o.a.Fragment,null,o.a.createElement(a.EuiModalHeader,null,o.a.createElement(a.EuiModalHeaderTitle,null,o.a.createElement("h1",null,p?o.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.editModalTitle",defaultMessage:"Edit query"}):o.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.addModalTitle",defaultMessage:"Add query"})))),o.a.createElement(a.EuiModalBody,null,o.a.createElement(o.a.Fragment,null,S)),o.a.createElement(a.EuiModalFooter,null,o.a.createElement(a.EuiButtonEmpty,{onClick:n},c.i18n.translate("xpack.securitySolution.markdown.osquery.modalCancelButtonLabel",{defaultMessage:"Cancel"})),o.a.createElement(a.EuiButton,{onClick:v.handleSubmit(E),fill:!0},p?o.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.addModalConfirmButtonLabel",defaultMessage:"Add query"}):o.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.editModalConfirmButtonLabel",defaultMessage:"Save changes"}))))},v=o.a.memo(h),E={name:"osquery",button:{label:"Osquery",iconType:"logoOsquery"},helpText:o.a.createElement("div",null,o.a.createElement(a.EuiCodeBlock,{language:"md",fontSize:"l",paddingSize:"s",isCopyable:!0},"!{osquery{options}}"),o.a.createElement(a.EuiSpacer,{size:"s"})),editor:v};var O=n(480),S=n(41),x=n.n(S),j=n(402),k=n(255),T=n(1037),C=n.n(T),w=n(511);const I=x()(a.EuiButton).withConfig({displayName:"StyledEuiButton",componentId:"sc-14wavsd-0"})(["> span > img{margin-block-end:0;}"]);var M=n(50),A=n.n(M),N=n(55),F=n.n(N),D=(n(21),n(83)),R=n(49),P=n(108),L=n(51),B=n(118),_=n(161),z=n(660),q=n(116),$=n(110),V=n(106),H=n(150);const U=e=>e===R.FILTERS.EXISTS?H.b:e===R.FILTERS.PHRASES?H.c:H.d,Q={$state:{store:R.FilterStateStore.APP_STATE},meta:{disabled:!1,negate:!1,alias:null,index:void 0}},G={and:[],enabled:!0,id:"",name:"",excluded:!1,kqlQuery:"",type:V.a.default,queryMatch:{field:"",value:"",operator:H.b}},W=e=>{const t={...Q,meta:{...Q.meta,negate:e.excluded,type:e.queryType}};if(e.queryType===R.FILTERS.EXISTS)return{...t,meta:{...t.meta,params:void 0,value:"exists"},query:{exists:{field:e.field}}};if(e.queryType===R.FILTERS.PHRASES){var n;let a=JSON.parse(String(e.value));return"number"===e.valueType?a=a.map(Number):"boolean"===e.valueType&&(a=a.map(Boolean)),{...t,meta:{...t.meta},query:{bool:{minimum_should_match:1,should:null===(n=a)||void 0===n?void 0:n.map((t=>({match_phrase:{[e.field]:t}})))}}}}var a;if(e.queryType===R.FILTERS.PHRASE)return{...t,meta:{...t.meta,params:{query:e.value},value:void 0},query:{match_phrase:{[e.field]:null!==(a=e.value)&&void 0!==a?a:""}}};if(e.queryType===R.FILTERS.RANGE){let n,a;try{const t=JSON.parse(String(e.value));n=t.gte,a=t.lt}catch{n="",a=""}const i={gte:n,lt:a};return{...t,meta:{...t.meta,params:i},query:{range:{[e.field]:i}}}}return t},K=({providers:e,alertData:t})=>{const n=Object(l.useMemo)((()=>e.some((e=>e.some((e=>"range"===e.queryType))))),[e]);return{dataProviders:Object(l.useMemo)((()=>n?[]:((e,t)=>e.map((e=>e.reduce(((e,n,a)=>{const{field:i,value:r,excluded:l,queryType:o}=n,{result:u,matchedBrackets:c}=((e,t)=>{if("number"==typeof e||"boolean"==typeof e)return{result:e,skipped:!0,matchedBrackets:null};const n=/\{{([^}]+)\}}/g,a=e.match(new RegExp(n));let i=e;a&&t&&Object(s.each)(a,(e=>{const n=e.replace(/{{|}}/g,"").trim();if(i.includes(e)){const a=t.find((({field:e})=>e===n));if(a&&a.values){const{values:[t]}=a;i=i.replace(e,t)}}}));const r=new RegExp(n).test(i);return{result:i,skipped:r,matchedBrackets:a}})(r,t),d=!t&&c;if(0===a)return{and:[],enabled:!0,id:JSON.stringify(i+r),name:i,excluded:l,kqlQuery:"",type:d?V.a.template:V.a.default,queryMatch:{field:i,value:u,operator:U(o)}};{const t={enabled:!0,id:JSON.stringify(i+r),name:i,excluded:l,kqlQuery:"",type:d?V.a.template:V.a.default,queryMatch:{field:i,value:u,operator:U(o)}};e.and.push(t)}return e}),G))))(e,t)),[t,e,n]),filters:Object(l.useMemo)((()=>n?((e,t)=>{const n=[];for(let t=0;t<e.length;t++){const a=e[t];if(a.length>1){const e=a.map((e=>W(e))),t={$state:{store:R.FilterStateStore.APP_STATE},meta:{type:R.FILTERS.COMBINED,relation:R.BooleanRelation.AND,params:e,index:void 0,disabled:!1,negate:!1}};n.push(t)}else{const e=a[0],t=W(e);n.push(t)}}return n})(e):[]),[n,e,t])}};var X=n(271),Y=n(286),J=n(4);const Z=e=>{var t,n,a,i,r,l;const o=null!==(t=null===(n=e.meta)||void 0===n?void 0:n.key)&&void 0!==t?t:"",s={field:o,excluded:null!==(a=null===(i=e.meta)||void 0===i?void 0:i.negate)&&void 0!==a&&a,queryType:null!==(r=null===(l=e.meta)||void 0===l?void 0:l.type)&&void 0!==r?r:R.FILTERS.PHRASE};if(Object(R.isRangeFilter)(e)){var u;const{gte:t,lt:n}=e.query.range[o],a=JSON.stringify({gte:t,lt:n});return{...s,value:a,queryType:null!==(u=e.meta.type)&&void 0!==u?u:R.FILTERS.RANGE}}if(Object(R.isPhrasesFilter)(e)){var c,d,m,p;const t=typeof(null===(c=e.meta)||void 0===c?void 0:c.params[0]);return{...s,value:JSON.stringify(null!==(d=null===(m=e.meta)||void 0===m?void 0:m.params)&&void 0!==d?d:[]),valueType:t,queryType:null!==(p=e.meta.type)&&void 0!==p?p:R.FILTERS.PHRASES}}var b;if(Object(R.isExistsFilter)(e))return{...s,value:"",queryType:null!==(b=e.meta.type)&&void 0!==b?b:R.FILTERS.EXISTS};if(Object(R.isPhraseFilter)(e)){var f,g,y,h,v,E;const t=typeof(null===(f=e.meta)||void 0===f||null===(g=f.params)||void 0===g?void 0:g.query);return{...s,value:null!==(y=null===(h=e.meta)||void 0===h||null===(v=h.params)||void 0===v?void 0:v.query)&&void 0!==y?y:"",valueType:t,queryType:null!==(E=e.meta.type)&&void 0!==E?E:R.FILTERS.PHRASE}}return{...s,value:"",queryType:R.FILTERS.PHRASE}},ee=e=>e.map((e=>Z(e))),te=e=>!1===e.some(R.isCombinedFilter)?[ee(e)]:e.reduce(((e,t)=>{if(Object(R.isCombinedFilter)(t)){const n=t.meta.params;if(t.meta.relation===R.BooleanRelation.OR){const t=n.map((e=>{const t=te([e]);return Object(s.flatten)(t)}));return[...e,...t]}{const t=te(n);return[...e,...t]}}return[...e,[Z(t)]]}),[]);var ne=n(17),ae=n(62),ie=n.n(ae),re=n(678),le=n.n(re),oe=n(374);function se(e,t,n){var a;if(void 0===t||"undefined"===n)return!1;switch(e.type){case"date":const n="string"==typeof t?ie.a.parse(t):null;return Boolean("string"==typeof t&&n&&n.isValid());case"ip":if("string"==typeof t||"number"==typeof t)try{return Boolean(new L.IpAddress(t))}catch(e){return!1}return!1;case"string":return"string"==typeof t&&null!==(a=e.esTypes)&&void 0!==a&&a.includes(oe.a.VERSION)?Boolean(le()(t)):"string"==typeof t&&t.trim().length>0;case"boolean":return"boolean"==typeof t;case"number":return"number"==typeof t||"string"==typeof t&&!isNaN(parseFloat(t));default:return!0}}const ue=c.i18n.translate("xpack.securitySolution.markdown.insight.label",{defaultMessage:"Label"}),ce=c.i18n.translate("xpack.securitySolution.markdown.insight.title",{defaultMessage:"Investigate"}),de=c.i18n.translate("xpack.securitySolution.markdown.insight.labelText",{defaultMessage:"Label on the query button."}),me=c.i18n.translate("xpack.securitySolution.markdown.insight.description",{defaultMessage:"Description"}),pe=c.i18n.translate("xpack.securitySolution.markdown.insight.descriptionText",{defaultMessage:"Additional description of the query."}),be=c.i18n.translate("xpack.securitySolution.markdown.insight.formDescription",{defaultMessage:"Create a query to investigate an alert in Timeline, using a clickable query button in the investigation guide. The button also displays a count of matching documents."}),fe=c.i18n.translate("xpack.securitySolution.markdown.insight.filterBuilder",{defaultMessage:"Filters"}),ge=c.i18n.translate("xpack.securitySolution.markdown.insight.filterBuilderText",{defaultMessage:"Create filters to populate the Timeline query builder. To use a value from the alert document, enter the field name in double braces {example} as a custom option in the value field.",values:{example:"{{kibana.alert.example}}"}}),ye=c.i18n.translate("xpack.securitySolution.markdown.insight.relativeTimerange",{defaultMessage:"Relative time range"}),he=c.i18n.translate("xpack.securitySolution.markdown.insight.relativeTimerangeText",{defaultMessage:"Select a time range to limit the query, relative to the alert's creation time (optional)."}),ve=c.i18n.translate("xpack.securitySolution.markdown.insight.modalCancelButtonLabel",{defaultMessage:"Cancel"}),Ee=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.insightProviderError",{defaultMessage:"Unable to parse insight provider configuration"}),Oe="!{investigate",Se=({label:e,description:t,providers:n,relativeFrom:i,relativeTo:r})=>{const{addError:s}=Object(P.a)();let u=[];try{void 0!==n&&(u=JSON.parse(n))}catch(e){s(e,{title:Ee})}const{data:c,timestamp:d}=Object(l.useContext)(j.a),{dataProviders:m,filters:p}=K({providers:u,alertData:c}),b=Object(l.useMemo)((()=>{if(i&&r){const e=d?A()(d):A()();return{kind:"absolute",from:Object(Y.e)(i,Y.a,!1,A.a,e.toDate()).toISOString(),to:Object(Y.e)(r,Y.b,!0,A.a,e.toDate()).toISOString()}}return null}),[i,r,d]),{totalCount:f,isQueryLoading:g,oldestTimestamp:h,hasError:v}=(({dataProviders:e,filters:t,relativeTimerange:n})=>{const{uiSettings:a}=Object(y.j)().services,i=Object(l.useMemo)((()=>Object(L.getEsQueryConfig)(a)),[a]),{browserFields:r,selectedPatterns:o,indexPattern:s,dataViewId:u}=Object(q.d)($.SourcererScopeName.timeline),[c,d]=Object(l.useState)(!1),m=Object(l.useMemo)((()=>{try{if(!1===c)return Object(_.d)({config:i,dataProviders:e,indexPattern:s,browserFields:r,filters:t,kqlQuery:{query:"",language:"kuery"},kqlMode:"filter"})}catch(e){return d(!0),null}}),[r,e,i,c,s,t]),[p,{events:b,totalCount:f}]=Object(z.a)({dataViewId:u,fields:["*"],filterQuery:null==m?void 0:m.filterQuery,id:B.c.active,indexNames:o,language:"kuery",limit:1,runtimeMappings:{},...n?{startDate:null==n?void 0:n.from,endDate:null==n?void 0:n.to}:{}}),[g]=b,h=g&&g.data&&g.data.find((e=>"@timestamp"===e.field));return{isQueryLoading:p,totalCount:f,oldestTimestamp:h&&h.value&&h.value[0],hasError:c}})({dataProviders:m,filters:p,relativeTimerange:b}),E=Object(l.useMemo)((()=>{if(b)return b;if(null!=h)return{kind:"absolute",from:h,to:(new Date).toISOString()};{const{to:e,from:t,fromStr:n,toStr:a}=Object(Y.d)();return{kind:"relative",to:e,from:t,fromStr:n,toStr:a}}}),[h,b]);return g?o.a.createElement(a.EuiLoadingSpinner,null):o.a.createElement(o.a.Fragment,null,o.a.createElement(X.a,{asEmptyButton:!1,isDisabled:v,dataProviders:m,filters:p,timeRange:E,keepDataView:!0,"data-test-subj":"insight-investigate-in-timeline-button"},o.a.createElement(a.EuiIcon,{type:"timeline"}),` ${e} (${F()(f).format("0,0.[000]a")})`),o.a.createElement("div",null,t))},xe=({node:e,onSave:t,onCancel:n})=>{const i=null!=e,{sourcererDataView:c,indexPattern:d}=Object(q.d)($.SourcererScopeName.default),{unifiedSearch:{ui:{FiltersBuilderLazy:p}},uiSettings:b,fieldFormats:f}=Object(y.j)().services,g=Object(l.useMemo)((()=>null!=c?new D.DataView({spec:c,fieldFormats:f}):null),[c,f]),[h,v]=Object(l.useState)([[]]),E=Object(l.useMemo)((()=>[{value:"0",text:""},...b.get(J.V).map((({display:e},t)=>({value:String(t),text:e})))]),[b]),O=Object(r.useForm)({defaultValues:{label:null==e?void 0:e.label,description:null==e?void 0:e.description,relativeTimerange:(null==e?void 0:e.relativeTimerange)||"0"},shouldUnregister:!0}),S=Object(r.useController)({name:"label",control:O.control}),x=Object(r.useController)({name:"description",control:O.control}),j=Object(r.useController)({name:"relativeTimerange",control:O.control}),k=Object(l.useCallback)((e=>{const t=E.find((t=>t.value===e));if(t&&"0"!==t.value){const e=Number(t.value),n=b.get(J.V);return{relativeFrom:n[e].from,relativeTo:n[e].to}}return{}}),[E,b]),T=Object(l.useCallback)((()=>{t(`${Oe}${JSON.stringify(Object(s.pickBy)({label:S.field.value,description:x.field.value,providers:h,...k(j.field.value)},(e=>!Object(s.isEmpty)(e))))}}`,{block:!0})}),[t,h,S.field.value,x.field.value,j.field.value,k]),C=Object(l.useCallback)((e=>{v(te(e))}),[]),w=Object(l.useCallback)((e=>{j.field.onChange(e.target.value)}),[j.field]),I=Object(l.useMemo)((()=>{var e;const t=null!==(e=S.field.value)&&void 0!==e?e:"",n=h.flat();return""===t.trim()||0===n.length||n.some((e=>!function(e,t){if(!t||!e.field)return!1;switch(e.queryType){case"phrase":return se(t,e.value,e.valueType);case"phrases":const n="string"==typeof e.value?JSON.parse(`${e.value}`):null;return!(!Array.isArray(n)||!n.length)&&n.every((n=>se(t,n,e.valueType)));case"range":const a=JSON.parse("string"==typeof e.value?e.value:"");return"object"==typeof a&&(!a.gte||se(t,a.gte,e.valueType))&&(!a.lt||se(t,a.lt,e.valueType));case"exists":return!0;default:throw new Error(`Unknown operator type: ${e.queryType}`)}}(e,null==g?void 0:g.getFieldByName(e.field))))}),[S.field.value,h,g]),M=Object(l.useMemo)((()=>{const e=d&&d.getName?d.getName():"*";return[{$state:{store:R.FilterStateStore.APP_STATE},meta:{disabled:!1,negate:!1,alias:null,index:e}}]}),[d]),A=Object(ne.b)().isAtLeast("platinum");return o.a.createElement(o.a.Fragment,null,o.a.createElement(Te,null,o.a.createElement(a.EuiModalHeaderTitle,null,o.a.createElement(a.EuiFlexGroup,{gutterSize:"s"},o.a.createElement(a.EuiFlexItem,null,i?o.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.editModalTitle",defaultMessage:"Edit investigation query"}):o.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.addModalTitle",defaultMessage:"Add investigation query"}))))),!1===A&&o.a.createElement(a.EuiCallOut,{title:"To add suggested queries to an investigation guide, please upgrade to platinum",iconType:"timeline"}),o.a.createElement(a.EuiModalBody,null,o.a.createElement(r.FormProvider,O,o.a.createElement(a.EuiForm,{fullWidth:!0},o.a.createElement(a.EuiFormRow,{label:be,fullWidth:!0},o.a.createElement(o.a.Fragment,null)),o.a.createElement(a.EuiFormRow,{label:ue,helpText:de,isInvalid:void 0!==S.field.value&&0===S.field.value.trim().length,fullWidth:!0},o.a.createElement(a.EuiFieldText,m()({},O.register("label"),{ref:null,name:"label",onChange:S.field.onChange}))),o.a.createElement(a.EuiFormRow,{label:me,helpText:pe,fullWidth:!0},o.a.createElement(a.EuiFieldText,m()({},O.register("description"),{ref:null,name:"description",onChange:x.field.onChange}))),o.a.createElement(a.EuiFormRow,{label:fe,helpText:ge,fullWidth:!0},g?o.a.createElement(p,{filters:M,onChange:C,dataView:g,maxDepth:1}):o.a.createElement(o.a.Fragment,null)),o.a.createElement(a.EuiFormRow,{label:ye,helpText:he,fullWidth:!0},o.a.createElement(a.EuiSelect,m()({},O.register("relativeTimerange"),{ref:null,onChange:w,options:E})))))),o.a.createElement(a.EuiModalFooter,null,o.a.createElement(a.EuiButtonEmpty,{onClick:n},ve),o.a.createElement(a.EuiButton,{onClick:O.handleSubmit(T),fill:!0,disabled:I},i?o.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.addModalConfirmButtonLabel",defaultMessage:"Add query"}):o.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.editModalConfirmButtonLabel",defaultMessage:"Save changes"}))))},je=o.a.memo(xe),ke=`${Oe}{\n  "label": "Test action",\n  "description": "Click to investigate",\n  "providers": [\n    [\n      {"field": "event.id", "value": "{{kibana.alert.original_event.id}}", "queryType": "phrase", "excluded": "false"}\n    ],\n    [\n      {"field": "event.action", "value": "", "queryType": "exists", "excluded": "false"},\n      {"field": "process.pid", "value": "{{process.pid}}", "queryType": "phrase", "excluded":"false"}\n    ]\n  ]\n}}`;var Te=x()(a.EuiModalHeader).withConfig({displayName:"_StyledEuiModalHeader",componentId:"sc-1kbgjgu-0"})(["min-width:700px;"]);const{uiPlugins:Ce,parsingPlugins:we,processingPlugins:Ie}={uiPlugins:Object(a.getDefaultEuiMarkdownUiPlugins)(),parsingPlugins:Object(a.getDefaultEuiMarkdownParsingPlugins)(),processingPlugins:Object(a.getDefaultEuiMarkdownProcessingPlugins)()},Me=[Oe],Ae=({insightsUpsellingMessage:e})=>{const t=Ce.map((e=>e.name)),n=(({insightsUpsellingMessage:e})=>({name:"insights",button:{label:null!=e?e:ce,iconType:"timelineWithArrow",isDisabled:!!e},helpText:o.a.createElement("div",null,o.a.createElement(a.EuiCodeBlock,{language:"md",fontSize:"l",paddingSize:"s",isCopyable:!0},ke),o.a.createElement(a.EuiSpacer,{size:"s"})),editor:je}))({insightsUpsellingMessage:e});if(!1===t.includes(n.name))Ce.push(i.b),Ce.push(E),Ce.push(n);else{const e=Ce.findIndex((e=>e.name===n.name));Ce[e]=n}return Ce};we.push((function(){const e=this.Parser,t=e.prototype.inlineTokenizers,n=e.prototype.inlineMethods,a=function(e,t,n){if(!1===t.startsWith(Oe))return!1;const a=t[Oe.length];if("{"!==a&&"}"!==a)return!1;if(n)return!0;let i={};if("{"===a){let n="",a=0;for(let e=Oe.length;e<t.length;e++){const i=t[e];if("{"===i)a++,n+=i;else if("}"===i){if(a--,-1===a)break;n+=i}else n+=i}try{return i=JSON.parse(n),e(t)({type:"insight",...i,providers:JSON.stringify(i.providers)})}catch(t){const n=e.now();this.file.fail((e=>c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.insightConfigError",{values:{err:e},defaultMessage:"Unable to parse insight JSON configuration: {err}"}))(t),{line:n.line,column:n.column+Oe.length})}}return!1};a.locator=(e,t)=>e.indexOf(Oe,t),t.insight=a,n.splice(n.indexOf("text"),0,"insight")})),we.push(i.a),we.push(O.a),Ie[1][1].components.insight=({label:e,description:t,providers:n,relativeFrom:i,relativeTo:r})=>!1===Object(ne.b)().isPlatinumPlus()?o.a.createElement(o.a.Fragment,null,o.a.createElement(a.EuiButton,{isDisabled:!0,iconSide:"left",iconType:"timeline","data-test-subj":"insight-investigate-in-timeline-button"},`${e}`),o.a.createElement("div",null,t)):o.a.createElement(Se,{label:e,description:t,providers:n,relativeFrom:i,relativeTo:r}),Ie[1][1].components.timeline=i.c,Ie[1][1].components.osquery=({configuration:e})=>{var t;const[n,a]=Object(l.useState)(!1),{agentId:i,alertId:r,data:u}=Object(l.useContext)(j.a),d=Object(l.useCallback)((()=>a(!0)),[a]),m=Object(l.useCallback)((()=>a(!1)),[a]),p=Object(l.useMemo)((()=>{const e=Object(s.reduce)(u,((e,t)=>{var n;return{...e,[t.field]:null==t||null===(n=t.values)||void 0===n?void 0:n[0]}}),{});return Object(k.a)(e)}),[u]);return o.a.createElement(o.a.Fragment,null,o.a.createElement(I,{iconType:C.a,onClick:d},null!==(t=e.label)&&void 0!==t?t:c.i18n.translate("xpack.securitySolution.markdown.osquery.runOsqueryButtonLabel",{defaultMessage:"Run Osquery"})),n&&o.a.createElement(w.a,{defaultValues:{...r?{alertIds:[r]}:{},query:e.query,ecs_mapping:e.ecs_mapping,queryField:!1},agentId:i,onClose:m,ecsData:p}))}},656:function(e,t,n){"use strict";n.d(t,"a",(function(){return ne}));var a=n(40),i=n(2),r=n.n(i),l=n(41),o=n.n(l),s=n(42),u=n(47),c=n(49),d=n(51),m=n(134),p=n(4),b=n(153),f=n(166),g=n(233),y=n(232),h=n(169),v=n(456),E=n(149),O=n(645),S=n(102),x=n(919),j=n(57),k=n(297),T=n(293),C=n(228),w=n(424),I=n(327);const M=r.a.memo((({chartHeight:e=174,data:t,from:n,legendItems:l,legendPosition:o=j.Position.Right,legendMinWidth:s,loading:u,showLegend:c,to:d,updateDateRange:m})=>{const{baseTheme:p,theme:b}=Object(k.i)(),f=Object(i.useMemo)((()=>["100%",e]),[e]),g=Object(i.useMemo)((()=>["y"]),[]),y=Object(i.useMemo)((()=>[e=>Object(C.a)(e.g)?e.g:I.c]),[]),h=Object(i.useMemo)((()=>Object(T.a)([n,d])),[n,d]);return r.a.createElement(r.a.Fragment,null,u&&r.a.createElement(a.EuiProgress,{"data-test-subj":"loadingPanelAlertsHistogram",size:"xs",position:"absolute",color:"accent"}),r.a.createElement(a.EuiFlexGroup,{gutterSize:"none"},r.a.createElement(a.EuiFlexItem,{grow:!0},r.a.createElement(j.Chart,{size:f},r.a.createElement(j.Settings,{legendPosition:o,onBrushEnd:m,showLegend:c&&0===l.length,showLegendExtra:c,theme:b,baseTheme:p}),r.a.createElement(j.Axis,{id:"alertsHistogramAxisX",position:j.Position.Bottom,tickFormat:h}),r.a.createElement(j.Axis,{id:"alertsHistogramAxisY",position:j.Position.Left}),r.a.createElement(j.HistogramBarSeries,{id:"alertsHistogram",xScaleType:j.ScaleType.Time,yScaleType:j.ScaleType.Linear,xAccessor:"x",yAccessors:g,splitSeriesAccessors:y,data:t}))),r.a.createElement(a.EuiFlexItem,{grow:!1},l.length>0&&r.a.createElement(w.a,{legendItems:l,height:e,minWidth:s}))))}));M.displayName="AlertsHistogram";var A=n(5);const N=A.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.headerTitle",{defaultMessage:"Trend"}),F=A.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.notAvailableTooltip",{defaultMessage:"Not available for trend view"}),D=A.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.viewAlertsButtonLabel",{defaultMessage:"View alerts"}),R=(e,t,n)=>A.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.showingAlertsTitle",{values:{totalAlertsFormatted:e,totalAlerts:t,modifier:n},defaultMessage:"Showing: {modifier}{totalAlertsFormatted} {totalAlerts, plural, =1 {alert} other {alerts}}"});var P=n(123),L=n(131),B=n(521),_=n(646),z=n(391),q=n(177),$=n(483),V=n(124);const H=Object(u.v4)(),U=(e="kibana.alert.rule.name",t)=>({title:"Alerts",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:H,accessors:["e09e0380-0740-4105-becc-0a4ca12e3944"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"aac9d7d0-13a3-480a-892b-08207a787926",splitAccessor:"34919782-4546-43a5-b668-06ac934d3acd"}],yRightExtent:{mode:"full"},yLeftExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},valuesInLegend:!0},query:{query:"",language:"kuery"},filters:null!=t&&t.filters?t.filters:[],datasourceStates:{formBased:{layers:{[H]:{columns:{"aac9d7d0-13a3-480a-892b-08207a787926":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"e09e0380-0740-4105-becc-0a4ca12e3944":{label:"Count of records",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___"},"34919782-4546-43a5-b668-06ac934d3acd":{label:`Top values of ${e}`,dataType:"string",operationType:"terms",scale:"ordinal",sourceField:e,isBucketed:!0,params:{size:1e3,orderBy:{type:"column",columnId:"e09e0380-0740-4105-becc-0a4ca12e3944"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"},secondaryFields:[]}}},columnOrder:["34919782-4546-43a5-b668-06ac934d3acd","aac9d7d0-13a3-480a-892b-08207a787926","e09e0380-0740-4105-becc-0a4ca12e3944"],incompleteColumns:{}}}}},internalReferences:[],adHocDataViews:{}},references:[{type:"index-pattern",id:"{dataViewId}",name:`indexpattern-datasource-layer-${H}`}]});var Q=n(110),G=n(403),W=n(55),K=n.n(W),X=n(413);const Y={value:0,relation:"eq"},J="detections-histogram",Z=o()(a.EuiFlexItem).withConfig({displayName:"ViewAlertsFlexItem",componentId:"sc-tvqkga-0"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeL)),ee=o()(a.EuiFlexItem).withConfig({displayName:"OptionsFlexItem",componentId:"sc-tvqkga-1"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeS)),te=[],ne=Object(i.memo)((({alignHeader:e,chartHeight:t=155,chartOptionsContextMenu:n,combinedQueries:l,comboboxRef:o,defaultStackByOption:j=B.a,extraActions:k,filters:T,headerChildren:C,inspectTitle:w,legendPosition:I="right",onFieldSelected:H,onlyField:W,paddingSize:ne="m",panelHeight:ae=B.d,query:ie,runtimeMappings:re,setComboboxInputRef:le,showCountsInLegend:oe=!1,showGroupByPlaceholder:se=!1,showLegend:ue=!0,showLinkToAlerts:ce=!1,showStackBy:de=!0,showTotalAlertsCount:me=!1,signalIndexName:pe,stackByLabel:be,stackByWidth:fe,timelineId:ge,title:ye=N,titleSize:he="m",updateDateRange:ve,hideQueryToggle:Ee=!1,isExpanded:Oe,setIsExpanded:Se})=>{var xe;const{to:je,from:ke,deleteQuery:Te,setQuery:Ce}=Object(m.a)(),we=Object(i.useMemo)((()=>`${J}-${Object(u.v4)()}`),[]),Ie=`alerts-trend-embeddable-${we}`,[Me,Ae]=Object(i.useState)(!0),[Ne,Fe]=Object(i.useState)(!1),[De,Re]=Object(i.useState)(Y),[Pe,Le]=Object(i.useState)(null==W?j:W),Be=Object(V.a)("chartEmbeddablesEnabled"),_e=Object(V.a)("alertsPageChartsEnabled"),ze=Object(i.useCallback)((e=>{Le(e),null!=H&&H(e)}),[H]);Object(i.useEffect)((()=>{Le(null==W?j:W)}),[j,W]);const{toggleStatus:qe,setToggleStatus:$e}=Object(q.a)(J),Ve=Object(i.useCallback)((e=>{_e&&void 0!==Se?Se(e):$e(e)}),[$e,Se,_e]),He=Object(i.useMemo)((()=>_e&&void 0!==Se?!Oe:!qe),[_e,Se,Oe,qe]),Ue=Object(i.useMemo)((()=>({from:ke,to:je})),[ke,je]),{loading:Qe,data:Ge,setQuery:We,response:Ke,request:Xe,refetch:Ye}=Object(g.a)({query:Object(x.d)(Pe,ke,je,Object(x.a)(l),re),indexName:pe,skip:He||Be,queryName:y.a.HISTOGRAM}),Je=Object(S.j)(),{navigateToApp:Ze}=Je.services.application,{formatUrl:et,search:tt}=Object(h.m)(L.a.alerts),nt=(({totalAlertsObj:e,visualizationId:t,isChartEmbeddablesEnabled:n})=>{const[a]=Object(S.p)(p.O),r=Object(X.a)({visualizationId:t}),l=Object(i.useMemo)((()=>R(K()(e.value).format(a),e.value,"gte"===e.relation?">":"lte"===e.relation?"<":"")),[e.value,e.relation,a]),o=Object(i.useMemo)((()=>{const e=null!=r?r[0].hits.total:0;return R(K()(e).format(a),e,"")}),[a,r]);return n?o:l})({totalAlertsObj:De,visualizationId:Ie,isChartEmbeddablesEnabled:Be}),at=Object(i.useCallback)((e=>{e.preventDefault(),Ze(p.l,{deepLinkId:L.a.alerts,path:Object(h.d)(tt)})}),[Ze,tt]),it=Object(i.useMemo)((()=>Object(x.c)(Ge)),[Ge]),rt=Object(i.useMemo)((()=>{var e,t;return ue&&null!=(null==Ge||null===(e=Ge.aggregations)||void 0===e||null===(t=e.alertsByGrouping)||void 0===t?void 0:t.buckets)?Ge.aggregations.alertsByGrouping.buckets.map(((e,t)=>{var n;return{color:t<v.a.length?v.a[t]:void 0,count:oe?e.doc_count:void 0,dataProviderId:Object(b.i)(`draggable-legend-item-${Object(u.v4)()}-${Pe}-${e.key}`),field:Pe,timelineId:ge,value:null!==(n=null==e?void 0:e.key_as_string)&&void 0!==n?n:e.key}})):te}),[null==Ge||null===(xe=Ge.aggregations)||void 0===xe?void 0:xe.alertsByGrouping.buckets,Pe,oe,ue,ge]);Object(i.useEffect)((()=>{let e=!1;return e||Object(x.f)({isInitialLoading:Me,isLoadingAlerts:Qe})||Ae(!1),()=>{e=!0}}),[Me,Qe,Ae]),Object(z.a)({deleteQuery:Te,loading:Qe,refetch:Ye,request:Xe,response:Ke,setQuery:Ce,uniqueQueryId:we}),Object(i.useEffect)((()=>{var e;Re(null!==(e=null==Ge?void 0:Ge.hits.total)&&void 0!==e?e:{value:0,relation:"eq"})}),[Ge]),Object(i.useEffect)((()=>{try{let t=null;var e;t=null!=l?Object(x.e)(l):Object(c.buildEsQuery)(void 0,null!=ie?[ie]:[],null!==(e=null==T?void 0:T.filter((e=>!1===e.meta.disabled)))&&void 0!==e?e:[],{...Object(d.getEsQueryConfig)(Je.services.uiSettings),dateFormatTZ:void 0}),Fe(!1),We(Object(x.d)(Pe,ke,je,Object(s.isEmpty)(t)?[]:[t],re))}catch(e){Fe(!0),We(Object(x.d)(Pe,ke,je,[],re))}}),[Pe,ke,je,ie,T,l,re]);const lt=Object(i.useMemo)((()=>{if(ce)return r.a.createElement(Z,{grow:!1},r.a.createElement(P.g,{"data-test-subj":"alerts-histogram-panel-go-to-alerts-page",onClick:at,href:et(Object(h.d)())},D))}),[ce,at,et]),ot=Object(i.useMemo)((()=>{return null==W?ye:(e=W,A.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.topNLabel",{values:{fieldName:e},defaultMessage:"Top {fieldName}"}));var e}),[W,ye]),st=Object(i.useMemo)((()=>_e&&void 0!==Oe?Oe:qe),[_e,Oe,qe]);return r.a.createElement(E.c,{show:!Me&&st},r.a.createElement(_.a,{height:ae,hasBorder:!0,paddingSize:ne,"data-test-subj":"alerts-histogram-panel",$toggleStatus:st},r.a.createElement(f.a,{alignHeader:e,id:we,inspectTitle:w,outerDirection:"column",title:ot,titleSize:he,toggleStatus:st,toggleQuery:Ee?void 0:Ve,showInspectButton:!Be&&null==n,subtitle:!Me&&me&&nt,isInspectDisabled:Ne},r.a.createElement(a.EuiFlexGroup,{alignItems:"flexStart","data-test-subj":"panelFlexGroup",gutterSize:"none"},r.a.createElement(a.EuiFlexItem,{grow:!1},de&&r.a.createElement(r.a.Fragment,null,r.a.createElement(_.b,{"data-test-subj":"stackByComboBox",inputRef:le,onSelect:ze,prepend:be,ref:o,selected:Pe,useLensCompatibleFields:Be,width:fe}),se&&r.a.createElement(r.a.Fragment,null,r.a.createElement(a.EuiSpacer,{"data-test-subj":"placeholderSpacer",size:"s"}),r.a.createElement(a.EuiToolTip,{"data-test-subj":"placeholderTooltip",content:F},r.a.createElement(_.b,{"data-test-subj":"stackByPlaceholder",isDisabled:!0,onSelect:s.noop,prepend:$.b,selected:"",useLensCompatibleFields:Be,width:fe})))),null!=C&&C),null!=n&&!Be&&r.a.createElement(ee,{grow:!1},n(we)),lt)),st?Be?r.a.createElement(G.a,{"data-test-subj":"embeddable-matrix-histogram",extraActions:k,extraOptions:{filters:T},getLensAttributes:U,height:null!=t?t:155,id:Ie,inspectTitle:null!=w?w:ye,scopeId:Q.SourcererScopeName.detections,stackByField:Pe,timerange:Ue}):Me?r.a.createElement(O.a,null):r.a.createElement(M,{chartHeight:t,data:it,from:ke,legendItems:rt,legendPosition:I,legendMinWidth:oe?300:void 0,loading:Qe,to:je,showLegend:ue,updateDateRange:ve}):null))}));ne.displayName="AlertsHistogramPanel"},657:function(e,t,n){"use strict";n.d(t,"a",(function(){return k}));var a=n(40),i=n(2),r=n.n(i),l=n(103),o=n(126),s=n(118),u=n(105),c=n(111),d=n(139),m=n(42),p=n(246),b=n.n(p),f=n(125),g=n(106),y=n(242),h=n(248),v=n(560);const E={title:{type:f.a.TEXT,validations:[{validator:f.h.emptyField("")}]},description:{type:f.a.TEXTAREA,validations:[]}};var O=n(159),S=n(196);const x=Object(f.j)({component:f.b}),j=r.a.memo((({closeSaveTimeline:e,initialFocus:t,timelineId:n,showWarning:o})=>{const{startTransaction:d}=Object(O.b)(),p=Object(i.useMemo)((()=>c.b.getTimelineByIdSelector()),[]),{isSaving:j,description:k="",status:T,title:C="",timelineType:w}=Object(u.a)((e=>Object(m.pick)(["isSaving","description","status","title","timelineType"],p(e,n)))),I=b()(j),M=Object(l.useDispatch)(),A=Object(y.a)({timelineId:s.c.active,timelineType:g.l.default}),N=Object(i.useCallback)(((e,t)=>(t&&M(c.a.updateTitleAndDescription({id:n,...e})),Promise.resolve())),[M,n]),F=Object(i.useMemo)((()=>({title:C,description:k})),[C,k]),{form:D}=Object(f.k)({id:"timelineTitleAndDescriptionForm",schema:E,onSubmit:N,options:{stripEmptyFields:!1},defaultValue:F}),{isSubmitted:R,isSubmitting:P,submit:L}=D,B=Object(i.useCallback)((()=>{d({name:S.f.SAVE}),L()}),[L,d]),_=Object(i.useCallback)((()=>{o&&A(),e()}),[e,A,o]),z=Object(i.useMemo)((()=>T===g.k.draft&&o?w===g.l.template?v.e:v.d:v.c),[o,T,w]),q=Object(i.useMemo)((()=>T===g.k.draft?w===g.l.template?v.l:v.k:w===g.l.template?v.h:v.g),[T,w]),$=Object(i.useMemo)((()=>T===g.k.draft&&o?w===g.l.template?v.l:v.k:v.j),[o,T,w]),V=Object(i.useMemo)((()=>v.p(w)),[w]),H=Object(i.useMemo)((()=>`${v.m} (${v.i})`),[]),U=Object(i.useMemo)((()=>({"aria-label":v.n,autoFocus:"title"===t,"data-test-subj":"save-timeline-title",disabled:j,spellCheck:!0,placeholder:w===g.l.template?h.k:h.l})),[t,j,w]),Q=Object(i.useMemo)((()=>({"aria-label":v.m,autoFocus:"description"===t,"data-test-subj":"save-timeline-description",disabled:j,placeholder:h.f})),[t,j]);return Object(i.useEffect)((()=>{R&&!j&&I&&e()}),[R,j,I,e]),r.a.createElement(a.EuiModal,{"data-test-subj":"save-timeline-modal",maxWidth:1024,onClose:e},j&&r.a.createElement(a.EuiProgress,{size:"s",color:"primary",position:"absolute","data-test-subj":"progress-bar"}),r.a.createElement(a.EuiModalHeader,{"data-test-subj":"modal-header"},q),r.a.createElement(a.EuiModalBody,null,o&&r.a.createElement(a.EuiFlexItem,{grow:!0},r.a.createElement(a.EuiCallOut,{title:V,color:"danger",iconType:"warning","data-test-subj":"save-timeline-callout"}),r.a.createElement(a.EuiSpacer,{size:"m"})),r.a.createElement(f.c,{form:D},r.a.createElement(a.EuiFlexItem,{grow:!0},r.a.createElement(x,{path:"title",fullWidth:!0,label:v.o,euiFieldProps:U}),r.a.createElement(a.EuiSpacer,null)),r.a.createElement(a.EuiFlexItem,{grow:!0},r.a.createElement(x,{label:H,path:"description",fullWidth:!0,euiFieldProps:Q}),r.a.createElement(a.EuiSpacer,null)),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"s"},r.a.createElement(a.EuiFlexItem,{grow:!1,component:"span"},r.a.createElement(a.EuiButton,{size:"s",fill:!1,onClick:_,isDisabled:j,"data-test-subj":"close-button"},z)),r.a.createElement(a.EuiFlexItem,{grow:!1,component:"span"},r.a.createElement(a.EuiButton,{size:"s",isDisabled:j||P,fill:!0,onClick:B,"data-test-subj":"save-button"},$)))))))}));j.displayName="TimelineTitleAndDescription";const k=r.a.memo((({initialFocus:e,timelineId:t,toolTip:n})=>{const m=Object(l.useDispatch)(),p=Object(i.useMemo)((()=>Object(d.createSelector)(c.b.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.showSaveModal)&&void 0!==t&&t}))),[]),b=Object(u.a)((e=>p(e,t))),[f,g]=Object(i.useState)(!1),y=Object(i.useCallback)((()=>{g(!1),b&&m(c.a.toggleModalSaveTimeline({id:s.c.active,showModalSaveTimeline:!1}))}),[m,g,b]),h=Object(i.useCallback)((()=>{g(!0)}),[g]),{kibanaSecuritySolutionsPrivileges:{crud:E}}=Object(o.a)(),O=Object(i.useMemo)((()=>E?n:v.b),[n,E]),S=Object(i.useMemo)((()=>r.a.createElement(a.EuiButtonIcon,{"aria-label":v.f,isDisabled:!E,onClick:h,iconType:"pencil","data-test-subj":"save-timeline-button-icon"})),[h,E]);return"title"===e&&b||f?r.a.createElement(r.a.Fragment,null,S,r.a.createElement(j,{closeSaveTimeline:y,initialFocus:e,timelineId:t,showWarning:"title"===e&&b})):r.a.createElement(a.EuiToolTip,{content:null!