/*! Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements.
 * Licensed under the Elastic License 2.0; you may not use this file except in compliance with the Elastic License 2.0. */
(window.securitySolution_bundle_jsonpfunction=window.securitySolution_bundle_jsonpfunction||[]).push([[22],{1e3:function(e,t,n){var a=n(435),i=8;function l(e,t,n){var r=a(e,i,void 0,void 0,void 0,void 0,void 0,t=n?void 0:t);return r.placeholder=l.placeholder,r}l.placeholder={},e.exports=l},1001:function(e,t,n){var a=n(1002),i=n(440),l=n(1003);e.exports=function(e){if(!i(e))return!1;var t=a(e);return"[object Error]"==t||"[object DOMException]"==t||"string"==typeof e.message&&"string"==typeof e.name&&!l(e)}},1002:function(e,t,n){e.exports=n(33)(355)},1003:function(e,t,n){e.exports=n(33)(3667)},1004:function(e,t,n){var a=n(715),i=n(440);e.exports=function(e){return i(e)&&"[object WeakMap]"==a(e)}},1005:function(e,t,n){var a=n(628),i=n(904);e.exports=function(e){return i("function"==typeof e?e:a(e,1))}},1006:function(e,t,n){var a=n(1007),i=n(1009),l=n(632);e.exports=function(e){var t=i(e);return 1==t.length&&t[0][2]?l(t[0][0],t[0][1]):function(n){return n===e||a(n,e,t)}}},1007:function(e,t,n){var a=n(1008),i=n(630);e.exports=function(e,t,n,l){var r=n.length,s=r,o=!l;if(null==e)return!s;for(e=Object(e);r--;){var u=n[r];if(o&&u[2]?u[1]!==e[u[0]]:!(u[0]in e))return!1}for(;++r<s;){var c=(u=n[r])[0],d=e[c],m=u[1];if(o&&u[2]){if(void 0===d&&!(c in e))return!1}else{var p=new a;if(l)var b=l(d,m,c,e,t,p);if(!(void 0===b?i(m,d,3,l,p):b))return!1}}return!0}},1008:function(e,t,n){e.exports=n(33)(1599)},1009:function(e,t,n){var a=n(631),i=n(905);e.exports=function(e){for(var t=i(e),n=t.length;n--;){var l=t[n],r=e[l];t[n]=[l,r,a(r)]}return t}},1010:function(e,t,n){var a=n(630),i=n(1011),l=n(1012),r=n(634),s=n(631),o=n(632),u=n(288);e.exports=function(e,t){return r(e)&&s(t)?o(u(e),t):function(n){var r=i(n,e);return void 0===r&&r===t?l(n,e):a(t,r,3)}}},1011:function(e,t,n){e.exports=n(33)(1936)},1012:function(e,t,n){var a=n(1013),i=n(1014);e.exports=function(e,t){return null!=e&&i(e,t,a)}},1013:function(e,t){e.exports=function(e,t){return null!=e&&t in Object(e)}},1014:function(e,t,n){var a=n(633),i=n(716),l=n(258),r=n(442),s=n(1015),o=n(288);e.exports=function(e,t,n){for(var u=-1,c=(t=a(t,e)).length,d=!1;++u<c;){var m=o(t[u]);if(!(d=null!=e&&n(e,m)))break;e=e[m]}return d||++u!=c?d:!!(c=null==e?0:e.length)&&s(c)&&r(m,c)&&(l(e)||i(e))}},1015:function(e,t,n){e.exports=n(33)(1611)},1016:function(e,t,n){var a=n(1017),i=n(1018),l=n(634),r=n(288);e.exports=function(e){return l(e)?a(r(e)):i(e)}},1017:function(e,t){e.exports=function(e){return function(t){return null==t?void 0:t[e]}}},1018:function(e,t,n){var a=n(1019);e.exports=function(e){return function(t){return a(t,e)}}},1019:function(e,t,n){e.exports=n(33)(1652)},1020:function(e,t,n){var a=n(435),i=n(1021)((function(e,t){return a(e,256,void 0,void 0,void 0,t)}));e.exports=i},1021:function(e,t,n){e.exports=n(33)(3668)},1022:function(e,t,n){var a=n(1023),i=n(441),l=n(258),r=n(1024),s=n(1025),o=n(288),u=n(1026);e.exports=function(e){return l(e)?a(e,o):r(e)?[e]:i(s(u(e)))}},1023:function(e,t,n){e.exports=n(33)(1653)},1024:function(e,t,n){e.exports=n(33)(820)},1025:function(e,t,n){e.exports=n(33)(3636)},1026:function(e,t,n){e.exports=n(33)(3638)},1027:function(e,t,n){e.exports=n(1028)},1028:function(e,t,n){var a=n(635);e.exports=function(e,t,n){return null==e?e:a(e,t,n)}},1029:function(e,t,n){e.exports=n(33)(1655)},1030:function(e,t,n){var a=n(549)("setWith",n(1031));a.placeholder=n(550),e.exports=a},1031:function(e,t,n){e.exports=n(1032)},1032:function(e,t,n){var a=n(635);e.exports=function(e,t,n,i){return i="function"==typeof i?i:void 0,null==e?e:a(e,t,n,i)}},1037:function(e,t){e.exports="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxzdmcgd2lkdGg9IjI1NnB4IiBoZWlnaHQ9IjI1NXB4IiB2aWV3Qm94PSIwIDAgMjU2IDI1NSIgdmVyc2lvbj0iMS4xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiBwcmVzZXJ2ZUFzcGVjdFJhdGlvPSJ4TWlkWU1pZCI+Cgk8Zz4KCQk8cGF0aCBkPSJNMjU1LjIxNDYxNywwLjI1NzU4MDI0NyBMMjU1LjIxNDYxNyw2My45OTM2NzkgTDE5MS42MDk2NzksMTI3LjU5ODYxNyBMMTkxLjYwOTY3OSw2My43Mjk3Nzc4IEwyNTUuMjE0NjE3LDAuMjU3NTgwMjQ3IiBmaWxsPSIjQTU5NkZGIj48L3BhdGg+CgkJPHBhdGggZD0iTTEyOC4wMDYzMjEsMC4yNTc1ODAyNDcgTDEyOC4wMDYzMjEsNjMuOTkzNjc5IEwxOTEuNjExMjU5LDEyNy41OTg2MTcgTDE5MS42MTEyNTksNjMuNzI5Nzc3OCBMMTI4LjAwNjMyMSwwLjI1NzU4MDI0NyIgZmlsbD0iIzAwMDAwMCI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0yNTUuMzQ1Nzc4LDI1NC44MDM3NTMgTDE5MS42MDk2NzksMjU0LjgwMzc1MyBMMTI4LjAwNDc0MSwxOTEuMTk4ODE1IEwxOTEuODcyLDE5MS4xOTg4MTUgTDI1NS4zNDU3NzgsMjU0LjgwMzc1MyIgZmlsbD0iI0E1OTZGRiI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0yNTUuMzQ1Nzc4LDEyNy41OTU0NTcgTDE5MS42MDk2NzksMTI3LjU5NTQ1NyBMMTI4LjAwNDc0MSwxOTEuMjAwMzk1IEwxOTEuODcyLDE5MS4yMDAzOTUgTDI1NS4zNDU3NzgsMTI3LjU5NTQ1NyIgZmlsbD0iIzAwMDAwMCI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0wLjgwMTE4NTE4NSwyNTQuOTM2NDk0IEwwLjgwMTE4NTE4NSwxOTEuMTk4ODE1IEw2NC40MDYxMjM1LDEyNy41OTM4NzcgTDY0LjQwNjEyMzUsMTkxLjQ2MjcxNiBMMC44MDExODUxODUsMjU0LjkzNjQ5NCIgZmlsbD0iI0E1OTZGRiI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0xMjguMDA5NDgxLDI1NC45MzY0OTQgTDEyOC4wMDk0ODEsMTkxLjE5ODgxNSBMNjQuNDA0NTQzMiwxMjcuNTkzODc3IEw2NC40MDQ1NDMyLDE5MS40NjI3MTYgTDEyOC4wMDk0ODEsMjU0LjkzNjQ5NCIgZmlsbD0iIzAwMDAwMCI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0wLjY3MTYwNDkzOCwwLjM4NTU4MDI0NyBMNjQuNDA3NzAzNywwLjM4NTU4MDI0NyBMMTI4LjAxMjY0Miw2My45OTA1MTg1IEw2NC4xNDUzODI3LDYzLjk5MDUxODUgTDAuNjcxNjA0OTM4LDAuMzg1NTgwMjQ3IiBmaWxsPSIjQTU5NkZGIj48L3BhdGg+CgkJPHBhdGggZD0iTTAuNjcxNjA0OTM4LDEyNy41OTM4NzcgTDY0LjQwNzcwMzcsMTI3LjU5Mzg3NyBMMTI4LjAxMjY0Miw2My45ODg5MzgzIEw2NC4xNDUzODI3LDYzLjk4ODkzODMgTDAuNjcxNjA0OTM4LDEyNy41OTM4NzciIGZpbGw9IiMwMDAwMDAiPjwvcGF0aD4KCTwvZz4KPC9zdmc+Cg=="},1038:function(e,t,n){"use strict";var a=n(796),i=n(2);function l(e,t,n){return e[t]?e[t][0]?e[t][0][n]:e[t][n]:"contentBoxSize"===t?e.contentRect["inlineSize"===n?"width":"height"]:void 0}e.exports=function(e){void 0===e&&(e={});var t=e.onResize,n=i.useRef(void 0);n.current=t;var r=e.round||Math.round,s=i.useRef(),o=i.useState({width:void 0,height:void 0}),u=o[0],c=o[1],d=i.useRef(!1);i.useEffect((function(){return d.current=!1,function(){d.current=!0}}),[]);var m=i.useRef({width:void 0,height:void 0}),p=function(e,t){var n=i.useRef(null),a=i.useRef(null);a.current=t;var l=i.useRef(null);i.useEffect((function(){r()}));var r=i.useCallback((function(){var t=l.current,i=a.current,r=t||(i?i instanceof Element?i:i.current:null);n.current&&n.current.element===r&&n.current.subscriber===e||(n.current&&n.current.cleanup&&n.current.cleanup(),n.current={element:r,subscriber:e,cleanup:r?e(r):void 0})}),[e]);return i.useEffect((function(){return function(){n.current&&n.current.cleanup&&(n.current.cleanup(),n.current=null)}}),[]),i.useCallback((function(e){l.current=e,r()}),[r])}(i.useCallback((function(t){return s.current&&s.current.box===e.box&&s.current.round===r||(s.current={box:e.box,round:r,instance:new a.ResizeObserver((function(t){var a=t[0],i="border-box"===e.box?"borderBoxSize":"device-pixel-content-box"===e.box?"devicePixelContentBoxSize":"contentBoxSize",s=l(a,i,"inlineSize"),o=l(a,i,"blockSize"),u=s?r(s):void 0,p=o?r(o):void 0;if(m.current.width!==u||m.current.height!==p){var b={width:u,height:p};m.current.width=u,m.current.height=p,n.current?n.current(b):d.current||c(b)}}))}),s.current.instance.observe(t,{box:e.box}),function(){s.current&&s.current.instance.unobserve(t)}}),[e.box,r]),e.ref);return i.useMemo((function(){return{ref:p,width:u.width,height:u.height}}),[p,u.width,u.height])}},116:function(e,t,n){"use strict";n.d(t,"c",(function(){return O})),n.d(t,"d",(function(){return k})),n.d(t,"a",(function(){return T})),n.d(t,"b",(function(){return M}));var a=n(2),i=n(103),l=n(5),r=n(45),s=n(158),o=n(110),u=n(181),c=n(111),d=n(4),m=n(142),p=n(105),b=n(477),g=n(108),f=n(689),y=n(377),v=n(183),h=n(160),E=n(221),S=n(340),x=n(102);const O=(e=o.SourcererScopeName.default)=>{const t=Object(i.useDispatch)(),{data:{dataViews:n}}=Object(x.j)().services,r=Object(a.useRef)(new AbortController),d=Object(a.useRef)(!0),v=Object(a.useRef)(!0),{loading:S,isSignalIndexExists:O,signalIndexName:j}=Object(u.c)(),T=Object(h.d)(E.a.sourcerer),w=Object(a.useMemo)((()=>s.d.getSourcererDataViewsSelector()),[]),{defaultDataView:M,signalIndexName:I}=Object(p.a)((e=>w(e))),{addError:C,addWarning:A}=Object(g.a)();Object(a.useEffect)((()=>{null!=M.error&&A({title:l.i18n.translate("xpack.securitySolution.sourcerer.permissions.title",{defaultMessage:"Write role required to generate data"}),text:l.i18n.translate("xpack.securitySolution.sourcerer.permissions.toastMessage",{defaultMessage:"Users with write permission need to access the Elastic Security app to initialize the app source data."})})}),[A,M.error]);const D=Object(a.useMemo)((()=>c.b.getTimelineByIdSelector()),[]),N=Object(p.a)((e=>D(e,m.f.active))),F=Object(a.useMemo)((()=>s.d.getSourcererScopeSelector()),[]),{sourcererScope:{selectedDataViewId:P,selectedPatterns:R,missingPatterns:L}}=Object(p.a)((t=>F(t,e))),{selectedDataView:B,sourcererScope:{selectedDataViewId:_,selectedPatterns:q,missingPatterns:z}}=Object(p.a)((e=>F(e,o.SourcererScopeName.timeline))),{indexFieldsSearch:V}=Object(y.b)(),$=Object(a.useCallback)((n=>{null!=n?Object.keys(n).forEach((a=>{var i,l,r,u;a===o.SourcererScopeName.default&&e===o.SourcererScopeName.detections||t(s.a.setSelectedDataView({id:a,selectedDataViewId:null!==(i=null===(l=n[a])||void 0===l?void 0:l.id)&&void 0!==i?i:null,selectedPatterns:null!==(r=null===(u=n[a])||void 0===u?void 0:u.selectedPatterns)&&void 0!==r?r:[]}))})):P&&T({[o.SourcererScopeName.default]:{id:P,selectedPatterns:R}})}),[t,P,e,R,T]);Object(h.b)(E.a.sourcerer,$);const Q=Object(a.useRef)([]);Object(a.useEffect)((()=>{[...new Set([P,_])].forEach(((e,t)=>{if(null!=e&&e.length>0&&!Q.current.includes(e)){Q.current=[...Q.current,e];const n=0===t?o.SourcererScopeName.default:o.SourcererScopeName.timeline,a=e===P?0===R.length&&0===L.length:_===e&&0===z.length&&0===(null==B?void 0:B.patternList.length);V({dataViewId:e,scopeId:n,needToBeInit:a,...a&&n===o.SourcererScopeName.timeline?{skipScopeUpdate:q.length>0}:{}})}}))}),[V,L.length,P,R.length,_,z.length,B,q.length]),Object(a.useEffect)((()=>{!S&&null!=j&&null==I&&(null==N||null==N.savedObjectId)&&d.current&&M.id.length>0?(d.current=!1,t(s.a.setSelectedDataView({id:o.SourcererScopeName.timeline,selectedDataViewId:M.id,selectedPatterns:Object(b.b)(M,o.SourcererScopeName.timeline,j,!0)}))):null!=I&&(null==N||null==N.savedObjectId)&&d.current&&M.id.length>0&&(d.current=!1,t(s.a.setSelectedDataView({id:o.SourcererScopeName.timeline,selectedDataViewId:M.id,selectedPatterns:Object(b.b)(M,o.SourcererScopeName.timeline,I,!0)})))}),[N,M,t,S,j,I]);const{dataViewId:U}=k(e),H=Object(a.useCallback)((e=>{-1===M.title.indexOf(e)&&(r.current.abort(),(async a=>{r.current=new AbortController,t(s.a.setSourcererScopeLoading({loading:!0}));try{const i=await Object(f.a)({body:{patternList:a},signal:r.current.signal,dataViewService:n,dataViewId:U});null!=i&&i.defaultDataView.patternList.includes(e)&&(V({dataViewId:i.defaultDataView.id}),t(s.a.setSourcererDataViews(i))),t(s.a.setSourcererScopeLoading({loading:!1}))}catch(e){"AbortError"===e.name||C(e,{title:l.i18n.translate("xpack.securitySolution.sourcerer.error.title",{defaultMessage:"Error updating Security Data View"}),toastMessage:l.i18n.translate("xpack.securitySolution.sourcerer.error.toastMessage",{defaultMessage:"Refresh the page"})}),t(s.a.setSourcererScopeLoading({loading:!1}))}})([...M.title.split(","),e]))}),[M.title,t,n,U,V,C]),G=Object(a.useCallback)((()=>{!S&&null!