=O?O:"","data-test-subj":"save-timeline-btn-tooltip"},S)}));k.displayName="SaveTimelineButton"},658:function(e,t,n){"use strict";n.d(t,"b",(function(){return be})),n.d(t,"a",(function(){return he}));var a=n(42),i=n(40),r=n(2),l=n.n(r),o=n(103),s=n(41),u=n.n(s),c=n(59),d=n(111),m=n(133),p=n(190),b=n(110),f=n(941),g=n(106),y=n(105),h=n(302),v=n(148),E=n(268),O=n(104),S=n.n(O),x=(n(21),n(220)),j=n(913),k=n(124),T=n(606),C=n(309),w=n(118),I=n(519),M=n(915),A=n(5);const N=A.i18n.translate("xpack.securitySolution.timeline.tabs.queyTabTimelineTitle",{defaultMessage:"Query"}),F=A.i18n.translate("xpack.securitySolution.timeline.tabs.eqlTabTimelineTitle",{defaultMessage:"Correlation"}),D=A.i18n.translate("xpack.securitySolution.timeline.tabs.analyserTabTimelineTitle",{defaultMessage:"Analyzer"}),R=A.i18n.translate("xpack.securitySolution.timeline.tabs.notesTabTimelineTitle",{defaultMessage:"Notes"}),P=A.i18n.translate("xpack.securitySolution.timeline.tabs.pinnedTabTimelineTitle",{defaultMessage:"Pinned"}),L=A.i18n.translate("xpack.securitySolution.timeline.tabs.securityAssistantTimelineTitle",{defaultMessage:"Elastic AI Assistant"}),B=A.i18n.translate("xpack.securitySolution.timeline.tabs.discoverInTimeline",{defaultMessage:"Discover"}),_=A.i18n.translate("xpack.securitySolution.timeline.tabs.sessionTabTimelineTitle",{defaultMessage:"Session View"});var z=n(17),q=n(640);const $=u.a.div.attrs((({$isVisible:e=!1,isOverflowYScroll:t=!1})=>({style:{display:e?"flex":"none",overflow:t?"hidden scroll":"hidden"}}))).withConfig({displayName:"HideShowContainer",componentId:"sc-1ib7jds-0"})(["flex:1;"]);var V=u()($).withConfig({displayName:"_StyledHideShowContainer",componentId:"sc-1ib7jds-1"})(["overflow:hidden !important;"]);const H=(e,t=l.a.createElement(i.EuiSkeletonText,{lines:10}))=>{var n;const a=l.a.forwardRef(((n,a)=>l.a.createElement(r.Suspense,{fallback:t},l.a.createElement(e,S()({},n,{ref:a})))));return a.displayName=`${null!==(n=e.displayName)&&void 0!==n?n:"Tab"}WithSuspense`,a},U=u.a.div.withConfig({displayName:"AssistantTabContainer",componentId:"sc-1ib7jds-2"})(["overflow-y:auto;width:100%;"]),Q=H(Object(r.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(15),n.e(16),n.e(48)]).then(n.bind(null,1663))))),G=H(Object(r.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(15),n.e(16),n.e(45)]).then(n.bind(null,1670))))),W=H(Object(r.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(46)]).then(n.bind(null,1649))))),K=H(Object(r.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(41)]).then(n.bind(null,1673))))),X=H(Object(r.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(15),n.e(47)]).then(n.bind(null,1650))))),Y=H(Object(r.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(49)]).then(n.bind(null,1651))))),J=H(Object(r.lazy)((()=>n.e(44).then(n.bind(null,1674))))),Z=Object(r.memo)((({isAssistantEnabled:e,renderCellValue:t,rowRenderers:n,timelineId:a,shouldRefocusPrompt:o,setConversationId:s})=>l.a.createElement(r.Suspense,{fallback:l.a.createElement(i.EuiSkeletonText,{lines:10})},l.a.createElement(U,null,l.a.createElement(x.a,{isAssistantEnabled:e,conversationId:q.a,setConversationId:s,shouldRefocusPrompt:o})))));Z.displayName="AssistantTab";const ee=Object(r.memo)((({activeTimelineTab:e,renderCellValue:t,rowRenderers:n,timelineId:a,timelineType:i,setConversationId:o,showTimeline:s})=>{const u=Object(k.a)("discoverInTimeline"),{hasAssistantPrivilege:c,isAssistantEnabled:d}=Object(C.a)(),m=Object(r.useCallback)((e=>{switch(e){case w.d.graph:return l.a.createElement(W,{timelineId:a});case w.d.notes:return l.a.createElement(K,{timelineId:a});case w.d.session:return l.a.createElement(Y,{timelineId:a});default:return null}}),[a]),p=Object(r.useMemo)((()=>[w.d.graph,w.d.notes,w.d.session].includes(e)),[e]),{conversations:b}=Object(T.a)(),f=Object(r.useMemo)((()=>b[q.a].messages.length>0),[b]);return l.a.createElement(l.a.Fragment,null,l.a.createElement($,{$isVisible:w.d.query===e,"data-test-subj":`timeline-tab-content-${w.d.query}`},l.a.createElement(Q,{renderCellValue:t,rowRenderers:n,timelineId:a})),l.a.createElement($,{$isVisible:w.d.pinned===e,"data-test-subj":`timeline-tab-content-${w.d.pinned}`},l.a.createElement(X,{renderCellValue:t,rowRenderers:n,timelineId:a})),i===g.l.default&&l.a.createElement($,{$isVisible:w.d.eql===e,"data-test-subj":`timeline-tab-content-${w.d.eql}`},l.a.createElement(G,{renderCellValue:t,rowRenderers:n,timelineId:a})),l.a.createElement($,{$isVisible:p,isOverflowYScroll:e===w.d.session,"data-test-subj":`timeline-tab-content-${w.d.graph}-${w.d.notes}`},p&&m(e)),c&&l.a.createElement(V,{$isVisible:e===w.d.securityAssistant,isOverflowYScroll:e===w.d.securityAssistant,"data-test-subj":"timeline-tab-content-security-assistant"},(e===w.d.securityAssistant||f)&&l.a.createElement(Z,{isAssistantEnabled:d,renderCellValue:t,rowRenderers:n,timelineId:a,setConversationId:o,shouldRefocusPrompt:s&&e===w.d.securityAssistant})),u&&l.a.createElement($,{$isVisible:w.d.discover===e,"data-test-subj":`timeline-tab-content-${w.d.discover}`},l.a.createElement(J,null)))}));ee.displayName="ActiveTimelineTab";const te=u()(i.EuiBadge).withConfig({displayName:"CountBadge",componentId:"sc-1ib7jds-3"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeS)),ne=u()(i.EuiTab).withConfig({displayName:"StyledEuiTab",componentId:"sc-1ib7jds-4"})([".euiTab__content{display:flex;flex-direction:row;white-space:pre;}:focus{text-decoration:none;> span > span{text-decoration:underline;}}"]),ae=({renderCellValue:e,rowRenderers:t,timelineId:n,timelineFullScreen:s,timelineType:u,graphEventId:c,sessionViewConfig:m,timelineDescription:p})=>{const b=Object(k.a)("discoverInTimeline"),{hasAssistantPrivilege:f}=Object(C.a)(),h=Object(o.useDispatch)(),v=Object(r.useMemo)((()=>Object(M.a)()),[]),E=Object(r.useMemo)((()=>Object(M.g)()),[]),O=Object(r.useMemo)((()=>Object(M.e)()),[]),S=Object(r.useMemo)((()=>Object(M.d)()),[]),x=Object(r.useMemo)((()=>Object(M.c)()),[]),T=Object(r.useMemo)((()=>Object(M.b)()),[]),A=Object(y.b)((e=>v(e,n))),$=Object(y.b)((e=>E(e,n))),V=Object(y.b)((e=>O(e,n))),H=Object(y.a)((e=>x(e,n))),U=Object(y.a)((e=>T(e,n))),Q=Object(y.a)((e=>S(e))),G=Object(z.b)().isEnterprise(),[W,K]=Object(r.useState)(q.a),{reportAssistantInvoked:X}=Object(j.a)(),Y=Object(r.useMemo)((()=>{const e=Object.values(U).reduce(((e,t)=>[...e,...t]),[]);return[...H,...e]}),[H,U]),J=Object(r.useMemo)((()=>Q.filter((e=>Y.includes(e.id))).length+(Object(a.isEmpty)(p)?0:1)),[Q,Y,p]),Z=Object(r.useCallback)((e=>{h(d.a.setActiveTabTimeline({id:n,activeTab:e}))}),[h,n]),ae=Object(r.useCallback)((()=>{Z(w.d.query)}),[Z]),ie=Object(r.useCallback)((()=>{Z(w.d.eql)}),[Z]),re=Object(r.useCallback)((()=>{Z(w.d.graph)}),[Z]),le=Object(r.useCallback)((()=>{Z(w.d.notes)}),[Z]),oe=Object(r.useCallback)((()=>{Z(w.d.pinned)}),[Z]),se=Object(r.useCallback)((()=>{Z(w.d.session)}),[Z]),ue=Object(r.useCallback)((()=>{Z(w.d.securityAssistant),A!==w.d.securityAssistant&&X({conversationId:W,invokedBy:q.a})}),[A,W,X,Z]),ce=Object(r.useCallback)((()=>{Z(w.d.discover)}),[Z]);return Object(r.useEffect)((()=>{c||A!==w.d.graph||ae()}),[A,c,ae]),l.a.createElement(l.a.Fragment,null,!s&&l.a.createElement(i.EuiTabs,null,l.a.createElement(ne,{"data-test-subj":`timelineTabs-${w.d.query}`,onClick:ae,isSelected:A===w.d.query,disabled:!1,key:w.d.query},l.a.createElement("span",null,N),$&&l.a.createElement(I.b,null)),u===g.l.default&&l.a.createElement(ne,{"data-test-subj":`timelineTabs-${w.d.eql}`,onClick:ie,isSelected:A===w.d.eql,disabled:!1,key:w.d.eql},l.a.createElement("span",null,F),$&&l.a.createElement(I.a,null)),l.a.createElement(i.EuiTab,{"data-test-subj":`timelineTabs-${w.d.graph}`,onClick:re,isSelected:A===w.d.graph,disabled:!c,key:w.d.graph},D),G&&l.a.createElement(i.EuiTab,{"data-test-subj":`timelineTabs-${w.d.session}`,onClick:se,isSelected:A===w.d.session,disabled:null===m,key:w.d.session},_),l.a.createElement(ne,{"data-test-subj":`timelineTabs-${w.d.notes}`,onClick:le,isSelected:A===w.d.notes,disabled:u===g.l.template,key:w.d.notes},l.a.createElement("span",null,R),$&&J>0&&u===g.l.default&&l.a.createElement("div",null,l.a.createElement(te,null,J))),l.a.createElement(ne,{"data-test-subj":`timelineTabs-${w.d.pinned}`,onClick:oe,disabled:u===g.l.template,isSelected:A===w.d.pinned,key:w.d.pinned},l.a.createElement("span",null,P),$&&V>0&&u===g.l.default&&l.a.createElement("div",null,l.a.createElement(te,null,V))),f&&l.a.createElement(ne,{"data-test-subj":`timelineTabs-${w.d.securityAssistant}`,onClick:ue,disabled:u===g.l.template,isSelected:A===w.d.securityAssistant,key:w.d.securityAssistant},l.a.createElement("span",null,L)),b&&l.a.createElement(ne,{"data-test-subj":`timelineTabs-${w.d.discover}`,onClick:ce,isSelected:A===w.d.discover,disabled:!1,key:w.d.discover},l.a.createElement("span",null,B))),l.a.createElement(ee,{activeTimelineTab:A,renderCellValue:e,rowRenderers:t,timelineId:n,timelineType:u,timelineDescription:p,setConversationId:K,showTimeline:$}))},ie=Object(r.memo)(ae);var re=n(170),le=n(178),oe=n(722),se=n(45),ue=n(56),ce=n(102),de=n(221),me=n(122);const pe=u.a.div.withConfig({displayName:"TimelineTemplateBadge",componentId:"sc-4r2lej-0"})(["background:",";color:#fff;padding:10px 15px;font-size:0.8em;"],(({theme:e})=>e.eui.euiColorVis3_behindText)),be=Object(r.createContext)({timelineId:null}),fe=({timelineId:e})=>{const t=Object(r.useMemo)((()=>d.b.getTimelineByIdSelector()),[]);return Object(y.b)((n=>{var a;return(null!==(a=t(n,e))&&void 0!==a?a:m.b).isSaving}))?l.a.createElement(i.EuiProgress,{size:"s",color:"primary",position:"absolute"}):null},ge=l.a.memo(fe),ye=({renderCellValue:e,rowRenderers:t,timelineId:n})=>{const s=Object(o.useDispatch)(),u=Object(r.useRef)(null),O=Object(r.useMemo)((()=>d.b.getTimelineByIdSelector()),[]),S=Object(r.useMemo)((()=>me.e.scopeIdSelector()),[]),{selectedPatterns:x,selectedDataViewId:j}=Object(y.a)((e=>S(e,b.SourcererScopeName.timeline))),{dataViewId:k,indexNames:T,graphEventId:C,savedObjectId:I,timelineType:M,description:A,sessionViewConfig:N,initialized:F}=Object(y.a)((e=>{var t;return Object(a.pick)(["indexNames","dataViewId","graphEventId","savedObjectId","timelineType","description","sessionViewConfig","initialized"],null!==(t=O(e,n))&&void 0!==t?t:m.b)})),{timelineFullScreen:D}=Object(le.c)();Object(r.useEffect)((()=>{I||F||s(d.a.createTimeline({id:n,columns:p.b,dataViewId:j,indexNames:x,expandedDetail:h.a.getExpandedDetail(),show:!1}))}),[]);const R=Object(r.useCallback)((()=>{!I||null==j||null===k&&0===T.length||k===j&&T.sort().join()===x.sort().join()||s(d.a.updateDataView({dataViewId:j,id:n,indexNames:x}))}),[s,I,j,k,x,T,n]);Object(r.useEffect)((()=>{R()}),[j,x]);const P=Object(r.useCallback)((()=>{var e;const t=null===(e=u.current)||void 0===e?void 0:e.querySelector(oe.a);var n,a;null!=t?t.focus():null===(n=u.current)||void 0===n||null===(a=n.querySelector(".globalFilterBar__addButton"))||void 0===a||a.focus()}),[u]),L=Object(r.useCallback)((()=>{var e,t;null===(e=u.current)||void 0===e||null===(t=e.querySelector(`.${v.d}`))||void 0===t||t.focus()}),[u]),B=Object(r.useCallback)((e=>{Object(c.isTab)(e)&&Object(v.l)({containerElement:u.current,keyboardEvent:e,onSkipFocusBeforeEventsTable:P,onSkipFocusAfterEventsTable:L})}),[u,P,L]),_=Object(r.useMemo)((()=>({timelineId:n})),[n]),z=(()=>{const{search:e,pathname:t}=Object(se.useLocation)(),{spaces:n}=Object(ce.j)().services,a=Object(r.useMemo)((()=>d.b.getTimelineByIdSelector()),[]),{resolveTimelineConfig:o,savedObjectId:s,show:u,graphEventId:c,activeTab:p}=Object(y.a)((e=>{var t;return null!==(t=a(e,w.c.active))&&void 0!==t?t:m.b})),b=Object(r.useCallback)((()=>{var a,r,d;const m=new URLSearchParams(e),b=null!==(a=m.get(de.a.timeline))&&void 0!==a?a:void 0,f={id:null!=s?s:"",isOpen:!!u,activeTab:p,graphEventId:c},g=null!==(r=Object(ue.safeDecode)(null!=b?b:""))&&void 0!==r?r:f,y=null==g?void 0:g.id;if(!n||"conflict"!==(null==o?void 0:o.outcome)||null==(null==o?void 0:o.alias_target_id)||null==y)return null;const h=null!==(d=null==o?void 0:o.alias_target_id)&&void 0!==d?d:"",v={...g,id:h},E=Object(ue.encode)(v);m.set(de.a.timeline,E);const O=`${t}?${m.toString()}${window.location.hash}`;return l.a.createElement(l.a.Fragment,null,n.ui.components.getLegacyUrlConflict({objectNoun:de.a.timeline,currentObjectId:y,otherObjectId:h,otherObjectPath:O}),l.a.createElement(i.EuiSpacer,null))}),[p,c,t,null==o?void 0:o.alias_target_id,null==o?void 0:o.outcome,s,e,u,n]);return Object(r.useMemo)((()=>b()),[b])})();return l.a.createElement(be.Provider,{value:_},l.a.createElement(re.B,{"data-test-subj":"timeline","data-timeline-id":n,onKeyDown:B,ref:u},l.a.createElement(ge,{timelineId:n}),M===g.l.template&&l.a.createElement(pe,null,E.f),z,l.a.createElement(re.y,{$isVisible:!D,"data-test-subj":"timeline-hide-show-container"},l.a.createElement(f.b,{timelineId:n}),l.a.createElement(f.a,{timelineId:n})),l.a.createElement(ie,{graphEventId:C,sessionViewConfig:N,renderCellValue:e,rowRenderers:t,timelineId:n,timelineType:M,timelineDescription:A,timelineFullScreen:D})))};ye.displayName="StatefulTimelineComponent";const he=l.a.memo(ye)},659:function(e,t,n){"use strict";n.d(t,"a",(function(){return M}));var a=n(2),i=n.n(a),r=n(41),l=n.n(r),o=n(40),s=n(103),u=n(42);const c=n(5).i18n.translate("xpack.securitySolution.components.histogram.stackByOptions.stackByLabel",{defaultMessage:"Stack by"});var d=n(166),m=n(520),p=n(456),b=n(959),f=n(151),g=n(114),y=n(311),h=n(390),v=n(177),E=n(124),O=n(211),S=n(403),x=n(726),j=n(645);const k=({isInitialLoading:e,barChart:t,configs:n,stackByField:a,scopeId:r})=>e?i.a.createElement(j.a,null):i.a.createElement(x.a,{barChart:t,configs:n,stackByField:a,scopeId:r}),T=i.a.memo(k);k.displayName="MatrixHistogramChartContentComponent";var C=n(413);const w=l()(m.a).withConfig({displayName:"HistogramPanel",componentId:"sc-cnfih-0"})(["display:flex;flex-direction:column;",""],(({height:e})=>null!=e?`min-height: ${e}px;`:"")),I=({chartHeight:e,defaultStackByOption:t,endDate:n,errorMessage:r,filterQuery:l,getLensAttributes:m,headerChildren:x,histogramType:j,hideHistogramIfEmpty:k=!1,id:I,indexNames:M,runtimeMappings:A,isPtrIncluded:N,legendPosition:F,lensAttributes:D,mapping:R,onError:P,paddingSize:L="m",panelHeight:B=300,setAbsoluteRangeDatePickerTarget:_=g.a.global,setQuery:z,showInspectButton:q=!1,showLegend:$,showSpacer:V=!0,stackByOptions:H,startDate:U,subtitle:Q,scopeId:G,sourcererScopeId:W,title:K,titleSize:X,yTickFormatter:Y,skip:J,hideQueryToggle:Z=!1,applyGlobalQueriesAndFilters:ee=!0})=>{const te=`${I}-embeddable`,ne=Object(s.useDispatch)(),ae=Object(a.useCallback)((({x:e})=>{if(!e)return;const[t,n]=e;ne(Object(f.setAbsoluteRangeDatePicker)({id:_,from:new Date(t).toISOString(),to:new Date(n).toISOString()}))}),[ne,_]),ie=Object(a.useMemo)((()=>Object(p.b)({chartHeight:e,from:U,legendPosition:F,to:n,onBrushEnd:ae,yTickFormatter:Y,showLegend:$})),[e,U,F,n,ae,Y,$]),[re,le]=Object(a.useState)(!0),[oe,se]=Object(a.useState)(t);Object(a.useEffect)((()=>{se(t)}),[t]);const ue=Object(a.useCallback)((e=>{var n;se(null!==(n=H.find((t=>t.value===e.target.value)))&&void 0!==n?n:t)}),[t,H]),{toggleStatus:ce,setToggleStatus:de}=Object(v.a)(I),[me,pe]=Object(a.useState)(J||!ce);Object(a.useEffect)((()=>{pe(J||!ce)}),[J,ce]);const be=Object(a.useCallback)((e=>{de(e),pe(!e)}),[pe,de]),fe=Object(E.a)("chartEmbeddablesEnabled"),ge={endDate:n,errorMessage:r,filterQuery:l,histogramType:j,indexNames:M,onError:P,startDate:U,stackByField:oe.value,runtimeMappings:A,isPtrIncluded:N,skip:me||fe},[ye,{data:he,inspect:ve,totalCount:Ee,refetch:Oe}]=Object(b.a)(ge),Se=Object(a.useMemo)((()=>null!=K&&"function"==typeof K?K(oe):K),[K,oe]),xe=Object(C.a)({visualizationId:te}),je=Object(a.useMemo)((()=>{if(re)return null;if("function"==typeof Q){if(fe){if(!xe||(e=xe[0],!Object.values(null!==(t=e.aggregations)&&void 0!==t?t:{}).some((({buckets:e})=>e.length>0))))return Q(0);const n=xe[0].hits.total;return n>=0?Q(n):null}return Ee>=0?Q(Ee):null}var e,t;return Q}),[fe,re,Q,Ee,xe]),ke=Object(a.useMemo)((()=>!!(Ee<=0&&k)),[Ee,k]),Te=Object(a.useMemo)((()=>Object(p.c)(he,R)),[he,R]);Object(a.useEffect)((()=>{ye||re||z({id:I,inspect:ve,loading:ye,refetch:Oe}),re&&Te&&he&&le(!1)}),[Te,he,I,ve,fe,re,ye,Oe,le,z]);const Ce=Object(a.useMemo)((()=>({from:U,to:n})),[U,n]),we=Object(a.useMemo)((()=>({dnsIsPtrIncluded:null!=N&&N,filters:l?[{query:Object(u.isString)(l)?JSON.parse(l):l,meta:{}}]:void 0})),[N,l]);return ke?null:i.a.createElement(i.a.Fragment,null,i.a.createElement(y.a,{show:!re,targetClassNames:[O.a]},i.a.createElement(w,{"data-test-subj":`${I}Panel`,height:ce?B:void 0,paddingSize:L},ye&&!re&&i.a.createElement(o.EuiProgress,{"data-test-subj":"initialLoadingPanelMatrixOverTime",size:"xs",position:"absolute",color:"accent"}),i.a.createElement(d.a,{id:I,height:ce?void 0:0,title:Se,titleSize:X,toggleStatus:ce,toggleQuery:Z?void 0:be,subtitle:je,inspectMultiple:!0,showInspectButton:q&&!fe,isInspectDisabled:void 0===l},i.a.createElement(o.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},(m||D)&&Ce&&!fe&&i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(h.a,{className:"histogram-viz-actions",extraOptions:we,getLensAttributes:m,isInspectButtonDisabled:void 0===l,lensAttributes:D,queryId:I,stackByField:oe.value,timerange:Ce,title:K})),i.a.createElement(o.EuiFlexItem,{grow:!1},H.length>1&&i.a.createElement(o.EuiSelect,{onChange:ue,options:H,prepend:c,value:null==oe?void 0:oe.value})),i.a.createElement(o.EuiFlexItem,{grow:!1},x))),ce?fe?i.a.createElement(S.a,{scopeId:W,applyGlobalQueriesAndFilters:ee,"data-test-subj":"embeddable-matrix-histogram",extraOptions:we,getLensAttributes:m,height:null!=e?e:150,id:te,inspectTitle:K,lensAttributes:D,stackByField:oe.value,timerange:Ce}):i.a.createElement(T,{isInitialLoading:re,barChart:Te,configs:ie,stackByField:oe.value,scopeId:G}):null)),V&&i.a.createElement(o.EuiSpacer,{"data-test-subj":"spacer",size:"l"}))},M=i.a.memo(I)},660:function(e,t,n){"use strict";n.d(t,"b",(function(){return T})),n.d(t,"a",(function(){return C}));var a=n(130),i=n.n(a),r=n(42),l=n(2),o=n(103),s=n(3),u=n(51),c=n(102),d=n(216),m=n(111),p=n(518),b=n(115),f=n(113);const g=n(5).i18n.translate("xpack.securitySolution.timelineEvents.errorSearchDescription",{defaultMessage:"An error has occurred on timeline events search"});var y=n(118),h=n(175),v=n(302),E=n(108),O=n(303),S=n(4);const x="timelineEventsQuery",j=[{field:"@timestamp",direction:f.b.asc,type:"date",esTypes:["date"]}],k=e=>({...Object(r.isEmpty)(null==e?void 0:e.eventCategoryField)?{}:{eventCategoryField:null==e?void 0:e.eventCategoryField},...Object(r.isEmpty)(null==e?void 0:e.size)?{}:{size:null==e?void 0:e.size},...Object(r.isEmpty)(null==e?void 0:e.tiebreakerField)?{}:{tiebreakerField:null==e?void 0:e.tiebreakerField},...Object(r.isEmpty)(null==e?void 0:e.timestampField)?{}:{timestampField:null==e?void 0:e.timestampField}}),T=({dataViewId:e,endDate:t,eqlOptions:n,id:a=x,indexNames:T,fields:C,filterQuery:w,runtimeMappings:I,startDate:M,language:A="kuery",limit:N,sort:F=j,skip:D=!1,timerangeKind:R})=>{const[{pageName:P}]=Object(h.a)(),L=Object(o.useDispatch)(),{data:B}=Object(c.j)().services,_=Object(l.useRef)(r.noop),z=Object(l.useRef)(new AbortController),q=Object(l.useRef)(new s.Subscription),[$,V]=Object(l.useState)(!1),[H,U]=Object(l.useState)(a===y.c.active?v.a.getActivePage():0),[Q,G]=Object(l.useState)(null),W=Object(l.useRef)(null),{startTracking:K}=Object(O.a)(),X=Object(l.useCallback)((()=>{null!=a&&p.a.some((e=>e===a))&&(L(m.a.clearEventsLoading({id:a})),L(m.a.clearEventsDeleted({id:a})))}),[L,a]),Y=Object(l.useCallback)((e=>{X(),a===y.c.active&&(v.a.setExpandedDetail({}),v.a.setActivePage(e)),U(e)}),[X,a]),J=Object(l.useCallback)((()=>{null!=_.current&&_.current(),Y(0)}),[Y]),Z=Object(l.useCallback)((e=>{L(m.a.setTimelineUpdatedAt({id:a,updated:e}))}),[L,a]),[ee,te]=Object(l.useState)({id:a,inspect:{dsl:[],response:[]},refetch:J,totalCount:-1,pageInfo:{activePage:0,querySize:0},events:[],loadPage:Y,updatedAt:0}),{addWarning:ne}=Object(E.a)(),ae=Object(l.useCallback)((async(t,n)=>{if(null==t||""===P||D)return;const i=async()=>{W.current=t,z.current=new AbortController,V(!0);const{endTracking:i}=K({name:`${S.l} timeline events search`});q.current=B.search.search(t,{strategy:"eql"===t.language?"timelineEqlSearchStrategy":"timelineSearchStrategy",abortSignal:z.current.signal,indexPattern:{id:e}}).subscribe({next:e=>{Object(u.isCompleteResponse)(e)?(i("success"),V(!1),te((i=>{const r={...i,events:(l=e.edges,l.map((e=>e.node))),inspect:Object(b.getInspectResponse)(e,i.inspect),pageInfo:e.pageInfo,totalCount:e.totalCount,updatedAt:Date.now()};var l;return Z(r.updatedAt),a===y.c.active&&(v.a.setExpandedDetail({}),v.a.setPageName(P),"eql"===t.language?(v.a.setEqlRequest(t),v.a.setEqlResponse(r)):(v.a.setRequest(t),v.a.setResponse(r))),n&&n(r),r})),q.current.unsubscribe()):Object(u.isErrorResponse)(e)&&(i("invalid"),V(!1),ne(g),q.current.unsubscribe())},error:e=>{i(z.current.signal.aborted?"aborted":"error"),V(!1),B.search.showError(e),q.current.unsubscribe()}})};if(a===y.c.active&&""!==v.a.getPageName()&&P!==v.a.getPageName()){if(v.a.setPageName(P),z.current.abort(),V(!1),"eql"===t.language?(W.current=v.a.getEqlRequest(),_.current=i.bind(null,v.a.getEqlRequest())):(W.current=v.a.getRequest(),_.current=i.bind(null,v.a.getRequest())),te((e=>{const n="eql"===t.language?v.a.getEqlResponse():v.a.getResponse();return null!=n?{...n,refetch:J,loadPage:Y}:e})),"eql"!==t.language&&null!=v.a.getResponse())return;if("eql"===t.language&&null!=v.a.getEqlResponse())return}q.current.unsubscribe(),z.current.abort(),await i(),_.current=i}),[P,D,a,K,B.search,e,Z,ne,J,Y]);Object(l.useEffect)((()=>{0!==T.length&&G((e=>{var r,l,o,s,u,c;const m=e,p={defaultIndex:null!==(r=null==e?void 0:e.defaultIndex)&&void 0!==r?r:[],filterQuery:null!==(l=null==e?void 0:e.filterQuery)&&void 0!==l?l:"",querySize:null!==(o=null==e?void 0:e.pagination.querySize)&&void 0!==o?o:0,sort:null!==(s=null==e?void 0:e.sort)&&void 0!==s?s:j,timerange:null!==(u=null==e?void 0:e.timerange)&&void 0!==u?u:{},runtimeMappings:null!==(c=null==e?void 0:e.runtimeMappings)&&void 0!==c?c:{},...k(m)},b=M&&t?{timerange:{interval:"12h",from:M,to:t}}:{},g={defaultIndex:T,filterQuery:Object(d.a)(w),querySize:N,sort:F,runtimeMappings:I,...b,...k(n)},h=i()(p,g)?H:0,E={defaultIndex:T,factoryQueryType:f.A.all,fieldRequested:C,fields:C,filterQuery:Object(d.a)(w),pagination:{activePage:h,querySize:N},language:A,runtimeMappings:I,sort:F,...b,...n||{}};return H!==h&&(U(h),a===y.c.active&&v.a.setActivePage(h)),i()(e,E)?e:E}))}),[L,T,H,t,n,w,a,A,N,M,F,C,I]);const ie=Object(l.useCallback)((async e=>{a===y.c.active&&"absolute"!==R&&i()(W.current,Q)||await ae(Q,e)}),[a,Q,ae,R]);return Object(l.useEffect)((()=>{Object(r.isEmpty)(w)&&te({id:a,inspect:{dsl:[],response:[]},refetch:J,totalCount:-1,pageInfo:{activePage:0,querySize:0},events:[],loadPage:Y,updatedAt:0})}),[w,a,J,Y]),[$,ee,ie]},C=({dataViewId:e,endDate:t,eqlOptions:n,id:a=x,indexNames:i,fields:r,filterQuery:o,runtimeMappings:s,startDate:u,language:c="kuery",limit:d,sort:m=j,skip:p=!1,timerangeKind:b})=>{const[f,g,y]=T({dataViewId:e,endDate:t,eqlOptions:n,id:a,indexNames:i,fields:r,filterQuery:o,runtimeMappings:s,startDate:u,language:c,limit:d,sort:m,skip:p,timerangeKind:b});return Object(l.useEffect)((()=>{y&&y()}),[y]),[f,g]}},662:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(2),i=n(102),r=n(109),l=n(59);const o=({closePopover:e,draggableId:t,fieldName:n,keyboardHandlerRef:o,openPopover:s})=>{const{timelines:u}=Object(i.j)().services,c=u.getUseAddToTimeline(),{beginDrag:d,cancelDrag:m,dragToLocation:p,endDrag:b,hasDraggableLock:f}=c({draggableId:t,fieldName:n}),[g,y]=Object(a.useState)(null),h=Object(a.useCallback)((()=>{y((e=>e?(m(e),null):null))}),[m]),v=Object(a.useCallback)((n=>{const a=document.querySelector(`[data-rbd-drag-handle-draggable-id="${t}"]`);var i;a&&((f()||!f()&&" "===n.key)&&(n.preventDefault(),n.stopPropagation()),(({beginDrag:e,cancelDragActions:t,closePopover:n,draggableElement:a,dragActions:i,dragToLocation:o,endDrag:s,keyboardEvent:u,openPopover:c,setDragActions:d})=>{let m=null;switch(u.key){case" ":i?(s(i),d(null)):(null!=n&&n(),d(e()));break;case"Escape":t();break;case"Tab":(e=>{const t=e.querySelectorAll("a, button");t.forEach((e=>{e.setAttribute("tabindex","-1")})),setTimeout((()=>{t.forEach((e=>{e.setAttribute("tabindex","0")}))}),0)})(a);break;case"ArrowUp":m=a.getBoundingClientRect(),o({dragActions:i,position:{x:m.x,y:m.y-r.f}});break;case"ArrowDown":m=a.getBoundingClientRect(),o({dragActions:i,position:{x:m.x,y:m.y+r.f}});break;case"ArrowLeft":m=a.getBoundingClientRect(),o({dragActions:i,position:{x:m.x-r.f,y:m.y}});break;case"ArrowRight":m=a.getBoundingClientRect(),o({dragActions:i,position:{x:m.x+r.f,y:m.y}});break;case"Enter":Object(l.stopPropagationAndPreventDefault)(u),i||null==c||c()}})({beginDrag:d,cancelDragActions:h,closePopover:e,dragActions:g,draggableElement:a,dragToLocation:p,endDrag:b,keyboardEvent:n,openPopover:s,setDragActions:y}),null===(i=o.current)||void 0===i||i.focus())}),[d,h,e,g,t,p,b,f,o,s,y]);return Object(a.useMemo)((()=>({onBlur:h,onKeyDown:v})),[h,v])}},667:function(e,t){e.exports=function(){}},668:function(e,t,n){"use strict";let a;n.d(t,"a",(function(){return a})),n(270).NetworkType.details,function(e){e.anomalies="anomalies",e.flows="flows",e.tls="tls",e.http="http",e.events="events",e.users="users"}(a||(a={}))},669:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"a",(function(){return r})),n.d(t,"b",(function(){return l}));var a=n(195);const i=(e,t)=>`/name/${e}${Object(a.a)(t)}`,r=(e,t,n)=>`/name/${e}/${t}${Object(a.a)(n)}`,l=(e,t)=>`/${e}${Object(a.a)(t)}`},670:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"b",(function(){return r}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.dragAndDrop.copyToClipboardTooltip",{defaultMessage:"Copy to Clipboard"}),r=a.i18n.translate("xpack.securitySolution.dragAndDrop.draggableKeyboardInstructionsNotDraggingScreenReaderOnly",{defaultMessage:"Press enter for options, or press space to begin dragging."});a.i18n.translate("xpack.securitySolution.dragAndDrop.fieldLabel",{defaultMessage:"Field"}),a.i18n.translate("xpack.securitySolution.dragAndDrop.closeButtonLabel",{defaultMessage:"Close"})},671:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(40),i=n(2),r=n.n(i),l=n(140),o=n(939);const s=r.a.memo((({hideActions:e=[],modalTitle:t,onClose:n,onOpen:i})=>r.a.createElement(a.EuiModal,{"data-test-subj":"open-timeline-modal",maxWidth:1100,onClose:n},r.a.createElement(o.a,{closeModalTimeline:n,hideActions:e,isModal:!0,defaultPageSize:10,onOpenTimeline:i,title:null!=t?t:l.H}))));s.displayName="OpenTimelineModal"},672:function(e,t,n){"use strict";n.d(t,"b",(function(){return y})),n.d(t,"a",(function(){return h})),n.d(t,"c",(function(){return v}));var a=n(42),i=n(2),r=n(103),l=n(5),o=n(161),s=n(12),u=n(108),c=n(116),d=n(158),m=n(164),p=n(254),b=n(148),f=n(909),g=n(110);const y="createRuleFromTimeline",h="createRuleFromEql",v=e=>{const t=Object(r.useDispatch)(),{addError:n}=Object(u.a)(),{browserFields:v,dataViewId:E,selectedPatterns:O}=Object(c.d)(g.SourcererScopeName.timeline),S=Object(i.useRef)(!1),[x,j]=Object(i.useState)(null),[k,T]=Object(i.useState)(!1),C=Object(i.useCallback)((e=>{T(!0),j(e),e.dataViewId===E||Object(a.isEmpty)(e.indexNames)||t(d.a.setSelectedDataView({id:g.SourcererScopeName.timeline,selectedDataViewId:e.dataViewId,selectedPatterns:e.indexNames}))}),[E,t]),[w]=Object(i.useState)({dataViewId:E,selectedPatterns:O}),I=Object(i.useMemo)((()=>null==x||Object(a.isEmpty)(v)||null!==x.dataViewId&&null!==E&&E!==x.dataViewId?null:v),[v,E,x]),M=Object(p.e)(y),A=Object(i.useMemo)(M,[M]),N=Object(p.e)(h),F=Object(i.useMemo)(N,[N]),D=Object(i.useCallback)((()=>{if(null!=x&&null!=I){try{const t=()=>{var e,t,n,a,i,r,l;return{dataProviders:null!=x.dataProviders&&x.dataProviders.length>0?Object(o.f)(Object(b.g)(x.dataProviders,I),{fields:[],title:O.join(",")}):"",query:{query:null!==(e=null===(t=x.kqlQuery.filterQuery)||void 0===t||null===(n=t.kuery)||void 0===n?void 0:n.expression)&&void 0!==e?e:"",language:null!==(a=null===(i=x.kqlQuery.filterQuery)||void 0===i||null===(r=i.kuery)||void 0===r?void 0:r.kind)&&void 0!==a?a:"kuery"},filters:null!==(l=x.filters)&&void 0!==l?l:[],eqlOptions:{}}},n=()=>{var e;return{dataProviders:"",query:{query:null!==(e=x.eqlOptions.query)&&void 0!==e?e:"",language:"eql"},filters:[],eqlOptions:{eqlOptions:x.eqlOptions}}},a=S.current?n():t();T(!1),e({index:O,queryBar:{filters:""!==a.dataProviders?[...a.filters,Object(f.b)(a.dataProviders)]:a.filters,query:a.query,saved_id:null},...a.eqlOptions})}catch(e){T(!1),n(e,{toastMessage:l.i18n.translate("xpack.securitySolution.ruleFromTimeline.error.toastMessage",{defaultMessage:"Failed to create rule from timeline with id: {id}",values:{id:x.id}}),title:l.i18n.translate("xpack.securitySolution.ruleFromTimeline.error.title",{defaultMessage:"Failed to import rule from timeline"})})}S.current=!1,w.dataViewId!==E&&t(d.a.setSelectedDataView({id:g.SourcererScopeName.timeline,selectedDataViewId:w.dataViewId,selectedPatterns:w.selectedPatterns}))}}),[n,E,t,w.dataViewId,w.selectedPatterns,I,O,x,e]);Object(i.useEffect)((()=>{null!=I&&D()}),[D,I]);const R=Object(i.useCallback)((e=>{null!=x&&e===x.id||Object(m.h)({timelineId:e,onOpenTimeline:C,updateIsLoading:({id:e,isLoading:n})=>t(Object(s.updateIsLoading)({id:e,isLoading:n})),updateTimeline:Object(m.b)(t)})}),[t,C,x]),[P,L]=Object(i.useState)(!1);return Object(i.useEffect)((()=>{if(!P){let e=null;null!=A?e=A:null!=F&&(e=F,S.current=!0),null!=e&&(L(!0),R(e),T(!0))}}),[R,A,F,P]),{loading:k,onOpenTimeline:C}}},673:function(e,t,n){"use strict";n.d(t,"a",(function(){return c}));var a=n(2),i=n.n(a),r=n(130),l=n.n(r),o=n(13),s=n(72),u=n(14);const c=Object(a.memo)((({dateRangeFrom:e,dateRangeTo:t,hideSavedQuery:n=!1,indexPattern:r,isLoading:c=!1,isRefreshPaused:d,filterQuery:m,filterManager:p,filters:b,onChangedQuery:f,onSubmitQuery:g,refreshInterval:y,savedQuery:h,onSavedQuery:v,dataTestSubj:E,displayStyle:O,isDisabled:S})=>{const x=Object(a.useCallback)((e=>{null==e.query||l()(e.query,m)||g(e.query)}),[m,g]),j=Object(a.useCallback)((e=>{f&&null!=e.query&&!l()(e.query,m)&&f(e.query)}),[m,f]),k=Object(a.useCallback)((e=>{const{query:t,filters:n,timefilter:a}=e.attributes;g(t,a),p.setFilters(n||[]),v(e)}),[p,g,v]),T=Object(a.useCallback)((()=>{null!=h&&(g({query:"",language:h.attributes.query.language}),p.setFilters([]),v(void 0))}),[p,g,v,h]),C=Object(a.useCallback)((e=>{p.setFilters(e)}),[p]),w=Object(a.useMemo)((()=>[r]),[r]),I=Object(a.useMemo)((()=>new o.TimeHistory(new u.Storage(localStorage))),[]);return i.a.createElement(s.SearchBar,{showSubmitButton:!1,dateRangeFrom:e,dateRangeTo:t,filters:b,indexPatterns:w,isLoading:c,isRefreshPaused:d,query:m,onClearSavedQuery:T,onFiltersUpdated:C,onQueryChange:j,onQuerySubmit:x,onSaved:v,onSavedQueryUpdated:k,refreshInterval:y,showAutoRefreshOnly:!1,showFilterBar:!n,showDatePicker:!1,showQueryInput:!0,showSaveQuery:!0,timeHistory:I,dataTestSubj:E,savedQuery:h,displayStyle:O,isDisabled:S})}));c.displayName="QueryBar"},674:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(40),i=n(2),r=n.n(i),l=n(41);const o=n.n(l)()((({iconSide:e,children:t,...n})=>r.a.createElement(a.EuiLink,n,t))).withConfig({displayName:"Link",componentId:"sc-z5mbxm-0"})(["",""],(({iconSide:e,theme:t})=>Object(l.css)(["align-items:center;display:inline-flex;vertical-align:top;white-space:nowrap;"," ",""],"left"===e&&Object(l.css)([".euiIcon{margin-right:",";}"],t.eui.euiSizeXS),"right"===e&&Object(l.css)(["flex-direction:row-reverse;.euiIcon{margin-left:",";}"],t.eui.euiSizeXS))));o.displayName="Link";const s=r.a.memo((({ariaLabel:e,children:t,color:n,dataTestSubj:l,disabled:s,href:u,iconSide:c="left",iconSize:d="s",iconType:m,onClick:p})=>{const b=Object(i.useCallback)((e=>"object"==typeof e&&null!=e&&"props"in e&&e.props&&e.props.children?b(e.props.children):null!=e&&Object.keys(e).length>0?e:""),[]),f=Object(i.useMemo)((()=>e||b(t)),[e,t,b]);return r.a.createElement(o,{className:"siemLinkIcon",color:n,"data-test-subj":l,disabled:s,href:u,iconSide:c,onClick:p,"aria-label":f},r.a.createElement(a.EuiIcon,{size:d,type:m}),r.a.createElement("span",{className:"siemLinkIcon__label"},t))}));s.displayName="LinkIcon"},675:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=(e,t)=>{const n=window.URL.createObjectURL(e),a=document.createElement("a");a.href=n,a.download=t,a.click(),window.URL.revokeObjectURL(n),a.remove()}},676:function(e,t,n){"use strict";n.d(t,"a",(function(){return v}));var a=n(40),i=n(42),r=n(2),l=n.n(r),o=n(41),s=n.n(o),u=n(106),c=n(479),d=n(164),m=n(140),p=n(117),b=n(268),f=n(113);const g=s()(a.EuiFlexItem).withConfig({displayName:"TimelineContentItem",componentId:"sc-t3gz96-0"})(["max-width:calc(100% - 56px);"]),y=s()(a.EuiFilterButton).withConfig({displayName:"StyledEuiFilterButton",componentId:"sc-t3gz96-1"})(["border-top:0;border-bottom:0;"]),h=({hideUntitled:e=!1,getSelectableOptions:t,onClosePopover:n,onTimelineChange:o,timelineType:s,placeholder:h})=>{const[v,E]=Object(r.useState)(50),[O,S]=Object(r.useState)(0),[x,j]=Object(r.useState)(""),[k,T]=Object(r.useState)(!1),{fetchAllTimeline:C,timelines:w,loading:I,totalCount:M}=Object(c.b)(),A=Object(r.useRef)(null),N=Object(r.useRef)(null),F=Object(r.useMemo)((()=>Object(i.debounce)(500,j)),[]),D=Object(r.useCallback)((e=>{F(e)}),[F]),R=Object(r.useCallback)((()=>{T(!k)}),[k]),P=Object(r.useCallback)(((e,t,n)=>{if(e<t&&A.current&&N.current){const e=A.current.clientHeight,t=N.current.clientHeight;n>10&&t-n<1.2*e&&t>O&&(S(t),E(v+50))}}),[O,v]),L=Object(r.useCallback)(((e,t)=>{const n=Object(d.f)({...e,title:e.timelineTitle})?m.ab:e.timelineTitle,r=null!=e.description&&e.description.trim().length>0?e.description:null;return l.a.createElement(a.EuiFlexGroup,{gutterSize:"s",justifyContent:"spaceBetween",alignItems:"center",responsive:!1},l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiIcon,{type:"on"===e.checked?"check":"empty",color:"primary"})),l.a.createElement(g,{grow:!0},l.a.createElement(a.EuiFlexGroup,{gutterSize:"none",direction:"column",responsive:!1},l.a.createElement(a.EuiFlexItem,{"data-test-subj":"timeline"},l.a.createElement(a.EuiToolTip,{content:n,anchorClassName:"eui-textTruncate eui-alignMiddle"},l.a.createElement(a.EuiHighlight,{search:t},n))),l.a.createElement(a.EuiFlexItem,null,l.a.createElement(a.EuiToolTip,{content:r,anchorClassName:"eui-textTruncate eui-alignMiddle"},l.a.createElement(a.EuiTextColor,{color:"subdued",component:"span"},l.a.createElement("small",null,null!=r?r:Object(p.d)())))))),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiIcon,{type:null!=e.favorite&&Object(i.isEmpty)(e.favorite)?"starEmpty":"starFilled"})))}),[]),B=Object(r.useCallback)((e=>{const t=e.filter((e=>"on"===e.checked));var a;null!=t&&t.length>0&&o(Object(i.isEmpty)(t[0].timelineTitle)?m.ab:t[0].timelineTitle,"-1"===t[0].id?null:t[0].id,null!==(a=t[0].graphEventId)&&void 0!==a?a:""),n()}),[n,o]),_=Object(r.useCallback)(((e,t)=>l.a.createElement(l.a.Fragment,null,t,e)),[]),z=Object(r.useMemo)((()=>({"data-test-subj":"timeline-super-select-search-box",placeholder:null!=h?h:b.e(s),onSearch:D,incremental:!1,append:l.a.createElement(y,{"data-test-subj":"only-favorites-toggle",hasActiveFilters:k,onClick:R},m.D)})),[R,D,k,s,h]),q=Object(r.useMemo)((()=>({rowHeight:50,showIcons:!1,windowProps:{onScroll:({scrollOffset:t})=>P((null!=w?w:[]).filter((t=>!e||""!==t.title)).length,M,t),outerRef:A,innerRef:N}})),[P,e,M,w]);return Object(r.useEffect)((()=>{C({pageInfo:{pageIndex:1,pageSize:v},search:x,sort:{sortField:u.f.updated,sortOrder:f.b.desc},onlyUserFavorite:k,status:null,timelineType:s})}),[C,k,v,x,s]),l.a.createElement(a.EuiSelectable,{"data-test-subj":"selectable-input",height:260,isLoading:I&&null==w,listProps:q,renderOption:L,onChange:B,searchable:!0,searchProps:z,singleSelection:!0,options:($=t({timelines:null!=w?w:[],onlyFavorites:k,searchTimelineValue:x,timelineType:s}),$.map((({title:e,...t})=>({...t,title:void 0,timelineTitle:e}))))},_);var $},v=Object(r.memo)(h)},677:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=n(5).i18n.translate("xpack.securitySolution.alertsView.osqueryAlertTitle",{defaultMessage:"Run Osquery"})},678:function(e,t,n){const a=n(292);e.exports=(e,t)=>{const n=a(e,t);return n?n.version:null}},679:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(2),i=n.n(a),r=n(41);const l=n.n(r).a.div.withConfig({displayName:"Wrapper",componentId:"sc-4ssvqk-0"})(["",""],(({theme:e})=>Object(r.css)([".siemSubtitle__item{color:",";font-size:",";line-height:",";@media only screen and (min-width:","){display:inline-block;margin-right:",";&:last-child{margin-right:0;}}}"],e.eui.euiTextSubduedColor,e.eui.euiFontSizeXS,e.eui.euiLineHeight,e.eui.euiBreakpoints.s,e.eui.euiSize)));l.displayName="Wrapper";const o=i.a.memo((({children:e,dataTestSubj:t="header-panel-subtitle"})=>"string"==typeof e?i.a.createElement("p",{className:"siemSubtitle__item siemSubtitle__item--text","data-test-subj":t},e):i.a.createElement("div",{className:"siemSubtitle__item siemSubtitle__item--node","data-test-subj":t},e)));o.displayName="SubtitleItem";const s=i.a.memo((({items:e})=>i.a.createElement(l,{className:"siemSubtitle"},Array.isArray(e)?e.map(((e,t)=>i.a.createElement(o,{key:t},e))):i.a.createElement(o,null,e))));s.displayName="Subtitle"},680:function(e,t,n){"use strict";n.d(t,"a",(function(){return l}));var a=n(2),i=n(4),r=n(102);const l=({defaultValue:e,key:t,plugin:n=i.i,isInvalidDefault:l})=>{const{storage:o}=Object(r.j)().services,[s,u]=Object(a.useState)(!1),[c,d]=Object(a.useState)(e),m=Object(a.useCallback)((()=>{const a=o.get(`${n}.${t}`),i=typeof a!=typeof e,r=null!=l&&l(a);d(i||r?e:a)}),[e,l,t,n,o]),p=Object(a.useCallback)((e=>{if("function"==typeof e){const a=e;d((e=>{const i=a(e);return o.set(`${n}.${t}`,i),i}))}else o.set(`${n}.${t}`,e),d(e)}),[t,n,o]);return Object(a.useEffect)((()=>{s||(m(),u(!0))}),[s,m]),[c,p,u]}},681:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"d",(function(){return r})),n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return o}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.eventsViewer.showingLabel",{defaultMessage:"Showing"}),r=(a.i18n.translate("xpack.securitySolution.eventsViewer.eventsLabel",{defaultMessage:"Events"}),e=>a.i18n.translate("xpack.securitySolution.eventsViewer.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {event} other {events}}"})),l=a.i18n.translate("xpack.securitySolution.eventsViewer.actionsColumnLabel",{defaultMessage:"Actions"}),o=a.i18n.translate("xpack.securitySolution.eventsViewer.timelineEvents.errorSearchDescription",{defaultMessage:"An error has occurred on timeline events search"})},682:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"a",(function(){return r})),n.d(t,"b",(function(){return l}));var a=n(5);const i=e=>a.i18n.translate("xpack.securitySolution.configurations.suppressedAlerts",{defaultMessage:"Alert has {numAlertsSuppressed} suppressed alerts",values:{numAlertsSuppressed:e}}),r=180,l=190},699:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(40),i=n(2),r=n.n(i);const l=n(5).i18n.translate("xpack.securitySolution.accessibility.tooltipWithKeyboardShortcut.pressTooltipLabel",{defaultMessage:"Press"}),o=({additionalScreenReaderOnlyContext:e="",content:t,shortcut:n,showShortcut:i})=>r.a.createElement(r.a.Fragment,null,r.a.createElement("div",{"data-test-subj":"content"},t),""!==e&&r.a.createElement(a.EuiScreenReaderOnly,{"data-test-subj":"additionalScreenReaderOnlyContext"},r.a.createElement("p",null,e)),i&&r.a.createElement(a.EuiText,{color:"subdued","data-test-subj":"shortcut",size:"s",textAlign:"center"},r.a.createElement("span",null,l)," ",r.a.createElement(a.EuiBadge,{color:"hollow"},n))),s=r.a.memo(o);s.displayName="TooltipWithKeyboardShortcut"},701:function(e,t,n){"use strict";n.d(t,"a",(function(){return m})),n.d(t,"b",(function(){return f}));var a=n(40),i=n(2),r=n.n(i),l=n(140);const o=r.a.memo((({onClick:e})=>r.a.createElement(a.EuiButtonEmpty,{color:"text","data-test-subj":"open-timeline-button",iconSide:"left",iconType:"folderOpen",onClick:e},l.G)));o.displayName="OpenTimelineModalButton";var s=n(671),u=n(248),c=n(412),d=n(912);const m="add-timeline-button",p=["createFrom"],b=({timelineId:e})=>{const[t,n]=Object(i.useState)(!1),[l,b]=Object(i.useState)(!1),f=Object(i.useCallback)((()=>n(!t)),[t]),g=Object(i.useCallback)((()=>n(!1)),[]),y=Object(i.useCallback)((()=>b(!1)),[]),h=Object(i.useCallback)((()=>{g(),b(!0)}),[g]),v=Object(i.useMemo)((()=>r.a.createElement(a.EuiButtonIcon,{className:m,"data-test-subj":"settings-plus-in-circle",iconType:"plusInCircle",color:"primary",size:"m",onClick:f,"aria-label":u.a})),[f]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiPopover,{anchorPosition:"downRight",button:v,id:"timelineSettingsPopover",panelProps:{"data-test-subj":"timeline-addPopupPanel"},isOpen:t,closePopover:g,ownFocus:!0,repositionOnScroll:!0},r.a.createElement(a.EuiFlexGroup,{alignItems:"flexStart",direction:"column",gutterSize:"none"},r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(c.c,{timelineId:e,title:u.h,closeGearMenu:g})),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(d.a,{closeGearMenu:g,timelineId:e,title:u.g})),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(o,{onClick:h}))))),l?r.a.createElement(s.a,{onClose:y,hideActions:p}):null)},f=r.a.memo(b)},715:function(e,t,n){e.exports=n(33)(811)},716:function(e,t,n){e.exports=n(33)(1608)},717:function(e,t,n){e.exports=n(33)(3344)},718:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return f}));var a=n(40),i=n(50),r=n.n(i),l=n(2),o=n.n(l),s=n(41),u=n.n(s),c=n(47),d=n(551),m=n(168);d.f;const p=u.a.h3.withConfig({displayName:"TitleText",componentId:"sc-7x1zh4-0"})(["margin:0 5px;cursor:default;user-select:none;"]);p.displayName="TitleText",o.a.memo((({noteIds:e})=>o.a.createElement(a.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},o.a.createElement(a.EuiFlexItem,{grow:!1},o.a.createElement(a.EuiIcon,{color:"text",size:"l",type:"editorComment"})),o.a.createElement(a.EuiFlexItem,{grow:!1},o.a.createElement(a.EuiTitle,{size:"s"},o.a.createElement(p,null,d.e))),o.a.createElement(a.EuiFlexItem,{grow:!1},o.a.createElement(m.c,{color:"hollow"},e.length))))).displayName="NotesCount";const b=({newNote:e,user:t})=>({created:r.a.utc().toDate(),id:Object(c.v4)(),lastEdit:null,note:e,saveObjectId:null,user:t,version:null}),f=({associateNote:e,newNote:t,updateNewNote:n,updateNote:a,user:i})=>{const r=b({newNote:t,user:i});a(r),e(r.id),n("")}},721:function(e,t,n){"use strict";n.d(t,"d",(function(){return i})),n.d(t,"a",(function(){return r})),n.d(t,"f",(function(){return l})),n.d(t,"e",(function(){return o})),n.d(t,"c",(function(){return s})),n.d(t,"b",(function(){return u}));var a=n(5);const i="timeline",r=a.i18n.translate("xpack.securitySolution.actions.cellValue.addToTimeline.displayName",{defaultMessage:"Add to timeline"}),l=a.i18n.translate("xpack.securitySolution.actions.cellValue.addToNewTimeline.displayName",{defaultMessage:"Investigate in timeline"}),o=e=>a.i18n.translate("xpack.securitySolution.actions.addToTimeline.addedFieldMessage",{values:{fieldOrValue:e},defaultMessage:"Added {fieldOrValue} to timeline"}),s=a.i18n.translate("xpack.securitySolution.actions.cellValue.addToTimeline.warningTitle",{defaultMessage:"Unable to add to timeline"}),u=a.i18n.translate("xpack.securitySolution.actions.cellValue.addToTimeline.warningMessage",{defaultMessage:"Filter received is empty or cannot be added to timeline"})},722:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"b",(function(){return m}));var a=n(40),i=n(2),r=n.n(i),l=n(41),o=n.n(l),s=n(497);const u="exit-full-screen",c=o()(a.EuiButton).withConfig({displayName:"StyledEuiButton",componentId:"sc-ve6et8-0"})(["margin:",";"],(({theme:e})=>e.eui.euiSizeS)),d=({fullScreen:e,setFullScreen:t})=>{const n=Object(i.useCallback)((()=>{t(!1)}),[t]),l=Object(i.useCallback)((e=>{"Escape"===e.key&&(e.preventDefault(),n())}),[n]);return e?r.a.createElement(r.a.Fragment,null,r.a.createElement(a.EuiWindowEvent,{event:"keydown",handler:l}),r.a.createElement(c,{className:u,"data-test-subj":"exit-full-screen",fullWidth:!1,iconType:"fullScreen",isDisabled:!e,onClick:n},s.a)):null};d.displayName="ExitFullScreenComponent";const m=r.a.memo(d)},723:function(e,t,n){"use strict";n.d(t,"a",(function(){return d}));var a=n(40),i=n(2),r=n.n(i),l=n(41),o=n.n(l),s=n(294);const u=o.a.div.withConfig({displayName:"PlaceHolder",componentId:"sc-pcodem-0"})(["padding:",";"],(e=>e.theme.eui.euiSizeS)),c=({count:e,onClick:t})=>{const n=Object(i.useCallback)((()=>t&&t()),[t]);return e?t?r.a.createElement(a.EuiLink,{onClick:n},r.a.createElement("b",null,r.a.createElement(s.a,{count:e}))):r.a.createElement("b",null,r.a.createElement(s.a,{count:e})):r.a.createElement(u,null)};c.displayName="ChartLabelComponent";const d=r.a.memo(c)},724:function(e,t,n){"use strict";n.d(t,"b",(function(){return y})),n.d(t,"a",(function(){return h}));var a=n(40),i=n(2),r=n.n(i),l=n(57),o=n(8),s=n(41),u=n.n(s),c=n(297),d=n(424),m=n(725);const p={chartMargins:{top:0,bottom:0,left:0,right:0},partition:{idealFontSizeJump:1.1,outerSizeRatio:1,emptySizeRatio:.8,circlePadding:4}},b=u()(a.EuiFlexGroup).withConfig({displayName:"DonutTextWrapper",componentId:"sc-g5h38u-0"})(["top:",";width:100%;max-width:77px;position:absolute;z-index:1;",""],(({$isChartEmbeddablesEnabled:e,$dataExists:t})=>e&&!t?"66%":"34%;"),(({className:e,$donutTextWrapperStyles:t})=>e&&t?`&.${e} {${t}}`:"")),f=u()(a.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItem",componentId:"sc-g5h38u-1"})(["position:relative;align-items:center;"]),g=({children:e,dataExists:t,donutTextWrapperClassName:n,donutTextWrapperStyles:l,isChartEmbeddablesEnabled:o,label:s,title:u})=>{const{euiTheme:c}=Object(a.useEuiTheme)(),d=Object(i.useMemo)((()=>({color:c.colors.disabled})),[c.colors.disabled]),m=o?void 0:"eui-textTruncate";return r.a.createElement(a.EuiFlexGroup,{alignItems:"center",justifyContent:"center",responsive:!1,gutterSize:"l","data-test-subj":"donut-chart"},r.a.createElement(f,{grow:o},r.a.createElement(b,{$dataExists:t,$donutTextWrapperStyles:l,$isChartEmbeddablesEnabled:o,alignItems:"center",className:n,direction:"column",gutterSize:"none",justifyContent:"center"},r.a.createElement(a.EuiFlexItem,null,u),s&&r.a.createElement(a.EuiFlexItem,{className:m},r.a.createElement(a.EuiToolTip,{content:s},r.a.createElement(a.EuiText,{className:m,size:"s",style:t?void 0:d},s)))),e))},y=r.a.memo(g),h=({data:e,fillColor:t,height:n=90,label:s,legendItems:u,onPartitionClick:b,title:f,totalCount:g})=>{const{baseTheme:h,theme:v}=Object(c.i)(),E=Object(i.useCallback)((e=>{if(b){var t;const n=e.flat(2),a=n.length>0&&"groupByRollup"in n[0]&&null!=(null===(t=n[0])||void 0===t?void 0:t.groupByRollup)?`${n[0].groupByRollup}`:"";Object(o.isEmpty)(a.trim())||b(a.toLowerCase())}}),[b]);return r.a.createElement(y,{dataExists:null!=e&&e.length>0,label:s,title:f,isChartEmbeddablesEnabled:!1},r.a.createElement(r.a.Fragment,null,null==e||null==g||0===g?r.a.createElement(m.a,{size:n}):r.a.createElement(l.Chart,{size:n},r.a.createElement(l.Settings,{theme:[p,v],baseTheme:h,onElementClick:E}),r.a.createElement(l.Partition,{id:"donut-chart",data:e,layout:l.PartitionLayout.sunburst,valueAccessor:e=>e.value,valueFormatter:e=>`${Object(l.defaultPartitionValueFormatter)(e)}`,layers:[{groupByRollup:e=>{var t;return null!==(t=e.label)&&void 0!==t?t:e.key},nodeLabel:e=>e,shape:{fillColor:t}}]})),u&&(null==u?void 0:u.length)>0&&r.a.createElement(a.EuiFlexItem,null,r.a.createElement(d.a,{legendItems:u,height:n}))))}},725:function(e,t,n){"use strict";n.d(t,"b",(function(){return s})),n.d(t,"a",(function(){return m}));var a=n(2),i=n.n(a),r=n(41),l=n.n(r),o=n(40);const s="#FAFBFD",u=l.a.div.withConfig({displayName:"BigRing",componentId:"sc-1m6sj8k-0"})(["border-radius:50%;",""],(({size:e})=>`height: ${e}px;\n    width: ${e}px;\n    background-color: ${s};\n    text-align: center;\n    line-height: ${e}px;`)),c=l.a.div.withConfig({displayName:"SmallRing",componentId:"sc-1m6sj8k-1"})(["border-radius:50%;",""],(({size:e})=>`\n    height: ${e}px;\n    width: ${e}px;\n    background-color: ${Object(o.useEuiBackgroundColor)("plain")};\n    display: inline-block;\n    vertical-align: middle;`)),d=({size:e=90,donutWidth:t=20})=>e-t>0?i.a.createElement(u,{size:e,"data-test-subj":"empty-donut"},i.a.createElement(c,{size:e-t,"data-test-subj":"empty-donut-small"})):null,m=i.a.memo(d)},726:function(e,t,n){"use strict";n.d(t,"a",(function(){return L}));var a=n(104),i=n.n(a),r=n(40),l=n(2),o=n.n(l),s=n(57),u=n(42),c=n(343),d=n.n(c),m=n(47),p=n(41),b=n.n(p),f=n(130),g=n.n(f),y=n(153),h=n(102),v=n(456),E=n(293),O=n(228),S=n(327),x=n(917),j=n(297),k=n(424),T=n(390),C=n(311),w=n(211);const I=b()(r.EuiFlexItem).withConfig({displayName:"LegendFlexItem",componentId:"sc-1257qcd-0"})(["overview:hidden;"]),M=e=>null!=e&&!!Object(u.get)("value.length",e)&&(e.value||[]).every((({x:e,y:t})=>Object(u.isNumber)(t)&&t>=0)),A=["y"],N=[e=>Object(O.a)(e.g)?e.g:S.c],F=({data:e,forceHiddenLegend:t=!1,yAxisTitle:n,...a})=>{const r=Object(j.i)(),c=Object(h.m)(),m=Object(u.get)("configs.axis.xTickFormatter",a),p=Object(u.get)("configs.axis.yTickFormatter",a),b=Object(u.getOr)(0,"configs.axis.tickSize",a),f=`stat-items-barchart-${e[0].key}-x`,g=`stat-items-barchart-${e[0].key}-y`,y={...j.e,...d()(Object(u.get)("configs.settings",a),r)},v=Object(l.useMemo)((()=>d()({tickLine:{size:b}},Object(u.getOr)({},"configs.axis.bottom.style",a))),[a,b]),E=Object(l.useMemo)((()=>d()({tickLine:{size:b}},Object(u.getOr)({},"configs.axis.left.style",a))),[a,b]),O=Object(u.get)("configs.axis.bottom.labelFormat",a);return a.width&&a.height?o.a.createElement(s.Chart,null,o.a.createElement(s.Settings,i()({},y,{showLegend:y.showLegend&&!t})),e.map((e=>{var t;const n=e.key;return M(e)?o.a.createElement(s.BarSeries,{id:n,key:n,name:e.key,xScaleType:Object(u.getOr)(s.ScaleType.Linear,"configs.series.xScaleType",a),yScaleType:Object(u.getOr)(s.ScaleType.Linear,"configs.series.yScaleType",a),xAccessor:"x",yAccessors:A,timeZone:c,splitSeriesAccessors:N,data:null!==(t=e.value)&&void 0!==t?t:[],stackAccessors:Object(u.get)("configs.series.stackAccessors",a),color:e.color?e.color:void 0,barSeriesStyle:Object(u.get)("configs.series.barSeriesStyle",a)}):null})),o.a.createElement(s.Axis,{id:f,position:s.Position.Bottom,showOverlappingTicks:!1,style:v,tickFormat:m,labelFormat:O}),o.a.createElement(s.Axis,{id:g,position:s.Position.Left,style:E,tickFormat:p,title:n})):null};F.displayName="BarChartBaseComponent";const D=o.a.memo(F);D.displayName="BarChartBase";const R=[],P=({barChart:e,configs:t,stackByField:n,scopeId:a,visualizationActionsOptions:s})=>{const{ref:c,width:d,height:p}=Object(E.b)(),b=Object(l.useMemo)((()=>null!=e&&null!=n?e.map(((e,t)=>{var i;return{color:null!==(i=e.color)&&void 0!==i?i:t<v.a.length?v.a[t]:void 0,dataProviderId:Object(y.i)(`draggable-legend-item-${Object(m.v4)()}-${n}-${e.key}`),scopeId:a,field:n,value:e.key}})):R),[e,n,a]),f=Object(u.get)("yAxisTitle",t),g=Object(u.get)("customHeight",t),h=Object(u.get)("customWidth",t),O=Object(j.g)(g,p),S=Object(j.h)(h,d),A=Object(l.useMemo)((()=>{return t=e,Array.isArray(t)&&!Object(j.f)(t)&&t.some(M);var t}),[e]);return o.a.createElement(j.d,null,o.a.createElement(C.a,{targetClassNames:[w.a]},A&&e&&o.a.createElement(j.a,{gutterSize:"none"},o.a.createElement(r.EuiFlexItem,{grow:!0},o.a.createElement(j.c,{ref:c,height:O},o.a.createElement(D,{configs:t,data:e,yAxisTitle:f,forceHiddenLegend:null!=n,height:O,width:O}))),o.a.createElement(I,{grow:!1},o.a.createElement(k.a,{legendItems:b,height:p}))),!A&&o.a.createElement(x.a,{height:O,width:S,data:e}),null!=s&&o.a.createElement(T.a,i()({},s,{className:"viz-actions"}))))},L=o.a.memo(P,((e,t)=>e.stackByField===t.stackByField&&e.scopeId===t.scopeId&&g()(e.configs,t.configs)&&g()(e.barChart,t.barChart)))},795:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=n(5).i18n.translate("securitySolutionPackages.ecsDataQualityDashboard.incompatibleTab.dataQualityDashboardConversationId",{defaultMessage:"Data Quality dashboard"})},796:function(e,t,n){!function(e){"use strict";var t,n=[],a="ResizeObserver loop completed with undelivered notifications.";!function(e){e.BORDER_BOX="border-box",e.CONTENT_BOX="content-box",e.DEVICE_PIXEL_CONTENT_BOX="device-pixel-content-box"}(t||(t={}));var i,r=function(e){return Object.freeze(e)},l=function(e,t){this.inlineSize=e,this.blockSize=t,r(this)},o=function(){function e(e,t,n,a){return this.x=e,this.y=t,this.width=n,this.height=a,this.top=this.y,this.left=this.x,this.bottom=this.top+this.height,this.right=this.left+this.width,r(this)}return e.prototype.toJSON=function(){var e=this;return{x:e.x,y:e.y,top:e.top,right:e.right,bottom:e.bottom,left:e.left,width:e.width,height:e.height}},e.fromRect=function(t){return new e(t.x,t.y,t.width,t.height)},e}(),s=function(e){return e instanceof SVGElement&&"getBBox"in e},u=function(e){if(s(e)){var t=e.getBBox(),n=t.width,a=t.height;return!n&&!a}var i=e,r=i.offsetWidth,l=i.offsetHeight;return!(r||l||e.getClientRects().length)},c=function(e){var t;if(e instanceof Element)return!0;var n=null===(t=null==e?void 0:e.ownerDocument)||void 0===t?void 0:t.defaultView;return!!(n&&e instanceof n.Element)},d="undefined"!=typeof window?window:{},m=new WeakMap,p=/auto|scroll/,b=/^tb|vertical/,f=/msie|trident/i.test(d.navigator&&d.navigator.userAgent),g=function(e){return parseFloat(e||"0")},y=function(e,t,n){return void 0===e&&(e=0),void 0===t&&(t=0),void 0===n&&(n=!1),new l((n?t:e)||0,(n?e:t)||0)},h=r({devicePixelContentBoxSize:y(),borderBoxSize:y(),contentBoxSize:y(),contentRect:new o(0,0,0,0)}),v=function(e,t){if(void 0===t&&(t=!1),m.has(e)&&!t)return m.get(e);if(u(e))return m.set(e,h),h;var n=getComputedStyle(e),a=s(e)&&e.ownerSVGElement&&e.getBBox(),i=!f&&"border-box"===n.boxSizing,l=b.test(n.writingMode||""),c=!a&&p.test(n.overflowY||""),d=!a&&p.test(n.overflowX||""),v=a?0:g(n.paddingTop),E=a?0:g(n.paddingRight),O=a?0:g(n.paddingBottom),S=a?0:g(n.paddingLeft),x=a?0:g(n.borderTopWidth),j=a?0:g(n.borderRightWidth),k=a?0:g(n.borderBottomWidth),T=S+E,C=v+O,w=(a?0:g(n.borderLeftWidth))+j,I=x+k,M=d?e.offsetHeight-I-e.clientHeight:0,A=c?e.offsetWidth-w-e.clientWidth:0,N=i?T+w:0,F=i?C+I:0,D=a?a.width:g(n.width)-N-A,R=a?a.height:g(n.height)-F-M,P=D+T+A+w,L=R+C+M+I,B=r({devicePixelContentBoxSize:y(Math.round(D*devicePixelRatio),Math.round(R*devicePixelRatio),l),borderBoxSize:y(P,L,l),contentBoxSize:y(D,R,l),contentRect:new o(S,v,D,R)});return m.set(e,B),B},E=function(e,n,a){var i=v(e,a),r=i.borderBoxSize,l=i.contentBoxSize,o=i.devicePixelContentBoxSize;switch(n){case t.DEVICE_PIXEL_CONTENT_BOX:return o;case t.BORDER_BOX:return r;default:return l}},O=function(e){var t=v(e);this.target=e,this.contentRect=t.contentRect,this.borderBoxSize=r([t.borderBoxSize]),this.contentBoxSize=r([t.contentBoxSize]),this.devicePixelContentBoxSize=r([t.devicePixelContentBoxSize])},S=function(e){if(u(e))return 1/0;for(var t=0,n=e.parentNode;n;)t+=1,n=n.parentNode;return t},x=function(){var e=1/0,t=[];n.forEach((function(n){if(0!==n.activeTargets.length){var a=[];n.activeTargets.forEach((function(t){var n=new O(t.target),i=S(t.target);a.push(n),t.lastReportedSize=E(t.target,t.observedBox),i<e&&(e=i)})),t.push((function(){n.callback.call(n.observer,a,n.observer)})),n.activeTargets.splice(0,n.activeTargets.length)}}));for(var a=0,i=t;a<i.length;a++)(0,i[a])();return e},j=function(e){n.forEach((function(t){t.activeTargets.splice(0,t.activeTargets.length),t.skippedTargets.splice(0,t.skippedTargets.length),t.observationTargets.forEach((function(n){n.isActive()&&(S(n.target)>e?t.activeTargets.push(n):t.skippedTargets.push(n))}))}))},k=function(){var e,t=0;for(j(t);n.some((function(e){return e.activeTargets.length>0}));)t=x(),j(t);return n.some((function(e){return e.skippedTargets.length>0}))&&("function"==typeof ErrorEvent?e=new ErrorEvent("error",{message:a}):((e=document.createEvent("Event")).initEvent("error",!1,!1),e.message=a),window.dispatchEvent(e)),t>0},T=[],C=function(e){if(!i){var t=0,n=document.createTextNode("");new MutationObserver((function(){return T.splice(0).forEach((function(e){return e()}))})).observe(n,{characterData:!0}),i=function(){n.textContent="".concat(t?t--:t++)}}T.push(e),i()},w=0,I={attributes:!0,characterData:!0,childList:!0,subtree:!0},M=["resize","load","transitionend","animationend","animationstart","animationiteration","keyup","keydown","mouseup","mousedown","mouseover","mouseout","blur","focus"],A=function(e){return void 0===e&&(e=0),Date.now()+e},N=!1,F=new(function(){function e(){var e=this;this.stopped=!0,this.listener=function(){return e.schedule()}}return e.prototype.run=function(e){var t,n=this;if(void 0===e&&(e=250),!N){N=!0;var a=A(e);t=function(){var t=!1;try{t=k()}finally{if(N=!1,e=a-A(),!w)return;t?n.run(1e3):e>0?n.run(e):n.start()}},C((function(){requestAnimationFrame(t)}))}},e.prototype.schedule=function(){this.stop(),this.run()},e.prototype.observe=function(){var e=this,t=function(){return e.observer&&e.observer.observe(document.body,I)};document.body?t():d.addEventListener("DOMContentLoaded",t)},e.prototype.start=function(){var e=this;this.stopped&&(this.stopped=!1,this.observer=new MutationObserver(this.listener),this.observe(),M.forEach((function(t){return d.addEventListener(t,e.listener,!0)})))},e.prototype.stop=function(){var e=this;this.stopped||(this.observer&&this.observer.disconnect(),M.forEach((function(t){return d.removeEventListener(t,e.listener,!0)})),this.stopped=!0)},e}()),D=function(e){!w&&e>0&&F.start(),!(w+=e)&&F.stop()},R=function(){function e(e,n){this.target=e,this.observedBox=n||t.CONTENT_BOX,this.lastReportedSize={inlineSize:0,blockSize:0}}return e.prototype.isActive=function(){var e,t=E(this.target,this.observedBox,!0);return e=this.target,!s(e)&&!function(e){switch(e.tagName){case"INPUT":if("image"!==e.type)break;case"VIDEO":case"AUDIO":case"EMBED":case"OBJECT":case"CANVAS":case"IFRAME":case"IMG":return!0}return!1}(e)&&"inline"===getComputedStyle(e).display&&(this.lastReportedSize=t),this.lastReportedSize.inlineSize!==t.inlineSize||this.lastReportedSize.blockSize!==t.blockSize},e}(),P=function(e,t){this.activeTargets=[],this.skippedTargets=[],this.observationTargets=[],this.observer=e,this.callback=t},L=new WeakMap,B=function(e,t){for(var n=0;n<e.length;n+=1)if(e[n].target===t)return n;return-1},_=function(){function e(){}return e.connect=function(e,t){var n=new P(e,t);L.set(e,n)},e.observe=function(e,t,a){var i=L.get(e),r=0===i.observationTargets.length;B(i.observationTargets,t)<0&&(r&&n.push(i),i.observationTargets.push(new R(t,a&&a.box)),D(1),F.schedule())},e.unobserve=function(e,t){var a=L.get(e),i=B(a.observationTargets,t),r=1===a.observationTargets.length;i>=0&&(r&&n.splice(n.indexOf(a),1),a.observationTargets.splice(i,1),D(-1))},e.disconnect=function(e){var t=this,n=L.get(e);n.observationTargets.slice().forEach((function(n){return t.unobserve(e,n.target)})),n.activeTargets.splice(0,n.activeTargets.length)},e}(),z=function(){function e(e){if(0===arguments.length)throw new TypeError("Failed to construct 'ResizeObserver': 1 argument required, but only 0 present.");if("function"!=typeof e)throw new TypeError("Failed to construct 'ResizeObserver': The callback provided as parameter 1 is not a function.");_.connect(this,e)}return e.prototype.observe=function(e,t){if(0===arguments.length)throw new TypeError("Failed to execute 'observe' on 'ResizeObserver': 1 argument required, but only 0 present.");if(!c(e))throw new TypeError("Failed to execute 'observe' on 'ResizeObserver': parameter 1 is not of type 'Element");_.observe(this,e,t)},e.prototype.unobserve=function(e){if(0===arguments.length)throw new TypeError("Failed to execute 'unobserve' on 'ResizeObserver': 1 argument required, but only 0 present.");if(!c(e))throw new TypeError("Failed to execute 'unobserve' on 'ResizeObserver': parameter 1 is not of type 'Element");_.unobserve(this,e)},e.prototype.disconnect=function(){_.disconnect(this)},e.toString=function(){return"function ResizeObserver () { [polyfill code] }"},e}();e.ResizeObserver=z,e.ResizeObserverEntry=O,e.ResizeObserverSize=l,Object.defineProperty(e,"__esModule",{value:!0})}(t)},865:function(e,t,n){"use strict";n.d(t,"a",(function(){return bt}));var a=n(2),i=n.n(a),r=n(40),l=n(41),o=n.n(l),s=n(102);const u="commandInputHistory";var c=n(295),d=n(0),m=n.n(d);class parsed_command_input_ParsedCommand{constructor(e){m()(this,"name",void 0),m()(this,"args",void 0),m()(this,"hasArgs",void 0),this.input=e;const t=(e=>{const t=e.trim(),n={name:b(t),args:{}};if(!t)return n;const a=t.indexOf(" "),i=-1===a?[]:t.substring(a).trim().split(/--/);for(const e of i){const t=e.trim();if(t){const e=/[ =]/.exec(t),a=(e?t.substring(0,e.index).trim():t).trim();if(a)if(n.args[a]||(n.args[a]=[]),a!==t&&e){let i=t.substring(e.index+1).trim().replace(/\\-\\-/g,"--");'"'===i.charAt(0)&&(i=i.substring(1)),'"'===i.charAt(i.length-1)&&(i=i.substring(0,i.length-1)),n.args[a].push(i)}else n.args[a].push(!0)}}return n})(e);this.name=t.name,this.args=t.args,this.hasArgs=Object.keys(this.args).length>0}hasArg(e){return e in this.args}}const p=e=>new parsed_command_input_ParsedCommand(e),b=e=>{const t=e.trimStart();if(!t)return"";const n=e.indexOf(" ");return-1===n?t:t.substring(0,n)},f=e=>{let t="",n="";const a=[];if(e.args)for(const[i,r]of Object.entries(e.args))r.required?(t.length&&(t+=" "),t+=`--${i}`):r.exclusiveOr?a.push(`--${i}`):(n.length&&(n+=" "),n+=`--${i}`);const i=({required:e,exclusive:t,optional:n})=>`${e||""}${t?` ${t}`:""} ${n&&n.length>0?`[${n}]`:""}`.trim();return a.length>0?a.map((e=>i({required:t,exclusive:e,optional:n}))):t||n?[i({required:t,optional:n})]:[]};var g=n(5),y=n(47);const h=g.i18n.translate("xpack.securitySolution.handleInputAreaState.inputPlaceholderText",{defaultMessage:"Submit response action"}),v=(e,t)=>{if(t&&t.argsWithValueSelectors)for(const a of Object.keys(t.argsWithValueSelectors))if(e.hasArg(a)){var n;const i=null!==(n=t.argState[a])&&void 0!==n?n:[];e.args[a]=i.map((e=>e.value))}},E=(e,{type:t,payload:n})=>{var a;switch(t){case"updateInputPopoverState":if(e.input.showPopover!==n.show)return{...e,input:{...e.input,showPopover:n.show}};break;case"updateInputHistoryState":return{...e,input:{...e.input,history:[{id:Object(y.v4)(),input:n.command,display:null!==(a=n.display)&&void 0!==a?a:n.command},...e.input.history.slice(0,99)]}};case"clearInputHistoryState":return{...e,input:{...e.input,history:[]}};case"updateInputTextEnteredState":const{leftOfCursorText:t,rightOfCursorText:o="",argState:s}="function"==typeof n?n(e.input):n;if(e.input.leftOfCursorText!==t||e.input.rightOfCursorText!==o){var i;const n=p(t+o);let a=e.input.enteredCommand;if(a&&s&&(null===(i=a)||void 0===i?void 0:i.argState)!==s&&(a={...a,argState:s}),n.name&&(!a||n.name!==a.commandDefinition.name)||!n.name&&a){a=void 0;const t=e.commands.find((e=>e.name===n.name));if(t){let e;for(const[n,a]of Object.entries(null!==(r=t.args)&&void 0!==r?r:{})){var r;a.SelectorComponent&&(e||(e={}),e[n]=a)}a={argState:{},commandDefinition:t,argsWithValueSelectors:e}}}return v(n,a),{...e,input:{...e.input,leftOfCursorText:t,rightOfCursorText:o,parsedInput:n,enteredCommand:a}}}break;case"updateInputPlaceholderState":if(e.input.placeholder!==n.placeholder)return{...e,input:{...e.input,placeholder:n.placeholder||h}};break;case"setInputState":if(e.input.visibleState!==n.value)return{...e,input:{...e.input,visibleState:n.value}};break;case"updateInputCommandArgState":if(e.input.enteredCommand){var l;const{name:t,instance:a,state:i}=n,r=[...null!==(l=e.input.enteredCommand.argState[t])&&void 0!==l?l:[]];r[a]=i;const o={...e.input.enteredCommand,argState:{...e.input.enteredCommand.argState,[t]:r}},s=p(e.input.leftOfCursorText+e.input.rightOfCursorText);return v(s,o),{...e,input:{...e.input,parsedInput:s,enteredCommand:o}}}}return e};var O=n(44),S=n(229);const x=Object.freeze({mustHaveValue:e=>g.i18n.translate("xpack.securitySolution.console.commandValidation.mustHaveValue",{defaultMessage:"Argument --{argName} must have a value",values:{argName:e}}),mustBeNumber:e=>g.i18n.translate("xpack.securitySolution.console.commandValidation.mustBeNumber",{defaultMessage:"Argument --${argName} value must be a number",values:{argName:e}}),mustBeGreaterThanZero:e=>g.i18n.translate("xpack.securitySolution.console.commandValidation.mustBeGreaterThanZero",{defaultMessage:"Argument --{argName} value must be greater than zero",values:{argName:e}}),NO_ARGUMENTS_SUPPORTED:g.i18n.translate("xpack.securitySolution.console.commandValidation.noArgumentsSupported",{defaultMessage:"Command does not support any arguments"}),missingRequiredArg:e=>g.i18n.translate("xpack.securitySolution.console.commandValidation.missingRequiredArg",{defaultMessage:"Missing required argument: --{argName}",values:{argName:e}}),unsupportedArg:e=>g.i18n.translate("xpack.securitySolution.console.commandValidation.unsupportedArg",{defaultMessage:"Unsupported argument: --{argName}",values:{argName:e}}),noMultiplesAllowed:e=>g.i18n.translate("xpack.securitySolution.console.commandValidation.argSupportedOnlyOnce",{defaultMessage:"Argument can only be used once: --{argName}",values:{argName:e}}),argValueValidatorError:(e,t)=>g.i18n.translate("xpack.securitySolution.console.commandValidation.invalidArgValue",{defaultMessage:"Invalid argument value: --{argName}. {error}",values:{argName:e,error:t}}),missingArguments:e=>g.i18n.translate("xpack.securitySolution.console.commandValidation.mustHaveArgs",{defaultMessage:"Missing required arguments: {missingArgs}",values:{missingArgs:e}}),MUST_HAVE_AT_LEAST_ONE_ARG:g.i18n.translate("xpack.securitySolution.console.commandValidation.oneArgIsRequired",{defaultMessage:"At least one argument must be used"}),onlyOneFromExclusiveOr:e=>i.a.createElement(S.a,null,i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.commandValidation.exclusiveOr",defaultMessage:"This command supports only one of the following arguments: {argNames}",values:{argNames:i.a.createElement(S.a,{bold:!0,inline:!0},e)}})),unknownArgument:(e,t,n)=>i.a.createElement(S.a,null,i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.commandValidation.unknownArgument",defaultMessage:"The following {command} {countOfInvalidArgs, plural, =1 {argument is} other {arguments are}} not supported by this command: {unknownArgs}",values:{countOfInvalidArgs:e,command:i.a.createElement(S.a,{bold:!0,inline:!0},t),unknownArgs:i.a.createElement(S.a,{bold:!0,inline:!0},n)}}))});var j=n(107);const k=(e="")=>{const t=oe().state.dataTestSubj;return t?t+(e?