=j&&null==I&&M.id.length>0&&(H(j),t(s.a.setSignalIndexName({signalIndexName:j})))}),[M.id.length,t,S,j,I,H]);Object(a.useEffect)((()=>{G()}),[j]),Object(a.useEffect)((()=>{e===o.SourcererScopeName.detections&&O&&null!=j&&v.current&&M.id.length>0?(v.current=!1,t(s.a.setSelectedDataView({id:o.SourcererScopeName.detections,selectedDataViewId:M.id,selectedPatterns:Object(b.b)(M,o.SourcererScopeName.detections,j,!0)}))):e===o.SourcererScopeName.detections&&null!=I&&d.current&&M.id.length>0&&(v.current=!1,s.a.setSelectedDataView({id:o.SourcererScopeName.detections,selectedDataViewId:M.id,selectedPatterns:Object(b.b)(M,o.SourcererScopeName.detections,I,!0)}))}),[M,t,O,e,j,I])},k=(e=o.SourcererScopeName.default)=>{const{getDataViewsSelector:t,getSourcererDataViewSelector:n,getScopeSelector:i}=Object(a.useMemo)((()=>({getDataViewsSelector:s.d.getSourcererDataViewsSelector(),getSourcererDataViewSelector:s.d.sourcererDataViewSelector(),getScopeSelector:s.d.scopeIdSelector()})),[]),{defaultDataView:l,signalIndexName:r,selectedDataView:u,sourcererScope:{missingPatterns:c,selectedPatterns:d,loading:m}}=Object(p.a)((a=>{const l=i(a,e);return{...t(a),selectedDataView:n(a,l.selectedDataViewId),sourcererScope:l}})),g=Object(a.useMemo)((()=>Object(S.b)(d)),[d]),[f,h]=Object(a.useState)([]),[E,x]=Object(v.b)(f),O=Object(a.useMemo)((()=>{var e,t,n,a,i,l,r;return{...x,dataView:x.dataView,runtimeMappings:null!==(e=null===(t=x.dataView)||void 0===t?void 0:t.runtimeFieldMap)&&void 0!==e?e:{},title:null!==(n=null===(a=x.dataView)||void 0===a?void 0:a.title)&&void 0!==n?n:"",id:null!==(i=null===(l=x.dataView)||void 0===l?void 0:l.id)&&void 0!==i?i:null,loading:E,patternList:x.indexes,indexFields:x.indexPatterns.fields,fields:null===(r=x.dataView)||void 0===r?void 0:r.fields}}),[x,E]);Object(a.useEffect)((()=>{null==u||c.length>0?h(g):h([])}),[c,u,g]);const k=Object(a.useMemo)((()=>null==u||c.length>0?O:u),[O,c.length,u]),j=Object(a.useMemo)((()=>!(!m&&!k.loading)||Object(b.a)({scopeId:e,signalIndexName:r,patternList:k.patternList,isDefaultDataViewSelected:k.id===l.id})),[l.id,m,e,r,k.id,k.loading,k.patternList]),T=Object(a.useCallback)((()=>{const{browserFields:e}=Object(y.a)(k.patternList.join(","),k.fields);return e}),[k.fields,k.patternList]);return Object(a.useMemo)((()=>({browserFields:T(),dataViewId:k.id,indexPattern:{fields:k.indexFields,title:g.join(","),getName:()=>g.join(",")},indicesExist:j,loading:m||k.loading,runtimeMappings:k.runtimeMappings,patternList:k.title.split(","),selectedPatterns:g,...f.length>0?{activePatterns:k.patternList}:{},sourcererDataView:k.dataView})),[T,k,g,j,m,f.length])},j=[d.d,`${d.mc}/id/:id`,`${d.r}/:detailName`],T=e=>null==Object(r.matchPath)(e,{path:j,strict:!1})?o.SourcererScopeName.default:o.SourcererScopeName.detections,w=[d.d,d.u,`${d.mc}/id/:id`,d.zb,d.Ic,d.Mb,d.Tb],M=e=>null!=Object(r.matchPath)(e,{path:w,strict:!1})},121:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return g})),n.d(t,"c",(function(){return v}));var a=n(40),i=n(2),l=n.n(i),r=n(41),s=n.n(r),o=n(321),u=n(153),c=n(117),d=n(150),m=n(379);const p=({field:e,tooltipContent:t})=>null!=t?t:e,b=l.a.memo((({children:e,field:t,tooltipContent:n,tooltipPosition:i,value:r})=>(e=>null===e)(n)?l.a.createElement(l.a.Fragment,null,e||r):l.a.createElement(a.EuiToolTip,{"data-test-subj":`${t}-tooltip`,position:i,content:p({tooltipContent:n,field:t})},l.a.createElement(l.a.Fragment,null,e||r))));b.displayName="Content";const g=l.a.memo((({hideTopN:e=!1,id:t,isDraggable:n=!0,field:a,fieldType:r="",isAggregatable:s=!1,value:c,name:p,children:g,scopeId:f,tooltipContent:y,tooltipPosition:v,queryValue:h,truncate:E})=>{const S=Object(i.useMemo)((()=>{var e;return{and:[],enabled:!0,id:Object(u.i)(t),name:p||(null!==(e=null==c?void 0:c.toString())&&void 0!==e?e:""),excluded:!1,kqlQuery:"",queryMatch:{field:a,value:h||(null!=c?c:""),operator:d.d}}}),[a,t,p,h,c]),x=Object(i.useCallback)(((e,t,n)=>n.isDragging?l.a.createElement(o.a,null,l.a.createElement(m.a,{dataProvider:e})):l.a.createElement(b,{field:a,tooltipContent:y,tooltipPosition:v,value:c},g)),[g,a,y,v,c]);return null==c?null:l.a.createElement(o.b,{dataProvider:S,fieldType:r,isAggregatable:s,hideTopN:e,isDraggable:n,render:x,scopeId:f,truncate:E})}));g.displayName="DefaultDraggable";const f=s()(a.EuiBadge).withConfig({displayName:"Badge",componentId:"sc-1g0jgxk-0"})(["vertical-align:top;"]);f.displayName="Badge";const y=({contextId:e,eventId:t,field:n,value:a,iconType:i,isDraggable:r,isAggregatable:s,fieldType:o,name:u,color:d="hollow",children:m,scopeId:p,tooltipContent:b,queryValue:y})=>null!=a?l.a.createElement(g,{id:`draggable-badge-default-draggable-${e}-${t}-${n}-${a}`,isDraggable:r,isAggregatable:s,fieldType:o,field:n,name:u,value:a,scopeId:p,tooltipContent:b,queryValue:y},l.a.createElement(f,{iconType:i,color:d,title:""},m||(""!==a?a:Object(c.c)()))):null;y.displayName="DraggableBadgeComponent";const v=l.a.memo(y);v.displayName="DraggableBadge"},125:function(e,t,n){"use strict";var a=n(52);n.d(t,"j",(function(){return a.getUseField})),n.d(t,"i",(function(){return a.getFieldValidityAndErrorMessage})),n.d(t,"a",(function(){return a.FIELD_TYPES})),n.d(t,"c",(function(){return a.Form})),n.d(t,"e",(function(){return a.UseField})),n.d(t,"f",(function(){return a.UseMultiFields})),n.d(t,"k",(function(){return a.useForm})),n.d(t,"l",(function(){return a.useFormContext})),n.d(t,"m",(function(){return a.useFormData})),n.d(t,"g",(function(){return a.VALIDATION_TYPES}));var i=n(67);n.d(t,"b",(function(){return i.Field})),n.d(t,"d",(function(){return i.SelectField}));var l=n(75);n.d(t,"h",(function(){return l.fieldValidators}))},134:function(e,t,n){"use strict";n.d(t,"a",(function(){return c}));var a=n(42),i=n(2),l=n(103),r=n(114),s=n(105),o=n(122),u=n(182);const c=()=>{const e=Object(l.useDispatch)(),{from:t,to:n}=Object(s.a)((e=>Object(a.pick)(["from","to"],o.d.globalTimeRangeSelector(e)))),[c,d]=Object(i.useState)(!0),m=Object(i.useRef)([]),p=Object(i.useCallback)((({id:t,inspect:n,loading:a,refetch:i,searchSessionId:l})=>{m.current=[...m.current,t],e(u.c.setQuery({inputId:r.a.global,id:t,inspect:n,loading:a,refetch:i,searchSessionId:l}))}),[e]),b=Object(i.useCallback)((({id:t})=>e(u.c.deleteOneQuery({inputId:r.a.global,id:t}))),[e]);return Object(i.useEffect)((()=>{d(!1)}),[]),Object(i.useEffect)((()=>()=>{m.current.length>0&&m.current.forEach((e=>b({id:e})))}),[b]),Object(i.useMemo)((()=>({isInitializing:c,from:t,to:n,setQuery:p,deleteQuery:b})),[b,t,c,p,n])}},135:function(e,t,n){"use strict";n.d(t,"H",(function(){return i})),n.d(t,"y",(function(){return l})),n.d(t,"a",(function(){return r})),n.d(t,"U",(function(){return s})),n.d(t,"p",(function(){return o})),n.d(t,"r",(function(){return u})),n.d(t,"q",(function(){return c})),n.d(t,"s",(function(){return d})),n.d(t,"n",(function(){return m})),n.d(t,"o",(function(){return p})),n.d(t,"u",(function(){return b})),n.d(t,"v",(function(){return g})),n.d(t,"t",(function(){return f})),n.d(t,"l",(function(){return y})),n.d(t,"m",(function(){return v})),n.d(t,"h",(function(){return h})),n.d(t,"i",(function(){return E})),n.d(t,"g",(function(){return S})),n.d(t,"e",(function(){return x})),n.d(t,"f",(function(){return O})),n.d(t,"d",(function(){return k})),n.d(t,"A",(function(){return j})),n.d(t,"G",(function(){return T})),n.d(t,"c",(function(){return w})),n.d(t,"z",(function(){return M})),n.d(t,"F",(function(){return I})),n.d(t,"b",(function(){return C})),n.d(t,"E",(function(){return A})),n.d(t,"w",(function(){return D})),n.d(t,"x",(function(){return N})),n.d(t,"J",(function(){return F})),n.d(t,"j",(function(){return P})),n.d(t,"k",(function(){return R})),n.d(t,"D",(function(){return L})),n.d(t,"I",(function(){return B})),n.d(t,"K",(function(){return _})),n.d(t,"L",(function(){return q})),n.d(t,"T",(function(){return z})),n.d(t,"M",(function(){return V})),n.d(t,"N",(function(){return $})),n.d(t,"S",(function(){return Q})),n.d(t,"Q",(function(){return U})),n.d(t,"P",(function(){return H})),n.d(t,"O",(function(){return G})),n.d(t,"R",(function(){return W})),n.d(t,"C",(function(){return K})),n.d(t,"B",(function(){return Y}));var a=n(5);a.i18n.translate("xpack.securitySolution.detectionEngine.pageTitle",{defaultMessage:"Detection engine"}),a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.documentTypeTitle",{defaultMessage:"Alerts"});const i=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.openAlertsTitle",{defaultMessage:"Open"}),l=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.closedAlertsTitle",{defaultMessage:"Closed"}),r=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.acknowledgedAlertsTitle",{defaultMessage:"Acknowledged"}),s=(a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.loadingAlertsTitle",{defaultMessage:"Loading Alerts"}),a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.totalCountOfAlertsTitle",{defaultMessage:"alerts"})),o=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.ruleTitle",{defaultMessage:"Rule"}),u=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.ruleNameTitle",{defaultMessage:"Rule name"}),c=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.ruleDescriptionTitle",{defaultMessage:"Rule description"}),d=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.severityTitle",{defaultMessage:"Severity"}),m=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.reasonTitle",{defaultMessage:"Reason"}),p=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.riskScoreTitle",{defaultMessage:"Risk Score"}),b=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.thresholdCount",{defaultMessage:"Event Count"}),g=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.thresholdTerms",{defaultMessage:"Threshold Terms"}),f=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.thresholdCardinality",{defaultMessage:"Event Cardinality"}),y=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.newTerms",{defaultMessage:"New Terms"}),v=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.newTermsFields",{defaultMessage:"New Terms fields"}),h=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.investigateInTimelineTitle",{defaultMessage:"Investigate in timeline"}),E=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.investigateInTimelineAriaLabel",{defaultMessage:"Send alert to timeline"}),S=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addException",{defaultMessage:"Add rule exception"}),x=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addEventFilter",{defaultMessage:"Add Endpoint event filter"}),O=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addEventFilter.disabled.tooltip",{defaultMessage:"Endpoint event filters can be created from the Events section of the Hosts page."}),k=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addEndpointException",{defaultMessage:"Add Endpoint exception"}),j=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.closedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully closed {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}}."}),T=(a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.alertDurationTitle",{defaultMessage:"Alert duration"}),e=>a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.openedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully opened {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}}."})),w=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.acknowledgedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully marked {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}} as acknowledged."}),M=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.closedAlertFailedToastMessage",{defaultMessage:"Failed to close alert(s)."}),I=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.openedAlertFailedToastMessage",{defaultMessage:"Failed to open alert(s)"}),C=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.acknowledgedAlertFailedToastMessage",{defaultMessage:"Failed to mark alert(s) as acknowledged"}),A=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.moreActionsAriaLabel",{defaultMessage:"More actions"}),D=(a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.statusTitle",{defaultMessage:"Status"}),a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.overview.changeAlertStatus",{defaultMessage:"Change alert status"})),N=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.overview.clickToChangeAlertStatus",{defaultMessage:"Click to change alert status"}),F=a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.overviewTable.signalStatusTitle",{defaultMessage:"Status"}),P=(a.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.triggeredTitle",{defaultMessage:"Triggered"}),a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addToCase",{defaultMessage:"Add to existing case"})),R=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addToNewCase",{defaultMessage:"Add to new case"}),L=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addBulkToTimeline",{defaultMessage:"Investigate in timeline"}),B=a.i18n.translate("xpack.securitySolution.sessionsView.sessionsTitle",{defaultMessage:"Sessions"}),_=(a.i18n.translate("xpack.securitySolution.detectionEngine.groups.additionalActions.takeAction",{defaultMessage:"Take actions"}),a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.alertsCount",{defaultMessage:"Alerts:"})),q=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.hostsCount",{defaultMessage:"Hosts:"}),z=(a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.ipsCount",{defaultMessage:"IP's:"}),a.i18n.translate("xpack.securitySolution.detectionEngine.selectGroup.title",{defaultMessage:"Group alerts by"}),a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.usersCount",{defaultMessage:"Users:"})),V=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.rulesCount",{defaultMessage:"Rules:"}),$=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity",{defaultMessage:"Severity:"}),Q=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.multi",{defaultMessage:"Multi"}),U=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.low",{defaultMessage:"Low"}),H=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.high",{defaultMessage:"High"}),G=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.critical",{defaultMessage:"Critical"}),W=a.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.medium",{defaultMessage:"Medium"}),K=a.i18n.translate("xpack.securitySolution.detectionsEngine.grouping.inspectTitle",{defaultMessage:"Grouping query"}),Y={timestamp:a.i18n.translate("xpack.securitySolution.EventRenderedView.timestampTitle.column",{defaultMessage:"Timestamp"}),rule:a.i18n.translate("xpack.securitySolution.EventRenderedView.ruleTitle.column",{defaultMessage:"Rule"}),eventSummary:a.i18n.translate("xpack.securitySolution.EventRenderedView.eventSummary.column",{defaultMessage:"Event Summary"})}},137:function(e,t,n){"use strict";n.d(t,"cc",(function(){return i})),n.d(t,"Lb",(function(){return l})),n.d(t,"Nb",(function(){return r})),n.d(t,"Zc",(function(){return s})),n.d(t,"d",(function(){return o})),n.d(t,"bc",(function(){return u})),n.d(t,"e",(function(){return c})),n.d(t,"Bb",(function(){return d})),n.d(t,"dc",(function(){return m})),n.d(t,"f",(function(){return p})),n.d(t,"r",(function(){return b})),n.d(t,"p",(function(){return g})),n.d(t,"s",(function(){return f})),n.d(t,"q",(function(){return y})),n.d(t,"m",(function(){return v})),n.d(t,"t",(function(){return h})),n.d(t,"w",(function(){return E})),n.d(t,"g",(function(){return S})),n.d(t,"n",(function(){return x})),n.d(t,"i",(function(){return O})),n.d(t,"o",(function(){return k})),n.d(t,"j",(function(){return j})),n.d(t,"h",(function(){return T})),n.d(t,"v",(function(){return w})),n.d(t,"u",(function(){return M})),n.d(t,"W",(function(){return I})),n.d(t,"U",(function(){return C})),n.d(t,"V",(function(){return A})),n.d(t,"Y",(function(){return D})),n.d(t,"A",(function(){return N})),n.d(t,"l",(function(){return F})),n.d(t,"y",(function(){return P})),n.d(t,"k",(function(){return R})),n.d(t,"z",(function(){return L})),n.d(t,"X",(function(){return B})),n.d(t,"S",(function(){return _})),n.d(t,"K",(function(){return q})),n.d(t,"B",(function(){return z})),n.d(t,"M",(function(){return V})),n.d(t,"C",(function(){return $})),n.d(t,"E",(function(){return Q})),n.d(t,"F",(function(){return U})),n.d(t,"D",(function(){return H})),n.d(t,"L",(function(){return G})),n.d(t,"N",(function(){return W})),n.d(t,"O",(function(){return K})),n.d(t,"G",(function(){return Y})),n.d(t,"P",(function(){return J})),n.d(t,"H",(function(){return X})),n.d(t,"T",(function(){return Z})),n.d(t,"J",(function(){return ee})),n.d(t,"I",(function(){return te})),n.d(t,"Q",(function(){return ne})),n.d(t,"R",(function(){return ae})),n.d(t,"Gb",(function(){return ie})),n.d(t,"Pc",(function(){return le})),n.d(t,"Oc",(function(){return re})),n.d(t,"Uc",(function(){return se})),n.d(t,"Sc",(function(){return oe})),n.d(t,"ab",(function(){return ue})),n.d(t,"Rc",(function(){return ce})),n.d(t,"Cb",(function(){return de})),n.d(t,"Qb",(function(){return me})),n.d(t,"Rb",(function(){return pe})),n.d(t,"Ab",(function(){return be})),n.d(t,"Hb",(function(){return ge})),n.d(t,"xb",(function(){return fe})),n.d(t,"mb",(function(){return ye})),n.d(t,"lb",(function(){return ve})),n.d(t,"nb",(function(){return he})),n.d(t,"gb",(function(){return Ee})),n.d(t,"ib",(function(){return Se})),n.d(t,"hb",(function(){return xe})),n.d(t,"pb",(function(){return Oe})),n.d(t,"bb",(function(){return ke})),n.d(t,"ob",(function(){return je})),n.d(t,"eb",(function(){return Te})),n.d(t,"fb",(function(){return we})),n.d(t,"jb",(function(){return Me})),n.d(t,"kb",(function(){return Ie})),n.d(t,"cb",(function(){return Ce})),n.d(t,"db",(function(){return Ae})),n.d(t,"Eb",(function(){return De})),n.d(t,"zb",(function(){return Ne})),n.d(t,"rb",(function(){return Fe})),n.d(t,"Db",(function(){return Pe})),n.d(t,"Xc",(function(){return Re})),n.d(t,"Qc",(function(){return Le})),n.d(t,"Fc",(function(){return Be})),n.d(t,"Yb",(function(){return _e})),n.d(t,"Hc",(function(){return qe})),n.d(t,"Sb",(function(){return ze})),n.d(t,"Xb",(function(){return Ve})),n.d(t,"Tb",(function(){return $e})),n.d(t,"Ub",(function(){return Qe})),n.d(t,"Vb",(function(){return Ue})),n.d(t,"Wb",(function(){return He})),n.d(t,"sb",(function(){return Ge})),n.d(t,"b",(function(){return We})),n.d(t,"Nc",(function(){return Ke})),n.d(t,"Gc",(function(){return Ye})),n.d(t,"tb",(function(){return Je})),n.d(t,"a",(function(){return Xe})),n.d(t,"Mc",(function(){return Ze})),n.d(t,"c",(function(){return et})),n.d(t,"Zb",(function(){return tt})),n.d(t,"qb",(function(){return nt})),n.d(t,"ub",(function(){return at})),n.d(t,"Mb",(function(){return it})),n.d(t,"Tc",(function(){return lt})),n.d(t,"Ob",(function(){return rt})),n.d(t,"ac",(function(){return st})),n.d(t,"Wc",(function(){return ot})),n.d(t,"Jb",(function(){return ut})),n.d(t,"Kb",(function(){return ct})),n.d(t,"x",(function(){return dt})),n.d(t,"Vc",(function(){return mt})),n.d(t,"wb",(function(){return pt})),n.d(t,"vb",(function(){return bt})),n.d(t,"ec",(function(){return gt})),n.d(t,"Z",(function(){return ft})),n.d(t,"Dc",(function(){return yt})),n.d(t,"Ec",(function(){return vt})),n.d(t,"Cc",(function(){return ht})),n.d(t,"Ac",(function(){return Et})),n.d(t,"Bc",(function(){return St})),n.d(t,"pc",(function(){return xt})),n.d(t,"qc",(function(){return Ot})),n.d(t,"nc",(function(){return kt})),n.d(t,"oc",(function(){return jt})),n.d(t,"hc",(function(){return Tt})),n.d(t,"ic",(function(){return wt})),n.d(t,"fc",(function(){return Mt})),n.d(t,"gc",(function(){return It})),n.d(t,"yc",(function(){return Ct})),n.d(t,"zc",(function(){return At})),n.d(t,"wc",(function(){return Dt})),n.d(t,"xc",(function(){return Nt})),n.d(t,"lc",(function(){return Ft})),n.d(t,"mc",(function(){return Pt})),n.d(t,"jc",(function(){return Rt})),n.d(t,"kc",(function(){return Lt})),n.d(t,"tc",(function(){return Bt})),n.d(t,"vc",(function(){return _t})),n.d(t,"uc",(function(){return qt})),n.d(t,"rc",(function(){return zt})),n.d(t,"sc",(function(){return Vt})),n.d(t,"Lc",(function(){return $t})),n.d(t,"Ic",(function(){return Qt})),n.d(t,"Fb",(function(){return Ut})),n.d(t,"yb",(function(){return Ht})),n.d(t,"Jc",(function(){return Gt})),n.d(t,"Pb",(function(){return Wt})),n.d(t,"Yc",(function(){return Kt})),n.d(t,"Ib",(function(){return Yt})),n.d(t,"Kc",(function(){return Jt}));var a=n(5);const i=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.popoverTooltip.ariaLabel",{defaultMessage:"Tooltip for column: {columnName}",values:{columnName:e}}),l=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.importRuleTitle",{defaultMessage:"Import rules"}),r=a.i18n.translate("xpack.securitySolution.lists.detectionEngine.rules.importValueListsButton",{defaultMessage:"Import value lists"}),s=a.i18n.translate("xpack.securitySolution.lists.detectionEngine.rules.uploadValueListsButtonTooltip",{defaultMessage:"Use value lists to create an exception when a field value matches a value found in a list"}),o=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.addNewRuleTitle",{defaultMessage:"Create new rule"}),u=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.pageTitle",{defaultMessage:"Rules"}),c=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.addPageTitle",{defaultMessage:"Create"}),d=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.editPageTitle",{defaultMessage:"Edit"}),m=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.refreshTitle",{defaultMessage:"Refresh"}),p=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.batchActionsTitle",{defaultMessage:"Bulk actions"}),b=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enableTitle",{defaultMessage:"Enable"}),g=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disableTitle",{defaultMessage:"Disable"}),f=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.exportTitle",{defaultMessage:"Export"}),y=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicateTitle",{defaultMessage:"Duplicate"}),v=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.deleteTitle",{defaultMessage:"Delete"}),h=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.indexPatternsTitle",{defaultMessage:"Index patterns"}),E=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.tagsTitle",{defaultMessage:"Tags"}),S=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addIndexPatternsTitle",{defaultMessage:"Add index patterns"}),x=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.deleteIndexPatternsTitle",{defaultMessage:"Delete index patterns"}),O=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addTagsTitle",{defaultMessage:"Add tags"}),k=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.deleteTagsTitle",{defaultMessage:"Delete tags"}),j=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.applyTimelineTemplateTitle",{defaultMessage:"Apply Timeline template"}),T=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addRuleActionsTitle",{defaultMessage:"Add rule actions"}),w=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.setScheduleTitle",{defaultMessage:"Update rule schedules"}),M=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.contextMenuTitle",{defaultMessage:"Options"}),I=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastTitle",{defaultMessage:"Rules updates are in progress"}),C=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} updating."