`-${e}`:""):""},T=g.i18n.translate("xpack.securitySolution.console.unsupportedMessageCallout.title",{defaultMessage:"Unsupported"}),C=Object(a.memo)((({children:e,header:t=T,"data-test-subj":n})=>i.a.createElement("div",{"data-test-subj":n},i.a.createElement(r.EuiText,{size:"s"},i.a.createElement(r.EuiTextColor,{color:"danger"},t)),i.a.createElement(r.EuiSpacer,{size:"s"}),e)));C.displayName="UnsupportedMessageCallout";const w={className:"euiTruncateText"},I=Object(a.memo)((({commandDef:e})=>{const t=Object(a.useMemo)((()=>f(e).map(((t,n)=>i.a.createElement(i.a.Fragment,{key:`helpUsage-${n}`},n>0&&i.a.createElement(r.EuiSpacer,{size:"xs"}),i.a.createElement(S.a,null,`${e.name} ${t}`))))),[e]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiDescriptionList,{compressed:!0,type:"column",className:"descriptionList-20_80",listItems:[{title:i.a.createElement(S.a,null,g.i18n.translate("xpack.securitySolution.console.commandUsage.inputUsage",{defaultMessage:"Usage"})),description:t&&t.length>0?t:e.name}],descriptionProps:w,titleProps:w}),i.a.createElement(r.EuiSpacer,{size:"s"}),e.exampleUsage&&i.a.createElement(r.EuiDescriptionList,{compressed:!0,type:"column",className:"descriptionList-20_80",listItems:[{title:i.a.createElement(S.a,null,g.i18n.translate("xpack.securitySolution.console.commandUsage.exampleUsage",{defaultMessage:"Example"})),description:i.a.createElement(S.a,null,e.exampleUsage)}],descriptionProps:w,titleProps:w}))}));I.displayName="CommandInputUsage";const M=Object(a.memo)((({commandDef:e,errorMessage:t})=>{const n=Object(j.a)(k()),l=Object(a.useMemo)((()=>{var t;return Object.keys(null!==(t=e.args)&&void 0!==t?t:[]).length>0}),[e.args]),o=Object(a.useMemo)((()=>l&&e.args?Object.entries(e.args).reduce(((e,t)=>{const n={title:`--${t[0]}`,description:t[1].about};return t[1].required?e.required.push(n):t[1].exclusiveOr?e.exclusiveOr.push(n):e.optional.push(n),e}),{required:[],exclusiveOr:[],optional:[]}):{required:[],exclusiveOr:[],optional:[]}),[e.args,l]),s=(t,a)=>{const l=a.map((e=>i.a.createElement("div",null,i.a.createElement(S.a,{bold:!0,inline:!0},e.title),i.a.createElement(S.a,{inline:!0}," - ",e.description))));return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"s"}),e.args&&i.a.createElement(r.EuiDescriptionList,{compressed:!0,type:"column",className:"descriptionList-20_80",listItems:[{title:i.a.createElement(S.a,null,t),description:l}],descriptionProps:w,titleProps:w,"data-test-subj":n("commandUsage-options")}))},u=Object(a.useCallback)((()=>t?i.a.createElement(C,{header:i.a.createElement(S.a,{textColor:"danger"},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.validationError.title",defaultMessage:"Unsupported action"})),"data-test-subj":n("validationError")},i.a.createElement("div",{"data-test-subj":n("badArgument-message")},t),i.a.createElement(r.EuiSpacer,{size:"s"})):null),[t,n]);return i.a.createElement(r.EuiPanel,{paddingSize:"none",color:"transparent","data-test-subj":n("commandUsage")},u(),i.a.createElement(r.EuiDescriptionList,{compressed:!0,type:"column",className:"descriptionList-20_80",listItems:[{title:i.a.createElement(S.a,null,g.i18n.translate("xpack.securitySolution.console.commandUsage.about",{defaultMessage:"About"})),description:i.a.createElement(S.a,null,e.about)}],descriptionProps:w,titleProps:w,"data-test-subj":n("commandUsage-options")}),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(I,{commandDef:e}),o.required&&o.required.length>0&&s(g.i18n.translate("xpack.securitySolution.console.commandUsage.requiredLabel",{defaultMessage:"Required parameters"}),o.required),o.exclusiveOr&&o.exclusiveOr.length>0&&s(g.i18n.translate("xpack.securitySolution.console.commandUsage.exclusiveOr",{defaultMessage:"Include only one parameter"}),o.exclusiveOr),o.optional&&o.optional.length>0&&s(g.i18n.translate("xpack.securitySolution.console.commandUsage.optional",{defaultMessage:"Optional parameters"}),o.optional))}));M.displayName="CommandUsage";const A=Object(a.memo)((({title:e,children:t})=>{const n=Object(j.a)(k());return i.a.createElement(r.EuiPanel,{hasShadow:!1,color:"transparent",paddingSize:"none","data-test-subj":n("helpOutput")},t)}));A.displayName="HelpOutput";const N=Object(a.memo)((e=>{const t=e.command.commandDefinition.HelpComponent;return Object(a.useEffect)((()=>{t||e.setStatus("success")}),[t,e]),t?i.a.createElement(t,e):i.a.createElement(A,{command:e.command,title:g.i18n.translate("xpack.securitySolution.console.buildInCommand.helpArgument.helpTitle",{defaultMessage:"{cmdName} command",values:{cmdName:e.command.args.name}})},i.a.createElement(M,{commandDef:e.command.commandDefinition,errorMessage:e.store.errorMessage}))}));N.displayName="HelpCommandArgument";const F=Object(a.memo)((({command:e,setStatus:t})=>{const n=Object(j.a)(k()),l=Object(a.useMemo)((()=>i.a.createElement(S.a,null,i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.unknownCommand.helpMessage",defaultMessage:"The text you entered {userInput} is unsupported! Click {helpIcon} {boldHelp} or type {helpCmd} for assistance.",values:{userInput:i.a.createElement(S.a,{bold:!0,inline:!0},e.input),helpIcon:i.a.createElement(r.EuiIcon,{type:"help"}),helpCmd:i.a.createElement(S.a,{bold:!0,inline:!0},"help"),boldHelp:i.a.createElement("strong",null,i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.unknownCommand.helpMessage.help",defaultMessage:"Help"}))}}))),[e.input]);return Object(a.useEffect)((()=>{t("success")}),[t]),i.a.createElement(C,{header:i.a.createElement(S.a,{textColor:"danger"},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.unknownCommand.title",defaultMessage:"Unsupported text/command"})),"data-test-subj":n("unknownCommandError")},l)}));F.displayName="UnknownCommand";const D=Object(a.memo)((({command:e,setStatus:t,store:n})=>{const l=Object(j.a)(k());return Object(a.useEffect)((()=>{t("success")}),[t]),i.a.createElement(C,{header:i.a.createElement(S.a,{textColor:"danger"},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.badArgument.title",defaultMessage:"Unsupported argument"})),"data-test-subj":l("badArgument")},i.a.createElement("div",{"data-test-subj":l("badArgument-message")},n.errorMessage),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(I,{commandDef:e.commandDefinition}),i.a.createElement(S.a,null,i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.badArgument.helpMessage",defaultMessage:"Enter {helpCmd} for further assistance.",values:{helpCmd:i.a.createElement(S.a,{bold:!0,inline:!0},`${e.commandDefinition.name} --help`)}})))}));D.displayName="BadArgument";const R=Object(a.memo)((({command:e,setStatus:t,store:n})=>{const l=Object(j.a)(k());return Object(a.useEffect)((()=>{t("success")}),[t]),i.a.createElement(C,{header:i.a.createElement(S.a,{textColor:"error"},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.validationError.title",defaultMessage:"Unsupported action"})),"data-test-subj":l("validationError")},i.a.createElement("div",{"data-test-subj":l("validationError-message")},n.errorMessage),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(I,{commandDef:e.commandDefinition}),i.a.createElement(S.a,null,i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.validationError.helpMessage",defaultMessage:"Enter {helpCmd} for further assistance.",values:{helpCmd:i.a.createElement(S.a,{bold:!0,inline:!0},`${e.commandDefinition.name} --help`)}})))}));R.displayName="ValidationError";const P=e=>`--${e}`,L=(e,t)=>{const n=E(e,{type:"updateInputHistoryState",payload:{command:t.command.input,display:t.command.inputDisplay}});return n.commandHistory=[...e.commandHistory,t],n},B={name:"unknown-command",about:"unknown command",RenderComponent:()=>null},_=(e={})=>({status:"pending",store:e}),z=(e,t)=>({...e,commandDefinition:{...e.commandDefinition,RenderComponent:t}}),q=(e,t=_(),n=!0)=>({id:Object(y.v4)(),isValid:n,enteredAt:(new Date).toISOString(),command:e,state:t}),$=()=>oe().dispatch,V=Object(a.memo)((({status:e,setStatus:t})=>{const n=$();return Object(a.useEffect)((()=>{"pending"===e&&n({type:"clear"}),t("success")}),[e,t,n]),null}));V.displayName="ClearCommand";var H=n(8);const U=e=>{if(!e.mustHaveArgs||!e.args)return e.name;let t=!1;const n=Object.entries(e.args).reduce(((e,[n,a])=>a.required?(e[n]=a,e):a.exclusiveOr&&!t?(t=!0,e[n]=a,e):e),{});return`${e.name} --${Object.keys(n).join(" --")}`},Q=g.i18n.translate("xpack.securitySolution.console.commandList.otherCommandsGroup.label",{defaultMessage:"Other commands"}),G=e=>e.replace(/[^A-Za-z0-9]/g,""),W=o()(r.EuiBasicTable).withConfig({displayName:"StyledEuiBasicTable",componentId:"sc-10x4uz4-0"})(["margin-top:",";.euiTableHeaderCell{.euiTableCellContent__text{color:",";font-size:",";padding-bottom:",";padding-left:",";}}"],(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiTextColor),(({theme:{eui:e}})=>e.euiFontSize),(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiSizeS)),K=o()(r.EuiCallOut).withConfig({displayName:"StyledEuiCallOut",componentId:"sc-10x4uz4-1"})(["margin:",";padding:",";border-radius:",";"],(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSizeXS)),X=o()(r.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-10x4uz4-2"})(["padding-left:",";"],(({theme:{eui:e}})=>e.euiSizeS)),Y=o()(r.EuiFlexGrid).withConfig({displayName:"StyledEuiFlexGrid",componentId:"sc-10x4uz4-3"})(["@media only screen and (min-width:","){max-width:75%;}@media only screen and (min-width:","){max-width:50%;}"],(e=>e.theme.eui.euiBreakpoints.l),(e=>e.theme.eui.euiBreakpoints.xl)),J=o()(r.EuiBadge).withConfig({displayName:"StyledEuiBadge",componentId:"sc-10x4uz4-4"})(["font-size:10px !important;span{color:"," !important;}"],(({theme:{eui:e}})=>e.euiShadowColor)),Z=Object(a.memo)((({commands:e,display:t="default"})=>{const n=Object(j.a)(k("commandList")),l=$(),{docLinks:o}=Object(s.j)().services,u=Object(a.useMemo)((()=>{var e;return i.a.createElement(r.EuiDescriptionList,{compressed:!0,listItems:[{title:i.a.createElement(J,null,i.a.createElement(S.a,{inline:!0,bold:!0},null===(e=ae.find((e=>"--help"===e.name)))||void 0===e?void 0:e.name)),description:i.a.createElement(r.EuiText,{color:"subdued",size:"xs"},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.commandList.footerText",defaultMessage:"For more help with the individual commands use the --help argument. Ex: processes --help"}))}]})}),[]),c=Object(a.useCallback)((e=>()=>{l({type:"updateInputTextEnteredState",payload:()=>({leftOfCursorText:e,rightOfCursorText:""})}),l({type:"addFocusToKeyCapture"})}),[l]),d=Object(a.useMemo)((()=>{const t=new Map,n=e.filter((e=>!0!==e.helpHidden));for(const e of n){const{helpGroupLabel:n=Q,helpGroupPosition:a=1/0}=e,i=t.get(n);i?(i.list.push(e),i.position===1/0&&void 0!==a&&a!==i.position&&(i.position=a)):t.set(e.helpGroupLabel,{label:n,position:a,list:[e]})}return Object(H.sortBy)(Array.from(t.values()),"position").map((e=>{const t=e.list.map((e=>void 0===e.helpCommandPosition?{...e,helpCommandPosition:1/0}:e));return Object(H.sortBy)(t,"helpCommandPosition")}))}),[e]),m=Object(a.useCallback)((e=>e[0].helpGroupLabel===ne.supporting.label?[...ae,...e].map((t=>{var n,a;return{[null!==(n=null===(a=e[0])||void 0===a?void 0:a.helpGroupLabel)&&void 0!==n?n:Q]:t}})):e.map((t=>{var n,a;return{[null!==(n=null===(a=e[0])||void 0===a?void 0:a.helpGroupLabel)&&void 0!==n?n:Q]:t}}))),[]),p=Object(a.useCallback)((e=>{var t,a;const l=null!==(t=null===(a=e[0])||void 0===a?void 0:a.helpGroupLabel)&&void 0!==t?t:Q,o=G(l);return[{field:l,name:i.a.createElement("div",{"data-test-subj":n("group")},l),render:e=>{const t=U(e);return i.a.createElement(X,{alignItems:"center","data-test-subj":n(`${o}-${e.name}`)},i.a.createElement(r.EuiFlexItem,{grow:1},i.a.createElement(r.EuiDescriptionList,{"data-test-subj":n("command"),listItems:[{title:i.a.createElement(r.EuiBadge,{"data-test-subj":n("commandName")},t),description:i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"xs"}),i.a.createElement(r.EuiText,{color:"subdued",size:"xs"},e.about))}]})),e.helpGroupLabel!==ne.supporting.label&&!0!==e.helpHidden&&e.RenderComponent&&i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiToolTip,{content:!0===e.helpDisabled?g.i18n.translate("xpack.securitySolution.console.commandList.disabledButtonTooltip",{defaultMessage:"Unsupported command"}):g.i18n.translate("xpack.securitySolution.console.commandList.addButtonTooltip",{defaultMessage:"Add to text bar"})},i.a.createElement(r.EuiButtonIcon,{iconType:"plusInCircle","aria-label":`updateTextInputCommand-${e.name}`,onClick:c(`${t} `),isDisabled:!0===e.helpDisabled,"data-test-subj":n(`${o}-${e.name}-addToInput`)}))))}}]}),[n,c]),b=Object(a.useCallback)((e=>e.filter((e=>"help"!==e.name&&"clear"!==e.name))),[]);if("table"===t){const e=[i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.commandList.callout.multipleResponses",defaultMessage:"You can enter consecutive response actions — no need to wait for previous actions to complete."}),i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.commandList.callout.leavingResponder",defaultMessage:"Leaving the response console does not terminate any actions that have been submitted."}),i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.commandList.callout.visitSupportSections",defaultMessage:"{learnMore} about response actions and using the console.",values:{learnMore:i.a.createElement(r.EuiLink,{href:o.links.securitySolution.responseActions,target:"_blank","data-test-subj":n("helpfulHintDocLink")},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.commandList.callout.readMoreLink",defaultMessage:"Learn more"}))}})],t=i.a.createElement(K,{title:i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.commandList.callout.title",defaultMessage:"Helpful tips:"}),"data-test-subj":n("helpfulTips")},i.a.createElement("ul",null,e.map(((e,t)=>i.a.createElement("li",{key:t},i.a.createElement(r.EuiText,{size:"s"},e))))));return i.a.createElement("div",{"data-test-subj":n()},d.map(((e,t)=>{var a;return i.a.createElement(W,{"data-test-subj":n(G(null!==(a=e[0].helpGroupLabel)&&void 0!==a?a:Q)),key:`styledEuiBasicTable-${t}`,items:m(e),columns:p(e)})})),t)}return i.a.createElement("div",{"data-test-subj":n()},i.a.createElement(r.EuiSpacer,{size:"s"}),d.map((e=>{const t=e[0].helpGroupLabel,a=b(e);return 0===a.length?null:i.a.createElement(Y,{columns:3,responsive:!1,gutterSize:"l",key:t,direction:"column"},a.map((e=>{const t=U(e);return i.a.createElement(r.EuiFlexItem,{key:e.name},i.a.createElement(r.EuiDescriptionList,{compressed:!0,listItems:[{title:i.a.createElement(r.EuiToolTip,{content:t},i.a.createElement(J,null,i.a.createElement(S.a,{inline:!0,bold:!0},t))),description:i.a.createElement(r.EuiText,{color:"subdued",size:"xs"},e.about)}],"data-test-subj":n("command")}))})))})),i.a.createElement(r.EuiSpacer,{size:"xl"}),u)}));Z.displayName="CommandList";const ee=()=>oe().state.commands,te=Object(a.memo)((e=>{const t=ee(),n=oe().state.HelpComponent;return Object(a.useEffect)((()=>{n||e.setStatus("success")}),[n,e]),n?i.a.createElement(n,e):i.a.createElement(A,{command:e.command,title:g.i18n.translate("xpack.securitySolution.console.builtInCommands.help.helpTitle",{defaultMessage:"Available commands"})},i.a.createElement(Z,{commands:t}))}));te.displayName="HelpCommand";const ne=Object.freeze({supporting:{label:g.i18n.translate("xpack.securitySolution.console.builtInCommands.groups.supporting",{defaultMessage:"Supporting commands & parameters"})}}),ae=Object.freeze([{name:"--comment",about:g.i18n.translate("xpack.securitySolution.console.commandList.commonArgs.comment",{defaultMessage:"Add comment to any action Ex: isolate --comment your comment"})},{name:"--help",about:g.i18n.translate("xpack.securitySolution.console.commandList.commonArgs.help",{defaultMessage:"Command assistance Ex: isolate --help"})}]),ie=(e,t)=>{var n,a,r,l;let o=e;switch(t.type){case"scrollDown":e.scrollToBottom();break;case"addFocusToKeyCapture":null===(n=e.keyCapture)||void 0===n||null===(a=n.current)||void 0===a||a.focus();break;case"removeFocusFromKeyCapture":null===(r=e.keyCapture)||void 0===r||null===(l=r.current)||void 0===l||l.blur();break;case"updateFooterContent":e.footerContent!==t.payload.value&&(o={...e,footerContent:t.payload.value});break;case"executeCommand":o=((e,t)=>{const{parsedInput:n,enteredCommand:a,input:r}=t.payload;if(""===n.name)return e;const l=null==a?void 0:a.commandDefinition;if(!l)return L(e,q({input:n.input,inputDisplay:r,args:n,commandDefinition:{...B,RenderComponent:F}},void 0,!1));const o={input:n.input,inputDisplay:r,args:n,commandDefinition:l},s=(u=l.args)?Object.entries(u).filter((([e,t])=>t.required)).map((([e])=>e)):[];var u;const c=(e=>e?Object.entries(e).reduce(((e,[t,n])=>(n.exclusiveOr&&e.push(t),e)),[]):[])(l.args),d=x.onlyOneFromExclusiveOr(c.map(P).join(", "));if(n.hasArgs){if(n.hasArg("help")){if(Object.keys(n.args).length>1||n.args.help.length>1||!0!==n.args.help[0])return L(e,q(z(o,D),void 0,!1));if(null!=l&&l.validate){const t=l.validate(o);if(!0!==t)return L(e,q(z(o,N),_({errorMessage:t}),!1))}return L(e,q(z(o,N),void 0,!1))}if(!l.args||0===Object.keys(l.args).length)return L(e,q(z(o,D),_({errorMessage:x.NO_ARGUMENTS_SUPPORTED}),!1));const t=((e,t)=>{const n=[];return Object.keys(e).forEach((e=>{"help"===e||t&&t[e]||n.push(e)})),n})(n.args,l.args);if(t.length)return L(e,q(z(o,D),_({errorMessage:x.unknownArgument(t.length,n.name,t.map(P).join(", "))}),!1));for(const t of s)if(!n.args[t])return L(e,q(z(o,D),_({errorMessage:i.a.createElement(S.a,null,x.missingRequiredArg(t))}),!1));if(c.filter((e=>n.args[e])).length>1)return L(e,q(z(o,D),_({errorMessage:d}),!1));for(const t of Object.keys(n.args)){var m;const a=null===(m=l.args)||void 0===m?void 0:m[t],r=n.args[t];if(!a)return L(e,q(z(o,D),_({errorMessage:i.a.createElement(S.a,null,x.unsupportedArg(t))}),!1));if(!a.allowMultiples&&Array.isArray(r)&&r.length>1)return L(e,q(z(o,D),_({errorMessage:i.a.createElement(S.a,null,x.noMultiplesAllowed(t))}),!1));if(void 0!==a.mustHaveValue&&!1!==a.mustHaveValue){let n="";if(0===r.length?n=x.mustHaveValue(t):r.some(((e,i)=>{switch(a.mustHaveValue){case!0:case"non-empty-string":("boolean"==typeof e||"non-empty-string"===a.mustHaveValue&&0===e.trim().length)&&(n=x.mustHaveValue(t));break;case"truthy":e||(n=x.mustHaveValue(t));break;case"number":case"number-greater-than-zero":{const l=Number(e);Number.isSafeInteger(l)?"number-greater-than-zero"===a.mustHaveValue&&l<=0&&(n=x.mustBeGreaterThanZero(t)):n=x.mustBeNumber(t),n||(r[i]=l)}}return!!n})),n)return L(e,q(z(o,D),_({errorMessage:i.a.createElement(S.a,null,n)}),!1))}if(a.validate){const n=a.validate(r);if(!0!==n)return L(e,q(z(o,D),_({errorMessage:i.a.createElement(S.a,null,x.argValueValidatorError(t,n))}),!1))}}}else{if(s.length>0)return L(e,q(z(o,D),_({errorMessage:i.a.createElement(S.a,null,x.missingArguments(s.map((e=>P(e))).join(", ")))}),!1));if(c.length>0)return L(e,q(z(o,D),_({errorMessage:d}),!1));if(l.mustHaveArgs)return L(e,q(z(o,D),_({errorMessage:i.a.createElement(S.a,null,x.MUST_HAVE_AT_LEAST_ONE_ARG)}),!1))}if(l.validate){const t=l.validate(o);if(!0!==t)return L(e,q(z(o,R),_({errorMessage:t}),!1))}return L(e,q(o))})(e,t);break;case"updateCommandStatusState":case"updateCommandStoreState":o=((e,{type:t,payload:{id:n,value:a}})=>{let i=!1;const r=e.commandHistory.map((e=>{if(i||e.id!==n)return e;i=!0;const r={...e,state:{...e.state}};switch(t){case"updateCommandStoreState":r.state.store=a(r.state.store);break;case"updateCommandStatusState":if(r.state.status===a)return i=!1,e;r.state.status=a}return r}));return i?{...e,commandHistory:r}:e})(e,t);break;case"showSidePanel":o=((e,t)=>"showSidePanel"===t.type&&e.sidePanel.show!==t.payload.show?{...e,sidePanel:{...e.sidePanel,show:t.payload.show}}:e)(e,t);break;case"updateInputPopoverState":case"updateInputHistoryState":case"clearInputHistoryState":case"updateInputTextEnteredState":case"updateInputPlaceholderState":case"setInputState":case"updateInputCommandArgState":o=E(e,t);break;case"clear":o={...e,commandHistory:[]}}return o},re=Object(a.createContext)(null),le=Object(a.memo)((({commands:e,scrollToBottom:t,keyCapture:n,HelpComponent:r,dataTestSubj:l,storagePrefix:o,managedKey:d,children:m})=>{const[b,f]=Object(c.d)(d),y=(e=>{const{storage:t}=Object(s.j)().services;return Object(a.useMemo)((()=>{if(e){var n;const a=null!==(n=t.get(`${e}.${u}`))&&void 0!==n?n:{version:2,data:[]};return 2!==a.version&&(e=>{const{data:t,version:n}=e;for(const e of t)n<2&&(e.display=e.input);e.version=2})(a),a.data}return[]}),[t,e])})(o),v=(e=>{const{storage:t}=Object(s.j)().services;return Object(a.useCallback)((n=>{if(e){const a={version:2,data:n};t.set(`${e}.${u}`,a)}}),[t,e])})(o),E=Object(a.useCallback)((e=>{const t=(({commands:e,...t},n)=>{const a=[{name:"help",about:g.i18n.translate("xpack.securitySolution.console.builtInCommands.helpAbout",{defaultMessage:"List all available commands"}),RenderComponent:te,helpGroupLabel:ne.supporting.label,helpCommandPosition:1},{name:"clear",about:g.i18n.translate("xpack.securitySolution.console.builtInCommands.clearAbout",{defaultMessage:"Clear console screen"}),RenderComponent:V,helpGroupLabel:ne.supporting.label,helpCommandPosition:0}].concat(e),i=null!=n?n:{commands:a,...t,commandHistory:[],sidePanel:{show:null},footerContent:"",input:{leftOfCursorText:"",rightOfCursorText:"",parsedInput:p(""),enteredCommand:void 0,placeholder:h,showPopover:void 0,history:[],visibleState:void 0}};return n&&Object.assign(i,{commands:a,...t}),i})(e,b?b():void 0);return t.input.history=y,t}),[b,y]),[O,S]=Object(a.useReducer)(ie,{commands:e,scrollToBottom:t,keyCapture:n,HelpComponent:r,dataTestSubj:l,storagePrefix:o},E);return Object(a.useEffect)((()=>{f&&f(O)}),[O,f]),Object(a.useEffect)((()=>{o&&O.input.history&&v(O.input.history)}),[v,O.input.history,o]),i.a.createElement(re.Provider,{value:{state:O,dispatch:S}},m)}));le.displayName="ConsoleStateProvider";const oe=()=>{const e=Object(a.useContext)(re);if(!e)throw new Error("ConsoleStateContext not defined");return e},se=()=>oe().state.input.visibleState,ue=Object(a.memo)((()=>{const e=oe().state.footerContent,t=Object(j.a)(k()),n=se(),l=Object(a.useMemo)((()=>"error"===n?"danger":"subdued"),[n]);return i.a.createElement(r.EuiPanel,{hasShadow:!1,paddingSize:"none",color:"transparent","data-test-subj":t("footer")},i.a.createElement(r.EuiText,{size:"xs",color:l,className:"font-style-italic"},e||i.a.createElement(i.a.Fragment,null," ")))}));ue.displayName="ConsoleFooter";const ce=()=>oe().state.sidePanel,de=(g.i18n.translate("xpack.securitySolution.console.layoutHeader.helpButtonTitle",{defaultMessage:"Help"}),g.i18n.translate("xpack.securitySolution.console.layoutHeader.helpButtonLabel",{defaultMessage:"Show help"})),me=o()(r.EuiButtonEmpty).withConfig({displayName:"StyledEuiButtonEmpty",componentId:"sc-lvlnbi-0"})(["margin-left:auto;height:inherit;"]),pe=Object(a.memo)((({TitleComponent:e})=>{const t=$(),n=ce().show,l=Object(j.a)(k("header")),o="help"===n,s=Object(a.useCallback)((()=>{t({type:"showSidePanel",payload:{show:o?null:"help"}})}),[t,o]);return i.a.createElement(r.EuiFlexGroup,{gutterSize:"none",alignItems:"center",justifyContent:"spaceBetween",responsive:!1},i.a.createElement(r.EuiFlexItem,{grow:1,className:"eui-textTruncate noThemeOverrides","data-test-subj":l("titleComponentContainer")},e?i.a.createElement(e,null):""),!o&&i.a.createElement(r.EuiFlexItem,{grow:1},i.a.createElement(me,{style:{marginLeft:"auto"},onClick:s,iconType:"help",title:de,"aria-label":de,isSelected:o,"data-test-subj":l("helpButton")},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.layoutHeader.helpButtonTitle",defaultMessage:"Help"}))))}));pe.displayName="ConsoleHeader";var be=n(104),fe=n.n(be),ge=n(53),ye=n.n(ge);const he=()=>{const{leftOfCursorText:e,rightOfCursorText:t,parsedInput:n,enteredCommand:i}=oe().state.input;return Object(a.useMemo)((()=>({leftOfCursorText:e,rightOfCursorText:t,parsedInput:n,enteredCommand:i,fullTextEntered:e+t})),[i,e,n,t])},ve=o.a.div.withConfig({displayName:"InputDisplayContainer",componentId:"sc-cduvts-0"})(["overflow:hidden !important;.inputDisplay{& > *{flex-direction:row;align-items:center;}}.cursor{display:inline-block;width:1px;height:","em;background-color:",";}"],(({theme:{eui:e}})=>e.euiLineHeight),(({theme:e})=>e.eui.euiTextSubduedColor)),Ee=Object(a.memo)((({leftOfCursor:e,rightOfCursor:t})=>{const n=Object(j.a)(k()),l=$(),{leftOfCursorText:o,fullTextEntered:s}=he(),u=Object(a.useRef)(null),c=Object(a.useRef)(null),d=Object(a.useRef)(null),m=o.length,p=Object(a.useCallback)((e=>{const t=e.target;if(s.length&&t.classList&&t.classList.contains("chr")){const n=Array.from(e.currentTarget.querySelectorAll("span.chr")).indexOf(t),a=s.substring(0,n+1),i=s.substring(n+1);l({type:"updateInputTextEnteredState",payload:{leftOfCursorText:a,rightOfCursorText:i}})}}),[l,s]);return Object(a.useEffect)((()=>{if(c.current){const e=e=>{if(c.current){const t=e[0];if(t&&t.rootBounds){const e=c.current.scrollLeft,n=t.rootBounds.right,a=t.rootBounds.left,i=t.boundingClientRect.right;if(i>n-20){const n=e+(i-t.rootBounds.width)+20;c.current.scrollLeft=n}else if(i<a+20){const t=i-20<0?0:e-20;c.current.scrollLeft=t}}}};return u.current=new IntersectionObserver(e,{root:c.current,rootMargin:"0px -10px",threshold:0}),()=>{var e;null===(e=u.current)||void 0===e||e.disconnect(),u.current=null}}}),[]),Object(a.useEffect)((()=>{if(u.current&&d.current){const e=u.current,t=d.current;return e.observe(t),()=>{e.unobserve(t)}}}),[m]),i.a.createElement(ve,{ref:c},i.a.createElement(r.EuiFlexGroup,{responsive:!1,alignItems:"center",gutterSize:"none",className:"inputDisplay",onClick:p},i.a.createElement(r.EuiFlexItem,{grow:!1,"data-test-subj":n("cmdInput-leftOfCursor"),className:"noMinWidth"},e),i.a.createElement(r.EuiFlexItem,{grow:!1,className:"noMinWidth"},i.a.createElement("span",{className:"cursor essentialAnimation",ref:d})),i.a.createElement(r.EuiFlexItem,{className:"noMinWidth","data-test-subj":n("cmdInput-rightOfCursor")},t)))}));Ee.displayName="InputDisplay";const Oe=()=>oe().state.input.showPopover,Se=o.a.span.withConfig({displayName:"ArgumentSelectorWrapperContainer",componentId:"sc-jnz75k-0"})(["border:",";border-radius:",";overflow:hidden;user-select:none;.flexGroup{align-items:stretch;}.selectorContainer{padding:0 ",";max-width:25vw;display:flex;align-items:center;height:100%;}.argNameContainer{background-color:",";}.argName{padding-left:",";height:100%;display:flex;align-items:center;white-space:nowrap;}"],(({theme:{eui:e}})=>e.euiBorderThin),(({theme:{eui:e}})=>e.euiBorderRadiusSmall),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiFormInputGroupLabelBackground),(({theme:{eui:e}})=>e.euiSizeXS)),xe=Object(a.memo)((({argName:e,argIndex:t,argDefinition:{SelectorComponent:n}})=>{const l=$(),{valueText:o,value:s,store:u}=((e,t)=>{const n=oe().state.input.enteredCommand;return Object(a.useMemo)((()=>{var a;const i=null==n||null===(a=n.argState[e])||void 0===a?void 0:a.at(t);return null!=i?i:{value:void 0,valueText:""}}),[e,n,t])})(e,t),c=Object(a.useCallback)((n=>{l({type:"updateInputCommandArgState",payload:{name:e,instance:t,state:n}})}),[t,e,l]);return i.a.createElement(Se,{className:"eui-displayInlineBlock"},i.a.createElement(r.EuiFlexGroup,{className:"flexGroup",responsive:!1,alignItems:"center",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{grow:!1,className:"argNameContainer"},i.a.createElement("div",{className:"argName"},i.a.createElement("span",null,`--${e}=`))),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement("div",{className:"selectorContainer noThemeOverrides eui-textTruncate"},i.a.createElement(n,{value:s,valueText:null!=o?o:"",argName:e,argIndex:t,store:u,onChange:c})))))}));xe.displayName="ArgumentSelectorWrapper";const je=[""," ","="],ke=(e={})=>({value:"",renderValue:null,isArgSelector:!1,argName:"",argIndex:0,argState:void 0,...e}),Te=e=>e.split("").map((e=>ke({value:e,renderValue:e}))),Ce=(e,t,n)=>{var a;return i.a.createElement("span",{className:"chr",key:`${e}.${n}.${null!==(a=t.value)&&void 0!==a?a:"$"}`},t.renderValue)},we=(e,t)=>{let n=t.value;var a,i;return e&&t.isArgSelector&&(n+=`="${null!==(a=null===(i=t.argState)||void 0===i?void 0:i.valueText)&&void 0!==a?a:""}"`),n};class entered_input_EnteredInput{constructor(e,t,n,a){if(m()(this,"leftOfCursorContent",void 0),m()(this,"rightOfCursorContent",void 0),m()(this,"canHaveArgValueSelectors",void 0),m()(this,"argState",void 0),this.leftOfCursorContent=Te(e),this.rightOfCursorContent=Te(t),this.canHaveArgValueSelectors=Boolean(null==a?void 0:a.argsWithValueSelectors),n.hasArgs&&a&&a.argsWithValueSelectors){this.argState=a.argState;const l=[{input:e,items:this.leftOfCursorContent,side:"left"},{input:t,items:this.rightOfCursorContent,side:"right"}];for(const[e,o]of Object.entries(a.argsWithValueSelectors))if(n.hasArg(e)){let n=0;for(const{input:s,items:u,side:c}of l){const l=`--${e}`;let d=s.indexOf(l);for(;d>-1;){const m=l.length,p=d+m,b=s.charAt(p),f="left"===c&&""===b&&je.includes(t.charAt(0));if(je.includes(b)&&(f||"left"===c&&""!==b||"right"===c)){var r;const t=Array.from({length:m},ke),s=null===(r=a.argState[e])||void 0===r?void 0:r.at(n);t[0]=ke({value:l,renderValue:i.a.createElement(xe,{argName:e,argIndex:n,argDefinition:o}),isArgSelector:!0,argName:e,argIndex:n++,argState:s}),u.splice(d,m,...t)}d=s.indexOf(l,p)}}}this.leftOfCursorContent=this.leftOfCursorContent.filter((({value:e})=>e.length>0)),this.rightOfCursorContent=this.rightOfCursorContent.filter((({value:e})=>e.length>0))}}replaceSelection(e,t){const n=this.getFullText(),a=t?ke({value:t}):void 0;let i=n.indexOf(e);const r=[...this.leftOfCursorContent,...this.rightOfCursorContent];this.canHaveArgValueSelectors&&r.forEach(((e,t)=>{e.isArgSelector&&t<i&&(i-=e.value.length-1)}));const l=r.splice(i,e.length);a&&(r.splice(i,0,a),i++),this.leftOfCursorContent=r.splice(0,i),this.rightOfCursorContent=r,this.removeArgState(l)}removeArgState(e){if(this.argState){let n=!1;const a={...this.argState};for(const{argName:i,argIndex:r,isArgSelector:l}of e){var t;l&&null!==(t=a[i])&&void 0!==t&&t.at(r)&&(a[i]=a[i].filter(((e,t)=>t!==r)),n=!0)}n&&(this.argState=a)}}getLeftOfCursorText(e=!1){return this.leftOfCursorContent.map(we.bind(null,e)).join("")}getRightOfCursorText(e=!1){return this.rightOfCursorContent.map(we.bind(null,e)).join("")}getFullText(e=!1){return this.getLeftOfCursorText(e)+this.getRightOfCursorText(e)}getLeftOfCursorRenderingContent(){return i.a.createElement(i.a.Fragment,null,this.leftOfCursorContent.map(Ce.bind(null,"left")))}getRightOfCursorRenderingContent(){return i.a.createElement(i.a.Fragment,null,this.rightOfCursorContent.map(Ce.bind(null,"right")))}getArgState(){return this.argState}moveCursorTo(e){switch(e){case"end":this.leftOfCursorContent.push(...this.rightOfCursorContent.splice(0));break;case"home":this.rightOfCursorContent.unshift(...this.leftOfCursorContent.splice(0));break;case"left":if(this.leftOfCursorContent.length){const e=this.leftOfCursorContent.pop();e&&this.rightOfCursorContent.unshift(e)}break;case"right":if(this.rightOfCursorContent.length){const e=this.rightOfCursorContent.shift();e&&this.leftOfCursorContent.push(e)}}}addValue(e,t=""){t.length&&e.length?this.replaceSelection(t,e):e&&this.leftOfCursorContent.push(ke({value:e}))}deleteChar(e=""){if(e)this.replaceSelection(e,"");else{const e=this.rightOfCursorContent.shift();null!=e&&e.isArgSelector&&this.removeArgState([e])}}backspaceChar(e=""){if(e)this.replaceSelection(e,"");else{const e=this.leftOfCursorContent.pop();null!=e&&e.isArgSelector&&this.removeArgState([e])}}clear(){this.leftOfCursorContent=[],this.rightOfCursorContent=[],this.argState=void 0}}const Ie=g.i18n.translate("xpack.securitySolution.inputCapture.ariaPlaceHolder",{defaultMessage:"Enter a command"}),Me=()=>{const e=getSelection();e&&e.removeAllRanges()},Ae=o.a.div.withConfig({displayName:"InputCaptureContainer",componentId:"sc-19dx6ae-0"})([".focus-container{outline:none !important;}.textSelectionBoundaryHelper{opacity:0;position:absolute;top:-100vh;left:-100vw;}.invisible-input{&,&:focus{border:none;outline:none;background-image:none;background-color:transparent;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;animation:none !important;width:1ch !important;position:absolute;opacity:0;top:-100vh;left:-100vw;}"]),Ne=Object(a.memo)((({onCapture:e,focusRef:t,onChangeFocus:n,children:r})=>{const l=Object(j.a)(k()),o=Object(a.useRef)(null),s=Object(a.useRef)(null),u=Object(a.useRef)(null),c=Object(a.useCallback)((()=>{if(o.current){var e,t,n;const a=document.getSelection(),i=(null!==(e=null==a?void 0:a.toString())&&void 0!==e?e:"").replace(/[\r\n]/g,""),r=!(!o.current||!a)&&(null===(t=o.current)||void 0===t?void 0:t.contains(a.focusNode))&&(null===(n=o.current)||void 0===n?void 0:n.contains(a.anchorNode));return a&&0!==i.length&&r?i:""}return""}),[]),d=Object(a.useCallback)((t=>{if(t.metaKey||t.ctrlKey){if("a"===t.key){t.preventDefault();const e=window.getSelection();if(e&&s.current){const t=document.createRange();t.selectNodeContents(s.current),t.toString().length>0&&(e.removeAllRanges(),e.addRange(t))}}return}const n=/^[\w\d]{2}/.test(t.key)?"":t.key,a=c(),i=Object(H.pick)(t,["key","altKey","ctrlKey","keyCode","metaKey","repeat","shiftKey"]);e({value:n,selection:a,eventDetails:i}),a&&Me()}),[c,e]),m=Object(a.useCallback)((t=>{t.preventDefault(),t.stopPropagation();const n=t.clipboardData.getData("text").replace(/[\r\n]/g,""),a=c();e({value:n,selection:a,eventDetails:{altKey:!1,ctrlKey:!1,key:"Meta",keyCode:91,metaKey:!0,repeat:!1,shiftKey:!1}}),a&&Me()}),[c,e]),p=Object(a.useCallback)((()=>{n&&n(!0)}),[n]),b=Object(a.useCallback)((()=>{n&&n(!1)}),[n]),f=Object(a.useMemo)((()=>({focus:(e=!1)=>{var t,n,a;!e&&(null!==(t=null===(n=window.getSelection())||void 0===n?void 0:n.toString())&&void 0!==t?t:"").length>0||document.activeElement===u.current||null===(a=u.current)||void 0===a||a.focus()},blur:()=>{var e;u.current&&document.activeElement===u.current&&(null===(e=u.current)||void 0===e||e.blur())}})),[]);return t&&(t.current=f),i.a.createElement(Ae,{"data-test-subj":l("inputCapture"),onKeyDown:d,onPaste:m},i.a.createElement("div",{role:"textbox","aria-placeholder":Ie,tabIndex:0,ref:o,className:"focus-container","data-test-subj":l("keyCapture-input"),onBlur:b,onFocus:p},i.a.createElement("div",{className:"textSelectionBoundaryHelper"}," "),i.a.createElement("div",{ref:s,className:"text-container"},r),i.a.createElement("div",{className:"textSelectionBoundaryHelper"}," "),i.a.createElement("input",{ref:u,type:"text",value:"",tabIndex:-1,onPaste:m,onChange:()=>{},spellCheck:"false",className:"invisible-input"})))}));Ne.displayName="InputCapture";const Fe=g.i18n.translate("xpack.securitySolution.useInputHints.noArguments",{defaultMessage:"Hit enter to execute"}),De=g.i18n.translate("xpack.securitySolution.useInputHints.viewInputHistory",{defaultMessage:"Press the up arrow key to access previously entered commands"}),Re=o()(r.EuiText).withConfig({displayName:"InputPlaceholderContainer",componentId:"sc-6afwlc-0"})(["position:absolute;pointer-events:none;padding-left:0.5em;width:96%;color:",";user-select:none;"],(({theme:{eui:e}})=>e.euiFormControlPlaceholderText)),Pe=Object(a.memo)((()=>{const{fullTextEntered:e}=he(),t=oe().state.input.placeholder,n=Object(j.a)(k());return e.length>0?null:i.a.createElement(Re,{size:"s",className:"eui-textTruncate","data-test-subj":n("inputPlaceholder")},i.a.createElement("div",{className:"eui-textTruncate"},t))}));Pe.displayName="InputPlaceholder";const Le=o()(r.EuiCode).withConfig({displayName:"StyledEuiCode",componentId:"sc-qp7srp-0"})(["padding-left:0;"]),Be=Object(a.memo)((({input:e,isValid:t=!0})=>{const n=Object(j.a)(k()),l=Object(a.useMemo)((()=>t?e:i.a.createElement(r.EuiTextColor,null,e)),[e,t]);return i.a.createElement(Le,{transparentBackground:!0,"data-test-subj":n("userCommandText")},l)}));Be.displayName="UserCommandInput";const _e=Object(a.memo)((()=>{const[e,t]=Object(a.useState)(!1),n=$(),l=Object(j.a)(k()),o=Object(a.useCallback)((()=>{t(!0)}),[]),s=Object(a.useCallback)((()=>{t(!1)}),[]),u=Object(a.useCallback)((()=>{n({type:"clearInputHistoryState"}),t(!1)}),[n]);return i.a.createElement(i.a.Fragment,null,e&&i.a.createElement(r.EuiConfirmModal,{title:g.i18n.translate("xpack.securitySolution.commandInputClearHistory.confirmTitle",{defaultMessage:"Clear input history"}),cancelButtonText:g.i18n.translate("xpack.securitySolution.commandInputClearHistory.confirmCancelButton",{defaultMessage:"Cancel"}),confirmButtonText:g.i18n.translate("xpack.securitySolution.commandInputClearHistory.confirmSubmitButton",{defaultMessage:"Clear"}),buttonColor:"danger",onCancel:s,onConfirm:u},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.commandInputClearHistory.confirmMessage",defaultMessage:"This action cannot be undone. Are you sure you wish to continue?"})),i.a.createElement(r.EuiFlexGroup,{responsive:!1,justifyContent:"flexEnd",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonEmpty,{size:"xs",tabIndex:-1,onClick:o,disabled:e,"data-test-subj":l("clearInputHistoryButton")},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.commandInputClearHistory.clearHistoryButtonLabel",defaultMessage:"Clear input history"})))))}));_e.displayName="CommandInputClearHistory";const ze=g.i18n.translate("xpack.securitySolution.commandInputHistory.noHistoryEmptyMessage",{defaultMessage:"No commands have been entered"}),qe=g.i18n.translate("xpack.securitySolution.commandInputHistory.filterPlaceholder",{defaultMessage:"Filter previously entered actions"}),$e=g.i18n.translate("xpack.securitySolution.commandInputHistory.noFilteredMatchesFoundMessage",{defaultMessage:"No entries found matching the filter entered"}),Ve=Object(a.memo)((()=>{const e=$(),t=oe().state.input.history,[n]=Object(a.useState)(he()),l=Object(a.useRef)(!1),o=Object(j.a)(k()),s=Object(a.useMemo)((()=>t.map(((e,t)=>({label:e.display,key:e.id,data:e})))),[t]),u=Object(a.useMemo)((()=>({showIcons:!1,bordered:!0})),[]),c=Object(a.useMemo)((()=>({placeholder:qe,compressed:!0,fullWidth:!0})),[]),d=Object(a.useCallback)(((e,n)=>i.a.createElement(i.a.Fragment,null,e,i.a.createElement(r.EuiSpacer,{size:"s"}),t.length>0?n:i.a.createElement("div",{tabIndex:-1}))),[t.length]),m=Object(a.useCallback)((t=>{l.current=!0;const n=t.find((e=>"on"===e.checked));e({type:"updateInputPopoverState",payload:{show:void 0}}),e({type:"updateInputPlaceholderState",payload:{placeholder:""}}),n&&e({type:"updateInputTextEnteredState",payload:{leftOfCursorText:n.data.input,rightOfCursorText:""}}),e({type:"addFocusToKeyCapture"})}),[e]),p=Object(a.useCallback)((t=>{t&&e({type:"updateInputPlaceholderState",payload:{placeholder:t.data.input}})}),[e]),b=Object(a.useCallback)((e=>i.a.createElement(Be,{input:e.label})),[]);return Object(a.useEffect)((()=>(e({type:"updateInputTextEnteredState",payload:{leftOfCursorText:"",rightOfCursorText:""}}),()=>{l.current||(e({type:"updateInputTextEnteredState",payload:{leftOfCursorText:n.leftOfCursorText,rightOfCursorText:n.rightOfCursorText}}),e({type:"updateInputPlaceholderState",payload:{placeholder:""}}))})),[e,l,n]),i.a.createElement("div",null,t.length>0&&i.a.createElement(_e,null),i.a.createElement(r.EuiSelectable,{options:s,onChange:m,onActiveOptionChange:p,renderOption:b,listProps:u,singleSelection:!0,searchable:!0,searchProps:c,emptyMessage:ze,noMatchesMessage:$e,"data-test-subj":o("inputHistorySelector"),"data-console-input-history":!0},d))}));Ve.displayName="CommandInputHistory";const He=Object(a.memo)((({children:e,width:t="92vw"})=>{const n=Object(j.a)(k()),l=Oe(),o=void 0!==l,s=$(),u=Object(a.useMemo)((()=>({width:t,borderBottomLeftRadius:0,borderBottomRightRadius:0})),[t]),c=Object(a.useMemo)((()=>({clickOutsideDisables:!0})),[]),d=Object(a.useCallback)((()=>{s({type:"updateInputPopoverState",payload:{show:void 0}}),s({type:"addFocusToKeyCapture"})}),[s]);return Object(a.useEffect)((()=>{l||s({type:"addFocusToKeyCapture"})}),[s,l]),i.a.createElement(r.EuiPopover,{button:e,closePopover:d,isOpen:o,panelStyle:u,anchorPosition:"upLeft",hasArrow:!1,display:"block",attachToAnchor:!0,focusTrapProps:c,ownFocus:!1,"data-test-subj":n("inputPopover")},l&&i.a.createElement(r.EuiFocusTrap,{clickOutsideDisables:!0},"input-history"===l&&i.a.createElement(Ve,null)))}));He.displayName="InputAreaPopover";const Ue=o.a.div.withConfig({displayName:"CommandInputContainer",componentId:"sc-ujnhrt-0"})(["background-color:",";border-radius:",";padding:",";outline:",";&:focus-within{border-bottom:",";border-bottom-color:",";}&.error{border-bottom-color:",";}.textEntered{white-space:break-spaces;}.prompt{padding-right:1ch;}&.withPopover{border-top-left-radius:0;border-top-right-radius:0;}&.hasFocus{.cursor{background-color:",";animation:cursor-blink-animation 1s steps(5,start) infinite;-webkit-animation:cursor-blink-animation 1s steps(5,start) infinite;@keyframes cursor-blink-animation{to{visibility:hidden;}}@-webkit-keyframes cursor-blink-animation{to{visibility:hidden;}}}}"],(({theme:{eui:e}})=>e.euiFormBackgroundColor),(({theme:{eui:e}})=>e.euiBorderRadius),(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiBorderThin),(({theme:{eui:e}})=>e.euiBorderThick),(({theme:{eui:e}})=>e.euiColorPrimary),(({theme:{eui:e}})=>e.euiColorDanger),(({theme:{eui:e}})=>e.euiTextColor)),Qe=Object(a.memo)((({prompt:e="",focusRef:t,...n})=>{(()=>{const e=$(),t=Boolean(Oe()),n=(()=>{const e=oe().state.input.parsedInput;return-1!==e.input.trimStart().indexOf(" ")?e.name:""})(),i=ee(),{leftOfCursorText:r}=he(),l=Object(a.useMemo)((()=>{if(n)return i.find((e=>e.name===n))}),[n,i]);Object(a.useEffect)((()=>{if(n&&!t)if(l&&!0!==l.helpHidden){var a,i;const t=null!==(a=null==l?void 0:l.exampleInstruction)&&void 0!==a?a:"",n=null!==(i=null==l?void 0:l.exampleUsage)&&void 0!==i?i:"";let r=null!=t?t:"";if(n&&(r+=t?` ${g.i18n.translate("xpack.securitySolution.useInputHints.exampleInstructions",{defaultMessage:"Ex: [ {exampleUsage} ]",values:{exampleUsage:n}})}`:n),!r||!n){const e=f(l);e.length>0?r+=`${l.name} ${e}`:r+=Fe}e({type:"updateFooterContent",payload:{value:r}}),e({type:"setInputState",payload:{value:void 0}})}else e({type:"updateFooterContent",payload:{value:(o=n,g.i18n.translate("xpack.securitySolution.useInputHints.unknownCommand",{defaultMessage:"Unknown command {commandName}",values:{commandName:o}}))}}),e({type:"setInputState",payload:{value:"error"}});else e({type:"updateFooterContent",payload:{value:r||t?"":De}}),e({type:"setInputState",payload:{value:void 0}});var o}),[n,l,e,t,r])})();const l=Object(j.a)(k()),o=$(),{rightOfCursorText:s,leftOfCursorText:u,fullTextEntered:c,enteredCommand:d,parsedInput:m}=he(),p=se(),b=!!Oe(),[y,h]=Object(a.useState)(!1),[v,E]=Object(a.useState)(void 0),[O,S]=Object(a.useState)("94vw"),x=Object(a.useRef)(null),T=t||x,C=Object(a.useMemo)((()=>ye()({cmdInput:!0,hasFocus:y,error:"error"===p,withPopover:b})),[y,b,p]),w=Object(a.useMemo)((()=>0===c.trim().length),[c]),I=Object(a.useMemo)((()=>new entered_input_EnteredInput(u,s,m,d)),[d,u,m,s]),M=Object(a.useCallback)((({width:e})=>{e>0&&S(`${e}px`)}),[]),A=Object(a.useCallback)((()=>{E({input:I.getFullText(!0),enteredCommand:d,parsedInput:m})}),[d,m,I]),N=Object(a.useCallback)((e=>{h(e)}),[]),F=Object(a.useCallback)((e=>{T.current&&T.current.focus(),b&&o({type:"updateInputPopoverState",payload:{show:void 0}})}),[o,b,T]),D=Object(a.useCallback)((({value:e,selection:t,eventDetails:n})=>{const a=n.keyCode;if(38===a)return o({type:"removeFocusFromKeyCapture"}),void o({type:"updateInputPopoverState",payload:{show:"input-history"}});o({type:"updateInputTextEnteredState",payload:({leftOfCursorText:n,rightOfCursorText:i,enteredCommand:r,parsedInput:l})=>{const o=new entered_input_EnteredInput(n,i,l,r);switch(o.addValue(null!=e?e:"",t),a){case 8:o.backspaceChar(t);break;case 46:o.deleteChar(t);break;case 13:E({input:o.getFullText(!0),enteredCommand:r,parsedInput:l}),o.clear();break;case 37:o.moveCursorTo("left");break;case 39:o.moveCursorTo("right");break;case 36:o.moveCursorTo("home");break;case 35:o.moveCursorTo("end")}return{leftOfCursorText:o.getLeftOfCursorText(),rightOfCursorText:o.getRightOfCursorText(),argState:o.getArgState()}}})}),[o]);return Object(a.useEffect)((()=>{v&&(o({type:"executeCommand",payload:v}),E(void 0),o({type:"updateInputTextEnteredState",payload:{leftOfCursorText:"",rightOfCursorText:""}}))}),[v,o]),i.a.createElement(He,{width:O},i.a.createElement(r.EuiResizeObserver,{onResize:M},(a=>i.a.createElement(Ue,fe()({},n,{className:C,onClick:F,ref:a,"data-test-subj":l("cmdInput-container")}),i.a.createElement(r.EuiFlexGroup,{responsive:!1,alignItems:"center",gutterSize:"none"},e&&i.a.createElement(r.EuiFlexItem,{grow:!1,"data-test-subj":l("cmdInput-prompt")},i.a.createElement("span",{className:"eui-displayInlineBlock prompt"},e)),i.a.createElement(r.EuiFlexItem,{className:"textEntered"},i.a.createElement(Ne,{onCapture:D,onChangeFocus:N,focusRef:t},i.a.createElement(Ee,{leftOfCursor:I.getLeftOfCursorRenderingContent(),rightOfCursor:I.getRightOfCursorRenderingContent()})),i.a.createElement(Pe,null)),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonIcon,{"data-test-subj":l("inputTextSubmitButton"),"aria-label":"submit-command",iconType:"playFilled",color:"primary",isDisabled:w,onClick:A})))))))}));Qe.displayName="CommandInput";var Ge=n(50),We=n.n(Ge);const Ke=Object(a.memo)((({size:e="s",color:t,children:n,"data-test-subj":a,className:l})=>{const{euiTheme:o}=Object(r.useEuiTheme)();return i.a.createElement(r.EuiText,{size:e,"data-test-subj":a,className:`font-family-code ${null!=l?l:""}`},i.a.createElement(r.EuiTextColor,{color:null!=t?t:o.colors.text},n))}));Ke.displayName="ConsoleText";const Xe=Object(a.memo)((()=>{const e=Object(j.a)(k());return i.a.createElement(Ke,{"data-test-subj":e("longRunningCommandHint")},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.longRunningCommandHintMessage",defaultMessage:"Hint: We are still working on this task. You may leave the console or place another command while this command is processing."}))}));Xe.displayName="LongRunningCommandHint";const Ye=g.i18n.translate("xpack.securitySolution.commandExecutionResult.successTitle",{defaultMessage:"Action completed."}),Je=g.i18n.translate("xpack.securitySolution.commandExecutionResult.failureTitle",{defaultMessage:"Action failed."}),Ze=g.i18n.translate("xpack.securitySolution.commandExecutionResult.pending",{defaultMessage:"Action pending."}),et=Object(a.memo)((({showAs:e="success",title:t,showTitle:n=!0,"data-test-subj":l,className:o,children:s})=>{const u=k(),c=Object(j.a)(null!=l?l:u),d=Object(a.useMemo)((()=>ye()({"eui-displayInlineBlock":"pending"===e,"font-family-code":!0,[o||"_"]:Boolean(o)})),[o,e]);return i.a.createElement(r.EuiPanel,{hasShadow:!1,paddingSize:"none",borderRadius:"none",color:"transparent",className:d,"data-test-subj":l||c("commandExecutionResult")},"pending"===e?i.a.createElement(Ke,null,null!=s?s:Ze):i.a.createElement(i.a.Fragment,null,n&&i.a.createElement(i.a.Fragment,null,i.a.createElement(Ke,{color:"success"===e?"success":"danger"},t||("success"===e?Ye:Je)),i.a.createElement(r.EuiSpacer,{size:"s"})),s))}));et.displayName="CommandExecutionResult";const tt=o.a.div.withConfig({displayName:"CommandOutputContainer",componentId:"sc-1wmcd6l-0"})(["position:relative;.busy-indicator{margin-left:0.5em;}"]),nt=Object(a.memo)((({item:{command:e,state:t,id:n,enteredAt:l,isValid:o}})=>{const s=$(),u=e.commandDefinition.RenderComponent,[c,d]=Object(a.useState)(!1),m=Object(a.useMemo)((()=>"pending"===t.status),[t.status]),p=Object(a.useCallback)((e=>{s({type:"updateCommandStatusState",payload:{id:n,value:e}})}),[s,n]),b=Object(a.useCallback)((e=>{s({type:"updateCommandStoreState",payload:{id:n,value:e}})}),[s,n]);return Object(a.useEffect)((()=>{let e;if(m&&!c){const t=We()().diff(We()(l),"seconds");if(t>=15)return void d(!0);e=setTimeout((()=>{d(!0)}),1e3*(15-t))}return()=>{e&&clearTimeout(e)}}),[l,c,m]),i.a.createElement(tt,null,i.a.createElement("div",null,i.a.createElement(Be,{input:e.inputDisplay,isValid:o})),i.a.createElement("div",{className:"noThemeOverrides"},i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiSpacer,{size:"xs"}),i.a.createElement(u,{command:e,store:t.store,status:t.status,setStore:b,setStatus:p,ResultComponent:et}),m&&i.a.createElement(r.EuiLoadingChart,{className:"busy-indicator",mono:!0}),m&&c&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(Xe,null))))}));nt.displayName="CommandExecutionOutput";const at=n(61).css`
  ${({theme:{eui:e}})=>e.euiSizeL}
`,it=o()(r.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItemHistoryItem",componentId:"sc-1249lql-0"})(["border-bottom:"," dashed ",";margin-bottom:",";padding-bottom:",";"],(({theme:{eui:e}})=>e.euiBorderWidthThin),(({theme:{eui:e}})=>e.euiBorderColor),at,at),rt=Object(a.memo)((({children:e})=>{const t=Object(j.a)(k());return i.a.createElement(it,{grow:!0,"data-test-subj":t("historyItem")},e)}));rt.displayName="HistoryItem";const lt=Object(a.memo)((e=>{const t=oe().state.commandHistory,n=$(),l=Object(j.a)(k()),o=Object(a.useMemo)((()=>t.map((e=>i.a.createElement(rt,{key:e.id},i.a.createElement(nt,{item:e}))))),[t]);return Object(a.useEffect)((()=>{n({type:"scrollDown"})}),[n,t.length]),i.a.createElement(r.EuiFlexGroup,fe()({"data-test-subj":l("historyOutput")},e,{wrap:!0,direction:"column",alignItems:"stretch",responsive:!1,gutterSize:"none"}),o)}));lt.displayName="HistoryOutput";const ot=o()(r.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItemNoPadding",componentId:"sc-ojfnk7-0"})(["padding:0 !important;"]),st=Object(a.memo)((({headerContent:e,children:t})=>{const n=Object(j.a)(k("sidePanel"));return i.a.createElement(r.EuiFlexGroup,{direction:"column",responsive:!1,className:"eui-fullHeight",gutterSize:"none","data-test-subj":n()},e&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiFlexItem,{grow:!1,className:"layout-container","data-test-subj":n("header")},e),i.a.createElement(r.EuiHorizontalRule,{margin:"none"})),i.a.createElement(ot,{className:"eui-scrollBar eui-yScroll layout-container"},i.a.createElement("div",{"data-test-subj":n("body")},t)))}));st.displayName="SidePanelContentLayout";const ut=o()(r.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-u9ickv-0"})(["padding-top:",";padding-right:",";"],(({theme:{eui:e}})=>e.euiPanelPaddingModifiers.paddingSmall),(({theme:{eui:e}})=>e.euiPanelPaddingModifiers.paddingSmall)),ct=Object(a.memo)((()=>{const e=$(),t=ee(),n=Object(j.a)(k("sidePanel")),l=ce().show,o=Object(a.useCallback)((()=>{e({type:"showSidePanel",payload:{show:null}})}),[e]),s=Object(a.useMemo)((()=>"help"===l?i.a.createElement(i.a.Fragment,null,i.a.createElement(ut,null,i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiTitle,{size:"s","data-test-subj":n("headerTitle")},i.a.createElement("h3",null,i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.sidePanel.helpTitle",defaultMessage:"Help"})))),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonIcon,{"aria-label":"closeSidePanelIcon",iconType:"cross",color:"text",onClick:o,"data-test-subj":n("headerCloseButton")}))),i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(r.EuiText,{size:"s"},i.a.createElement(O.FormattedMessage,{id:"xpack.securitySolution.console.sidePanel.helpDescription",defaultMessage:"Use the add ({icon}) button to populate a response action to the text bar. Add additional parameters or comments as necessary.",values:{icon:i.a.createElement(r.EuiIcon,{type:"plusInCircle"})}}))):null),[l,n,o]),u=Object(a.useMemo)((()=>"help"===l?i.a.createElement("div",{"data-test-subj":n("helpContent")},i.a.createElement(Z,{commands:t,display:"table"})):null),[t,n,l]);return l?i.a.createElement(st,{headerContent:s},u):null}));ct.displayName="RightPanelContentManager";const dt=o()(r.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItemWhite",componentId:"sc-hd3kv7-0"})(["background-color:"," !important;border-radius:",";box-shadow:0 "," "," ",";"],(({theme:{eui:e}})=>e.euiHeaderBackgroundColor),(({theme:{eui:e}})=>`0 ${e.euiSizeXS} ${e.euiSizeXS} 0`),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>Object(r.transparentize)(e.euiShadowColor,.04))),mt=Object(a.memo)((e=>Boolean(ce().show)?i.a.createElement(dt,{grow:!1,className:"layout-rightPanel"},i.a.createElement(ct,null)):null));mt.displayName="SidePanelFlexItem";const pt=o.a.div.withConfig({displayName:"ConsoleWindow",componentId:"sc-d15gh7-0"})(["height:100%;background-color:",";border:",";border-radius:",";.layout{height:100%;width:100%;min-height:300px;min-width:300px;overflow:hidden;&-hideOverflow{overflow:hidden;}&-bottomBorder{border-bottom:"," solid ",";}&-container{padding:",";}&-header{background-color:",";border-bottom:1px solid ",";border-top-left-radius:",";border-top-right-radius:",";padding:"," "," "," ",";}&-commandInput{padding-top:",";padding-bottom:",";}&-footer{padding-top:0;padding-bottom:",";}&-rightPanel{width:35%;background-color:",";border-left:",";}&-historyOutput{overflow:auto;}&-historyViewport{height:100%;overflow-x:hidden;white-space:pre-wrap;}.euiFlexItem:not(.noMinWidth):not(.noThemeOverrides .euiFlexItem){min-width:0;}}.font-family-code{font-family:",";}.font-style-italic{font-style:italic;}.descriptionList-20_80{&.euiDescriptionList{> .euiDescriptionList__title{width:20%;margin-top:",";}> .euiDescriptionList__description{width:80%;margin-top:",";}}}"],(({theme:{eui:e}})=>e.euiPageBackgroundColor),(({theme:{eui:e}})=>e.euiBorderThin),(({theme:{eui:e}})=>e.euiBorderRadiusSmall),(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiPageBackgroundColor),(({theme:{eui:e}})=>e.euiPanelPaddingModifiers.paddingMedium),(({theme:{eui:e}})=>e.euiColorEmptyShade),(({theme:{eui:e}})=>e.euiColorLightShade),(({theme:{eui:e}})=>e.euiBorderRadiusSmall),(({theme:{eui:e}})=>e.euiBorderRadiusSmall),(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiFormBackgroundColor),(({theme:{eui:e}})=>e.euiBorderThin),(({theme:{eui:e}})=>e.euiCodeFontFamily),(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiSizeS)),bt=Object(a.memo)((({prompt:e,commands:t,HelpComponent:n,TitleComponent:l,storagePrefix:o,managedKey:s,...u})=>{const d=Object(a.useRef)(null),m=Object(a.useRef)(null),p=Object(j.a)(u["data-test-subj"]),b=Object(c.c)(s),f=Object(a.useCallback)((()=>{setTimeout((()=>{d.current&&(d.current.scrollTop=d.current.scrollHeight)}),1)}),[]),g=Object(a.useCallback)((()=>{m.current&&m.current.focus()}),[]);return Object(a.useEffect)((()=>{b&&!b.isOpen||setTimeout(g,2)}),[g,b]),i.a.createElement(le,{commands:t,scrollToBottom:f,keyCapture:m,managedKey:s,HelpComponent:n,dataTestSubj:u["data-test-subj"],storagePrefix:o},i.a.createElement(pt,u,i.a.createElement(r.EuiFlexGroup,{className:"layout",gutterSize:"none",responsive:!1},i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiFlexGroup,{direction:"column",className:"layout",gutterSize:"none",responsive:!1,"data-test-subj":p("mainPanel")},i.a.createElement(r.EuiFlexItem,{grow:!1,className:"layout-header"},i.a.createElement(pe,{TitleComponent:l})),i.a.createElement(r.EuiFlexItem,{grow:!0,className:"layout-hideOverflow"},i.a.createElement(r.EuiFlexGroup,{gutterSize:"none",responsive:!1,className:"layout-hideOverflow"},i.a.createElement(r.EuiFlexItem,{className:"eui-fullHeight layout-hideOverflow"},i.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"none",responsive:!1,className:"layout-hideOverflow"},i.a.createElement(r.EuiFlexItem,{grow:!0,className:"layout-historyOutput"},i.a.createElement("div",{className:"layout-container layout-historyViewport eui-scrollBar eui-yScroll",ref:d},i.a.createElement(lt,null))),i.a.createElement(r.EuiFlexItem,{onClick:g,grow:!1,className:"layout-container layout-commandInput","data-test-subj":p("mainPanel-inputArea")},i.a.createElement(Qe,{prompt:e,focusRef:m})),i.a.createElement(r.EuiFlexItem,{grow:!1,className:"layout-container layout-footer"},i.a.createElement(ue,null)))))))),i.a.createElement(mt,null))))}));bt.displayName="Console"},899:function(e,t,n){"use strict";n.d(t,"b",(function(){return N})),n.d(t,"a",(function(){return B}));var a=n(42),i=n(40),r=n(44),l=n(2),o=n.n(l),s=n(41),u=n.n(s),c=n(103),d=n(46),m=n(117),p=n(383),b=n(111),f=n(179),g=n(346),y=n(5);const h=y.i18n.translate("xpack.securitySolution.timeline.toggleEventDetailsTitle",{defaultMessage:"Expand event details"}),v=y.i18n.translate("xpack.securitySolution.timeline.addedANoteLabel",{defaultMessage:"added a note"}),E=y.i18n.translate("xpack.securitySolution.timeline.addedADescriptionLabel",{defaultMessage:"added description"}),O=y.i18n.translate("xpack.securitySolution.timeline.anUnknownUserLabel",{defaultMessage:"an unknown user"}),S=y.i18n.translate("xpack.securitySolution.timeline.deleteNoteLabel",{defaultMessage:"Delete Note"}),x=y.i18n.translate("xpack.securitySolution.timeline.cancelDeleteNoteLabel",{defaultMessage:"Keep Note"}),j=y.i18n.translate("xpack.securitySolution.timeline.promptDeleteNoteLabel",{defaultMessage:"Delete timeline note?"});var k=n(118),T=n(105),C=n(657),w=n(110),I=n(116),M=n(102),A=n(108);const N=u.a.section.withConfig({displayName:"NotePreviewsContainer",componentId:"sc-16ieedj-0"})(["padding-top:",";"],(({theme:e})=>`${e.eui.euiSizeS}`));N.displayName="NotePreviewsContainer";const F=({eventId:e,timelineId:t})=>{const n=Object(c.useDispatch)(),{selectedPatterns:a}=Object(I.d)(w.SourcererScopeName.timeline),r=Object(l.useCallback)((()=>{n(b.a.toggleDetailPanel({panelView:"eventDetail",tabType:k.d.notes,id:t,params:{eventId:e,indexName:a.join(",")}}))}),[n,e,a,t]);return o.a.createElement(i.EuiButtonIcon,{title:h,"aria-label":h,color:"text",iconType:"arrowRight",onClick:r})},D=o.a.memo(F),R=o.a.memo((({closeModal:e,confirmModal:t})=>o.a.createElement(i.EuiConfirmModal,{title:j,onCancel:e,onConfirm:t,cancelButtonText:x,confirmButtonText:S,buttonColor:"danger",defaultFocusedButton:"confirm"})));R.displayName="DeleteNoteConfirm";const P=o.a.memo((({noteId:e})=>{const[t,n]=Object(l.useState)(null),{mutate:a,isLoading:r}=function(e){const{services:{http:t}}=Object(M.j)(),n=Object(c.useDispatch)(),{addError:a}=Object(A.a)();return Object(d.useMutation)({mutationFn:e=>t.fetch("/api/note",{method:"DELETE",body:JSON.stringify({noteId:e})}),onSuccess:()=>{e&&n(f.a.deleteNote({id:e}))},onError:e=>{var t;a(e,{title:(t=e,y.i18n.translate("xpack.securitySolution.timeline.deleteNoteError",{defaultMessage:"An error occurred deleting note {error}",values:{error:t}}))})}})}(e),s=Object(l.useCallback)((async()=>{n(e)}),[e]),u=Object(l.useCallback)((()=>{n(null)}),[]),m=Object(l.useCallback)((()=>{a(e),n(null)}),[a,e]),p=Object(l.useMemo)((()=>r||null==e),[r,e]);return o.a.createElement(o.a.Fragment,null,o.a.createElement(i.EuiButtonIcon,{title:S,"aria-label":S,"data-test-subj":"delete-note",color:"text",iconType:"trash",onClick:s,disabled:p}),null!=t&&o.a.createElement(R,{closeModal:u,confirmModal:m}))}));P.displayName="DeleteNoteButton";const L=o.a.memo((({eventId:e,timelineId:t,noteId:n})=>e&&t?o.a.createElement(o.a.Fragment,null,o.a.createElement(D,{eventId:e,timelineId:t}),o.a.createElement(P,{noteId:n})):o.a.createElement(P,{noteId:n})));L.displayName="NoteActions";const B=o.a.memo((({eventIdToNoteIds:e,notes:t,timelineId:n,showTimelineDescription:s})=>{const u=Object(l.useMemo)((()=>b.b.getTimelineByIdSelector()),[]),c=Object(T.a)((e=>n?u(e,n):null)),d=Object(l.useMemo)((()=>s&&n&&null!=c&&c.description?[{username:Object(m.a)(c.updatedBy),event:E,"data-test-subj":"note-preview-description",id:"note-preview-description",timestamp:c.updated?o.a.createElement(r.FormattedRelative,{"data-test-subj":"updated",value:new Date(c.updated)}):Object(m.e)(),children:o.a.createElement(i.EuiText,{size:"s"},c.description),timelineAvatar:o.a.createElement(i.EuiAvatar,{"data-test-subj":"avatar",name:null!=c.updatedBy?c.updatedBy:"?",size:"l"}),actions:o.a.createElement(C.a,{timelineId:n,initialFocus:"description"})}]:[]),[c,n,s]),f=Object(l.useMemo)((()=>Object(a.uniqBy)("savedObjectId",t).map((t=>{var a,l,s;const u=null!=e?Object.entries(e).reduce(((e,[n,a])=>{var i;return a.includes(null!==(i=t.noteId)&&void 0!==i?i:"")?n:e}),null):null!==(a=t.eventId)&&void 0!==a?a:null;return{"data-test-subj":`note-preview-${t.savedObjectId}`,username:Object(m.a)(t.updatedBy),event:v,timestamp:t.updated?o.a.createElement(r.FormattedRelative,{"data-test-subj":"updated",value:new Date(t.updated)}):Object(m.e)(),children:o.a.createElement("div",{className:g.a,tabIndex:0},o.a.createElement(i.EuiScreenReaderOnly,{"data-test-subj":"screenReaderOnlyUserAddedANote"},o.a.createElement("p",null,`${null!==(l=t.updatedBy)&&void 0!==l?l:O} ${v}`)),o.a.createElement(p.b,null,null!==(s=t.note)&&void 0!==s?s:"")),actions:o.a.createElement(L,{eventId:u,timelineId:n,noteId:t.savedObjectId}),timelineAvatar:o.a.createElement(i.EuiAvatar,{"data-test-subj":"avatar",name:null!=t.updatedBy?t.updatedBy:"?",size:"l"})}}))),[e,t,n]);return o.a.createElement(i.EuiCommentList,{"data-test-subj":"note-comment-list",comments:[...d,...f]})}));B.displayName="NotePreviews"},901:function(e,t,n){"use strict";n.d(t,"b",(function(){return r})),n.d(t,"a",(function(){return l}));var a=n(42),i=n(2);const r={pageName:n(131).a.noPage,detailName:void 0,tabName:void 0,search:"",pathName:"/",state:void 0},l=Object(i.createContext)([r,()=>a.noop])},904:function(e,t,n){var a=n(1006),i=n(1010),r=n(614),l=n(258),o=n(1016);e.exports=function(e){return"function"==typeof e?e:null==e?r:"object"==typeof e?l(e)?i(e[0],e[1]):a(e):o(e)}},905:function(e,t,n){e.exports=n(33)(1215)},907:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(40),i=n(44),r=n(50),l=n.n(r),o=n(2),s=n.n(o);const u=s.a.memo((({children:e,date:t,fieldName:n,className:r=""})=>s.a.createElement(a.EuiToolTip,{"data-test-subj":"localized-date-tool-tip",anchorClassName:r,content:s.a.createElement(a.EuiFlexGroup,{"data-test-subj":"dates-container",direction:"column",gutterSize:"none"},null!=n?s.a.createElement(a.EuiFlexItem,{grow:!1},s.a.createElement("span",{"data-test-subj":"field-name"},n)):null,s.a.createElement(a.EuiFlexItem,{grow:!1},s.a.createElement(i.FormattedRelative,{"data-test-subj":"humanized-relative-date",value:l.a.utc(t).toDate()})),s.a.createElement(a.EuiFlexItem,{"data-test-subj":"with-day-of-week",grow:!1},l.a.utc(t).local().format("llll")),s.a.createElement(a.EuiFlexItem,{"data-test-subj":"with-time-zone-offset-in-hours",grow:!1},l()(t).format()))},s.a.createElement(s.a.Fragment,null,e))));u.displayName="LocalizedDateTooltip"},908:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(5);const i="siem";a.i18n.translate("xpack.securitySolution.guideConfig.title",{defaultMessage:"Detect threats in my data with SIEM"}),a.i18n.translate("xpack.securitySolution.guideConfig.description",{defaultMessage:"There are many ways to get your SIEM data into Elastic. In this guide, we'll help you get set up quickly using the Elastic Defend integration."}),a.i18n.translate("xpack.securitySolution.guideConfig.documentationLink",{defaultMessage:"Learn more"}),a.i18n.translate("xpack.securitySolution.guideConfig.addDataStep.title",{defaultMessage:"Add data with Elastic Defend"}),a.i18n.translate("xpack.securitySolution.guideConfig.addDataStep.description",{defaultMessage:"Install Elastic Agent and its Elastic Defend integration on one of your computers to get SIEM data flowing."}),a.i18n.translate("xpack.securitySolution.guideConfig.addDataStep.description.linkText",{defaultMessage:"Learn more"}),a.i18n.translate("xpack.securitySolution.guideConfig.rulesStep.title",{defaultMessage:"Turn on rules"}),a.i18n.translate("xpack.securitySolution.guideConfig.rulesStep.description",{defaultMessage:"Load the Elastic prebuilt rules, select the rules you want, and enable them to generate alerts."}),a.i18n.translate("xpack.securitySolution.guideConfig.rulesStep.manualCompletion.title",{defaultMessage:"Continue with the guide"}),a.i18n.translate("xpack.securitySolution.guideConfig.rulesStep.manualCompletion.description",{defaultMessage:"After you've enabled the rules you need, continue."