}),A=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastNotifyButtonLabel",{defaultMessage:"Notify me when done"}),D=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkExportConfirmationDeniedTitle",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule} other {# rules}} cannot be exported"}),N=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditConfirmationDeniedTitle",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule} other {# rules}} cannot be edited"}),F=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkActionConfirmationPartlyTitle",{values:{customRulesCount:e},defaultMessage:"This action can only be applied to {customRulesCount, plural, =1 {# custom rule} other {# custom rules}}"}),P=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmationCancelButtonLabel",{defaultMessage:"Cancel"}),R=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkActionConfirmationCloseButtonLabel",{defaultMessage:"Close"}),L=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmation.confirmButtonLabel",{values:{customRulesCount:e},defaultMessage:"Edit {customRulesCount, plural, =1 {# custom rule} other {# custom rules}}"}),B=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkExportConfirmation.confirmButtonLabel",{values:{customRulesCount:e},defaultMessage:"Export {customRulesCount, plural, =1 {# custom rule} other {# custom rules}}"}),_=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.saveButtonLabel",{defaultMessage:"Save"}),q=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.cancelButtonLabel",{defaultMessage:"Cancel"}),z=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxHelpText",{defaultMessage:"Enter the pattern of Elasticsearch indices that you would like to add. By default, the dropdown includes index patterns defined in Security Solution advanced settings."}),V=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteIndexPatternsComboboxHelpText",{defaultMessage:"Enter the pattern of Elasticsearch indices that you would like to delete. By default, the dropdown includes index patterns defined in Security Solution advanced settings."}),$=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxLabel",{defaultMessage:"Add index patterns for selected rules"}),Q=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.indexPatternsRequiredErrorMessage",{defaultMessage:"A minimum of one index pattern is required."}),U=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsTitle",{defaultMessage:"Add index patterns"}),H=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsOverwriteCheckboxLabel",{defaultMessage:"Overwrite all selected rules' index patterns"}),G=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.dataViewsOverwriteCheckboxLabel",{defaultMessage:"Apply changes to rules configured with data views"}),W=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteIndexPatternsComboboxLabel",{defaultMessage:"Delete index patterns for selected rules"}),K=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteIndexPatternsTitle",{defaultMessage:"Delete index patterns"}),Y=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsComboboxHelpText",{defaultMessage:"Add one or more tags for selected rules from the dropdown. You can also enter custom identifying tags and press Enter to begin a new one."}),J=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteTagsComboboxHelpText",{defaultMessage:"Delete one or more tags for selected rules from the dropdown. You can also enter custom identifying tags and press Enter to begin a new one."}),X=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsComboboxLabel",{defaultMessage:"Add tags for selected rules"}),Z=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.tagsComoboxRequiredErrorMessage",{defaultMessage:"A minimum of one tag is required."}),ee=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsTitle",{defaultMessage:"Add tags"}),te=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsOverwriteCheckboxLabel",{defaultMessage:"Overwrite all selected rules' tags"}),ne=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteTagsComboboxLabel",{defaultMessage:"Delete tags for selected rules"}),ae=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteTagsTitle",{defaultMessage:"Delete tags"}),ie=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.exportFilenameTitle",{defaultMessage:"rules_export"}),le=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.searchAriaLabel",{defaultMessage:"Search rules"}),re=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.searchPlaceholder",{defaultMessage:'Rule name, index pattern (e.g., "filebeat-*"), or MITRE ATT&CK™ tactic or technique (e.g., "Defense Evasion" or "TA0005")'}),se=(e,t,n)=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.showingRulesTitle",{values:{firstInPage:e,lastOfPage:t,totalRules:n},defaultMessage:"Showing {firstInPage}-{lastOfPage} of {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),oe=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.selectAllRulesTitle",{values:{totalRules:e},defaultMessage:"Select all {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),ue=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.clearSelectionTitle",{defaultMessage:"Clear selection"}),ce=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.selectedRulesTitle",{values:{selectedRules:e},defaultMessage:"Selected {selectedRules} {selectedRules, plural, =1 {rule} other {rules}}"}),de=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.editRuleSettingsDescription",{defaultMessage:"Edit rule settings"}),me=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.lackOfKibanaActionsFeaturePrivileges",{defaultMessage:"You do not have Kibana Actions privileges"}),pe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.lackOfKibanaSecurityPrivileges",{defaultMessage:"You do not have Kibana Security privileges"}),be=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.duplicateRuleDescription",{defaultMessage:"Duplicate rule"}),ge=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.exportRuleDescription",{defaultMessage:"Export rule"}),fe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.deleteRuleDescription",{defaultMessage:"Delete rule"}),ye=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.ruleTitle",{defaultMessage:"Rule"}),ve=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.riskScoreTitle",{defaultMessage:"Risk score"}),he=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.severityTitle",{defaultMessage:"Severity"}),Ee=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.lastRunTitle",{defaultMessage:"Last run"}),Se=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.lastUpdateTitle",{defaultMessage:"Last updated"}),xe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.lastResponseTitle",{defaultMessage:"Last response"}),Oe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.tagsTitle",{defaultMessage:"Tags"}),ke=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.enabledTitle",{defaultMessage:"Enabled"}),je=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.snoozeTitle",{defaultMessage:"Notify"}),Te=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.indexingTimes",{defaultMessage:"Indexing Time (ms)"}),we=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.indexingTimesTooltip",{defaultMessage:"Total time spent indexing alerts during last Rule execution"}),Me=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.queryTimes",{defaultMessage:"Query Time (ms)"}),Ie=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.queryTimesTooltip",{defaultMessage:"Total time spent querying source indices during last Rule execution"}),Ce=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.gap",{defaultMessage:"Last Gap (if any)"}),Ae=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.gapTooltipSeeDocsDescription",{defaultMessage:"see documentation"}),De=(a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.tabs.rules",{defaultMessage:"Rules"}),a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.tabs.monitoring",{defaultMessage:"Rule Monitoring"}),a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.enabledRulesTitle",{defaultMessage:"Enabled rules"})),Ne=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.disabledRulesTitle",{defaultMessage:"Disabled rules"}),Fe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.customRulesTitle",{defaultMessage:"Custom rules"}),Pe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.elasticRulesTitle",{defaultMessage:"Elastic rules"}),Re=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.tagsLabel",{defaultMessage:"Tags"}),Le=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.searchTagsPlaceholder",{defaultMessage:"Search tags"}),Be=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.rulesTagSearchText",{defaultMessage:"Rules tag search"}),_e=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.noTagsAvailableDescription",{defaultMessage:"No tags available"}),qe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.ruleExecutionStatusFilter",{defaultMessage:"Select rule execution status to filter by"}),ze=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.noRulesTitle",{defaultMessage:"No rules found"}),Ve=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.noRulesBodyTitle",{defaultMessage:"We weren't able to find any rules with the above filters."}),$e=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.addRules.noRulesTitle",{defaultMessage:"All Elastic rules have been installed"}),Qe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.addRules.noRulesBodyTitle",{defaultMessage:"There are no prebuilt detection rules available for installation"}),Ue=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesTitle",{defaultMessage:"All Elastic rules are up to date"}),He=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesBodyTitle",{defaultMessage:"There are currently no available updates to your installed Elastic rules."}),Ge=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.defineRuleTitle",{defaultMessage:"Define rule"}),We=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.aboutRuleTitle",{defaultMessage:"About rule"}),Ke=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.scheduleRuleTitle",{defaultMessage:"Schedule rule"}),Ye=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.ruleActionsTitle",{defaultMessage:"Rule actions"}),Je=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepDefinitionTitle",{defaultMessage:"Definition"}),Xe=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepAboutTitle",{defaultMessage:"About"}),Ze=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepScheduleTitle",{defaultMessage:"Schedule"}),et=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepActionsTitle",{defaultMessage:"Actions"}),tt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.optionalFieldDescription",{defaultMessage:"Optional"}),nt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.continueButtonTitle",{defaultMessage:"Continue"}),at=(a.i18n.translate("xpack.securitySolution.detectionEngine.rules.updateButtonTitle",{defaultMessage:"Update"}),a.i18n.translate("xpack.securitySolution.detectionEngine.rules.deleteDescription",{defaultMessage:"Delete"})),it=a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importRuleTitle",{defaultMessage:"Import"}),lt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.selectRuleDescription",{defaultMessage:"Select rules to import. Associated rule actions and exceptions can be included."