}),a.i18n.translate("xpack.securitySolution.guideConfig.alertsStep.title",{defaultMessage:"Manage alerts and cases"}),a.i18n.translate("xpack.securitySolution.guideConfig.alertsStep.description",{defaultMessage:"Learn how to view and triage alerts with cases."}),a.i18n.translate("xpack.securitySolution.guideConfig.alertsStep.manualCompletion.title",{defaultMessage:"Continue the guide"}),a.i18n.translate("xpack.securitySolution.guideConfig.alertsStep.manualCompletion.description",{defaultMessage:"After you've explored the case, continue."})},909:function(e,t,n){"use strict";n.d(t,"a",(function(){return O})),n.d(t,"b",(function(){return S}));var a=n(42),i=n(2),r=n.n(i),l=n(103),o=n(3),s=n(130),u=n.n(s),c=n(49),d=n(114),m=n(116),p=n(110),b=n(161),f=n(495),g=n(673),y=n(148),h=n(111);const v="timeline-filter-drop-area",E=(e=[])=>e.filter((e=>e.meta.controlledBy!==v)),O=Object(i.memo)((({dataProviders:e,filters:t,filterManager:n,filterQuery:a,from:s,fromStr:c,kqlMode:O,isRefreshPaused:x,savedQueryId:j,setFilters:k,setSavedQueryId:T,refreshInterval:C,timelineId:w,to:I,toStr:M,updateReduxTime:A})=>{const N=Object(l.useDispatch)(),[F,D]=Object(i.useState)(null!=c?c:new Date(s).toISOString()),[R,P]=Object(i.useState)(null!=M?M:new Date(I).toISOString()),{browserFields:L,indexPattern:B}=Object(m.d)(p.SourcererScopeName.timeline),[_,z]=Object(i.useState)(void 0),[q,$]=Object(i.useState)({query:null!=a?a.expression:"",language:null!=a?a.kind:"kuery"}),[V,H]=Object(i.useState)(E(t)),[U,Q]=Object(i.useState)(Object(b.f)(Object(y.g)(e,L),B)),G=Object(f.a)(),W=Object(i.useCallback)(((e,t)=>N(h.a.applyKqlFilterQuery({id:w,filterQuery:{kuery:{kind:t,expression:e},serializedQuery:Object(b.f)(e,B)}}))),[N,B,w]);Object(i.useEffect)((()=>{let e=!0;const a=new o.Subscription;return n.setFilters(t),a.add(n.getUpdates$().subscribe({next:()=>{if(e){const e=E(n.getFilters());k(e),H(e)}}})),()=>{e=!1,a.unsubscribe()}}),[]),Object(i.useEffect)((()=>{const e=E(n.getFilters());u()(t,e)||n.setFilters(t)}),[t]),Object(i.useEffect)((()=>{$({query:null!=a?a.expression:"",language:null!=a?a.kind:"kuery"})}),[a]),Object(i.useEffect)((()=>{Q(Object(b.f)(Object(y.g)(e,L),B))}),[e,L,B]),Object(i.useEffect)((()=>{null!=c&&null!=M?(D(c),P(M)):null!=s&&null!=I&&(D(new Date(s).toISOString()),P(new Date(I).toISOString()))}),[s,c,I,M]),Object(i.useEffect)((()=>{let e=!0;return async function(){if(null!=j&&null!=G)try{const n=await G.getSavedQuery(j);e&&null!=n&&z({...n,attributes:{...n.attributes,filters:E(t)}})}catch(e){z(void 0)}else e&&z(void 0)}(),()=>{e=!1}}),[j]);const K=Object(i.useCallback)(((e,t)=>{if((null==a||null!=a&&a.expression!==e.query||a.kind!==e.language)&&W(e.query,e.language),null!=t){const e=t.from.includes("now")||t.to.includes("now");A({id:d.a.timeline,end:t.to,start:t.from,isInvalid:!1,isQuickSelection:e,timelineId:w})}}),[a,w]),X=Object(i.useCallback)((e=>{if(null!=e){if(e.id!==j&&T(e.id),null!=G&&""!==U){const t=null!=e.attributes.filters?e.attributes.filters.findIndex((e=>e.meta.controlledBy===v)):-1;G.updateQuery(e.id,{...e.attributes,filters:null!=e.attributes.filters?t>-1?[...e.attributes.filters.slice(0,t),S(U),...e.attributes.filters.slice(t+1)]:[...e.attributes.filters,S(U)]:[]})}}else T(null)}),[U,j,G]);return r.a.createElement(g.a,{dateRangeFrom:F,dateRangeTo:R,hideSavedQuery:"search"===O,indexPattern:B,isRefreshPaused:x,filterQuery:q,filterManager:n,filters:V,onSubmitQuery:K,refreshInterval:C,savedQuery:_,onSavedQuery:X,dataTestSubj:"timelineQueryInput",displayStyle:"inPage"})})),S=e=>{const t=JSON.parse(e),n=Object.keys(t);return{...t,meta:{alias:v,controlledBy:v,negate:!1,disabled:!1,type:"custom",key:Object(a.isEmpty)(n)?"bool":n[0],value:e},$state:{store:c.FilterStateStore.APP_STATE}}}},910:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(5);const i=e=>e?a.i18n.translate("xpack.securitySolution.toggleQuery.on",{defaultMessage:"Open"}):a.i18n.translate("xpack.securitySolution.toggleQuery.off",{defaultMessage:"Closed"})},911:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),r=n(40),l=n(106),o=n(140),s=n(209);const u=({timelineType:e,elasticTemplateTimelineCount:t,customTemplateTimelineCount:n})=>{const[u,c]=Object(a.useState)(null),d=Object(a.useMemo)((()=>e===l.l.template),[e]),m=Object(a.useMemo)((()=>d?u:null),[u,d]),p=Object(a.useMemo)((()=>null==m?null:m===l.g.elastic?l.k.immutable:l.k.active),[m]),b=Object(a.useMemo)((()=>[{id:l.g.elastic,name:o.s,disabled:!d,withNext:!0,count:null!=t?t:void 0},{id:l.g.custom,name:o.r,disabled:!d,withNext:!1,count:null!=n?n:void 0}]),[n,t,d]),f=Object(a.useCallback)((e=>{c(u===e?null:e)}),[c,u]),g=Object(a.useMemo)((()=>d?b.map((e=>i.a.createElement(r.EuiFilterButton,{hasActiveFilters:e.id===m,key:`template-timeline-filter-${e.id}`,numFilters:e.count,onClick:f.bind(null,e.id),withNext:e.withNext,isDisabled:e.disabled,"data-test-subj":e.name},e.name))):null),[m,b,d,f]),y=Object(a.useCallback)((async()=>{m!==l.g.custom&&await Object(s.f)()}),[m]);return{timelineStatus:p,templateTimelineType:m,templateTimelineFilter:g,installPrepackagedTimelines:y}}},912:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),r=n(118),l=n(106),o=n(242);const s=({closeGearMenu:e,outline:t,title:n,timelineId:a=r.c.active})=>{const{getButton:i}=Object(o.b)({timelineId:a,timelineType:l.l.template,closeGearMenu:e});return i({outline:t,title:n})},u=i.a.memo(s);u.displayName="NewTemplateTimeline"},913:function(e,t,n){"use strict";n.d(t,"a",(function(){return l}));var a=n(2),i=n(606),r=n(102);const l=()=>{const{conversations:e}=Object(i.a)(),{services:{telemetry:t}}=Object(r.j)(),n=Object(a.useCallback)((t=>{var n;return(null!==(n=e[t])&&void 0!==n?n:{isDefault:!1}).isDefault?t:"Custom"}),[e]),l=Object(a.useCallback)((({fn:e,params:{conversationId:t,...a}})=>e({...a,conversationId:n(t)})),[n]);return{reportAssistantInvoked:e=>l({fn:t.reportAssistantInvoked,params:e}),reportAssistantMessageSent:e=>l({fn:t.reportAssistantMessageSent,params:e}),reportAssistantQuickPrompt:e=>l({fn:t.reportAssistantQuickPrompt,params:e})}}},914:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"b",(function(){return r})),n.d(t,"c",(function(){return l})),n.d(t,"d",(function(){return o})),n.d(t,"f",(function(){return s})),n.d(t,"e",(function(){return u}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.assistant.commentActions.addedNoteToTimelineToast",{defaultMessage:"Added note to timeline"}),r=a.i18n.translate("xpack.securitySolution.assistant.commentActions.addMessageContentAsTimelineNoteAriaLabel",{defaultMessage:"Add message content as a timeline note"}),l=a.i18n.translate("xpack.securitySolution.assistant.commentActions.addNoteToTimelineTooltip",{defaultMessage:"Add note to timeline"}),o=a.i18n.translate("xpack.securitySolution.assistant.commentActions.addToCaseExistingCase",{defaultMessage:"Add to existing case"}),s=a.i18n.translate("xpack.securitySolution.assistant.commentActions.elasticAiAssistantTitle",{defaultMessage:"Elastic AI Assistant"}),u=a.i18n.translate("xpack.securitySolution.assistant.commentActions.copyToClipboard",{defaultMessage:"Copy to clipboard"})},915:function(e,t,n){"use strict";n.d(t,"a",(function(){return o})),n.d(t,"g",(function(){return s})),n.d(t,"e",(function(){return u})),n.d(t,"c",(function(){return c})),n.d(t,"b",(function(){return d})),n.d(t,"d",(function(){return m})),n.d(t,"f",(function(){return p}));var a=n(139),i=n(118),r=n(515),l=n(376);const o=()=>Object(a.createSelector)(l.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.activeTab)&&void 0!==t?t:i.d.query})),s=()=>Object(a.createSelector)(l.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.show)&&void 0!==t&&t})),u=()=>Object(a.createSelector)(l.selectTimeline,(e=>{var t;return Object.keys(null!==(t=null==e?void 0:e.pinnedEventIds)&&void 0!==t?t:{}).length})),c=()=>Object(a.createSelector)(l.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.noteIds)&&void 0!==t?t:[]})),d=()=>Object(a.createSelector)(l.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.eventIdToNoteIds)&&void 0!==t?t:{}})),m=()=>Object(a.createSelector)(r.selectNotesById,(e=>Object.values(e))),p=()=>Object(a.createSelector)(l.selectTimeline,(e=>null==e?void 0:e.scrollToTop))},916:function(e,t,n){"use strict";n.d(t,"a",(function(){return I}));var a=n(104),i=n.n(a),r=n(57),l=n(55),o=n.n(l),s=n(2),u=n.n(s),c=n(41),d=n.n(c),m=n(40),p=n(51),b=n(4),f=n(681),g=n(259),y=n(659),h=n(161),v=n(102),E=n(604),O=n(200),S=n(457),x=n(131),j=n(169),k=n(273);const T=e=>({text:e,value:e}),C=d()(m.EuiButton).withConfig({displayName:"StyledLinkButton",componentId:"sc-11itwu1-0"})(["margin-left:0;@media only screen and (min-width:","){margin-left:",";}"],(e=>e.theme.eui.euiBreakpoints.m),(({theme:e})=>e.eui.euiSizeL)),w=({combinedQueries:e,deleteQuery:t,filters:n,from:a,headerChildren:l,indexPattern:c,indexNames:d,runtimeMappings:m,onlyField:w,paddingSize:I,query:M,queryType:A,setAbsoluteRangeDatePickerTarget:N,setQuery:F,showLegend:D,showSpacer:R=!0,scopeId:P,sourcererScopeId:L,to:B,toggleTopN:_,hideQueryToggle:z=!1})=>{const q=Object(s.useMemo)((()=>`eventsByDatasetOverview-${A}`),[A]);Object(s.useEffect)((()=>()=>{t&&t({id:q})}),[t,q]);const $=Object(v.j)(),{formatUrl:V,search:H}=Object(j.m)(x.a.hosts),{navigateToApp:U}=$.services.application,[Q]=Object(v.p)(b.O),G=Object(s.useCallback)((e=>{e.preventDefault(),U(b.l,{deepLinkId:x.a.hosts,path:Object(g.c)(O.HostsTableType.events,H)})}),[U,H]),W=Object(s.useMemo)((()=>u.a.createElement(C,{onClick:G,href:V(Object(g.c)(O.HostsTableType.events))},S.n)),[G,V]),[K,X]=Object(s.useMemo)((()=>null==e?Object(h.i)({config:Object(p.getEsQueryConfig)($.services.uiSettings),indexPattern:c,queries:[M],filters:n}):[e]),[e,$,c,M,n]);Object(k.a)({id:q,filterQuery:K,kqlError:X,query:M,startDate:a,endDate:B});const Y=Object(s.useMemo)((()=>{var e;return{...E.b,stackByOptions:null!=w?[T(w)]:E.b.stackByOptions,defaultStackByOption:null!=w?T(w):null!==(e=E.c.find((e=>"event.dataset"===e.text)))&&void 0!==e?e:E.c[0],legendPosition:r.Position.Right,subtitle:e=>`${f.c}: ${o()(e).format(Q)} ${Object(f.d)(e)}`,titleSize:null==w?"m":"s"}}),[w,Q]),J=Object(s.useMemo)((()=>null==w||null!=l?u.a.createElement(u.a.Fragment,null,l,null==w&&W):null),[w,l,W]);return u.a.createElement(y.a,i()({endDate:B,filterQuery:K,headerChildren:J,id:q,indexNames:d,runtimeMappings:m,onError:_,paddingSize:I,setAbsoluteRangeDatePickerTarget:N,setQuery:F,showSpacer:R,showLegend:D,skip:void 0===K,startDate:a,scopeId:P,sourcererScopeId:L},Y,{title:null!=w?S.k(w):Y.title,chartHeight:160,hideQueryToggle:z}))};w.displayName="EventsByDatasetComponent";const I=u.a.memo(w)},917:function(e,t,n){"use strict";n.d(t,"a",(function(){return d}));var a=n(2),i=n.n(a),r=n(40),l=n(41),o=n.n(l),s=n(297),u=n(327);const c=o()(r.EuiFlexGroup).withConfig({displayName:"FlexGroup",componentId:"sc-1719m3x-0"})(["height:",";width:",";position:relative;margin:0;"],(({height:e})=>e||"100%"),(({width:e})=>e||"100%"));c.displayName="FlexGroup";const d=({height:e="100%",width:t="100%",data:n})=>i.a.createElement(c,{justifyContent:"center",alignItems:"center",height:e,width:t},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiText,{size:"s",textAlign:"center",color:"subdued","data-test-subj":"chartHolderText"},Object(s.f)(n)?u.a:u.b)))},918:function(e,t,n){"use strict";n.d(t,"f",(function(){return i})),n.d(t,"e",(function(){return r})),n.d(t,"g",(function(){return l})),n.d(t,"a",(function(){return o})),n.d(t,"b",(function(){return s})),n.d(t,"c",(function(){return u})),n.d(t,"h",(function(){return c})),n.d(t,"d",(function(){return d}));var a=n(5);const i=e=>a.i18n.translate("xpack.securitySolution.eventsTab.externalAlertsUnit",{values:{totalCount:e},defaultMessage:"external {totalCount, plural, =1 {alert} other {alerts}}"}),r=e=>a.i18n.translate("xpack.securitySolution.hosts.navigaton.eventsUnit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {event} other {events}}"}),l=a.i18n.translate("xpack.securitySolution.eventsTab.showing",{defaultMessage:"Showing"}),o=a.i18n.translate("xpack.securitySolution.eventsTab.alertsGraphTitle",{defaultMessage:"External alert trend"}),s=a.i18n.translate("xpack.securitySolution.eventsTab.errorFetchingAlertsData",{defaultMessage:"Failed to query alerts data"}),u=a.i18n.translate("xpack.securitySolution.eventsTab.errorFetchingEventsData",{defaultMessage:"Failed to query events data"}),c=a.i18n.translate("xpack.securitySolution.eventsTab.showExternalAlerts",{defaultMessage:"Show only external alerts"}),d=a.i18n.translate("xpack.securitySolution.eventsGraphTitle",{defaultMessage:"Events"})},919:function(e,t,n){"use strict";n.d(t,"c",(function(){return s})),n.d(t,"d",(function(){return u})),n.d(t,"f",(function(){return c})),n.d(t,"e",(function(){return d})),n.d(t,"a",(function(){return m})),n.d(t,"b",(function(){return p}));var a=n(42),i=n(50),r=n.n(i),l=n(920);const o=[],s=e=>{var t,n,a;return(null!==(t=null==e||null===(n=e.aggregations)||void 0===n||null===(a=n.alertsByGrouping)||void 0===a?void 0:a.buckets)&&void 0!==t?t:[]).reduce(((e,{key_as_string:t,key:n,alerts:a})=>{var i;return[...e,...(null!==(i=a.buckets)&&void 0!==i?i:[]).map((({key:e,doc_count:a})=>({x:e,y:a,g:null!=t?t:n.toString()})))]}),o)},u=(e,t,n,a,i)=>({aggs:{alertsByGrouping:{terms:{field:e,order:{_count:"desc"},size:10},aggs:{alerts:{date_histogram:{field:"@timestamp",fixed_interval:`${Math.floor(r()(n).diff(r()(t))/32)}ms`,min_doc_count:0,extended_bounds:{min:t,max:n}}}}}},query:{bool:{filter:[...a,{range:{"@timestamp":{gte:t,lte:n}}}]}},runtime_mappings:i,_source:!1,size:0}),c=({isInitialLoading:e,isLoadingAlerts:t})=>e&&t,d=e=>{try{return null==e||Object(a.isEmpty)(e)?{}:JSON.parse(e)}catch{return{}}},m=e=>{try{return Object(a.isEmpty)(e)?[]:[d(e)]}catch{return[]}},p=({callback:e,order:t}={})=>({id:"resetGroupByField",getDisplayName:()=>l.b,getIconType:()=>"editorRedo",type:"actionButton",isCompatible:async()=>!0,async execute({embeddable:t}){null==e||e();const n=t.getInput(),{attributes:{state:{visualization:{columns:a}}}}=n;t.updateInput({...n,attributes:{...n.attributes,state:{...n.attributes.state,visualization:{...n.attributes.state.visualization,columns:a.map((e=>({...e,hidden:!1})))}}}})},order:t})},920:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"b",(function(){return r}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.components.chartSettingsPopover.contextMenuItems.inspectTitle",{defaultMessage:"Inspect"}),r=a.i18n.translate("xpack.securitySolution.components.chartSettingsPopover.contextMenuItems.resetGroupByFieldsMenuItem",{defaultMessage:"Reset group by fields"})},921:function(e,t,n){"use strict";n.d(t,"a",(function(){return r}));var a=n(374);const i=new Set([a.b.STRING,a.b.BOOLEAN,a.b.NUMBER,a.b.IP]),r=e=>!!e&&i.has(e)},922:function(e,t,n){"use strict";n.d(t,"b",(function(){return u})),n.d(t,"c",(function(){return c})),n.d(t,"a",(function(){return m}));var a=n(2),i=n.n(a),r=n(40),l=n(44),o=n(58);const s={tall:490,short:250},u=Object(a.createContext)({tableId:null}),c=({height:e="tall"})=>i.a.createElement(r.EuiPanel,{color:"subdued"},i.a.createElement(r.EuiFlexGroup,{style:{height:s[e]},alignItems:"center",justifyContent:"center","data-test-subj":"loading-alerts-panel"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiLoadingSpinner,{size:"xl"})))),d={maxWidth:500},m=()=>{const{http:e}=Object(o.useKibana)().services;return i.a.createElement(r.EuiPanel,{color:"subdued","data-test-subj":"tGridEmptyState"},i.a.createElement(r.EuiFlexGroup,{alignItems:"center",justifyContent:"center"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiPanel,{hasBorder:!0,style:d},i.a.createElement(r.EuiFlexGroup,null,i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiText,{size:"s"},i.a.createElement(r.EuiTitle,null,i.a.createElement("h3",null,i.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.eventsViewer.empty.title",defaultMessage:"No results match your search criteria"}))),i.a.createElement("p",null,i.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.eventsViewer.empty.description",defaultMessage:"Try searching over a longer period of time or modifying your search"})))),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiImage,{size:"200",alt:"",url:e.basePath.prepend("/plugins/timelines/assets/illustration_product_no_results_magnifying_glass.svg")})))))))}},939:function(e,t,n){"use strict";n.d(t,"a",(function(){return ye}));var a=n(2),i=n.n(a),r=n(103),l=n(56),o=n(672),s=n(102),u=n(4),c=n(105),d=n(118),m=n(111),p=n(12),b=n(479),f=n(190),g=n(44),y=n(41),h=n.n(y),v=n(106),E=n(947),O=n(317),S=n(209),x=n(126),j=n(40),k=n(140),T=n(45),C=n(108),w=n(675);const I=({onComplete:e,isEnableDownloader:t,exportedIds:n})=>{const{tabName:i}=Object(T.useParams)(),{addSuccess:r}=Object(C.a)(),l=Object(a.useCallback)((t=>{null!=e&&e(),r({title:i===v.l.template?k.U(t):k.T(t),"data-test-subj":"addObjectToContainerSuccess"})}),[r,e,i]),o=Object(a.useCallback)((()=>{null!=e&&e()}),[e]);return Object(a.useEffect)((()=>{(async()=>{if(null!=n&&n.length&&t){const e=await Object(S.b)({ids:n});e instanceof Blob?(Object(w.a)(e,`${k.n}.ndjson`),l(n.length)):o()}})()}),[n,t]),null};I.displayName="ExportTimeline";const M=i.a.memo(I);var A=n(42);const N=i.a.memo((({title:e,closeModal:t,onDelete:n})=>{const{tabName:r}=Object(T.useParams)(),l=r===v.l.template?k.j:k.k,o=Object(a.useCallback)((()=>{const t=null!=e?e.trim():"",n=Object(A.isEmpty)(t)?k.ab:t;return i.a.createElement(g.FormattedMessage,{id:"xpack.securitySolution.open.timeline.deleteTimelineModalTitle",defaultMessage:'Delete "{title}"?',"data-test-subj":"title",values:{title:n}})}),[e]);return i.a.createElement(j.EuiConfirmModal,{buttonColor:"danger",cancelButtonText:k.b,confirmButtonText:k.h,defaultFocusedButton:j.EUI_MODAL_CONFIRM_BUTTON,onCancel:t,onConfirm:n,title:o()},i.a.createElement("div",{"data-test-subj":"warning"},l))}));N.displayName="DeleteTimelineModal";const F=Object(y.createGlobalStyle)(["div[data-popover-open]{display:none;}"]),D=i.a.memo((({deleteTimelines:e,isModalOpen:t,savedObjectIds:n,title:r,onComplete:l})=>{const{addSuccess:o}=Object(C.a)(),{tabName:s}=Object(T.useParams)(),u=Object(a.useCallback)((()=>{null!=l&&l()}),[l]),c=Object(a.useCallback)((()=>{n.length>0&&(e(n),o({title:s===v.l.template?k.S(n.length):k.R(n.length)})),null!=l&&l()}),[e,n,l,o,s]);return i.a.createElement(i.a.Fragment,null,t&&i.a.createElement(F,{"data-test-subj":"remove-popover"}),t?i.a.createElement(j.EuiModal,{maxWidth:600,onClose:u},i.a.createElement(N,{"data-test-subj":"delete-timeline-modal",onDelete:c,title:r,closeModal:u})):null)}));D.displayName="DeleteTimelineModalOverlay";const R=({deleteTimelines:e,ids:t,isEnableDownloader:n,isDeleteTimelineModalOpen:a,onComplete:r,title:l})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(M,{"data-test-subj":"TimelineDownloader",exportedIds:t,isEnableDownloader:n,onComplete:r}),null!=e&&i.a.createElement(D,{"data-test-subj":"DeleteTimelineModalOverlay",deleteTimelines:e,isModalOpen:a,onComplete:r,savedObjectIds:t,title:l})),P=i.a.memo(R),L=()=>{const[e,t]=Object(a.useState)(null),[n,i]=Object(a.useState)(!1),[r,l]=Object(a.useState)(!1),o=Object(a.useCallback)((()=>{i(!1),t(null)}),[e]),s=Object(a.useCallback)((e=>{i(!0),null!=e&&t(e)}),[]),u=Object(a.useCallback)((e=>{l(!0),null!=e&&t(e)}),[]),c=Object(a.useCallback)((()=>{l(!1),t(null)}),[]);return{actionItem:e,onCompleteEditTimelineAction:Object(a.useCallback)((()=>{i(!1),l(!1),t(null)}),[]),isDeleteTimelineModalOpen:n,onCloseDeleteTimelineModal:o,onOpenDeleteTimelineModal:s,isEnableDownloader:r,enableExportTimelineDownloader:u,disableExportTimelineDownloader:c}},B=h.a.div.withConfig({displayName:"SearchRowContainer",componentId:"sc-1dq1et8-0"})(["&:not(:last-child){margin-bottom:",";}"],(e=>e.theme.eui.euiSizeL));B.displayName="SearchRowContainer";const _=h()(j.EuiFlexGroup).withConfig({displayName:"SearchRowFlexGroup",componentId:"sc-1dq1et8-1"})(["margin-bottom:",";"],(e=>e.theme.eui.euiSizeXS));_.displayName="SearchRowFlexGroup";const z=i.a.memo((({favoriteCount:e,onlyFavorites:t,onQueryChange:n,onToggleOnlyFavorites:r,children:l,timelineType:o})=>{const s=Object(a.useMemo)((()=>({placeholder:o===v.l.default?k.L:k.M,incremental:!1,"data-test-subj":"search-bar"})),[o]);return i.a.createElement(B,null,i.a.createElement(_,{gutterSize:"s"},i.a.createElement(j.EuiFlexItem,null,i.a.createElement(j.EuiSearchBar,{box:s,onChange:n})),i.a.createElement(j.EuiFlexItem,{grow:!1},i.a.createElement(j.EuiFilterGroup,{fullWidth:!0},i.a.createElement(i.a.Fragment,null,i.a.createElement(j.EuiFilterButton,{"data-test-subj":"only-favorites-toggle",hasActiveFilters:t,onClick:r,numFilters:null!=e?e:void 0},k.D),!!l&&l)))))}));z.displayName="SearchRow";var q=n(104),$=n.n(q);const V=({actionTimelineToShow:e,deleteTimelines:t,enableExportTimelineDownloader:n,onOpenDeleteTimelineModal:a,onOpenTimeline:i,onCreateRule:r,onCreateRuleFromEql:l,hasCrudAccess:o})=>[{width:o?"80px":"150px",actions:[{name:k.g,icon:"timeline",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineType:v.l.default,timelineId:e})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:k.g,"data-test-subj":"create-from-template",available:t=>t.timelineType===v.l.template&&e.includes("createFrom")},{name:k.f,icon:"visText",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineType:v.l.template,timelineId:e})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:k.f,"data-test-subj":"create-template-from-timeline",available:t=>t.timelineType!==v.l.template&&e.includes("createFrom")},{name:k.E,icon:"copy",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineId:null!=e?e:""})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:k.E,"data-test-subj":"open-duplicate",available:t=>t.timelineType!==v.l.template&&e.includes("duplicate")},{name:k.F,icon:"copy",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineId:null!=e?e:""})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:k.F,"data-test-subj":"open-duplicate-template",available:t=>t.timelineType===v.l.template&&e.includes("duplicate")},{name:k.o,icon:"exportAction",onClick:e=>{null!=n&&n(e)},enabled:e=>null!=e.savedObjectId&&e.status!==v.k.immutable,description:k.o,"data-test-subj":"export-timeline",available:()=>e.includes("export")},{name:k.i,icon:"trash",onClick:e=>{null!=a&&a(e)},enabled:({savedObjectId:e,status:t})=>null!=e&&t!==v.k.immutable,description:k.i,"data-test-subj":"delete-timeline",available:()=>e.includes("delete")&&null!=t},{name:k.d,icon:"indexEdit",onClick:e=>{null!=r&&e.savedObjectId&&r(e.savedObjectId)},enabled:e=>null!=r&&null!=e.savedObjectId&&e.status!==v.k.immutable,description:k.d,"data-test-subj":"create-rule-from-timeline",available:({queryType:t})=>e.includes("createRule")&&null!=r&&null!=t&&t.hasQuery},{name:k.e,icon:"indexEdit",onClick:e=>{null!=l&&e.savedObjectId&&l(e.savedObjectId)},enabled:e=>null!=l&&null!=e.savedObjectId&&e.status!==v.k.immutable,description:k.d,"data-test-subj":"create-rule-from-eql",available:({queryType:t})=>e.includes("createRuleFromEql")&&null!=l&&null!=t&&t.hasEql}]}],H="45px";var U=n(164),Q=n(899),G=n(117),W=n(132);const K=h.a.span.withConfig({displayName:"LineClampTextContainer",componentId:"sc-4zme7l-0"})(["text-overflow:ellipsis;display:-webkit-box;-webkit-line-clamp:5;-webkit-box-orient:vertical;overflow:hidden;"]),X=({itemIdToExpandedNotesRowMap:e,onOpenTimeline:t,onToggleShowNotes:n,timelineType:a})=>[{isExpander:!0,render:({notes:t,savedObjectId:a})=>null!=t&&t.length>0&&null!=a?i.a.createElement(j.EuiButtonIcon,{"data-test-subj":"expand-notes",onClick:()=>null!=e[a]?n(Object(A.omit)(a,e)):n({...e,[a]:i.a.createElement(Q.a,{notes:t})}),"aria-label":e[a]?k.c:k.m,iconType:e[a]?"arrowDown":"arrowRight"}):null,width:H},{dataType:"string",field:"title",name:a===v.l.default?k.Y:k.Z,render:(e,n)=>null!=n.savedObjectId?i.a.createElement(j.EuiLink,{"data-test-subj":`title-${n.savedObjectId}`,onClick:()=>t({duplicate:!1,timelineId:`${n.savedObjectId}`})},Object(U.f)(n)?k.ab:i.a.createElement(K,null,e)):i.a.createElement("div",{"data-test-subj":`title-no-saved-object-id-${e||"no-title"}`},Object(U.f)(n)?k.ab:e),sortable:!1},{dataType:"string",field:"description",name:k.l,render:e=>i.a.createElement(K,{"data-test-subj":"description"},null!=e&&e.trim().length>0?e:Object(G.d)()),sortable:!1},{dataType:"date",field:"updated",name:k.y,render:(e,t)=>i.a.createElement("div",{"data-test-subj":"updated"},null!=t.updated?i.a.createElement(W.b,{value:e}):Object(G.d)()),sortable:!0}],Y=e=>e?[{dataType:"string",field:"updatedBy",name:k.B,render:e=>i.a.createElement("div",{"data-test-subj":"username"},Object(G.a)(e)),sortable:!1}]:[],J=({timelineType:e})=>{const t={note:{align:"center",field:"eventIdToNoteIds",name:i.a.createElement(j.EuiToolTip,{content:k.C},i.a.createElement(j.EuiIcon,{"data-test-subj":"notes-count-header-icon",size:"m",type:"editorComment"})),render:(e,t)=>i.a.createElement("span",{"data-test-subj":"notes-count"},Object(U.d)(t)),sortable:!1,width:H},pinnedEvent:{align:"center",field:"pinnedEventIds",name:i.a.createElement(j.EuiToolTip,{content:k.J},i.a.createElement(j.EuiIcon,{"data-test-subj":"pinned-event-header-icon",size:"m",type:"pin"})),render:(e,t)=>i.a.createElement("span",{"data-test-subj":"pinned-event-count"},`${Object(U.e)(t)}`),sortable:!1,width:H},favorite:{align:"center",field:"favorite",name:i.a.createElement(j.EuiToolTip,{content:k.p},i.a.createElement(j.EuiIcon,{"data-test-subj":"favorites-header-icon",size:"m",type:"starEmpty"})),render:e=>{const t=null!=e&&e.length>0?"starFilled":"starEmpty";return i.a.createElement(j.EuiIcon,{"data-test-subj":`favorite-${t}-star`,type:t,size:"m"})},sortable:!1,width:H}},n=[t.note,t.favorite],a=[t.pinnedEvent,t.note,t.favorite];return e===v.l.template?n:a},Z=j.EuiBasicTable,ee=h()(Z).withConfig({displayName:"BasicTable",componentId:"sc-1yfhyq7-0"})([".euiTableCellContent{animation:none;}.euiTableRow-isExpandedRow .euiTableCellContent__text{width:100%;}"]);ee.displayName="BasicTable";const te=i.a.memo((({actionTimelineToShow:e,deleteTimelines:t,defaultPageSize:n,loading:r,itemIdToExpandedNotesRowMap:l,enableExportTimelineDownloader:o,onCreateRule:s,onCreateRuleFromEql:u,onOpenDeleteTimelineModal:c,onOpenTimeline:d,onSelectionChange:m,onTableChange:p,onToggleShowNotes:b,pageIndex:f,pageSize:g,searchResults:y,showExtendedColumns:h,sortField:E,sortDirection:O,tableRef:S,timelineType:j,totalSearchResultsCount:T})=>{const C={showPerPageOptions:h,pageIndex:f,pageSize:g,pageSizeOptions:[Math.floor(Math.max(n,1)/2),n,2*n],totalItemCount:T},w={sort:{field:E,direction:O}},I={selectable:e=>null!=e.savedObjectId&&e.status!==v.k.immutable,selectableMessage:e=>e?void 0:k.A,onSelectionChange:m},M=null!=S?{ref:S}:{},{kibanaSecuritySolutionsPrivileges:A}=Object(x.a)(),N=Object(a.useMemo)((()=>(({actionTimelineToShow:e,deleteTimelines:t,enableExportTimelineDownloader:n,itemIdToExpandedNotesRowMap:a,onCreateRule:i,onCreateRuleFromEql:r,onOpenDeleteTimelineModal:l,onOpenTimeline:o,onToggleShowNotes:s,showExtendedColumns:u,timelineType:c,hasCrudAccess:d})=>[...X({itemIdToExpandedNotesRowMap:a,onOpenTimeline:o,onToggleShowNotes:s,timelineType:c}),...Y(u),...J({timelineType:c}),...e.length?V({onCreateRule:i,onCreateRuleFromEql:r,actionTimelineToShow:e,deleteTimelines:t,enableExportTimelineDownloader:n,onOpenDeleteTimelineModal:l,onOpenTimeline:o,hasCrudAccess:d}):[]])({actionTimelineToShow:e,deleteTimelines:t,itemIdToExpandedNotesRowMap:l,enableExportTimelineDownloader:o,onCreateRule:s,onCreateRuleFromEql:u,onOpenDeleteTimelineModal:c,onOpenTimeline:d,onSelectionChange:m,onToggleShowNotes:b,showExtendedColumns:h,timelineType:j,hasCrudAccess:A.crud})),[e,t,l,o,s,u,c,d,m,b,h,j,A]),F=r||null==y?k.z:j===v.l.template?k.db:k.cb;return i.a.createElement(ee,$()({columns:N,"data-test-subj":"timelines-table",isExpandable:!0,isSelectable:e.includes("selectable"),itemId:"savedObjectId",itemIdToExpandedRowMap:l,items:null!=y?y:[],loading:r,noItemsMessage:F,onChange:p,pagination:C,selection:e.includes("selectable")?I:void 0,sorting:w},M))}));te.displayName="TimelinesTable";const ne=h.a.span.withConfig({displayName:"QueryText",componentId:"sc-1qxahey-0"})(["white-space:normal;word-break:break-word;"]),ae=i.a.memo((({deleteTimelines:e,defaultPageSize:t,favoriteCount:n,isLoading:r,itemIdToExpandedNotesRowMap:l,importDataModalToggle:o,onCreateRule:s,onCreateRuleFromEql:u,onDeleteSelected:c,onlyFavorites:d,onOpenTimeline:m,onQueryChange:p,onSelectionChange:b,onTableChange:f,onToggleOnlyFavorites:y,onToggleShowNotes:h,pageIndex:T,pageSize:C,query:w,refetch:I,searchResults:M,selectedItems:A,sortDirection:N,setImportDataModalToggle:F,sortField:D,timelineType:R=v.l.default,timelineStatus:B,timelineFilter:_,templateTimelineFilter:q,totalSearchResultsCount:$})=>{var V;const H=Object(a.useRef)(),{actionItem:Q,enableExportTimelineDownloader:G,isEnableDownloader:W,isDeleteTimelineModalOpen:K,onOpenDeleteTimelineModal:X,onCompleteEditTimelineAction:Y}=L(),{kibanaSecuritySolutionsPrivileges:J}=Object(x.a)(),{getBatchItemsPopoverContent:Z}=(({deleteTimelines:e,selectedItems:t,tableRef:n,timelineType:r=v.l.default})=>{const{enableExportTimelineDownloader:l,disableExportTimelineDownloader:o,isEnableDownloader:s,isDeleteTimelineModalOpen:u,onOpenDeleteTimelineModal:c,onCloseDeleteTimelineModal:d}=L(),m=Object(a.useCallback)((e=>{null!=e&&e(),null!=n&&null!=n.current&&n.current.changeSelection([]),o(),d()}),[o,d,n]),p=Object(a.useMemo)((()=>{return e=null!=t?t:[],(Array.isArray(e)?e:[e]).reduce(((e,t)=>null!=t.savedObjectId?[...e,t.savedObjectId]:[...e]),[]);var e}),[t]),b=Object(a.useCallback)((()=>l()),[l]),f=Object(a.useCallback)((()=>c()),[c]),g=Object(a.useCallback)((n=>{var a,l,o,c;const d=null==t||0===t.length,g=[];return t&&g.push(i.a.createElement(j.EuiContextMenuItem,{"data-test-subj":"export-timeline-action",disabled:d,icon:"exportAction",key:"ExportItemKey",onClick:b},k.o)),e&&g.push(i.a.createElement(j.EuiContextMenuItem,{"data-test-subj":"delete-timeline-action",disabled:d,icon:"trash",key:"DeleteItemKey",onClick:f},k.i)),i.a.createElement(i.a.Fragment,null,i.a.createElement(P,{deleteTimelines:e,ids:p,isEnableDownloader:s,isDeleteTimelineModalOpen:u,onComplete:m.bind(null,n),title:1!==(null==t?void 0:t.length)?r===v.l.template?k.N(null!==(a=null==t?void 0:t.length)&&void 0!==a?a:0):k.O(null!==(l=null==t?void 0:t.length)&&void 0!==l?l:0):null!==(o=null===(c=t[0])||void 0===c?void 0:c.title)&&void 0!==o?o:""}),i.a.createElement(j.EuiContextMenuPanel,{items:g}))}),[t,e,p,s,u,m,r,b,f]);return{onCompleteBatchActions:m,getBatchItemsPopoverContent:g}})({deleteTimelines:J.crud?e:void 0,selectedItems:A,tableRef:H,timelineType:R}),ee=Object(a.useMemo)((()=>i.a.createElement(g.FormattedMessage,{id:"xpack.securitySolution.open.timeline.showingNTemplatesLabel",defaultMessage:"{totalSearchResultsCount} {totalSearchResultsCount, plural, one {template} other {templates}} {with}",values:{totalSearchResultsCount:$,with:i.a.createElement(ne,{"data-test-subj":"selectable-query-text"},w.trim().length?`${k.bb} "${w.trim()}"`:"")}})),[$,w]),ae=Object(a.useMemo)((()=>i.a.createElement(g.FormattedMessage,{id:"xpack.securitySolution.open.timeline.showingNTimelinesLabel",defaultMessage:"{totalSearchResultsCount} {totalSearchResultsCount, plural, one {timeline} other {timelines}} {with}",values:{totalSearchResultsCount:$,with:i.a.createElement(ne,{"data-test-subj":"selectable-query-text"},w.trim().length?`${k.bb} "${w.trim()}"`:"")}})),[$,w]),ie=Object(a.useMemo)((()=>null!=Q&&null!=Q.savedObjectId?[Q.savedObjectId]:[]),[Q]),re=Object(a.useCallback)((()=>{null!=I&&I()}),[I]),le=Object(a.useCallback)((()=>{null!=F&&F(!1)}),[F]),oe=Object(a.useCallback)((()=>{null!=F&&F(!1),null!=I&&I()}),[F,I]),se=Object(a.useMemo)((()=>{if(J.crud){const t=["createFrom","duplicate",...null!=s?["createRule"]:[],...null!=u?["createRuleFromEql"]:[]];return B!==v.k.immutable&&(t.push("export"),t.push("selectable")),null!=c&&null!=e&&B!==v.k.immutable&&t.push("delete"),t}return B!==v.k.immutable?["export","selectable"]:[]}),[s,u,B,c,e,J]),ue=Object(a.useMemo)((()=>i.a.createElement(i.a.Fragment,null,q)),[q]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(P,{deleteTimelines:e,ids:ie,isDeleteTimelineModalOpen:K,isEnableDownloader:W,onComplete:Y,title:null!==(V=null==Q?void 0:Q.title)&&void 0!==V?V:k.ab}),i.a.createElement(E.a,{checkBoxLabel:k.I,closeModal:le,description:k.P,errorMessage:k.t,failedDetailed:k.u,importComplete:oe,importData:S.e,successMessage:k.V,showCheckBox:!1,showModal:null!=o&&o,submitBtnText:k.w,subtitle:k.x,title:k.v}),i.a.createElement("div",{className:U.a},!!_&&_,i.a.createElement(z,{"data-test-subj":"search-row",favoriteCount:n,onlyFavorites:d,onQueryChange:p,onToggleOnlyFavorites:y,query:w,timelineType:R},ue),i.a.createElement(O.a,{border:!0},i.a.createElement(O.d,null,i.a.createElement(O.c,null,i.a.createElement(O.e,{"data-test-subj":"query-message"},i.a.createElement(i.a.Fragment,null,k.Q," ",R===v.l.template?ee:ae))),i.a.createElement(O.c,null,B!==v.k.immutable&&i.a.createElement(i.a.Fragment,null,i.a.createElement(O.e,{"data-test-subj":"selected-count"},R===v.l.template?k.N(A.length):k.O(A.length)),i.a.createElement(O.b,{dataTestSubj:"batchActions",iconSide:"right",iconType:"arrowDown",popoverContent:Z,"data-test-subj":"utility-bar-action"},i.a.createElement("span",{"data-test-subj":"utility-bar-action-button"},k.a))),i.a.createElement(O.b,{dataTestSubj:"refreshButton",iconSide:"right",iconType:"refresh",onClick:re},k.K)))),i.a.createElement(te,{actionTimelineToShow:se,"data-test-subj":"timelines-table",deleteTimelines:e,defaultPageSize:t,loading:r,itemIdToExpandedNotesRowMap:l,enableExportTimelineDownloader:G,onCreateRule:s,onCreateRuleFromEql:u,onOpenDeleteTimelineModal:X,onOpenTimeline:m,onSelectionChange:b,onTableChange:f,onToggleShowNotes:h,pageIndex:T,pageSize:C,searchResults:M,showExtendedColumns:!0,sortDirection:N,sortField:D,timelineType:R,tableRef:H,totalSearchResultsCount:$})))}));ae.displayName="OpenTimeline";var ie=n(166);const re=i.a.memo((({children:e,onAddTimelinesToFavorites:t,selectedTimelinesCount:n,title:a})=>i.a.createElement(ie.a,{title:a,split:!0,height:40},i.a.createElement(j.EuiFlexGroup,{gutterSize:"s",responsive:!1},t&&i.a.createElement(j.EuiFlexItem,{grow:!1},i.a.createElement(j.EuiButton,{"data-test-subj":"favorite-selected",iconSide:"left",iconType:"starEmptySpace",isDisabled:0===n,onClick:t},k.q)),e&&i.a.createElement(j.EuiFlexItem,null,e)))));re.displayName="TitleRow";const le=h.a.div.withConfig({displayName:"HeaderContainer",componentId:"sc-98e87t-0"})(["width:100%;"]);le.displayName="HeaderContainer";const oe=Object(a.memo)((({deleteTimelines:e,defaultPageSize:t,favoriteCount:n,hideActions:r=[],isLoading:l,itemIdToExpandedNotesRowMap:o,onAddTimelinesToFavorites:s,onDeleteSelected:u,onlyFavorites:c,onOpenTimeline:d,onQueryChange:m,onSelectionChange:p,onTableChange:b,onToggleOnlyFavorites:f,onToggleShowNotes:g,pageIndex:y,pageSize:h,searchResults:v,selectedItems:E,sortDirection:O,sortField:S,timelineFilter:x,timelineType:k,templateTimelineFilter:T,title:C,totalSearchResultsCount:w})=>{const I=Object(a.useMemo)((()=>{const t=["createFrom","duplicate"];return null!=u&&null!=e&&t.push("delete"),t.filter((e=>!r.includes(e)))}),[u,e,r]),M=Object(a.useMemo)((()=>i.a.createElement(a.Fragment,{key:"search-row-content"},!!T&&T)),[T]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(j.EuiModalHeader,null,i.a.createElement(le,null,i.a.createElement(re,{"data-test-subj":"title-row",onAddTimelinesToFavorites:s,selectedTimelinesCount:E.length,title:C}))),i.a.createElement(j.EuiModalBody,null,i.a.createElement(i.a.Fragment,null,!!x&&i.a.createElement(i.a.Fragment,null,x,i.a.createElement(j.EuiSpacer,{size:"m"})),i.a.createElement(z,{"data-test-subj":"search-row",onlyFavorites:c,onQueryChange:m,onToggleOnlyFavorites:f,query:"",timelineType:k},M),i.a.createElement(te,{actionTimelineToShow:I,"data-test-subj":"timelines-table",deleteTimelines:e,defaultPageSize:t,loading:l,itemIdToExpandedNotesRowMap:o,onOpenTimeline:d,onSelectionChange:p,onTableChange:b,onToggleShowNotes:g,pageIndex:y,pageSize:h,searchResults:v,showExtendedColumns:!1,sortDirection:O,sortField:S,timelineType:k,totalSearchResultsCount:w}))))}));oe.displayName="OpenTimelineModalBody";var se=n(131),ue=n(169);let ce;!function(e){e.tab="tab",e.filter="filter"}(ce||(ce={}));var de=n(911),me=n(110),pe=n(116),be=n(159),fe=n(196);const ge=i.a.memo((({closeModalTimeline:e,defaultPageSize:t,hideActions:n=[],isModal:g=!1,importDataModalToggle:y,onOpenTimeline:h,setImportDataModalToggle:E,title:O})=>{const x=Object(r.useDispatch)(),{startTransaction:C}=Object(be.b)(),[w,I]=Object(a.useState)({}),[M,N]=Object(a.useState)(!1),[F,D]=Object(a.useState)(0),[R,P]=Object(a.useState)(t),[L,B]=Object(a.useState)(""),[_,z]=Object(a.useState)([]),[q,$]=Object(a.useState)("desc"),[V,H]=Object(a.useState)("updated"),Q=Object(a.useMemo)((()=>m.b.getTimelineByIdSelector()),[]),G=Object(c.b)((e=>{var t,n;return null!==(t=null===(n=Q(e,d.c.active))||void 0===n?void 0:n.savedObjectId)&&void 0!==t?t:""})),{dataViewId:W,selectedPatterns:K}=Object(pe.d)(me.SourcererScopeName.timeline),X=Object(a.useMemo)((()=>Object(U.b)(x)),[x]),Y=Object(a.useCallback)((e=>x(Object(p.updateIsLoading)(e))),[x]),{customTemplateTimelineCount:J,defaultTimelineCount:Z,elasticTemplateTimelineCount:ee,favoriteCount:te,fetchAllTimeline:ne,timelines:ie,loading:re,totalCount:le,templateTimelineCount:ge}=Object(b.b)(),{timelineType:ye,timelineTabs:he,timelineFilters:ve}=(({defaultTimelineCount:e,templateTimelineCount:t})=>{const{formatUrl:n,search:r}=Object(ue.m)(se.a.timelines),{navigateToUrl:l}=Object(s.j)().services.application,{tabName:o}=Object(T.useParams)(),[u,c]=Object(a.useState)(o===v.l.default||o===v.l.template?o:v.l.default),d=n(Object(ue.k)(v.l.default,r)),m=n(Object(ue.k)(v.l.template,r)),p=Object(a.useCallback)((e=>{e.preventDefault(),l(d)}),[l,d]),b=Object(a.useCallback)((e=>{e.preventDefault(),l(m)}),[l,m]),f=Object(a.useCallback)((e=>[{id:v.l.default,name:k.X,href:d,disabled:!1,onClick:e===ce.tab?p:A.noop},{id:v.l.template,name:k.W,href:m,disabled:!1,onClick:e===ce.tab?b:A.noop}]),[d,m,p,b]),g=Object(a.useCallback)(((e,t)=>{c((t=>(t!==e&&c(e),t)))}),[c]),y=Object(a.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(j.EuiTabs,{"data-test-subj":"open-timeline-subtabs"},f(ce.tab).map((e=>i.a.createElement(j.EuiTab,{"data-test-subj":`timeline-${ce.tab}-${e.id}`,isSelected:e.id===o,disabled:e.disabled,key:`timeline-${ce.tab}-${e.id}`,href:e.href,onClick:t=>{e.onClick(t),g(e.id,ce.tab)}},e.name)))),i.a.createElement(j.EuiSpacer,{size:"m"}))),[o]),h=Object(a.useMemo)((()=>i.a.createElement(j.EuiTabs,null,f(ce.filter).map((e=>i.a.createElement(j.EuiTab,{"data-test-subj":`open-timeline-modal-body-${ce.filter}-${e.id}`,isSelected:e.id===u,key:`timeline-${ce.filter}-${e.id}`,onClick:t=>{e.onClick(t),g(e.id,ce.filter)}},e.name))))),[u,f,g]);return{timelineType:u,timelineTabs:y,timelineFilters:h}})({defaultTimelineCount:Z,templateTimelineCount:ge}),{timelineStatus:Ee,templateTimelineFilter:Oe,installPrepackagedTimelines:Se}=Object(de.a)({timelineType:ye,customTemplateTimelineCount:J,elasticTemplateTimelineCount:ee}),xe=Object(a.useCallback)((()=>{ne({pageInfo:{pageIndex:F+1,pageSize:R},search:L,sort:{sortField:V,sortOrder:q},onlyUserFavorite:M,timelineType:ye,status:Ee})}),[ne,F,R,L,V,q,ye,Ee,M]),je=Object(a.useCallback)((e=>{B(e.queryText.trim())}),[]),ke=Object(a.useCallback)((async e=>{C({name:e.length>1?fe.f.BULK_DELETE:fe.f.DELETE}),e.includes(G)&&x(Object(p.createTimeline)({id:d.c.active,columns:f.b,dataViewId:W,indexNames:K,show:!1})),await Object(S.a)(e),xe()}),[C,G,xe,x,W,K]),Te=Object(a.useCallback)((async e=>{await ke(e)}),[ke]),Ce=Object(a.useCallback)((async()=>{await ke((e=>e.reduce(((e,t)=>null!=t.savedObjectId?[...e,t.savedObjectId]:e),[]))(_)),Re()}),[_,ke]),we=Object(a.useCallback)((e=>{z(e)}),[]),Ie=Object(a.useCallback)((({page:e,sort:t})=>{const{index:n,size:a}=e,{field:i,direction:r}=t;D(n),P(a),$(r),H(i)}),[]),Me=Object(a.useCallback)((()=>{N(!M)}),[M]),Ae=Object(a.useCallback)((e=>{I(e)}),[]),{navigateTo:Ne}=Object(s.l)(),Fe=Object(a.useCallback)((e=>Ne({deepLinkId:u.wc.rulesCreate,path:`?${o.b}=${Object(l.encode)(e)}`})),[Ne]),De=Object(a.useCallback)((e=>Ne({deepLinkId:u.wc.rulesCreate,path:`?${o.a}=${Object(l.encode)(e)}`})),[Ne]),Re=Object(a.useCallback)((()=>{z([])}),[]),Pe=Object(a.useCallback)((({duplicate:t,timelineId:n,timelineType:a})=>{t&&C({name:fe.f.DUPLICATE}),g&&null!=e&&e(),Object(U.h)({duplicate:t,onOpenTimeline:h,timelineId:n,timelineType:a,updateIsLoading:Y,updateTimeline:X})}),[Y,X]);return Object(a.useEffect)((()=>{(()=>{const e=document.querySelector(`.${U.a} input`);null!=e&&e.focus()})()}),[]),Object(a.useEffect)((()=>{(async()=>{await Se(),xe()})()}),[xe,Se]),g?i.a.createElement(oe,{"data-test-subj":"open-timeline-modal",deleteTimelines:Te,defaultPageSize:t,favoriteCount:te,hideActions:n,isLoading:re,itemIdToExpandedNotesRowMap:w,onAddTimelinesToFavorites:void 0,onlyFavorites:M,onOpenTimeline:Pe,onQueryChange:je,onSelectionChange:we,onTableChange:Ie,onToggleOnlyFavorites:Me,onToggleShowNotes:Ae,pageIndex:F,pageSize:R,query:L,searchResults:ie,selectedItems:_,sortDirection:q,sortField:V,templateTimelineFilter:Oe,timelineType:ye,timelineStatus:Ee,timelineFilter:ve,title:O,totalSearchResultsCount:le}):i.a.createElement(ae,{"data-test-subj":"open-timeline",deleteTimelines:Te,defaultPageSize:t,favoriteCount:te,isLoading:re,itemIdToExpandedNotesRowMap:w,importDataModalToggle:y,onAddTimelinesToFavorites:void 0,onCreateRule:Fe,onCreateRuleFromEql:De,onDeleteSelected:Ce,onlyFavorites:M,onOpenTimeline:Pe,onQueryChange:je,onSelectionChange:we,onTableChange:Ie,onToggleOnlyFavorites:Me,onToggleShowNotes:Ae,pageIndex:F,pageSize:R,query:L,refetch:xe,searchResults:ie,setImportDataModalToggle:E,selectedItems:_,sortDirection:q,sortField:V,templateTimelineFilter:Oe,timelineType:ye,timelineStatus:Ee,timelineFilter:he,title:O,totalSearchResultsCount:le})})),ye=i.a.memo(ge)},941:function(e,t,n){"use strict";n.d(t,"b",(function(){return ge})),n.d(t,"a",(function(){return Ae}));var a=n(40),i=n(2),r=n.n(i),l=n(42),o=n(103),s=n(41),u=n.n(s),c=n(44),d=n(51),m=n(114),p=n(105),b=n(118),f=n(106),g=n(111),y=n(133),h=n(412),v=n(4),E=n(12),O=n(102),S=n(169),x=n(131),j=n(248);const k=({timelineId:e})=>{const t=Object(i.useMemo)((()=>g.b.getTimelineByIdSelector()),[]),{cases:n,application:{navigateToApp:s}}=Object(O.j)().services,u=Object(o.useDispatch)(),{graphEventId:c,savedObjectId:d,status:m,title:h,timelineType:k}=Object(p.a)((n=>{var a;return Object(l.pick)(["graphEventId","savedObjectId","status","title","timelineType"],null!==(a=t(n,e))&&void 0!==a?a:y.b)})),[T,C]=Object(i.useState)(!1),[w,I]=Object(i.useState)(!1),M=Object(i.useCallback)((async t=>{I(!1),await s(v.l,{deepLinkId:x.a.case,path:null!=t?Object(S.b)({id:t.id}):Object(S.c)()}),u(Object(E.setInsertTimeline)({graphEventId:c,timelineId:e,timelineSavedObjectId:d,timelineTitle:h}))}),[u,c,s,d,e,h]),A=Object(O.h)(),N=Object(i.useCallback)((()=>{C((e=>!e))}),[]),F=Object(i.useCallback)((()=>C(!1)),[]),D=Object(i.useCallback)((()=>{F(),s(v.l,{deepLinkId:x.a.case,path:Object(S.c)()}).then((()=>{u(Object(E.setInsertTimeline)({graphEventId:c,timelineId:e,timelineSavedObjectId:d,timelineTitle:h.length>0?h:j.l})),u(Object(E.showTimeline)({id:b.c.active,show:!1}))}))}),[u,c,s,F,d,e,h]),R=Object(i.useCallback)((()=>{F(),I(!0)}),[I,F]),P=Object(i.useCallback)((()=>{I(!1)}),[I]),L=Object(i.useCallback)((()=>{C(!1)}),[]),B=Object(i.useMemo)((()=>r.a.createElement(a.EuiButton,{fill:!0,size:"m","data-test-subj":"attach-timeline-case-button",iconType:"arrowDown",iconSide:"right",onClick:N,disabled:m===f.k.draft||k!==f.l.default},j.c)),[N,m,k]),_=Object(i.useMemo)((()=>[r.a.createElement(a.EuiContextMenuItem,{key:"new-case","data-test-subj":"attach-timeline-new-case",onClick:D},j.e),r.a.createElement(a.EuiContextMenuItem,{key:"existing-case","data-test-subj":"attach-timeline-existing-case",onClick:R},j.d)]),[R,D]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(a.EuiPopover,{id:"singlePanel",button:B,isOpen:T,closePopover:L,panelPaddingSize:"none",anchorPosition:"downLeft"},r.a.createElement(a.EuiContextMenuPanel,{items:_})),w&&n.ui.getAllCasesSelectorModal({onRowClick:M,onClose:P,owner:[v.i],permissions:A}))};k.displayName="AddToCaseButtonComponent";const T=r.a.memo(k);var C=n(701),w=n(657),I=n(149),M=n(130),A=n.n(M),N=n(3),F=n(13),D=n(113),R=n(108),P=n(5);const L=P.i18n.translate("xpack.securitySolution.timeline.kpiFailDescription",{defaultMessage:"An error has occurred"}),B=P.i18n.translate("xpack.securitySolution.timeline.kpiFailSearchDescription",{defaultMessage:"Failed to load KPIs"});var _=n(116),z=n(187),q=n(148),$=n(161),V=n(110),H=n(519);const U=e=>P.i18n.translate("xpack.securitySolution.timeline.flyout.header.closeTimelineButtonLabel",{defaultMessage:"Close {isTimeline, select, true {timeline} false {template}}",values:{isTimeline:e}}),Q=P.i18n.translate("xpack.securitySolution.timeline.properties.unsavedLabel",{defaultMessage:"Unsaved"}),G=P.i18n.translate("xpack.securitySolution.timeline.properties.autosavedLabel",{defaultMessage:"Autosaved"}),W=P.i18n.translate("xpack.securitySolution.timeline.properties.inspectTimelineTitle",{defaultMessage:"Timeline"}),K=P.i18n.translate("xpack.securitySolution.timeline.kpis.processKpiTitle",{defaultMessage:"Processes"}),X=P.i18n.translate("xpack.securitySolution.timeline.kpis.hostKpiTitle",{defaultMessage:"Hosts"}),Y=P.i18n.translate("xpack.securitySolution.timeline.kpis.sourceIpKpiTitle",{defaultMessage:"Source IPs"}),J=P.i18n.translate("xpack.securitySolution.timeline.kpis.destinationKpiTitle",{defaultMessage:"Destination IPs"}),Z=P.i18n.translate("xpack.securitySolution.timeline.kpis.userKpiTitle",{defaultMessage:"Users"}),ee=P.i18n.translate("xpack.securitySolution.timeline.properties.readMore",{defaultMessage:"Read More"}),te=({isOpen:e,title:t})=>P.i18n.translate("xpack.securitySolution.timeline.properties.timelineToggleButtonAriaLabel",{values:{isOpen:e,title:t},defaultMessage:"{isOpen, select, false {Open} true {Close} other {Toggle}} timeline {title}"}),ne=u()(a.EuiHealth).withConfig({displayName:"EuiHealthStyled",componentId:"sc-m1giyi-0"})(["display:block;"]),ae=u()(a.EuiButtonEmpty).withConfig({displayName:"StyledEuiButtonEmpty",componentId:"sc-m1giyi-1"})(["> span{padding:0;}"]),ie=u()(a.EuiFlexItem).withConfig({displayName:"TitleConatiner",componentId:"sc-m1giyi-2"})(["overflow:hidden;display:inline-block;text-overflow:ellipsis;"]),re=({timelineId:e,timelineStatus:t,timelineType:n,timelineTitle:s,updated:u,isOpen:d})=>{const m=Object(o.useDispatch)(),p=Object(i.useCallback)((()=>{m(g.a.showTimeline({id:e,show:!d})),Object(q.i)()}),[m,d,e]),b=Object(l.isEmpty)(s)?n===f.l.template?j.k:j.l:s,y=Object(i.useMemo)((()=>t===f.k.draft?r.a.createElement(r.a.Fragment,null,Q):r.a.createElement(r.a.Fragment,null,G," ",r.a.createElement(c.FormattedRelative,{"data-test-subj":"timeline-status",key:"timeline-status-autosaved",value:new Date(u)}))),[t,u]);return r.a.createElement(ae,{"aria-label":te({isOpen:d,title:b}),className:q.b,flush:"both","data-test-subj":"flyoutOverlay",size:"s",isSelected:d,onClick:p},r.a.createElement(a.EuiFlexGroup,{gutterSize:"none",alignItems:"center",justifyContent:"flexStart",responsive:!1},r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiToolTip,{position:"top",content:y},r.a.createElement(ne,{color:t===f.k.draft?"warning":"success"}))),r.a.createElement(ie,{grow:!1},b),!d&&r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(H.b,null))))},le=r.a.memo(re);var oe=n(139),se=n(55),ue=n.n(se),ce=n(117);const de=u()(a.EuiStat).withConfig({displayName:"NoWrapEuiStat",componentId:"sc-iiqy2a-0"})(["& .euiStat__description{white-space:nowrap;}"]),me=r.a.memo((({kpis:e,isLoading:t})=>{const n="0,0.[000]a",[l]=Object(O.p)(v.O),o=Object(i.useMemo)((()=>({process:null===e?Object(ce.e)():ue()(e.processCount).format(n),user:null===e?Object(ce.e)():ue()(e.userCount).format(n),host:null===e?Object(ce.e)():ue()(e.hostCount).format(n),sourceIp:null===e?Object(ce.e)():ue()(e.sourceIpCount).format(n),destinationIp:null===e?Object(ce.e)():ue()(e.destinationIpCount).format(n)})),[e]),s=Object(i.useMemo)((()=>({process:ue()(null==e?void 0:e.processCount).format(l),user:ue()(null==e?void 0:e.userCount).format(l),host:ue()(null==e?void 0:e.hostCount).format(l),sourceIp:ue()(null==e?void 0:e.sourceIpCount).format(l),destinationIp:ue()(null==e?void 0:e.destinationIpCount).format(l)})),[e,l]);return r.a.createElement(a.EuiFlexGroup,{wrap:!0,"data-test-subj":"siem-timeline-kpis"},r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiToolTip,{position:"left",content:s.process},r.a.createElement(de,{"data-test-subj":"siem-timeline-process-kpi",title:o.process,description:K,titleSize:"s",isLoading:t}))),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiToolTip,{position:"left",content:s.user},r.a.createElement(de,{"data-test-subj":"siem-timeline-user-kpi",title:o.user,description:Z,titleSize:"s",isLoading:t}))),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiToolTip,{position:"left",content:s.host},r.a.createElement(de,{"data-test-subj":"siem-timeline-host-kpi",title:o.host,description:X,titleSize:"s",isLoading:t}))),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiToolTip,{position:"left",content:s.sourceIp},r.a.createElement(de,{"data-test-subj":"siem-timeline-source-ip-kpi",title:o.sourceIp,description:Y,titleSize:"s",isLoading:t}))),r.a.createElement(a.EuiFlexItem,{grow:!1,style:{minWidth:100}},r.a.createElement(a.EuiToolTip,{position:"left",content:s.destinationIp},r.a.createElement(de,{"data-test-subj":"siem-timeline-destination-ip-kpi",title:o.destinationIp,description:J,titleSize:"s",isLoading:t}))))}));me.displayName="TimelineKPIs";var pe=n(639);const be=u()(a.EuiFlexItem).withConfig({displayName:"ActiveTimelinesContainer",componentId:"sc-a6ccyo-0"})(["overflow:hidden;"]),fe=({timelineId:e})=>{const t=Object(o.useDispatch)(),{browserFields:n,indexPattern:s}=Object(_.d)(V.SourcererScopeName.timeline),{uiSettings:u}=Object(O.j)().services,c=Object(i.useMemo)((()=>Object(d.getEsQueryConfig)(u)),[u]),f=Object(i.useMemo)((()=>g.b.getTimelineByIdSelector()),[]),{activeTab:h,dataProviders:v,kqlQuery:E,title:S,timelineType:x,status:j,updated:k,show:T,filters:w,kqlMode:M}=Object(p.a)((t=>{var n;return Object(l.pick)(["activeTab","dataProviders","kqlQuery","status","title","timelineType","updated","show","filters","kqlMode"],null!==(n=f(t,e))&&void 0!==n?n:y.b)})),A=Object(i.useMemo)((()=>!Object(l.isEmpty)(v)||!Object(l.isEmpty)(Object(l.get)("filterQuery.kuery.expression",E))),[v,E]),N=Object(i.useMemo)((()=>g.b.getKqlFilterQuerySelector()),[]),F=Object(o.useSelector)((t=>N(t,e))),D=Object(l.isEmpty)(v)&&Object(l.isEmpty)(F)&&"template"===x?" ":F,R=Object(i.useMemo)((()=>({query:D,language:"kuery"})),[D]),P=Object(i.useMemo)((()=>Object($.d)({config:c,dataProviders:v,indexPattern:s,browserFields:n,filters:w||[],kqlQuery:R,kqlMode:M})),[n,v,c,w,s,M,R]),L=Object(i.useCallback)((()=>{t(g.a.showTimeline({id:e,show:!1})),Object(q.i)()}),[t,e]),{euiTheme:B}=Object(a.useEuiTheme)();return r.a.createElement(a.EuiPanel,{borderRadius:"none",grow:!1,paddingSize:"s",hasShadow:!1,"data-test-subj":"timeline-flyout-header-panel",style:{backgroundColor:B.colors.emptyShade,color:B.colors.text}},r.a.createElement(a.EuiFlexGroup,{alignItems:"center",gutterSize:"s",responsive:!1},r.a.createElement(C.b,{timelineId:e}),r.a.createElement(be,{grow:!1},r.a.createElement(le,{timelineId:e,timelineType:x,timelineTitle:S,timelineStatus:j,isOpen:T,updated:k})),T&&r.a.createElement(a.EuiFlexItem,null,r.a.createElement(a.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"s",responsive:!1},(h===b.d.query||h===b.d.eql)&&r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(I.b,{compact:!0,queryId:`${e}-${h}`,inputId:m.a.timeline,inspectIndex:0,isDisabled:!A||void 0===(null==P?void 0:P.filterQuery),title:W})),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiToolTip,{content:U("default"===x)},r.a.createElement(a.EuiButtonIcon,{"aria-label":U("default"===x),"data-test-subj":"close-timeline",iconType:"cross",onClick:L})))))))},ge=r.a.memo(fe),ye=u.a.div.withConfig({displayName:"StyledDiv",componentId:"sc-a6ccyo-1"})(["display:-webkit-box;-webkit-line-clamp:1;-webkit-box-orient:vertical;overflow:hidden;word-break:break-word;"]),he=({description:e,onclick:t})=>{const[n,i]=Object(pe.a)(e);return r.a.createElement(r.a.Fragment,null,r.a.createElement(ye,{ref:i},e),n&&r.a.createElement(a.EuiButtonEmpty,{flush:"left",onClick:t},ee))},ve=u()(a.EuiFlexGroup).withConfig({displayName:"StyledTimelineHeader",componentId:"sc-a6ccyo-2"})([""," flex:0;"],(({theme:e})=>`margin: ${e.eui.euiSizeXS} ${e.eui.euiSizeS} 0 ${e.eui.euiSizeS};`)),Ee=u.a.span.withConfig({displayName:"TimelineStatusInfoContainer",componentId:"sc-a6ccyo-3"})([""," white-space:nowrap;"],(({theme:e})=>`margin-left: ${e.eui.euiSizeS};`)),Oe=u.a.div.withConfig({displayName:"KpisContainer",componentId:"sc-a6ccyo-4"})(["",""],(({theme:e})=>`margin-right: ${e.eui.euiSizeM};`)),Se=u()(a.EuiFlexItem).withConfig({displayName:"RowFlexItem",componentId:"sc-a6ccyo-5"})(["flex-direction:row;align-items:center;"]),xe=u.a.h3.withConfig({displayName:"TimelineTitleContainer",componentId:"sc-a6ccyo-6"})(["display:-webkit-box;overflow:hidden;-webkit-line-clamp:1;-webkit-box-orient:vertical;word-break:break-word;"]),je=({timelineId:e})=>{const t=Object(i.useMemo)((()=>g.b.getTimelineByIdSelector()),[]),{title:n,timelineType:o}=Object(p.a)((n=>{var a;return Object(l.pick)(["title","timelineType"],null!==(a=t(n,e))&&void 0!==a?a:y.b)})),s=Object(i.useMemo)((()=>o===f.l.template?j.k:j.l),[o]),u=Object(i.useMemo)((()=>n||s),[n,s]);return r.a.createElement(a.EuiToolTip,{content:u,position:"bottom"},r.a.createElement(a.EuiText,null,r.a.createElement(xe,{"data-test-subj":"timeline-title"},u)))},ke=r.a.memo(je),Te=({timelineId:e})=>{const t=Object(i.useMemo)((()=>g.b.getTimelineByIdSelector()),[]),n=Object(p.a)((n=>{var a;return(null!==(a=t(n,e))&&void 0!==a?a:y.b).description})),l=Object(o.useDispatch)(),s=Object(i.useCallback)((t=>{l(Object(E.setActiveTabTimeline)({id:e,activeTab:b.d.notes,scrollToTop:!0}))}),[l,e]);return r.a.createElement(a.EuiText,{size:"s","data-test-subj":"timeline-description"},r.a.createElement(he,{description:n||j.f,onclick:s}))},Ce=r.a.memo(Te),we=({timelineId:e})=>{const t=Object(i.useMemo)((()=>Object(oe.createSelector)(g.b.selectTimeline,(e=>{var t,n;return{status:null!==(t=null==e?void 0:e.status)&&void 0!==t?t:f.k.draft,updated:null!==(n=null==e?void 0:e.updated)&&void 0!==n?n:void 0}}))),[]),{status:n,updated:l}=Object(p.a)((n=>t(n,e)));return Object(i.useMemo)((()=>n===f.k.draft),[n])?r.a.createElement(a.EuiText,{size:"xs"},r.a.createElement(a.EuiTextColor,{color:"warning","data-test-subj":"timeline-status"},Q)):r.a.createElement(a.EuiText,{size:"xs"},r.a.createElement(a.EuiTextColor,{color:"default"},G," ",r.a.createElement(c.FormattedRelative,{"data-test-subj":"timeline-status",key:"timeline-status-autosaved",value:new Date(l)})))},Ie=r.a.memo(we),Me=({timelineId:e})=>{var t;const{selectedPatterns:n,indexPattern:s,browserFields:u}=Object(_.d)(V.SourcererScopeName.timeline),c=Object(i.useMemo)((()=>Object(z.i)()),[]),m=Object(i.useMemo)((()=>Object(z.b)()),[]),f=Object(i.useMemo)((()=>e===b.c.active),[e]),v=Object(p.a)((e=>f?{from:c(e.inputs.timeline),to:m(e.inputs.timeline),interval:""}:{from:c(e.inputs.global),to:m(e.inputs.global),interval:""})),{uiSettings:E}=Object(O.j)().services,S=Object(i.useMemo)((()=>Object(d.getEsQueryConfig)(E)),[E]),x=Object(i.useMemo)((()=>g.b.getTimelineByIdSelector()),[]),j=Object(o.useSelector)((t=>{var n;return null!==(n=x(t,e))&&void 0!==n?n:y.b})),{dataProviders:k,filters:C,timelineType:I,kqlMode:M,activeTab:P}=j,q=Object(i.useMemo)((()=>g.b.getKqlFilterQuerySelector()),[]),H=Object(o.useSelector)((t=>q(t,e))),U=Object(l.isEmpty)(k)&&Object(l.isEmpty)(H)&&"template"===I?" ":H,Q=Object(i.useMemo)((()=>({query:U,language:"kuery"})),[U]),G=Object(i.useMemo)((()=>Object($.d)({config:S,dataProviders:k,indexPattern:s,browserFields:u,filters:C||[],kqlQuery:Q,kqlMode:M})),[u,k,S,C,s,M,Q]),W=Object(i.useMemo)((()=>Object(l.isEmpty)(k)&&Object(l.isEmpty)(C)&&Object(l.isEmpty)(Q.query)||void 0===(null==G?void 0:G.filterQuery)),[k,C,Q,G]),[K,X]=(({timerange:e,filterQuery:t,defaultIndex:n,isBlankTimeline:a})=>{const{data:r}=Object(O.j)().services,o=Object(i.useRef)(l.noop),s=Object(i.useRef)(new AbortController),u=Object(i.useRef)(new N.Subscription),[c,d]=Object(i.useState)(!1),[m,p]=Object(i.useState)(null),[b,f]=Object(i.useState)(null),{addError:g,addWarning:y}=Object(R.a)(),h=Object(i.useCallback)((e=>{if(null==e)return;const t=async()=>{s.current=new AbortController,d(!0),u.current=r.search.search(e,{strategy:"timelineSearchStrategy",abortSignal:s.current.signal}).subscribe({next:e=>{Object(F.isCompleteResponse)(e)?(d(!1),f(e),u.current.unsubscribe()):Object(F.isErrorResponse)(e)&&(d(!1),y(L),u.current.unsubscribe())},error:e=>{d(!1),g(e,{title:B}),u.current.unsubscribe()}})};u.current.unsubscribe(),s.current.abort(),t(),o.current=t}),[r.search,g,y]);return Object(i.useEffect)((()=>{p((a=>{const i={...null!=a?a:{},defaultIndex:n,timerange:e,filterQuery:t,factoryQueryType:D.A.kpi};return A()(a,i)?a:i}))}),[n,e,t]),Object(i.useEffect)((()=>(a?(d(!1),f(null)):h(m),()=>{u.current.unsubscribe(),s.current.abort()})),[a,m,h]),[c,b]})({defaultIndex:n,timerange:v,isBlankTimeline:W,filterQuery:null!==(t=null==G?void 0:G.filterQuery)&&void 0!==t?t:""}),Y=Object(O.h)();return r.a.createElement(ve,{alignItems:"center",gutterSize:"s"},r.a.createElement(a.EuiFlexItem,null,r.a.createElement(a.EuiFlexGroup,{"data-test-subj":"properties-left",direction:"column",gutterSize:"none"},r.a.createElement(Se,null,r.a.createElement(ke,{timelineId:e}),r.a.createElement(w.a,{timelineId:e,initialFocus:"title"}),r.a.createElement(Ee,null,r.a.createElement(Ie,{timelineId:e}))),r.a.createElement(Se,null,r.a.createElement(Ce,{timelineId:e}),r.a.createElement(w.a,{timelineId:e,initialFocus:"description"})))),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(Oe,null,P===b.d.query?r.a.createElement(me,{kpis:X,isLoading:K}):null)),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiFlexGroup,{gutterSize:"s"},r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(h.a,{timelineId:e})),Y.create&&Y.read&&r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(T,{timelineId:e})))))};Me.displayName="FlyoutHeaderComponent";const Ae=r.a.memo(Me)},942:function(e,t,n){"use strict";n.d(t,"b",(function(){return E})),n.d(t,"a",(function(){return x})),n.d(t,"c",(function(){return I}));var a=n(2),i=n.n(a),r=n(40),l=n(106),o=n(676),s=n(169);const u="timeline";var c=n(5);const d=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.insertTimelineButtonLabel",{defaultMessage:"Insert timeline link"}),m=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.noTimelineNameFoundErrorMsg",{defaultMessage:"No timeline name found"}),p=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.noTimelineIdFoundErrorMsg",{defaultMessage:"No timeline id found"}),b=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.noParenthesesErrorMsg",{defaultMessage:"Expected left parentheses"}),f=e=>c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.failedRetrieveTimelineErrorMsg",{defaultMessage:"Failed to retrieve timeline id: { timelineId }",values:{timelineId:e}}),g=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.timelineErrorTitle",{defaultMessage:"Timeline Error"});var y=n(131);const h=({onClosePopover:e,onInsert:t})=>{const{formatUrl:n}=Object(s.m)(y.a.timelines),u=Object(a.useCallback)((({timelines:e})=>[...e.map(((e,t)=>({description:e.description,favorite:e.favorite,label:e.title,id:e.savedObjectId,key:`${e.title}-${t}`,title:e.title,checked:void 0})))]),[]),c=Object(a.useCallback)(((e,a,i)=>{const r=n(Object(s.l)(null!=a?a:"",i),{absolute:!0,skipSearch:!0});t(`[${e}](${r})`,{block:!1})}),[n,t]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiModalHeader,null),i.a.createElement(r.EuiModalBody,null,i.a.createElement(o.a,{hideUntitled:!0,getSelectableOptions:u,onTimelineChange:c,onClosePopover:e,timelineType:l.l.default})))},v=Object(a.memo)(h),E={name:u,button:{label:d,iconType:"timeline"},helpText:i.a.createElement(r.EuiCodeBlock,{language:"md",paddingSize:"s",fontSize:"l"},"[title](url)"),editor:function({node:e,onSave:t,onCancel:n}){return i.a.createElement(v,{onClosePopover:n,onInsert:t})}};var O=n(56),S=n(478);const x=function(){const e=this.Parser,t=e.prototype.inlineTokenizers,n=e.prototype.inlineMethods,a=function(e,t,n){let a=0;if("["!==t[a])return!1;if(n)return!0;function i(e,n){if(t[a]!==e)throw new Error(b);a++;let i="",r=0;for(;a<t.length;a++){const l=t[a];if(l===n&&0===r)return a++,i;l===n?r--:l===e&&r++,i+=l}return""}const r=i("[","]"),l=i("(",")"),o=e.now();if(!r)return this.file.info(m,{line:o.line,column:o.column}),!1;try{var s;const t=l.split("?"),n=Object(S.parse)(t[1]),a=Object(O.safeDecode)(null!==(s=n.timeline)&&void 0!==s?s:""),{id:i="",graphEventId:c=""}=null!=a?a:{id:null,graphEventId:""};return i?e(`[${r}](${l})`)({type:u,id:i,title:r,graphEventId:c}):(this.file.info(p,{line:o.line,column:o.column+l.indexOf("id")}),!1)}catch{this.file.info((e=>c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.toolTip.timelineUrlIsNotValidErrorMsg",{defaultMessage:"Timeline URL is not valid => {timelineUrl}",values:{timelineUrl:e}}))(l),{line:o.line,column:o.column})}return!1},i=function(e,t,n){return!(!1===t.startsWith("[")||!0===t.startsWith("[")&&!t.includes("timelines?timeline=(id"))&&a.call(this,e,t,n)};i.locator=(e,t)=>e.indexOf("[",t),t.timeline=i,n.splice(n.indexOf("url"),0,u)};var j=n(103),k=n(164),T=n(12),C=n(108);const w=({id:e,title:t,graphEventId:n})=>{const{addError:l}=Object(C.a)(),o=(()=>{const e=Object(j.useDispatch)();return Object(a.useCallback)(((t,n,a)=>{Object(k.h)({graphEventId:a,timelineId:t,onError:n,updateIsLoading:({id:t,isLoading:n})=>e(Object(T.updateIsLoading)({id:t,isLoading:n})),updateTimeline:Object(k.b)(e)})}),[e])})(),s=Object(a.useCallback)(((e,t)=>{l(e,{title:g,toastMessage:f(t)})}),[l]),u=Object(a.useCallback)((()=>o(null!=e?e:"",s,n)),[e,n,o,s]);return i.a.createElement(r.EuiToolTip,{content:(d=null!=e?e:"",c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.toolTip.timelineId",{defaultMessage:"Timeline id: { timelineId }",values:{timelineId:d}}))},i.a.createElement(r.EuiLink,{onClick:u,"data-test-subj":`markdown-timeline-link-${e}`},t));var d},I=Object(a.memo)(w)},945:function(e,t,n){"use strict";n.d(t,"a",(function(){return $}));var a=n(42),i=n(40),r=n(2),l=n.n(r),o=n(41),s=n.n(o),u=n(150),c=n(106),d=n(183),m=n(5);const p=m.i18n.translate("xpack.securitySolution.editDataProvider.doesNotExistLabel",{defaultMessage:"does not exist"}),b=m.i18n.translate("xpack.securitySolution.editDataProvider.existsLabel",{defaultMessage:"exists"}),f=m.i18n.translate("xpack.securitySolution.editDataProvider.fieldLabel",{defaultMessage:"Field"}),g=m.i18n.translate("xpack.securitySolution.editDataProvider.placeholder",{defaultMessage:"Select a field"}),y=m.i18n.translate("xpack.securitySolution.editDataProvider.isLabel",{defaultMessage:"is"}),h=m.i18n.translate("xpack.securitySolution.editDataProvider.isOneOfLabel",{defaultMessage:"is one of"}),v=m.i18n.translate("xpack.securitySolution.editDataProvider.isNotLabel",{defaultMessage:"is not"}),E=m.i18n.translate("xpack.securitySolution.editDataProvider.isNotOneOfLabel",{defaultMessage:"is not one of"}),O=m.i18n.translate("xpack.securitySolution.editDataProvider.includesPlaceholder",{defaultMessage:"enter one or more values"}),S=m.i18n.translate("xpack.securitySolution.editDataProvider.operatorLabel",{defaultMessage:"Operator"}),x=m.i18n.translate("xpack.securitySolution.editDataProvider.saveButton",{defaultMessage:"Save"}),j=m.i18n.translate("xpack.securitySolution.editDataProvider.valuePlaceholder",{defaultMessage:"value"}),k=m.i18n.translate("xpack.securitySolution.editDataProvider.valueLabel",{defaultMessage:"Value"}),T=m.i18n.translate("xpack.securitySolution.editDataProvider.selectAnOperatorPlaceholder",{defaultMessage:"Select an operator"}),C=e=>m.i18n.translate("xpack.securitySolution.editDataProvider.unavailableOperator",{values:{operator:e},defaultMessage:"{operator} operator is unavailable with templates"}),w=[{label:y},{label:v},{label:h},{label:E},{label:b},{label:p}],I=[],M=e=>e?Object.keys(e).sort().map((t=>{return{label:t,options:(n=e[t],null!=n.fields&&Object.keys(n.fields).length>0?Object.keys(n.fields):I).map((e=>({label:e})))};var n})):I,A=({browserFields:e,selectedField:t,selectedOperator:n,type:i})=>{const r=t.length>0?t[0].label:"",l=n.length>0?n[0].label:"",o=e&&null!=Object(d.a)(e)[r],s=-1!