}),rt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.initialPromptTextDescription",{defaultMessage:"Select or drag and drop a valid rules_export.ndjson file"}),st=a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.overwriteDescription",{defaultMessage:'Overwrite existing detection rules with conflicting "rule_id"'}),ot=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.successfullyImportedRulesTitle",{values:{totalRules:e},defaultMessage:"Successfully imported {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),ut=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importFailedTitle",{values:{totalRules:e},defaultMessage:"Failed to import {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),ct=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importFailedDetailedTitle",{values:{message:e},defaultMessage:"{message}"}),dt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkDeleteConfirmationTitle",{defaultMessage:"Confirm bulk deletion"}),mt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.singleDeleteConfirmationTitle",{defaultMessage:"Confirm deletion"}),pt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationConfirm",{defaultMessage:"Delete"}),bt=a.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationCancel",{defaultMessage:"Cancel"}),gt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.refreshRulePopoverDescription",{defaultMessage:"Automatically refresh table"}),ft=(a.i18n.translate("xpack.securitySolution.detectionEngine.rules.refreshRulePopoverLabel",{defaultMessage:"Refresh settings"}),a.i18n.translate("xpack.securitySolution.detectionEngine.rules.clearRulesTableFilters",{defaultMessage:"Clear filters"})),yt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.successToastTitle",{defaultMessage:"Rules exported"}),vt=(e,t)=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.successToastDescription",{values:{totalRules:t,exportedRules:e},defaultMessage:"Successfully exported {exportedRules} of {totalRules} {totalRules, plural, =1 {rule} other {rules}}."}),ht=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.prebuiltRulesExcludedToastDescription",{defaultMessage:"Prebuilt rules were excluded from the resulting file."}),Et=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.errorToastTitle",{defaultMessage:"Error exporting rules"}),St=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to export."}),xt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.successToastTitle",{defaultMessage:"Rules duplicated"}),Ot=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully duplicated {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),kt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.errorToastTitle",{defaultMessage:"Error duplicating rule"}),jt=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to duplicate."}),Tt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.successToastTitle",{defaultMessage:"Rules deleted"}),wt=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully deleted {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),Mt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.errorToastTitle",{defaultMessage:"Error deleting rules"}),It=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to delete."}),Ct=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enable.successToastTitle",{defaultMessage:"Rules enabled"}),At=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkAction.enable.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully enabled {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),Dt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enable.errorToastTitle",{defaultMessage:"Error enabling rules"}),Nt=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enable.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to enable."}),Ft=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.successToastTitle",{defaultMessage:"Rules disabled"}),Pt=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully disabled {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),Rt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.errorToastTitle",{defaultMessage:"Error disabling rules"}),Lt=e=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to disable."}),Bt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.successToastTitle",{defaultMessage:"Rules updated"}),_t=(e,t)=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.successToastDescription",{values:{succeededRulesCount:e,skippedRulesCount:t},defaultMessage:"{succeededRulesCount, plural, =0 {} =1 {You've successfully updated # rule. } other {You've successfully updated # rules. }}\n        {skippedRulesCount, plural, =0 {} =1 { # rule was skipped.} other { # rules were skipped.}}\n        "}),qt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.successIndexEditToastDescription",{defaultMessage:"If you did not select to apply changes to rules using Kibana data views, those rules were not updated and will continue using data views."}),zt=a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.errorToastTitle",{defaultMessage:"Error updating rules"}),Vt=(e,t)=>a.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.errorToastDescription",{values:{failedRulesCount:e,skippedRulesCount:t},defaultMessage:"{failedRulesCount, plural, =0 {} =1 {# rule} other {# rules}} failed to update. {skippedRulesCount, plural, =0 {} =1 { # rule was skipped.} other { # rules were skipped.}}"}),$t=(a.i18n.translate("xpack.securitySolution.detectionEngine.createRule.cancelButtonLabel",{defaultMessage:"Cancel"}),a.i18n.translate("xpack.securitySolution.hooks.useGetSavedQuery.errorToastMessage",{defaultMessage:"Failed to load the saved query"})),Qt=a.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.ruleManagementContextDescription",{defaultMessage:"Selected Detection Rules"}),Ut=a.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.explainThenSummarizeRuleDetails",{defaultMessage:"Please explain the selected rules above. For each rule, highlight why they are relevant, the query as published on Elastic's detection rules repository and an in-depth explanation of it, and what they typically mean for an organization if detected."}),Ht=a.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.detectionRulesConversationId",{defaultMessage:"Detection Rules"}),Gt=a.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.ruleManagementContextTooltip",{defaultMessage:"Add this alert as context"}),Wt=a.i18n.translate("xpack.securitySolution.addRules.installRuleButton",{defaultMessage:"Install rule"}),Kt=a.i18n.translate("xpack.securitySolution.addRules.upgradeRuleButton",{defaultMessage:"Update rule"}),Yt=a.i18n.translate("xpack.securitySolution.addRules.goBackToRulesTableButton",{defaultMessage:"Go back to installed Elastic rules"}),Jt=a.i18n.translate("xpack.securitySolution.ruleUpdates.documentationLink",{defaultMessage:"See what's new in Prebuilt Security Detection Rules"})},1395:function(e,t,n){e.exports=n(33)(190)},140:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"b",(function(){return l})),n.d(t,"c",(function(){return r})),n.d(t,"h",(function(){return s})),n.d(t,"i",(function(){return o})),n.d(t,"k",(function(){return u})),n.d(t,"j",(function(){return c})),n.d(t,"l",(function(){return d})),n.d(t,"m",(function(){return m})),n.d(t,"n",(function(){return p})),n.d(t,"o",(function(){return b})),n.d(t,"q",(function(){return g})),n.d(t,"p",(function(){return f})),n.d(t,"y",(function(){return y})),n.d(t,"A",(function(){return v})),n.d(t,"B",(function(){return h})),n.d(t,"C",(function(){return E})),n.d(t,"D",(function(){return S})),n.d(t,"d",(function(){return x})),n.d(t,"e",(function(){return O})),n.d(t,"f",(function(){return k})),n.d(t,"g",(function(){return j})),n.d(t,"E",(function(){return T})),n.d(t,"F",(function(){return w})),n.d(t,"G",(function(){return M})),n.d(t,"H",(function(){return I})),n.d(t,"J",(function(){return C})),n.d(t,"K",(function(){return A})),n.d(t,"L",(function(){return D})),n.d(t,"M",(function(){return N})),n.d(t,"Y",(function(){return F})),n.d(t,"Z",(function(){return P})),n.d(t,"ab",(function(){return R})),n.d(t,"bb",(function(){return L})),n.d(t,"z",(function(){return B})),n.d(t,"cb",(function(){return _})),n.d(t,"db",(function(){return q})),n.d(t,"N",(function(){return z})),n.d(t,"O",(function(){return V})),n.d(t,"Q",(function(){return $})),n.d(t,"T",(function(){return Q})),n.d(t,"U",(function(){return U})),n.d(t,"R",(function(){return H})),n.d(t,"S",(function(){return G})),n.d(t,"X",(function(){return W})),n.d(t,"W",(function(){return K})),n.d(t,"s",(function(){return Y})),n.d(t,"r",(function(){return J})),n.d(t,"w",(function(){return X})),n.d(t,"P",(function(){return Z})),n.d(t,"x",(function(){return ee})),n.d(t,"I",(function(){return te})),n.d(t,"V",(function(){return ne})),n.d(t,"t",(function(){return ae})),n.d(t,"v",(function(){return ie})),n.d(t,"u",(function(){return le}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.open.timeline.batchActionsTitle",{defaultMessage:"Bulk actions"}),l=a.i18n.translate("xpack.securitySolution.open.timeline.cancelButton",{defaultMessage:"Cancel"}),r=a.i18n.translate("xpack.securitySolution.open.timeline.collapseButton",{defaultMessage:"Collapse"}),s=a.i18n.translate("xpack.securitySolution.open.timeline.deleteButton",{defaultMessage:"Delete"}),o=a.i18n.translate("xpack.securitySolution.open.timeline.deleteSelectedButton",{defaultMessage:"Delete selected"}),u=a.i18n.translate("xpack.securitySolution.open.timeline.deleteWarningLabel",{defaultMessage:"You will not be able to recover this timeline or its notes once deleted."}),c=a.i18n.translate("xpack.securitySolution.open.timeline.deleteTemplateWarningLabel",{defaultMessage:"You will not be able to recover this timeline template or its notes once deleted."}),d=a.i18n.translate("xpack.securitySolution.open.timeline.descriptionTableHeader",{defaultMessage:"Description"}),m=a.i18n.translate("xpack.securitySolution.open.timeline.expandButton",{defaultMessage:"Expand"}),p=a.i18n.translate("xpack.securitySolution.open.timeline.exportFileNameTitle",{defaultMessage:"timelines_export"}),b=a.i18n.translate("xpack.securitySolution.open.timeline.exportSelectedButton",{defaultMessage:"Export selected"}),g=a.i18n.translate("xpack.securitySolution.open.timeline.favoriteSelectedButton",{defaultMessage:"Favorite selected"}),f=a.i18n.translate("xpack.securitySolution.open.timeline.favoritesTooltip",{defaultMessage:"Favorites"}),y=a.i18n.translate("xpack.securitySolution.open.timeline.lastModifiedTableHeader",{defaultMessage:"Last modified"}),v=a.i18n.translate("xpack.securitySolution.open.timeline.missingSavedObjectIdTooltip",{defaultMessage:"Missing savedObjectId"}),h=a.i18n.translate("xpack.securitySolution.open.timeline.modifiedByTableHeader",{defaultMessage:"Modified by"}),E=a.i18n.translate("xpack.securitySolution.open.timeline.notesTooltip",{defaultMessage:"Notes"}),S=a.i18n.translate("xpack.securitySolution.open.timeline.onlyFavoritesButtonLabel",{defaultMessage:"Only favorites"}),x=a.i18n.translate("xpack.securitySolution.open.timeline.createRuleFromTimelineTooltip",{defaultMessage:"Create query rule from timeline"}),O=a.i18n.translate("xpack.securitySolution.open.timeline.createRuleFromTimelineEqlTooltip",{defaultMessage:"Create EQL rule from timeline"}),k=a.i18n.translate("xpack.securitySolution.open.timeline.createTemplateFromTimelineTooltip",{defaultMessage:"Create template from timeline"}),j=a.i18n.translate("xpack.securitySolution.open.timeline.createTimelineFromTemplateTooltip",{defaultMessage:"Create timeline from template"}),T=a.i18n.translate("xpack.securitySolution.open.timeline.openAsDuplicateTooltip",{defaultMessage:"Duplicate timeline"}),w=a.i18n.translate("xpack.securitySolution.open.timeline.openAsDuplicateTemplateTooltip",{defaultMessage:"Duplicate template"}),M=a.i18n.translate("xpack.securitySolution.open.timeline.openTimelineButton",{defaultMessage:"Open Timeline…"}),I=a.i18n.translate("xpack.securitySolution.open.timeline.openTimelineTitle",{defaultMessage:"Open"}),C=a.i18n.translate("xpack.securitySolution.open.timeline.pinnedEventsTooltip",{defaultMessage:"Pinned events"}),A=a.i18n.translate("xpack.securitySolution.open.timeline.refreshTitle",{defaultMessage:"Refresh"}),D=a.i18n.translate("xpack.securitySolution.open.timeline.searchPlaceholder",{defaultMessage:"e.g. timeline name, or description"}),N=a.i18n.translate("xpack.securitySolution.open.timeline.searchTemplatePlaceholder",{defaultMessage:"e.g. template name, or description"}),F=a.i18n.translate("xpack.securitySolution.open.timeline.timelineNameTableHeader",{defaultMessage:"Timeline name"}),P=a.i18n.translate("xpack.securitySolution.open.timeline.timelineTemplateNameTableHeader",{defaultMessage:"Template name"}),R=a.i18n.translate("xpack.securitySolution.open.timeline.untitledTimelineLabel",{defaultMessage:"Untitled timeline"}),L=a.i18n.translate("xpack.securitySolution.open.timeline.withLabel",{defaultMessage:"with"}),B=a.i18n.translate("xpack.securitySolution.open.timeline.loadingLabel",{defaultMessage:"Loading..."