==Object(a.findIndex)((e=>e.label===l),w),u=i===c.a.template&&(l===h||l===E);return o&&s&&!u},N=e=>{switch(e.length>0?e[0].label:""){case y:case v:return u.d;case h:case E:return u.c;case b:case p:return u.b;default:return u.d}},F=e=>{switch(e.length>0?e[0].label:""){case v:case E:case p:return!0;default:return!1}},D=e=>Array.isArray(e)?e.length?`${e[0]}`:"":`${e}`;var R=n(148);const P=({value:e,onChangeCallback:t})=>{const[n,a]=Object(r.useState)(L(e));Object(r.useEffect)((()=>{t(B(n))}),[n,t]);const o=Object(r.useCallback)(((e,t=n)=>{const i=e.trim().toLowerCase();i&&-1===t.findIndex((e=>e.label.trim().toLowerCase()===i))&&a([...n,{label:e}])}),[n]),s=Object(r.useCallback)((e=>{a(e)}),[]);return l.a.createElement(i.EuiComboBox,{noSuggestions:!0,isClearable:!0,"data-test-subj":"is-one-of-combobox-input",selectedOptions:n,placeholder:O,onCreateOption:o,onChange:s})},L=e=>Object(R.k)(e)?e.map((e=>({label:String(e)}))):[],B=e=>e.map((e=>e.label)),_=({value:e,onChangeCallback:t})=>{const[n,a]=Object(r.useState)(z(e));Object(r.useEffect)((()=>{t(D(n))}),[n,t]);const o=Object(r.useCallback)((e=>{a(e.target.value)}),[]);return l.a.createElement(i.EuiFieldText,{className:"edit-data-provider-value",onChange:o,placeholder:j,value:D(n)})},z=e=>{var t;return Object(R.k)(e)?null!==(t=e[0])&&void 0!==t?t:"":e},q="edit-data-provider-save";s.a.div.withConfig({displayName:"HeaderContainer",componentId:"sc-1dznxok-0"})(["width:",";"],400).displayName="HeaderContainer";const $=l.a.memo((({andProviderId:e,browserFields:t,field:n,isExcluded:o,onDataProviderEdited:s,operator:c,providerId:d,timelineId:m,value:O,type:j=u.a.default})=>{const[I,D]=Object(r.useState)([{label:n}]),[R,L]=Object(r.useState)(((e,t)=>":"===t?e?[{label:v}]:[{label:y}]:"includes"===t?e?[{label:E}]:[{label:h}]:e?[{label:p}]:[{label:b}])(o,c)),[B,z]=Object(r.useState)(O),$=Object(r.useMemo)((()=>R.length>0&&(R[0].label===h||R[0].label===E)),[R]),V=Object(r.useMemo)((()=>j!==u.a.template&&R.length>0&&R[0].label!==b&&R[0].label!==p&&!$),[$,j,R]),H=Object(r.useMemo)((()=>$&&Array.isArray(B)&&!B.length),[$,B]),U=()=>{const e=document.getElementsByClassName("edit-data-provider-value");if(e.length>0)e[0].focus();else{const e=document.getElementsByClassName(q);e.length>0&&e[0].focus()}},Q=Object(r.useCallback)((e=>{D(e),j===u.a.template&&z(`{${e[0].label}}`),U()}),[j]),G=Object(r.useCallback)((e=>{L(e),U()}),[]),W=Object(r.useCallback)((e=>{z(e)}),[]),K=Object(r.useCallback)((()=>{s({andProviderId:e,excluded:F(R),field:I.length>0?I[0].label:"",id:m,operator:N(R),providerId:d,value:B,type:j})}),[s,e,R,I,m,d,B,j]);return Object(r.useEffect)((()=>((()=>{const e=void 0!==window.pageXOffset?window.pageXOffset:(document.documentElement||document.body.parentNode||document.body).scrollLeft,t=void 0!==window.pageYOffset?window.pageYOffset:(document.documentElement||document.body.parentNode||document.body).scrollTop;window.onscroll=()=>window.scrollTo(e,t)})(),()=>{window.onscroll=()=>a.noop})),[]),l.a.createElement(i.EuiPanel,{paddingSize:"s"},l.a.createElement(i.EuiFlexGroup,{direction:"column",gutterSize:"none"},l.a.createElement(i.EuiFlexItem,{grow:!0},l.a.createElement(i.EuiFormRow,{label:f},l.a.createElement(i.EuiComboBox,{autoFocus:!0,"data-test-subj":"field",isClearable:!1,onChange:Q,options:M(t),placeholder:g,selectedOptions:I,singleSelection:{asPlainText:!0},fullWidth:!0}))),l.a.createElement(i.EuiFlexItem,{grow:!1},l.a.createElement(i.EuiSpacer,{size:"m"})),l.a.createElement(i.EuiFlexItem,{grow:!0},l.a.createElement(i.EuiFlexGroup,{gutterSize:"s",direction:"row",justifyContent:"spaceBetween"},l.a.createElement(i.EuiFlexItem,{grow:!0},l.a.createElement(i.EuiFormRow,{label:S},l.a.createElement(i.EuiComboBox,{"data-test-subj":"operator",isClearable:!1,onChange:G,options:w,placeholder:T,selectedOptions:R,singleSelection:{asPlainText:!0},style:{minWidth:152}}))))),l.a.createElement(i.EuiFlexItem,{grow:!1},l.a.createElement(i.EuiSpacer,{size:"m"})),l.a.createElement(i.EuiFlexItem,{grow:!1},V&&l.a.createElement(i.EuiFormRow,{label:k},l.a.createElement(_,{onChangeCallback:W,value:O})),$&&j!==u.a.template&&l.a.createElement(i.EuiFormRow,{label:k},l.a.createElement(P,{onChangeCallback:W,value:O}))),l.a.createElement(i.EuiFlexItem,{grow:!1},l.a.createElement(i.EuiSpacer,{size:"m"})),l.a.createElement(i.EuiFlexItem,{grow:!1},j===u.a.template&&$&&l.a.createElement(l.a.Fragment,null,l.a.createElement(i.EuiCallOut,{color:"warning",iconType:"warning",size:"s",title:C(R[0].label)}),l.a.createElement(i.EuiSpacer,{size:"m"})),l.a.createElement(i.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"none"},l.a.createElement(i.EuiFlexItem,{grow:!1},l.a.createElement(i.EuiButton,{className:q,color:"primary","data-test-subj":"save",fill:!0,isDisabled:!A({type:j,browserFields:t,selectedField:I,selectedOperator:R})||H,onClick:K,size:"m"},x))))))}));$.displayName="StatefulEditDataProvider"},947:function(e,t,n){"use strict";n.d(t,"a",(function(){return E}));var a=n(2),i=n.n(a),r=n(40),l=n(108),o=n(5);const s=o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.cancelTitle",{defaultMessage:"Cancel"}),u=o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.overwriteExceptionLabel",{defaultMessage:'Overwrite existing exception lists with conflicting "list_id"'}),c=o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.overwriteActionConnectorsLabel",{defaultMessage:'Overwrite existing connectors with conflicting action "id"'}),d=e=>o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importExceptionsFailedLabel",{values:{totalExceptions:e},defaultMessage:"Failed to import {totalExceptions} {totalExceptions, plural, =1 {exception} other {exceptions}}"}),m=e=>o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importConnectorsFailedLabel",{values:{totalConnectors:e},defaultMessage:"Failed to import {totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}}"}),p=o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsWarningButton",{defaultMessage:"Go to connectors"}),b=o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsAdditionalPrivilegesError",{defaultMessage:"You need additional privileges to import rules with actions."}),f=(e,t,n)=>{const a=n.map((t=>e(t.error.message))),i=new Error(a.join(". "));return i.stack=void 0,i.name="Network errors",i.raw_network_error=t,i};var g=n(407);const y=({actionConnectorsWarnings:e,importedActionConnectorsCount:t})=>{const{http:n}=Object(g.b)().services;if(!t||!e.length)return null;const{actionPath:a,message:l,buttonLabel:s}=e[0];return i.a.createElement(r.EuiCallOut,{"data-test-subj":"actionConnectorsWarningsCallOut",size:"m",heading:"h2",iconType:"warning",title:i.a.createElement("span",{"data-test-subj":"actionConnectorsWarningsCallOutTitle"},(u=t,o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsWarningTitle",{values:{totalConnectors:u},defaultMessage:"{totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}} imported"}))),color:"warning"},i.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{"data-test-subj":"actionConnectorsWarningsCallOutMessage"},i.a.createElement(r.EuiText,{size:"xs"},l)),i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiFlexGroup,{gutterSize:"none",direction:"columnReverse",alignItems:"flexEnd"},i.a.createElement(r.EuiButton,{"data-test-subj":"actionConnectorsWarningsCallOutButton",color:"warning",href:n.basePath.prepend(a)},s||p)))));var u};y.displayName="ActionConnectorWarningsComponent";const h=i.a.memo(y);h.displayName="ActionConnectorWarnings";const v=({checkBoxLabel:e,closeModal:t,description:n,errorMessage:p,failedDetailed:g,importComplete:y,importData:v,showCheckBox:E=!0,showExceptionsCheckBox:O=!1,showActionConnectorsCheckBox:S=!1,showModal:x,submitBtnText:j,subtitle:k,successMessage:T,title:C})=>{const[w,I]=Object(a.useState)(null),[M,A]=Object(a.useState)(!1),[N,F]=Object(a.useState)(!1),[D,R]=Object(a.useState)(!1),[P,L]=Object(a.useState)(!1),{addError:B,addSuccess:_}=Object(l.a)(),[z,q]=Object(a.useState)([]),[$,V]=Object(a.useState)(0),H=Object(a.useCallback)((()=>{t(),F(!1),R(!1),L(!1),q([])}),[t,F,R]),U=Object(a.useCallback)((e=>{A(!1),I(null),y(),e&&(y(),H())}),[H,y]),Q=Object(a.useCallback)((async()=>{if(null!=w){A(!0);const e=new AbortController;try{const{action_connectors_warnings:t,...n}=await v({fileToImport:w[0],overwrite:N,overwriteExceptions:D,overwriteActionConnectors:P,signal:e.signal}),a=n.action_connectors_success_count;q(t),V(a),(({importResponse:e,exceptionsIncluded:t,actionConnectorsIncluded:n,successMessage:a,errorMessage:i,errorMessageDetailed:r,addError:l,addSuccess:s})=>{if(e.success)return e.success_count>0&&s(a(e.success_count)),t&&e.exceptions_success&&null!=e.exceptions_success_count&&e.exceptions_success_count>0&&s((c=e.exceptions_success_count,o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.exceptionsSuccessLabel",{values:{totalExceptions:c},defaultMessage:"Successfully imported {totalExceptions} {totalExceptions, plural, =1 {exception} other {exceptions}}."}))),void(n&&e.action_connectors_success&&null!=e.action_connectors_success_count&&e.action_connectors_success_count>0&&s((u=e.action_connectors_success_count,o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.connectorsSuccessLabel",{values:{totalConnectors:u},defaultMessage:"Successfully imported {totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}}."}))));var u,c;if(e.errors.length>0){if(n&&null!=e.action_connectors_errors&&e.action_connectors_errors.length>0){const{mappedErrors:t,numberOfActions:n}=(e=>{let t="";return{mappedErrors:e.map((e=>{const{id:n,error:a}=e;t=t&&t!==n?`${t},${n}`:n;const{status_code:i,message:r}=a||{};let l;return l=403===i?b:r,{...e,error:{...a,message:l}}})),numberOfActions:new Set(t&&[...t.split(",")]).size}})(e.action_connectors_errors);return l(f(r,e,t),{title:m(n||t.length)})}l(f(r,e,e.errors),{title:i(e.errors.length)}),t&&null!=e.exceptions_errors&&e.exceptions_errors.length>0&&l(f(r,e,e.exceptions_errors),{title:d(e.exceptions_errors.length)})}})({importResponse:n,exceptionsIncluded:O,actionConnectorsIncluded:S,successMessage:T,errorMessage:p,errorMessageDetailed:g,addError:B,addSuccess:_}),U(!(null!=t&&t.length))}catch(e){H(),B(e,{title:p(1)})}}}),[w,v,N,D,P,O,T,p,g,B,_,S,U,H]),G=Object(a.useCallback)((()=>{H()}),[H]),W=Object(a.useCallback)((()=>{F((e=>!e))}),[]),K=Object(a.useCallback)((()=>{R((e=>!e))}),[]),X=Object(a.useCallback)((()=>{L((e=>!e))}),[]);return i.a.createElement(i.a.Fragment,null,x&&i.a.createElement(r.EuiModal,{onClose:G,maxWidth:"750px"},i.a.createElement(r.EuiModalHeader,null,i.a.createElement(r.EuiModalHeaderTitle,null,C)),i.a.createElement(r.EuiModalBody,null,i.a.createElement(r.EuiText,{size:"s"},i.a.createElement("h4",null,n)),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiFilePicker,{"data-test-subj":"rule-file-picker",accept:".ndjson",id:"rule-file-picker",initialPromptText:k,onChange:e=>{I(e&&e.length>0?e:null)},display:"large",fullWidth:!0,isLoading:M}),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(h,{actionConnectorsWarnings:z,importedActionConnectorsCount:$}),i.a.createElement(r.EuiSpacer,{size:"s"}),E&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiCheckbox,{"data-test-subj":"importDataModalCheckboxLabel",id:"importDataModalCheckboxLabel",label:e,checked:N,onChange:W}),O&&i.a.createElement(r.EuiCheckbox,{"data-test-subj":"importDataModalExceptionsCheckboxLabel",id:"importDataModalExceptionsCheckboxLabel",label:u,checked:D,onChange:K}),S&&i.a.createElement(r.EuiCheckbox,{"data-test-subj":"importDataModalActionConnectorsCheckbox",id:"importDataModalActionConnectorsCheckbox",label:c,checked:P,onChange:X}))),i.a.createElement(r.EuiModalFooter,null,i.a.createElement(r.EuiButtonEmpty,{onClick:G},s),i.a.createElement(r.EuiButton,{"data-test-subj":"import-data-modal-button",onClick:Q,disabled:null==w||M,fill:!0},j))))};v.displayName="ImportDataModalComponent";const E=i.a.memo(v);E.displayName="ImportDataModal"},949:function(e,t,n){"use strict";n.d(t,"a",(function(){return p}));var a=n(2),i=n.n(a),r=n(103),l=n(656),o=n(299),s=n(151),u=n(114),c=n(457),d=n(312);const m=({combinedQueries:e,filters:t,headerChildren:n,onlyField:m,paddingSize:p,query:b,showLegend:f,setAbsoluteRangeDatePickerTarget:g=u.a.global,runtimeMappings:y,hideQueryToggle:h=!1})=>{const v=Object(r.useDispatch)(),{signalIndexName:E}=Object(o.a)(),O=(S=t,Object(a.useMemo)((()=>[...S,...Object(d.d)(!1)]),[S]));var S;const x=Object(a.useCallback)((({x:e})=>{if(!e)return;const[t,n]=e;v(Object(s.setAbsoluteRangeDatePicker)({id:g,from:new Date(t).toISOString(),to:new Date(n).toISOString()}))}),[v,g]);return i.a.createElement(l.a,{combinedQueries:e,filters:O,headerChildren:n,legendPosition:"right",onlyField:m,paddingSize:p,query:b,showLegend:f,showLinkToAlerts:null==m,showStackBy:null==m,showTotalAlertsCount:!0,signalIndexName:E,runtimeMappings:y,title:c.b,titleSize:null==m?"m":"s",updateDateRange:x,hideQueryToggle:h})};m.displayName="SignalsByCategoryComponent";const p=i.a.memo(m)},950:function(e,t,n){"use strict";n.d(t,"a",(function(){return B}));var a=n(42),i=n(2),r=n.n(i),l=n(103),o=n(106),s=n(105),u=n(111),c=n(40),d=n(53),m=n.n(d),p=n(41),b=n.n(p),f=n(117),g=n(638),y=n(150),h=n(484);const v=b()(c.EuiBadge).withConfig({displayName:"ProviderBadgeStyled",componentId:"sc-l32wgy-0"})([".euiToolTipAnchor{&::after{font-style:normal;content:'|';padding:0px 3px;}}&.globalFilterItem{white-space:nowrap;min-width:",";display:flex;&.globalFilterItem-isDisabled{text-decoration:line-through;font-weight:400;font-style:italic;}&.globalFilterItem-isError{box-shadow:0 1px 1px -1px rgba(152,162,179,0.2),0 3px 2px -2px rgba(152,162,179,0.2),inset 0 0 0 1px #bd271e;}}"],(({$timelineType:e})=>e===o.l.template?"140px":"none"));v.displayName="ProviderBadgeStyled";const E=b.a.div.withConfig({displayName:"ProviderFieldBadge",componentId:"sc-l32wgy-1"})(["display:block;color:#fff;padding:6px 8px;font-size:0.6em;"]),O=b()(E).withConfig({displayName:"StyledTemplateFieldBadge",componentId:"sc-l32wgy-2"})(["background:",";text-transform:uppercase;"],(({theme:e})=>e.eui.euiColorVis3_behindText)),S=b()(E).withConfig({displayName:"ConvertFieldBadge",componentId:"sc-l32wgy-3"})(["background:",";cursor:pointer;&:hover{text-decoration:underline;}"],(({theme:e})=>e.eui.euiColorDarkShade)),x=({type:e,toggleType:t})=>e!==y.a.template?r.a.createElement(S,{onClick:t},h.d):r.a.createElement(O,null,h.v),j=r.a.memo(x),k={tabIndex:-1},T=r.a.memo((({deleteProvider:e,field:t,isEnabled:n,isExcluded:l,operator:s,providerId:u,togglePopover:c,toggleType:d,displayValue:p,val:b,type:E,timelineType:O})=>{const S=Object(i.useCallback)((t=>{t.stopPropagation&&t.stopPropagation(),e()}),[e]),x=Object(i.useMemo)((()=>m()("globalFilterItem",{"globalFilterItem-isDisabled":!n,"globalFilterItem-isExcluded":l})),[n,l]),T=Object(i.useMemo)((()=>Object(a.isString)(b)&&""===b?Object(f.b)():b),[b]),C=Object(i.useMemo)((()=>l?r.a.createElement("span",null,h.p," "):null),[l]),w=Object(i.useMemo)((()=>r.a.createElement(r.a.Fragment,null,C,s!==y.b?r.a.createElement("span",{className:"field-value"},`${t}: "${"includes"===s?p:T}"`):r.a.createElement("span",{className:"field-value"},t," ",h.j))),[p,t,T,s,C]),I=Object(i.useMemo)((()=>h.u({field:t,value:`${T}`})),[t,T]);return r.a.createElement(g.a,{id:`${u}-${t}-${b}`},r.a.createElement(r.a.Fragment,null,r.a.createElement(v,{className:x,color:"hollow",title:"",iconOnClick:S,iconOnClickAriaLabel:h.s,iconType:"cross",iconSide:"right",onClick:c,onClickAriaLabel:I,closeButtonProps:k,"data-test-subj":"providerBadge",$timelineType:O},w),O===o.l.template&&s!==y.c&&r.a.createElement(j,{toggleType:d,type:E})))}));T.displayName="ProviderBadge";var C=n(0),w=n.n(C),I=n(945);const M="edit-data-provider",A="exclude-data-provider",N="enable-data-provider",F="filter-for-field-present-data-provider",D="delete-data-provider",R=b()(c.EuiPopover).withConfig({displayName:"MyEuiPopover",componentId:"sc-2zwix7-0"})(["height:100%;user-select:none;"]);R.displayName="MyEuiPopover";class provider_item_actions_ProviderItemActions extends r.a.PureComponent{constructor(...e){super(...e),w()(this,"onDataProviderEdited",(({andProviderId:e,excluded:t,field:n,id:a,operator:i,providerId:r,value:l,type:o})=>{null!=this.props.onDataProviderEdited&&this.props.onDataProviderEdited({andProviderId:e,excluded:t,field:n,id:a,operator:i,providerId:r,value:l,type:o}),this.props.closePopover()})),w()(this,"onFilterForFieldPresent",(()=>{const{andProviderId:e,field:t,timelineId:n,providerId:a,value:i,type:r}=this.props;null!=this.props.onDataProviderEdited&&this.props.onDataProviderEdited({andProviderId:e,excluded:!1,field:t,id:`${n}`,operator:y.b,providerId:a,value:i,type:r}),this.props.closePopover()}))}render(){const{andProviderId:e,browserFields:t,button:n,closePopover:a,deleteProvider:i,field:l,isEnabled:s,isExcluded:u,isLoading:d,isOpen:m,operator:p,providerId:b,timelineId:f,timelineType:g,toggleEnabledProvider:v,toggleExcludedProvider:E,toggleTypeProvider:O,value:S,type:x}=this.props,j=(({andProviderId:e,browserFields:t,deleteItem:n,field:a,isEnabled:i,isExcluded:l,isLoading:s,operator:u,onDataProviderEdited:c,onFilterForFieldPresent:d,providerId:m,timelineId:p,timelineType:b,toggleEnabled:f,toggleExcluded:g,toggleType:v,type:E,value:O})=>[{id:0,items:[{className:M,disabled:s,icon:"pencil",name:h.g,panel:1},{className:A,disabled:s,icon:l?"plusInCircle":"minusInCircle",name:l?h.o:h.i,onClick:g},{className:N,disabled:s,icon:i?"eyeClosed":"eye",name:i?h.w:h.t,onClick:f},{className:F,disabled:s,icon:"logstashFilter",name:h.k,onClick:d},b===o.l.template?{className:"convert-to-field-data-provider",disabled:s||u===y.c,icon:"visText",name:E===y.a.template?h.c:h.d,onClick:v}:{name:null},{className:D,disabled:s,icon:"trash",name:h.e,onClick:n}].filter((e=>null!=e.name))},{content:null!=t&&null!=p&&null!=c?r.a.createElement(I.a,{andProviderId:e,browserFields:t,field:a,isExcluded:l,onDataProviderEdited:c,operator:u,providerId:m,timelineId:p,value:O,type:E}):null,id:1,title:h.h,width:400}])({andProviderId:e,browserFields:t,deleteItem:i,field:l,isEnabled:s,isExcluded:u,isLoading:d,onDataProviderEdited:this.onDataProviderEdited,onFilterForFieldPresent:this.onFilterForFieldPresent,operator:p,providerId:b,timelineId:f,timelineType:g,toggleEnabled:v,toggleExcluded:E,toggleType:O,value:S,type:x});return r.a.createElement(R,{id:`popoverFor_${b}-${l}-${S}`,isOpen:m,closePopover:a,button:n,anchorPosition:"downCenter",panelPaddingSize:"none",ownFocus:!0},r.a.createElement("div",{style:{userSelect:"none"}},r.a.createElement(c.EuiContextMenu,{initialPanelId:0,panels:j,"data-test-subj":"providerActions"})))}}var P=n(227),L=n(133);const B=r.a.memo((({andProviderId:e,browserFields:t,deleteProvider:n,field:c,kqlQuery:d,isEnabled:m,isExcluded:p,isPopoverOpen:b,onDataProviderEdited:f,operator:g,providerId:h,register:v,setIsPopoverOpen:E,timelineId:O,toggleEnabledProvider:S,toggleExcludedProvider:x,toggleTypeProvider:j,displayValue:k,val:C,type:w=y.a.default,wrapperRef:I})=>{const M=Object(i.useMemo)((()=>u.b.getTimelineByIdSelector()),[]),A=Object(s.b)((e=>{var t,n;return O&&null!==(t=null===(n=M(e,O))||void 0===n?void 0:n.timelineType)&&void 0!==t?t:o.l.default})),{isLoading:N}=Object(s.a)((e=>{var t;return null!==(t=M(e,null!=O?O:""))&&void 0!==t?t:L.b})),F=Object(i.useCallback)((()=>{E(!b)}),[b,E]),D=Object(i.useCallback)((()=>{var e;E(!1),null==I||null===(e=I.current)||void 0===e||e.focus()}),[I,E]),R=Object(i.useCallback)((()=>{S(),D()}),[D,S]),B=Object(i.useCallback)((()=>{x(),D()}),[x,D]),_=Object(i.useCallback)((()=>{j(),D()}),[j,D]),[z,q]=Object(i.useState)(!1),$=Object(l.useDispatch)();Object(i.useEffect)((()=>{null!=v&&($(P.a.registerProvider({provider:{...v,and:[]}})),q(!0))}),[z,$,v,q]);const V=Object(i.useCallback)((()=>{z&&null!=v&&$(P.a.unRegisterProvider({id:v.id}))}),[z,$,v]);Object(i.useEffect)((()=>()=>{V()}),[V]);const H=Object(i.useMemo)((()=>r.a.createElement(T,{deleteProvider:N?a.noop:n,field:c,kqlQuery:d,isEnabled:m,isExcluded:p,providerId:h,togglePopover:F,toggleType:_,displayValue:null!=k?k:String(C),val:C,operator:g,type:w,timelineType:A})),[n,k,c,m,p,N,d,_,g,h,A,F,w,C]);return r.a.createElement(provider_item_actions_ProviderItemActions,{andProviderId:e,browserFields:t,button:H,closePopover:D,deleteProvider:n,field:c,kqlQuery:d,isEnabled:m,isExcluded:p,isLoading:N,isOpen:b,onDataProviderEdited:f,operator:g,providerId:h,timelineId:O,timelineType:A,toggleEnabledProvider:R,toggleExcludedProvider:B,toggleTypeProvider:_,value:C,type:w})}));B.displayName="ProviderItemBadge"},958:function(e,t,n){"use strict";n.d(t,"a",(function(){return D}));var a=n(2),i=n.n(a),r=n(103),l=n(51),o=n(115),s=n(114),u=n(134),c=n(102),d=n(161),m=n(122),p=n(133),b=n(111),f=n(272),g=n(40),y=n(41),h=n.n(y),v=n(916),E=n(949),O=n(116),S=n(641);const x=h.a.div.withConfig({displayName:"TopNContainer",componentId:"sc-149y4ld-0"})(["min-width:600px;"]),j=h()(g.EuiButtonIcon).withConfig({displayName:"CloseButton",componentId:"sc-149y4ld-1"})(["position:absolute;right:4px;top:4px;"]),k=h()(g.EuiSuperSelect).withConfig({displayName:"ViewSelect",componentId:"sc-149y4ld-2"})(["width:170px;"]),T=h.a.div.withConfig({displayName:"TopNContent",componentId:"sc-149y4ld-3"})(["margin-top:4px;margin-right:",";.euiPanel{border:none;}"],(({theme:e})=>e.eui.euiSizeXS)),C=({combinedQueries:e,defaultView:t,deleteQuery:n,filters:r,field:l,from:o,indexPattern:s,options:u,paddingSize:c,query:d,showLegend:m,setAbsoluteRangeDatePickerTarget:p,setQuery:b,scopeId:g,to:y,toggleTopN:h})=>{const[C,w]=Object(a.useState)(t),I=Object(a.useCallback)((e=>w(e)),[w]),M=Object(f.b)({scopeId:g,view:C}),{selectedPatterns:A,runtimeMappings:N}=Object(O.d)(M);Object(a.useEffect)((()=>{w(t)}),[t]);const F=Object(a.useMemo)((()=>i.a.createElement(k,{"data-test-subj":"view-select",disabled:1===u.length,onChange:I,options:u,valueOfSelected:C})),[I,u,C]),D=Object(a.useMemo)((()=>Object(f.d)({filters:r,tableId:g,view:C})),[r,g,C]);return i.a.createElement(x,{"data-test-subj":"topN-container"},i.a.createElement(T,null,"raw"===C||"all"===C?i.a.createElement(v.a,{combinedQueries:e,deleteQuery:n,filters:D,from:o,headerChildren:F,indexPattern:s,indexNames:A,runtimeMappings:N,onlyField:l,paddingSize:c,query:d,queryType:"topN",showLegend:m,setAbsoluteRangeDatePickerTarget:p,setQuery:b,showSpacer:!1,toggleTopN:h,scopeId:g,sourcererScopeId:M,to:y,hideQueryToggle:!0}):i.a.createElement(E.a,{combinedQueries:e,filters:D,headerChildren:F,onlyField:l,paddingSize:c,query:d,showLegend:m,setAbsoluteRangeDatePickerTarget:p,runtimeMappings:N,hideQueryToggle:!0})),i.a.createElement(j,{"aria-label":S.c,"data-test-subj":"close",iconType:"cross",onClick:h}))};C.displayName="TopNComponent";const w=i.a.memo(C);var I=n(118);const M=[],A={query:"",language:"kuery"},N=Object(r.connect)((()=>{const e=m.d.globalQuerySelector(),t=m.d.globalFiltersQuerySelector(),n=b.b.getTimelineByIdSelector(),a=m.d.getTimelineSelector(),i=b.b.getKqlFilterQuerySelector();return(r,l)=>{var o,s;const u=null!==(o=n(r,I.c.active))&&void 0!==o?o:p.b,c=null!==(s=u.filters)&&void 0!==s?s:M,d=a(r),{globalFilters:m}=l;return{activeTimelineEventType:u.eventType,activeTimelineFilters:u.activeTab===I.d.query?c:M,activeTimelineFrom:d.timerange.from,activeTimelineKqlQueryExpression:u.activeTab===I.d.query?i(r,I.c.active):null,activeTimelineTo:d.timerange.to,dataProviders:u.activeTab===I.d.query?u.dataProviders:[],globalQuery:e(r),globalFilters:null!=m?m:t(r),kqlMode:u.kqlMode}}})),F=({activeTimelineEventType:e,activeTimelineFilters:t,activeTimelineFrom:n,activeTimelineKqlQueryExpression:r,activeTimelineTo:m,browserFields:p,dataProviders:b,field:g,indexPattern:y,globalFilters:h=M,globalQuery:v=A,kqlMode:E,onFilterAdded:O,paddingSize:S,showLegend:x,scopeId:j,toggleTopN:k})=>{const{uiSettings:T}=Object(c.j)().services,{from:C,deleteQuery:I,setQuery:N,to:F}=Object(u.a)(),D=Object(f.a)(Object(o.isActiveTimeline)(null!=j?j:"")?e:void 0),R=Object(a.useMemo)((()=>{var e;return Object(o.isActiveTimeline)(null!=j?j:"")?null===(e=Object(d.d)({browserFields:p,config:Object(l.getEsQueryConfig)(T),dataProviders:b,filters:t,indexPattern:y,kqlMode:E,kqlQuery:{language:"kuery",query:null!=r?r:""}}))||void 0===e?void 0:e.filterQuery:void 0}),[j,p,T,b,t,y,E,r]),P=Object(a.useMemo)((()=>Object(f.c)(j)?"alert":D[0].value),[D,j]);return i.a.createElement(w,{combinedQueries:R,"data-test-subj":"top-n",defaultView:P,deleteQuery:Object(o.isActiveTimeline)(null!=j?j:"")?void 0:I,field:g,filters:Object(o.isActiveTimeline)(null!=j?j:"")?M:h,from:Object(o.isActiveTimeline)(null!=j?j:"")?n:C,indexPattern:y,options:D,paddingSize:S,query:Object(o.isActiveTimeline)(null!=j?j:"")?A:v,showLegend:x,setAbsoluteRangeDatePickerTarget:Object(o.isActiveTimeline)(null!=j?j:"")?s.a.timeline:s.a.global,setQuery:N,scopeId:j,to:Object(o.isActiveTimeline)(null!=j?j:"")?m:F,toggleTopN:k,onFilterAdded:O})};F.displayName="StatefulTopNComponent";const D=N(i.a.memo(F))},959:function(e,t,n){"use strict";n.d(t,"a",(function(){return O}));var a=n(130),i=n.n(a),r=n(42),l=n(2),o=n(3),s=n(51),u=n(216),c=n(102),d=n(338),m=n(115),p=n(5);const b=p.i18n.translate("xpack.securitySolution.matrixHistogram.errorSearchDescription",{defaultMessage:"An error has occurred on matrix histogram search"}),f=p.i18n.translate("xpack.securitySolution.matrixHistogram.failSearchDescription",{defaultMessage:"Failed to run search on matrix histogram"});var g=n(108),y=n(303),h=n(4);const v=[],E=({endDate:e,errorMessage:t,filterQuery:n,histogramType:a,indexNames:p,isPtrIncluded:E,onError:O,stackByField:S,runtimeMappings:x,startDate:j,threshold:k,skip:T=!1,includeMissingData:C=!0})=>{const{data:w}=Object(c.j)().services,I=Object(l.useRef)(r.noop),M=Object(l.useRef)(new AbortController),A=Object(l.useRef)(new o.Subscription),[N,F]=Object(l.useState)(!1),{startTracking:D}=Object(y.a)(),[R,P]=Object(l.useState)({defaultIndex:p,factoryQueryType:d.i,filterQuery:Object(u.a)(n),histogramType:a,timerange:{interval:"12h",from:j,to:e},stackByField:S,runtimeMappings:x,threshold:k,...null!=E?{isPtrIncluded:E}:{},...null!=C?{includeMissingData:C}:{}}),{addError:L,addWarning:B}=Object(g.a)(),[_,z]=Object(l.useState)({data:[],inspect:{dsl:[],response:[]},refetch:I.current,totalCount:-1,buckets:[]}),q=Object(l.useCallback)((e=>{const n=async()=>{M.current=new AbortController,F(!0);const{endTracking:n}=D({name:`${h.l} matrixHistogram ${a}`});A.current=w.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:M.current.signal}).subscribe({next:e=>{if(Object(s.isCompleteResponse)(e)){const t=Object(r.getOr)(v,d.k[a],e.rawResponse);F(!1),z((n=>({...n,data:e.matrixHistogramData,inspect:Object(m.getInspectResponse)(e,n.inspect),refetch:I.current,totalCount:t.reduce(((e,t)=>t.doc_count+e),0),buckets:t}))),n("success"),A.current.unsubscribe()}else Object(s.isErrorResponse)(e)&&(F(!1),B(b),n("invalid"),A.current.unsubscribe())},error:e=>{F(!1),L(e,{title:null!=t?t:f}),n("error"),A.current.unsubscribe()}})};A.current.unsubscribe(),M.current.abort(),n(),I.current=n}),[w.search,a,B,L,t,D]);return Object(l.useEffect)((()=>{P((t=>{const r={...t,defaultIndex:p,filterQuery:Object(u.a)(n),histogramType:a,timerange:{interval:"12h",from:j,to:e},stackByField:S,threshold:k,...null!=E?{isPtrIncluded:E}:{}};return i()(t,r)?t:r}))}),[p,e,n,j,S,a,k,E]),Object(l.useEffect)((()=>(T||q(R),()=>{A.current.unsubscribe(),M.current.abort()})),[R,q,T]),Object(l.useEffect)((()=>{T&&(F(!1),A.current.unsubscribe(),M.current.abort())}),[T]),[N,_,Object(l.useCallback)(((e,t)=>{q({...R,timerange:{interval:"12h",from:t,to:e}})}),[R,q])]},O=e=>{const[t,n]=E({...e,includeMissingData:!0}),a=Object(l.useMemo)((()=>!e.stackByField.endsWith(".ip")),[e.stackByField]),[i,r]=E({...e,includeMissingData:!1,skip:a||void 0===e.filterQuery||e.skip}),o=Object(l.useMemo)((()=>t||i),[t,i]),s=Object(l.useMemo)((()=>{if(a)return n;const{data:e,inspect:t,totalCount:i,refetch:l,buckets:s}=n,{data:u,inspect:c,totalCount:d,refetch:m}=r,p=()=>{l(),m()};return o?{data:[],inspect:{dsl:[],response:[]},refetch:p,totalCount:-1,buckets:[]}:{data:[...e,...u],inspect:{dsl:[...t.dsl,...c.dsl],response:[...t.response,...c.response]},totalCount:i+d,refetch:p,buckets:s}}),[o,n,r,a]);return[o,s]}},972:function(e,t,n){var a=n(549)("set",n(1027));a.placeholder=n(550),e.exports=a},973:function(e,t,n){e.exports=n(33)(3822)},974:function(e,t,n){e.exports={ary:n(975),assign:n(998),clone:n(999),curry:n(1e3),forEach:n(625),isArray:n(258),isError:n(1001),isFunction:n(629),isWeakMap:n(1004),iteratee:n(1005),keys:n(717),rearg:n(1020),toInteger:n(627),toPath:n(1022)}},975:function(e,t,n){var a=n(435);e.exports=function(e,t,n){return t=n?void 0:t,t=e&&null==t?e.length:t,a(e,128,void 0,void 0,void 0,void 0,t)}},976:function(e,t,n){e.exports=n(33)(3349)},977:function(e,t,n){var a=n(341),i=n(342);e.exports=function(e,t,n){var r=1&t,l=a(e);return function t(){return(this&&this!==i&&this instanceof t?l:e).apply(r?n:this,arguments)}}},978:function(e,t,n){var a=n(616),i=n(341),r=n(617),l=n(620),o=n(626),s=n(443),u=n(342);e.exports=function(e,t,n){var c=i(e);return function i(){for(var d=arguments.length,m=Array(d),p=d,b=o(i);p--;)m[p]=arguments[p];var f=d<3&&m[0]!==b&&m[d-1]!==b?[]:s(m,b);return(d-=f.length)<n?l(e,t,r,i.placeholder,void 0,m,f,void 0,void 0,n-d):a(this&&this!==u&&this instanceof i?c:e,this,m)}}},979:function(e,t){e.exports=function(e,t){for(var n=e.length,a=0;n--;)e[n]===t&&++a;return a}},980:function(e,t,n){var a=n(438),i=n(621),r=n(981),l=n(983);e.exports=function(e){var t=r(e),n=l[t];if("function"!=typeof n||!(t in a.prototype))return!1;if(e===n)return!0;var o=i(n);return!!o&&e===o[0]}},981:function(e,t,n){var a=n(982),i=Object.prototype.hasOwnProperty;e.exports=function(e){for(var t=e.name+"",n=a[t],r=i.call(a,t)?n.length:0;r--;){var l=n[r],o=l.func;if(null==o||o==e)return l.name}return t}},982:function(e,t){e.exports={}},983:function(e,t,n){var a=n(438),i=n(622),r=n(439),l=n(258),o=n(440),s=n(984),u=Object.prototype.hasOwnProperty;function c(e){if(o(e)&&!l(e)&&!(e instanceof a)){if(e instanceof i)return e;if(u.call(e,"__wrapped__"))return s(e)}return new i(e)}c.prototype=r.prototype,c.prototype.constructor=c,e.exports=c},984:function(e,t,n){var a=n(438),i=n(622),r=n(441);e.exports=function(e){if(e instanceof a)return e.clone();var t=new i(e.__wrapped__,e.__chain__);return t.__actions__=r(e.__actions__),t.__index__=e.__index__,t.__values__=e.__values__,t}},985:function(e,t,n){e.exports=n(33)(3677)},986:function(e,t){var n=/\{\n\/\* \[wrapped with (.+)\] \*/,a=/,? & /;e.exports=function(e){var t=e.match(n);return t?t[1].split(a):[]}},987:function(e,t){var n=/\{(?:\n\/\* \[wrapped with .+\] \*\/)?\n?/;e.exports=function(e,t){var a=t.length;if(!a)return e;var i=a-1;return t[i]=(a>1?"& ":"")+t[i],t=t.join(a>2?", ":" "),e.replace(n,"{\n/* [wrapped with "+t+"] */\n")}},988:function(e,t,n){e.exports=n(33)(3674)},989:function(e,t,n){var a=n(625),i=n(990),r=[["ary",128],["bind",1],["bindKey",2],["curry",8],["curryRight",16],["flip",512],["partial",32],["partialRight",64],["rearg",256]];e.exports=function(e,t){return a(r,(function(n){var a="_."+n[0];t&n[1]&&!i(e,a)&&e.push(a)})),e.sort()}},990:function(e,t,n){var a=n(991);e.exports=function(e,t){return!(null==e||!e.length)&&a(e,t,0)>-1}},991:function(e,t,n){var a=n(992),i=n(993),r=n(994);e.exports=function(e,t,n){return t==t?r(e,t,n):a(e,i,n)}},992:function(e,t){e.exports=function(e,t,n,a){for(var i=e.length,r=n+(a?1:-1);a?r--:++r<i;)if(t(e[r],r,e))return r;return-1}},993:function(e,t){e.exports=function(e){return e!=e}},994:function(e,t){e.exports=function(e,t,n){for(var a=n-1,i=e.length;++a<i;)if(e[a]===t)return a;return-1}},995:function(e,t,n){var a=n(441),i=n(442),r=Math.min;e.exports=function(e,t){for(var n=e.length,l=r(t.length,n),o=a(e);l--;){var s=t[l];e[l]=i(s,n)?o[s]:void 0}return e}},996:function(e,t,n){var a=n(616),i=n(341),r=n(342);e.exports=function(e,t,n,l){var o=1&t,s=i(e);return function t(){for(var i=-1,u=arguments.length,c=-1,d=l.length,m=Array(d+u),p=this&&this!==r&&this instanceof t?s:e;++c<d;)m[c]=l[c];for(;u--;)m[c++]=arguments[++i];return a(p,o?n:this,m)}}},997:function(e,t,n){var a=n(618),i=n(619),r=n(443),l="__lodash_placeholder__",o=128,s=Math.min;e.exports=function(e,t){var n=e[1],u=t[1],c=n|u,d=c<131,m=u==o&&8==n||u==o&&256==n&&e[7].length<=t[8]||384==u&&t[7].length<=t[8]&&8==n;if(!d&&!m)return e;1&u&&(e[2]=t[2],c|=1&n?0:4);var p=t[3];if(p){var b=e[3];e[3]=b?a(b,p,t[4]):p,e[4]=b?r(e[3],l):t[4]}return(p=t[5])&&(b=e[5],e[5]=b?i(b,p,t[6]):p,e[6]=b?r(e[5],l):t[6]),(p=t[7])&&(e[7]=p),u&o&&(e[8]=null==e[8]?t[8]:s(e[8],t[8])),null==e[9]&&(e[9]=t[9]),e[0]=t[0],e[1]=c,e}},998:function(e,t,n){e.exports=n(33)(3642)},999:function(e,t,n){var a=n(628);e.exports=function(e){return a(e,4)}}}]);