}),_=a.i18n.translate("xpack.securitySolution.open.timeline.zeroTimelinesMatchLabel",{defaultMessage:"0 timelines match the search criteria"}),q=a.i18n.translate("xpack.securitySolution.open.timeline.zeroTimelineTemplatesMatchLabel",{defaultMessage:"0 timeline templates match the search criteria"}),z=e=>a.i18n.translate("xpack.securitySolution.open.timeline.selectedTemplatesTitle",{values:{selectedTemplates:e},defaultMessage:"Selected {selectedTemplates} {selectedTemplates, plural, =1 {template} other {templates}}"}),V=e=>a.i18n.translate("xpack.securitySolution.open.timeline.selectedTimelinesTitle",{values:{selectedTimelines:e},defaultMessage:"Selected {selectedTimelines} {selectedTimelines, plural, =1 {timeline} other {timelines}}"}),$=a.i18n.translate("xpack.securitySolution.open.timeline.showingLabel",{defaultMessage:"Showing:"}),Q=e=>a.i18n.translate("xpack.securitySolution.open.timeline.successfullyExportedTimelinesTitle",{values:{totalTimelines:e},defaultMessage:"Successfully exported {totalTimelines, plural, =0 {all timelines} =1 {{totalTimelines} timeline} other {{totalTimelines} timelines}}"}),U=e=>a.i18n.translate("xpack.securitySolution.open.timeline.successfullyExportedTimelineTemplatesTitle",{values:{totalTimelineTemplates:e},defaultMessage:"Successfully exported {totalTimelineTemplates, plural, =0 {all timelines} =1 {{totalTimelineTemplates} timeline template} other {{totalTimelineTemplates} timeline templates}}"}),H=e=>a.i18n.translate("xpack.securitySolution.open.timeline.successfullyDeletedTimelinesTitle",{values:{totalTimelines:e},defaultMessage:"Successfully deleted {totalTimelines, plural, =0 {all timelines} =1 {{totalTimelines} timeline} other {{totalTimelines} timelines}}"}),G=e=>a.i18n.translate("xpack.securitySolution.open.timeline.successfullyDeletedTimelineTemplatesTitle",{values:{totalTimelineTemplates:e},defaultMessage:"Successfully deleted {totalTimelineTemplates, plural, =0 {all timelines} =1 {{totalTimelineTemplates} timeline template} other {{totalTimelineTemplates} timeline templates}}"}),W=a.i18n.translate("xpack.securitySolution.timelines.components.tabs.timelinesTitle",{defaultMessage:"Timelines"}),K=a.i18n.translate("xpack.securitySolution.timelines.components.tabs.templatesTitle",{defaultMessage:"Templates"}),Y=a.i18n.translate("xpack.securitySolution.timelines.components.templateFilter.elasticTitle",{defaultMessage:"Elastic templates"}),J=a.i18n.translate("xpack.securitySolution.timelines.components.templateFilter.customizedTitle",{defaultMessage:"Custom templates"}),X=a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importTimelineTitle",{defaultMessage:"Import"}),Z=a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.selectTimelineDescription",{defaultMessage:"Select a timeline or timeline template file to import"}),ee=a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.initialPromptTextDescription",{defaultMessage:"Select or drag and drop a valid timelines_export.ndjson file"}),te=a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.overwriteDescription",{defaultMessage:"Automatically overwrite saved objects with the same timeline ID"}),ne=e=>a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.successfullyImportedTimelinesTitle",{values:{totalCount:e},defaultMessage:"Successfully imported {totalCount} {totalCount, plural, =1 {item} other {items}}"}),ae=e=>a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importFailedTitle",{values:{totalTimelines:e},defaultMessage:"Failed to import {totalTimelines} {totalTimelines, plural, =1 {timeline} other {timelines}}"}),ie=a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importTitle",{defaultMessage:"Import…"}),le=e=>a.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importFailedDetailedTitle",{values:{message:e},defaultMessage:"{message}"})},1427:function(e,t,n){"use strict";n.d(t,"b",(function(){return r})),n.d(t,"a",(function(){return s}));var a=n(2),i=n.n(a),l=n(46);class SecuritySolutionQueryClient extends l.QueryClient{constructor(e={}){var t,n,a;super({...e,defaultOptions:{...null!==(t=e.defaultOptions)&&void 0!==t?t:{},queries:{refetchIntervalInBackground:!1,refetchOnWindowFocus:!1,refetchOnMount:!0,keepPreviousData:!0,...null!==(n=null==e||null===(a=e.defaultOptions)||void 0===a?void 0:a.queries)&&void 0!==n?n:{}}}})}}const r=new SecuritySolutionQueryClient,s=Object(a.memo)((({queryClient:e,children:t})=>{const n=Object(a.useMemo)((()=>e||r),[e]);return i.a.createElement(l.QueryClientProvider,{client:n},t)}));s.displayName="ReactQueryClientProvider"},1434:function(e,t,n){"use strict";n.d(t,"b",(function(){return g})),n.d(t,"a",(function(){return f}));var a=n(46),i=n(2),l=n(25),r=n(126),s=n(102),o=n(65),u=n(143),c=n(857),d=n(650),m=n(856);const p=["POST",o.EPM_API_ROUTES.BULK_INSTALL_PATTERN],b=["POST",o.EPM_API_ROUTES.INSTALL_FROM_REGISTRY_PATTERN],g=()=>{const e=Object(s.j)(),t=Object(r.a)().endpointPrivileges.canAccessFleet,{mutate:n}=(e=>{const t=Object(d.b)(),n=Object(c.b)(),i=Object(m.b)();return Object(a.useMutation)((e=>Object(u.c)(e)),{...e,mutationKey:p,onSettled:(...e)=>{const a=e[0],r=null==a?void 0:a.items.find((e=>e.name===l.b));r&&"result"in r&&"installed"===r.result.status&&(t(),n(),i())}})})(),{mutate:o}=(e=>{const t=Object(d.b)(),n=Object(c.b)(),i=Object(m.b)();return Object(a.useMutation)((e=>Object(u.o)(e)),{...e,mutationKey:b,onSettled:(...e)=>{const{packageName:a}=e[2];a===l.b&&(t(),n(),i())}})})();Object(i.useEffect)((()=>{t&&(async()=>{var t;await(null===(t=e.services.fleet)||void 0===t?void 0:t.isInitialized());const a=s.b.getKibanaVersion().includes("-SNAPSHOT")||"main"===s.b.getKibanaBranch(),i=s.b.getPrebuiltRulesPackageVersion(),r=["endpoint",l.b];null!=i&&(o({packageName:l.b,packageVersion:i,prerelease:a,force:!0}),r.splice(r.indexOf(l.b),1)),n({packages:r,prerelease:a})})()}),[n,t,e.services.fleet,o])},f=()=>Object(a.useIsMutating)({predicate:({options:{mutationKey:e},state:{variables:t}})=>e===p?t.packages.includes(l.b):e===b&&t.packageName===l.b})>0},1445:function(e,t,n){"use strict";n.d(t,"a",(function(){return Pe}));var a=n(40),i=n(2),l=n.n(i),r=n(103),s=n(5);const o=s.i18n.translate("xpack.securitySolution.indexPatterns.callOutTitle",{defaultMessage:"Data view cannot be modified on this page"}),u=s.i18n.translate("xpack.securitySolution.indexPatterns.callOutDeprecxatedTitle",{defaultMessage:"This timeline uses a legacy data view selector"}),c=s.i18n.translate("xpack.securitySolution.indexPatterns.callOutDeprecxatedTemplateTitle",{defaultMessage:"This timeline template uses a legacy data view selector"}),d=s.i18n.translate("xpack.securitySolution.indexPatterns.callOutMissingPatternsTitle",{defaultMessage:"This timeline is out of date with the Security Data View"}),m=s.i18n.translate("xpack.securitySolution.indexPatterns.callOutMissingPatternsTemplateTitle",{defaultMessage:"This timeline template is out of date with the Security Data View"}),p=s.i18n.translate("xpack.securitySolution.indexPatterns.callOutTimelineTitle",{defaultMessage:"Data view cannot be modified when show only detection alerts is selected"}),b=s.i18n.translate("xpack.securitySolution.indexPatterns.toggleToNewSourcerer.link",{defaultMessage:"here"}),g=s.i18n.translate("xpack.securitySolution.indexPatterns.dataViewLabel",{defaultMessage:"Data view"}),f=s.i18n.translate("xpack.securitySolution.indexPatterns.updateDataView",{defaultMessage:"Would you like to add this index pattern to Security Data View? Otherwise, we can recreate the data view without the missing index patterns."}),y=s.i18n.translate("xpack.securitySolution.indexPatterns.updateSecurityDataView",{defaultMessage:"Update Security Data View"}),v=s.i18n.translate("xpack.securitySolution.indexPatterns.continue",{defaultMessage:"Continue without adding"}),h=s.i18n.translate("xpack.securitySolution.indexPatterns.add",{defaultMessage:"Add index pattern"}),E=s.i18n.translate("xpack.securitySolution.indexPatterns.modifiedBadgeTitle",{defaultMessage:"Modified"}),S=s.i18n.translate("xpack.securitySolution.indexPatterns.alertsBadgeTitle",{defaultMessage:"Alerts"}),x=s.i18n.translate("xpack.securitySolution.indexPatterns.updateAvailableBadgeTitle",{defaultMessage:"Update available"}),O=s.i18n.translate("xpack.securitySolution.indexPatterns.securityDefaultDataViewLabel",{defaultMessage:"Security Default Data View"}),k=s.i18n.translate("xpack.securitySolution.indexPatterns.securityDataViewLabel",{defaultMessage:"Security Data View"}),j=s.i18n.translate("xpack.securitySolution.indexPatterns.selectDataView",{defaultMessage:"Data view selection"}),T=s.i18n.translate("xpack.securitySolution.indexPatterns.save",{defaultMessage:"Save"}),w=s.i18n.translate("xpack.securitySolution.indexPatterns.chooseDataViewLabel",{defaultMessage:"Choose data view"}),M=s.i18n.translate("xpack.securitySolution.indexPatterns.advancedOptionsTitle",{defaultMessage:"Advanced options"}),I=s.i18n.translate("xpack.securitySolution.indexPatterns.indexPatternsLabel",{defaultMessage:"Index patterns"}),C=s.i18n.translate("xpack.securitySolution.indexPatterns.descriptionsLabel",{defaultMessage:"These are the index patterns currently selected. Filtering out index patterns from your data view can help improve overall performance."}),A=s.i18n.translate("xpack.securitySolution.sourcerer.disabled",{defaultMessage:"The updates to the Data view require a page reload to take effect."}),D=s.i18n.translate("xpack.securitySolution.indexPatterns.update",{defaultMessage:"Update and recreate data view"}),N=s.i18n.translate("xpack.securitySolution.indexPatterns.resetButton",{defaultMessage:"Reset"}),F=s.i18n.translate("xpack.securitySolution.indexPatterns.closeButton",{defaultMessage:"Close"}),P=s.i18n.translate("xpack.securitySolution.indexPatterns.inactive",{defaultMessage:"Inactive index patterns"}),R=s.i18n.translate("xpack.securitySolution.indexPatterns.noData",{defaultMessage:"The index pattern on this timeline doesn't match any data streams, indices, or index aliases."}),L=s.i18n.translate("xpack.securitySolution.indexPatterns.pickIndexPatternsCombo",{defaultMessage:"Pick index patterns"}),B=s.i18n.translate("xpack.securitySolution.indexPatterns.onlyDetectionAlertsLabel",{defaultMessage:"Show only detection alerts"}),_=s.i18n.translate("xpack.securitySolution.indexPatterns.successToastTitle",{defaultMessage:"One or more settings require you to reload the page to take effect"}),q=s.i18n.translate("xpack.securitySolution.indexPatterns.reloadPageTitle",{defaultMessage:"Reload page"}),z=s.i18n.translate("xpack.securitySolution.indexPatterns.failureToastTitle",{defaultMessage:"Unable to update data view"});var V=n(158),$=n(105),Q=n(110),U=n(477),H=n(41),G=n.n(H);const W=G()(a.EuiFormRow).withConfig({displayName:"FormRow",componentId:"sc-1x3qwn3-0"})(["display:",";max-width:none;"],(({$expandAdvancedOptions:e})=>e?"flex":"none")),K=G()(a.EuiFormRow).withConfig({displayName:"StyledFormRow",componentId:"sc-1x3qwn3-1"})(["max-width:none;"]),Y=G()(a.EuiButtonEmpty).withConfig({displayName:"StyledButton",componentId:"sc-1x3qwn3-2"})(["&:enabled:focus,&:focus{background-color:transparent;}"]),J=G()(a.EuiButtonEmpty).withConfig({displayName:"ResetButton",componentId:"sc-1x3qwn3-3"})(["width:fit-content;&:enabled:focus,&:focus{background-color:transparent;}"]),X=G.a.div.withConfig({displayName:"PopoverContent",componentId:"sc-1x3qwn3-4"})(["width:600px;"]),Z=G()(a.EuiBadge).withConfig({displayName:"StyledBadge",componentId:"sc-1x3qwn3-5"})(["margin-left:8px;&,.euiBadge__text{cursor:pointer;}"]),ee=G.a.span.withConfig({displayName:"Blockquote",componentId:"sc-1x3qwn3-6"})(["",""],(({theme:e})=>Object(H.css)(["display:block;border-color:",";border-left:",";margin:"," 0 "," ",";padding:",";"],e.eui.euiColorDarkShade,e.eui.euiBorderThick,e.eui.euiSizeS,e.eui.euiSizeS,e.eui.euiSizeS,e.eui.euiSizeS))),te=(e,t)=>e.filter((e=>e!==t));var ne=n(340),ae=n(102),ie=n(665);const le=(e,t)=>Object(ne.b)(e).map((e=>({label:e,value:e,...null!=t?{disabled:!t.includes(e)}:{}})));var re=n(44);const se=G()(a.EuiModal).withConfig({displayName:"MyEuiModal",componentId:"sc-1e562tk-0"})([".euiModal__flex{width:60vw;}.euiCodeBlock{height:auto !important;max-width:718px;}"]),oe=l.a.memo((({isShowing:e,onDismissModal:t,onContinue:n,onUpdate:i,missingPatterns:r})=>e?l.a.createElement(se,{onClose:t,"data-test-subj":"sourcerer-update-data-view-modal"},l.a.createElement(a.EuiModalHeader,null,l.a.createElement(a.EuiModalHeaderTitle,null,y)),l.a.createElement(a.EuiModalBody,null,l.a.createElement(a.EuiText,{size:"s"},l.a.createElement(a.EuiTextColor,{color:"subdued"},l.a.createElement("p",null,l.a.createElement(re.FormattedMessage,{id:"xpack.securitySolution.indexPatterns.missingPatterns",defaultMessage:"Security Data View is missing the following index patterns in order to recreate the previous timeline's data view: {callout}",values:{callout:l.a.createElement(ee,null,r.join(", "))}}),f))),l.a.createElement(a.EuiFlexGroup,{alignItems:"center",justifyContent:"flexEnd"},l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(J,{"aria-label":v,"data-test-subj":"sourcerer-continue-close",flush:"left",onClick:n,title:v},v)),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiButton,{"data-test-subj":"sourcerer-update-data-view",fill:!0,fullWidth:!0,onClick:i,size:"s"},h))))):null));oe.displayName="UpdateDefaultDataViewModal";var ue=n(142),ce=n(106),de=n(111),me=n(133);const pe=({activePatterns:e,deadPatterns:t,selectedPatterns:n,timelineType:r})=>{const s=Object(i.useMemo)((()=>t.length>0?l.a.createElement(a.EuiToolTip,{content:l.a.createElement(be,{activePatterns:e,selectedPatterns:n,timelineType:r})},l.a.createElement(a.EuiIcon,{type:"questionInCircle",title:P})):null),[e,t.length,n,r]);return r===ce.l.template?l.a.createElement(re.FormattedMessage,{"data-test-subj":"sourcerer-current-patterns-message",id:"xpack.securitySolution.indexPatterns.timelineTemplate.currentPatterns",defaultMessage:"The active index patterns in this timeline template are{tooltip}: {callout}",values:{tooltip:s,callout:l.a.createElement(ee,null,e.join(", "))}}):l.a.createElement(re.FormattedMessage,{"data-test-subj":"sourcerer-current-patterns-message",id:"xpack.securitySolution.indexPatterns.timeline.currentPatterns",defaultMessage:"The active index patterns in this timeline are{tooltip}: {callout}",values:{tooltip:s,callout:l.a.createElement(ee,null,e.join(", "))}})},be=({activePatterns:e,selectedPatterns:t,timelineType:n})=>{const a=Object(i.useMemo)((()=>t.filter((t=>!e.includes(t))).join(", ")),[e,t]);return n===ce.l.template?l.a.createElement(re.FormattedMessage,{id:"xpack.securitySolution.indexPatterns.timelineTemplate.noMatchData",defaultMessage:"The following index patterns are saved to this timeline template but do not match any data streams, indices, or index aliases: {aliases}",values:{aliases:a}}):l.a.createElement(re.FormattedMessage,{id:"xpack.securitySolution.indexPatterns.timeline.noMatchData",defaultMessage:"The following index patterns are saved to this timeline but do not match any data streams, indices, or index aliases: {aliases}",values:{aliases:a}})},ge=({timelineType:e,selectedPatterns:t})=>{const n=Object(i.useMemo)((()=>l.a.createElement(ee,null,t.join(", "))),[t]);return e===ce.l.template?l.a.createElement(re.FormattedMessage,{id:"xpack.securitySolution.indexPatterns.timelineTemplate.currentPatternsBad",defaultMessage:"The current index patterns in this timeline template are: {callout}",values:{callout:n}}):l.a.createElement(re.FormattedMessage,{id:"xpack.securitySolution.indexPatterns.timeline.currentPatternsBad",defaultMessage:"The current index patterns in this timeline are: {callout}",values:{callout:n}})},fe=({onReset:e,timelineType:t})=>t===ce.l.template?l.a.createElement(re.FormattedMessage,{"data-test-subj":"sourcerer-deprecated-message",id:"xpack.securitySolution.indexPatterns.timelineTemplate.toggleToNewSourcerer",defaultMessage:"We have preserved your timeline template by creating a temporary data view. If you'd like to modify your data, we can recreate your temporary data view with the new data view selector. You can also manually select a data view {link}.",values:{link:l.a.createElement(a.EuiLink,{onClick:e},b)}}):l.a.createElement(re.FormattedMessage,{"data-test-subj":"sourcerer-deprecated-message",id:"xpack.securitySolution.indexPatterns.timeline.toggleToNewSourcerer",defaultMessage:"We have preserved your timeline by creating a temporary data view. If you'd like to modify your data, we can recreate your temporary data view with the new data view selector. You can also manually select a data view {link}.",values:{link:l.a.createElement(a.EuiLink,{onClick:e},b)}}),ye=({onReset:e,timelineType:t})=>t===ce.l.template?l.a.createElement(re.FormattedMessage,{"data-test-subj":"sourcerer-missing-patterns-message",id:"xpack.securitySolution.indexPatterns.missingPatterns.timelineTemplate.description",defaultMessage:"We have preserved your timeline template by creating a temporary data view. If you'd like to modify your data, we can add the missing index patterns to the Security Data View. You can also manually select a data view {link}.",values:{link:l.a.createElement(a.EuiLink,{onClick:e},b)}}):l.a.createElement(re.FormattedMessage,{"data-test-subj":"sourcerer-missing-patterns-message",id:"xpack.securitySolution.indexPatterns.missingPatterns.timeline.description",defaultMessage:"We have preserved your timeline by creating a temporary data view. If you'd like to modify your data, we can add the missing index patterns to the Security Data View. You can also manually select a data view {link}.",values:{link:l.a.createElement(a.EuiLink,{onClick:e},b)}}),ve={deprecated:{title:{[ce.l.default]:u,[ce.l.template]:c},update:D},missingPatterns:{title:{[ce.l.default]:d,[ce.l.template]:m},update:h}},he=l.a.memo((({activePatterns:e,indicesExist:t,isModified:n,onDismiss:r,onReset:s,onUpdate:o,selectedPatterns:u,missingPatterns:c})=>{const d=Object(i.useMemo)((()=>l.a.createElement(a.EuiButton,{"data-test-subj":"sourcerer-deprecated-update",fill:!0,fullWidth:!0,onClick:o,size:"s",disabled:!t},ve[n].update)),[t,n,o]),m=Object(i.useMemo)((()=>t?d:l.a.createElement(a.EuiToolTip,{position:"top",content:R,"data-test-subj":"sourcerer-tooltip"},d)),[t,d]),p=e&&e.length>0?u.filter((t=>!e.includes(t))):[],b=Object(i.useMemo)((()=>de.b.getTimelineByIdSelector()),[]),g=Object($.a)((e=>{var t;return(null!==(t=b(e,ue.f.active))&&void 0!==t?t:me.b).timelineType}));return l.a.createElement(l.a.Fragment,null,l.a.createElement(a.EuiCallOut,{color:"warning","data-test-subj":"sourcerer-deprecated-callout",iconType:"warning",size:"s",title:ve[n].title[g]}),l.a.createElement(a.EuiSpacer,{size:"s"}),l.a.createElement(a.EuiText,{size:"s"},l.a.createElement(a.EuiTextColor,{color:"subdued"},l.a.createElement("p",null,e&&e.length>0?l.a.createElement(pe,{timelineType:g,activePatterns:e,deadPatterns:p,selectedPatterns:u}):l.a.createElement(ge,{timelineType:g,selectedPatterns:u}),"deprecated"===n&&l.a.createElement(fe,{timelineType:g,onReset:s}),"missingPatterns"===n&&l.a.createElement(l.a.Fragment,null,l.a.createElement(re.FormattedMessage,{"data-test-subj":"sourcerer-missing-patterns-callout",id:"xpack.securitySolution.indexPatterns.missingPatterns.callout",defaultMessage:"Security Data View is missing the following index patterns: {callout}",values:{callout:l.a.createElement(ee,null,c.join(", "))}}),l.a.createElement(ye,{timelineType:g,onReset:s}))))),l.a.createElement(a.EuiFlexGroup,{alignItems:"center",justifyContent:"flexEnd"},l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(J,{"aria-label":F,"data-test-subj":"sourcerer-deprecated-close",flush:"left",onClick:r,title:F},F)),l.a.createElement(a.EuiFlexItem,{grow:!1},m)))}));he.displayName="TemporarySourcererComp";const Ee=l.a.memo((({activePatterns:e,indicesExist:t,isModified:n,missingPatterns:a,onContinueWithoutUpdate:i,onDismiss:r,onReset:s,onUpdateStepOne:o,onUpdateStepTwo:u,selectedPatterns:c,isShowingUpdateModal:d,onDismissModal:m})=>l.a.createElement(l.a.Fragment,null,l.a.createElement(he,{activePatterns:e,indicesExist:t,isModified:n,missingPatterns:a,onDismiss:r,onReset:s,onUpdate:o,selectedPatterns:c}),l.a.createElement(oe,{isShowing:d,missingPatterns:a,onDismissModal:m,onContinue:i,onUpdate:u}))));Ee.displayName="TemporarySourcerer";var Se=n(116),xe=n(58),Oe=n(4);const ke=G()(a.EuiButton).withConfig({displayName:"StyledRefreshButton",componentId:"sc-nuholq-0"})(["float:right;"]),je=l.a.memo((()=>{const e=Object(i.useCallback)((()=>{document.location.reload()}),[]);return l.a.createElement(ke,{onClick:e,"data-test-subj":"page-refresh"},q)}));je.displayName="RefreshButton";var Te=n(108);const we=({activePatterns:e,disabled:t,isModified:n,isOnlyDetectionAlerts:r,isPopoverOpen:s,isTimelineSourcerer:o,loading:u,onClick:c,selectedPatterns:d,signalIndexName:m})=>{const p=Object(i.useMemo)((()=>{switch(n){case"modified":return l.a.createElement(Z,{"data-test-subj":"sourcerer-modified-badge"},E);case"alerts":return l.a.createElement(Z,{"data-test-subj":"sourcerer-alerts-badge"},S);case"deprecated":return l.a.createElement(Z,{color:"warning","data-test-subj":"sourcerer-deprecated-badge"},x);case"missingPatterns":return l.a.createElement(Z,{color:"warning","data-test-subj":"sourcerer-missingPatterns-badge"},x);default:return null}}),[n]),b=Object(i.useMemo)((()=>l.a.createElement(Y,{"aria-label":g,"data-test-subj":o?"timeline-sourcerer-trigger":"sourcerer-trigger",flush:"left",iconSide:"right",iconType:"arrowDown",disabled:t,isLoading:u,onClick:c,title:g},g,!t&&p)),[t,p,o,u,c]),f=Object(i.useMemo)((()=>t?A:(({isOnlyDetectionAlerts:e,isPopoverOpen:t,selectedPatterns:n,signalIndexName:a})=>t||e&&!a?null:(e?[a]:n).join(", "))({isOnlyDetectionAlerts:r,isPopoverOpen:s,selectedPatterns:null!=e?e:d,signalIndexName:m})),[e,t,r,s,d,m]);return f?l.a.createElement(a.EuiToolTip,{position:"top",content:f,"data-test-subj":"sourcerer-tooltip"},b):b},Me=Object(i.memo)(we),Ie=l.a.memo((({isOnlyDetectionAlerts:e,title:t})=>e?l.a.createElement(a.EuiCallOut,{"data-test-subj":"sourcerer-callout",iconType:"iInCircle",size:"s",title:t}):null));Ie.displayName="SourcererCallout";const Ce=l.a.memo((({onChange:e,checked:t,isShow:n})=>n?l.a.createElement(K,null,l.a.createElement(a.EuiCheckbox,{checked:t,"data-test-subj":"sourcerer-alert-only-checkbox",id:"sourcerer-alert-only-checkbox",label:B,onChange:e})):null));Ce.displayName="AlertsCheckbox";const Ae=l.a.memo((({disableSave:e,isShow:t,onReset:n,onSave:i})=>t?l.a.createElement(K,null,l.a.createElement(a.EuiFlexGroup,{alignItems:"center",justifyContent:"flexEnd"},l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(J,{"aria-label":N,"data-test-subj":"sourcerer-reset",flush:"left",onClick:n,title:N},N)),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiButton,{onClick:i,disabled:e,"data-test-subj":"sourcerer-save",fill:!0,fullWidth:!0,size:"s"},T)))):null));Ae.displayName="SaveButtons";var De=n(1377),Ne=n(160),Fe=n(221);const Pe=l.a.memo((({scope:e})=>{const t=Object(r.useDispatch)(),n=e===Q.SourcererScopeName.detections,s=e===Q.SourcererScopeName.timeline,u=e===Q.SourcererScopeName.default,c=Object(Ne.d)(Fe.a.sourcerer),d=Object(i.useMemo)((()=>V.d.getSourcererScopeSelector()),[]),{defaultDataView:m,kibanaDataViews:g,signalIndexName:f,sourcererScope:{selectedDataViewId:y,selectedPatterns:v,missingPatterns:h}}=Object($.a)((t=>d(t,e))),{pollForSignalIndex:x}=Object(De.a)();Object(i.useEffect)((()=>{null!=x&&(s||n)&&x()}),[n,s,x]);const{activePatterns:T,indicesExist:A,loading:D}=Object(Se.d)(e),[N,F]=Object(i.useState)(T&&T.length>0?h.filter((e=>T.includes(e))):[]);Object(i.useEffect)((()=>{T&&T.length>0&&F(h.filter((e=>T.includes(e))))}),[T,h]);const[P,R]=Object(i.useState)(s&&v.join()===f),B=Object(i.useCallback)((()=>{R(s&&v.join()===f)}),[s,v,f]);Object(i.useEffect)((()=>{B()}),[v]);const q=n||s&&P,[H,G]=Object(i.useState)(!1),[J,ee]=Object(i.useState)(y),{allOptions:se,dataViewSelectOptions:oe,loadingIndexPatterns:ue,isModified:ce,handleOutsideClick:de,onChangeCombo:me,renderOption:pe,selectedOptions:be,setIndexPatternsByDataView:ge}=(({dataViewId:e,defaultDataViewId:t,isOnlyDetectionAlerts:n,kibanaDataViews:s,missingPatterns:o,scopeId:u,selectedDataViewId:c,selectedPatterns:d,signalIndexName:m})=>{const p=Object(r.useDispatch)(),{data:{dataViews:b}}=Object(ae.j)().services,g=Object(i.useRef)(!0),[f,y]=Object(i.useState)(!1),v=Object(i.useMemo)((()=>m?le([m]):[]),[m]),[h,x]=Object(i.useState)(n?v:le(d)),[j,T]=Object(i.useState)(null==e?"deprecated":o.length>0?"missingPatterns":""),{allPatterns:w,selectablePatterns:M}=Object(i.useMemo)((()=>{if(n&&m)return{allPatterns:[m],selectablePatterns:[m]};const t=s.find((t=>t.id===e));if(null==t)return{allPatterns:[],selectablePatterns:[]};const a=[...new Set(t.title.split(","))];return u===V.b.SourcererScopeName.default?{allPatterns:te(a,m),selectablePatterns:te(t.patternList,m)}:{allPatterns:a,selectablePatterns:t.patternList}}),[e,n,s,u,m]),I=Object(i.useMemo)((()=>le(w,M)),[w,M]),C=Object(i.useCallback)(((e,n=!1)=>u===Q.SourcererScopeName.detections||n?v:le(Object(U.b)(s.find((t=>t.id===e)),u,m,e===t))),[v,s,u,m,t]),A=Object(i.useMemo)((()=>null!=e?C(e):[]),[e,C]),D=Object(i.useCallback)(((e,t)=>{if(null==t)return T("deprecated");if(o.length>0)return T("missingPatterns");if(n)return T("alerts");const a=A.length!==e.length||!A.every((t=>e.find((e=>t.value===e))));return T(a?"modified":"")}),[A,n,o.length]);Object(i.useEffect)((()=>{x(u===Q.SourcererScopeName.detections?v:le(d))}),[d,u]),Object(i.useEffect)((()=>{D(d.map((e=>e)),c)}),[n,c,o,u,d]);const N=Object(i.useCallback)((e=>{x(e)}),[]),F=Object(i.useCallback)((({value:e})=>l.a.createElement("span",{"data-test-subj":"sourcerer-combo-option"},e)),[]),P=Object(i.useCallback)((async(e,t)=>{if(s.some((t=>t.id===e&&0===t.indexFields.length))){try{y(!0),x([]);const t=await Object(ie.a)(e,b);g.current&&(p(V.a.setDataView(t)),x(n?v:le(t.patternList)))}catch(e){}y(!1)}else x(C(e,t))}),[v,p,C,n,s,b]),R=Object(i.useMemo)((()=>null!=e?(({dataViewId:e,defaultDataViewId:t,isModified:n,isOnlyDetectionAlerts:i,kibanaDataViews:r})=>i?[{inputDisplay:l.a.createElement("span",{"data-test-subj":"security-alerts-option-super"},l.a.createElement(a.EuiIcon,{type:"logoSecurity",size:"s"})," ",k,l.a.createElement(Z,{"data-test-subj":"security-alerts-option-badge"},S)),value:t}]:r.map((({title:i,id:r})=>({inputDisplay:r===t?l.a.createElement("span",{"data-test-subj":"security-option-super"},l.a.createElement(a.EuiIcon,{type:"logoSecurity",size:"s"})," ",O,n&&r===e&&l.a.createElement(Z,{"data-test-subj":"security-modified-option-badge"},E)):l.a.createElement("span",{"data-test-subj":"dataView-option-super"},l.a.createElement(a.EuiIcon,{type:"logoKibana",size:"s"})," ",i,n&&r===e&&l.a.createElement(Z,{"data-test-subj":"security-modified-option-badge"},E)),value:r}))))({dataViewId:e,defaultDataViewId:t,isModified:"modified"===j,isOnlyDetectionAlerts:n,kibanaDataViews:s}):[]),[e,t,j,n,s]);return Object(i.useEffect)((()=>(g.current=!0,()=>{g.current=!1})),[]),{allOptions:I,dataViewSelectOptions:R,loadingIndexPatterns:f,handleOutsideClick:Object(i.useCallback)((()=>{x(le(d))}),[d]),isModified:j,onChangeCombo:N,renderOption:F,selectedOptions:h,setIndexPatternsByDataView:P}})({dataViewId:J,defaultDataViewId:m.id,isOnlyDetectionAlerts:q,kibanaDataViews:g,missingPatterns:N,scopeId:e,selectedDataViewId:y,selectedPatterns:v,signalIndexName:f}),fe=Object(i.useCallback)((e=>{R(e.target.checked),ee(m.id),ge(m.id,e.target.checked)}),[m.id,ge]),[ye,ve]=Object(i.useState)(!1),[he,ke]=Object(i.useState)(!1),we=Object(i.useCallback)((()=>{G((e=>!e)),ve(!1)}),[]),Pe=Object(i.useCallback)(((n,a,i)=>{t(V.a.setSelectedDataView({id:e,selectedDataViewId:n,selectedPatterns:a,shouldValidateSelectedPatterns:i})),u&&c({[Q.SourcererScopeName.default]:{id:n,selectedPatterns:a}})}),[t,e,u,c]),Re=Object(i.useCallback)((e=>{ee(e),ge(e)}),[ge]),Le=Object(i.useCallback)((()=>{ee(m.id),ge(m.id),R(!1),F([])}),[m.id,ge]),Be=Object(i.useCallback)((()=>{const e=be.map((e=>e.label));null!=J&&Pe(J,e),G(!1)}),[Pe,J,be]),_e=Object(i.useCallback)((()=>{G(!1),ve(!1)}),[]),qe=Object(i.useCallback)((()=>{ke(!1);const e=v.filter((e=>m.patternList.includes(e)));Pe(m.id,e),G(!1)}),[m.id,m.patternList,Pe,v]),ze=Object(i.useCallback)((()=>{0===N.length?qe():ke(!0)}),[N,qe]),[Ve,$e]=Object(i.useState)(!1),Qe=(e=>{const{theme:t,uiSettings:n}=Object(ae.j)().services,{addSuccess:r,addError:s}=Object(Te.a)();return Object(i.useCallback)((async i=>{const[o,u]=await(async()=>{try{const e=[...n.get(Oe.H),...i];return[await n.set(Oe.H,Object(ne.a)(e)),null]}catch(e){return[!1,e]}})();return o?(r({color:"success",title:Object(xe.toMountPoint)(_,{theme$:t.theme$}),text:Object(xe.toMountPoint)(l.a.createElement(je,null),{theme$:t.theme$}),iconType:void 0,toastLifeTimeMs:6e5}),!0):(s(null!==u?u:new Error(z),{title:z,toastMessage:l.a.createElement(l.a.Fragment,null,l.a.createElement(re.FormattedMessage,{id:"xpack.securitySolution.indexPatterns.failureToastText",defaultMessage:"Unexpected error occurred on update. If you would like to modify your data, you can manually select a data view {link}.",values:{link:l.a.createElement(a.EuiLink,{onClick:e,"data-test-subj":"failureToastLink"},b)}}))}),!1)}),[s,r,e,t.theme$,n])})(Object(i.useCallback)((()=>{G(!0),Le()}),[Le])),Ue=Object(i.useCallback)((async()=>{const e=await Qe(N);ke(!1),G(!1),e&&(Pe(m.id,null!=T?T:v,!1),$e(!0))}),[T,m.id,N,Pe,v,Qe]);Object(i.useEffect)((()=>{ee(y)}),[y]);const He=Object(i.useCallback)((()=>{ee(y),F(h),B(),de()}),[de,B,y,h]),Ge=Object(i.useCallback)((()=>{ve((e=>!e))}),[]);return A||e===Q.SourcererScopeName.timeline?l.a.createElement(a.EuiPopover,{panelClassName:"sourcererPopoverPanel",button:l.a.createElement(Me,{activePatterns:T,disabled:Ve,isModified:ce,isOnlyDetectionAlerts:q,isPopoverOpen:H,isTimelineSourcerer:s,loading:D,onClick:we,selectedPatterns:v,signalIndexName:f}),closePopover:_e,"data-test-subj":s?"timeline-sourcerer-popover":"sourcerer-popover",display:"block",isOpen:H,ownFocus:!0,repositionOnScroll:!0},l.a.createElement(a.EuiOutsideClickDetector,{onOutsideClick:He},l.a.createElement(X,null,l.a.createElement(a.EuiPopoverTitle,{"data-test-subj":"sourcerer-title"},l.a.createElement(l.a.Fragment,null,j)),l.a.createElement(Ie,{isOnlyDetectionAlerts:q,title:s?p:o}),l.a.createElement(a.EuiSpacer,{size:"s"}),null===J&&"deprecated"===ce||"missingPatterns"===ce?l.a.createElement(Ee,{activePatterns:T,indicesExist:A,isModified:ce,isShowingUpdateModal:he,missingPatterns:N,onContinueWithoutUpdate:qe,onDismiss:we,onDismissModal:()=>ke(!1),onReset:Le,onUpdateStepOne:"deprecated"===ce?ze:Ue,onUpdateStepTwo:Ue,selectedPatterns:v}):l.a.createElement(a.EuiForm,{component:"form"},l.a.createElement(l.a.Fragment,null,l.a.createElement(Ce,{isShow:s,checked:P,onChange:fe}),J&&l.a.createElement(K,{label:w},l.a.createElement(a.EuiSuperSelect,{"data-test-subj":"sourcerer-select",isLoading:ue,disabled:q,fullWidth:!0,onChange:Re,options:oe,placeholder:w,valueOfSelected:J})),l.a.createElement(a.EuiSpacer,{size:"m"}),l.a.createElement(Y,{color:"text","data-test-subj":"sourcerer-advanced-options-toggle",iconType:ye?"arrowDown":"arrowRight",onClick:Ge},M),ye&&l.a.createElement(a.EuiSpacer,{size:"m"}),l.a.createElement(W,{isDisabled:ue,$expandAdvancedOptions:ye,helpText:q?void 0:C,label:I},l.a.createElement(a.EuiComboBox,{"data-test-subj":"sourcerer-combo-box",fullWidth:!0,isDisabled:q||ue,onChange:me,options:se,placeholder:L,renderOption:pe,selectedOptions:be})),l.a.createElement(Ae,{disableSave:0===be.length,isShow:!n,onReset:Le,onSave:Be})),l.a.createElement(a.EuiSpacer,{size:"s"}))))):null}));Pe.displayName="Sourcerer"},1448:function(e,t,n){(function(e){var a=Function.prototype.apply;function i(e,t){this._id=e,this._clearFn=t}t.setTimeout=function(){return new i(a.call(setTimeout,window,arguments),clearTimeout)},t.setInterval=function(){return new i(a.call(setInterval,window,arguments),clearInterval)},t.clearTimeout=t.clearInterval=function(e){e&&e.close()},i.prototype.unref=i.prototype.ref=function(){},i.prototype.close=function(){this._clearFn.call(window,this._id)},t.enroll=function(e,t){clearTimeout(e._idleTimeoutId),e._idleTimeout=t},t.unenroll=function(e){clearTimeout(e._idleTimeoutId),e._idleTimeout=-1},t._unrefActive=t.active=function(e){clearTimeout(e._idleTimeoutId);var t=e._idleTimeout;t>=0&&(e._idleTimeoutId=setTimeout((function(){e._onTimeout&&e._onTimeout()}),t))},n(1449),t.setImmediate="undefined"!=typeof self&&self.setImmediate||void 0!==e&&e.setImmediate||this&&this.setImmediate,t.clearImmediate="undefined"!=typeof self&&self.clearImmediate||void 0!==e&&e.clearImmediate||this&&this.clearImmediate}).call(this,n(1395))},1449:function(e,t,n){(function(e,t){!function(e,n){"use strict";if(!e.setImmediate){var a,i,l,r,s,o=1,u={},c=!1,d=e.document,m=Object.getPrototypeOf&&Object.getPrototypeOf(e);m=m&&m.setTimeout?m:e,"[object process]"==={}.toString.call(e.process)?a=function(e){t.nextTick((function(){b(e)}))}:function(){if(e.postMessage&&!e.importScripts){var t=!0,n=e.onmessage;return e.onmessage=function(){t=!1},e.postMessage("","*"),e.onmessage=n,t}}()?(r="setImmediate$"+Math.random()+"$",s=function(t){t.source===e&&"string"==typeof t.data&&0===t.data.indexOf(r)&&b(+t.data.slice(r.length))},e.addEventListener?e.addEventListener("message",s,!1):e.attachEvent("onmessage",s),a=function(t){e.postMessage(r+t,"*")}):e.MessageChannel?((l=new MessageChannel).port1.onmessage=function(e){b(e.data)},a=function(e){l.port2.postMessage(e)}):d&&"onreadystatechange"in d.createElement("script")?(i=d.documentElement,a=function(e){var t=d.createElement("script");t.onreadystatechange=function(){b(e),t.onreadystatechange=null,i.removeChild(t),t=null},i.appendChild(t)}):a=function(e){setTimeout(b,0,e)},m.setImmediate=function(e){"function"!=typeof e&&(e=new Function(""+e));for(var t=new Array(arguments.length-1),n=0;n<t.length;n++)t[n]=arguments[n+1];var i={callback:e,args:t};return u[o]=i,a(o),o++},m.clearImmediate=p}function p(e){delete u[e]}function b(e){if(c)setTimeout(b,0,e);else{var t=u[e];if(t){c=!0;try{!function(e){var t=e.callback,a=e.args;switch(a.length){case 0:t();break;case 1:t(a[0]);break;case 2:t(a[0],a[1]);break;case 3:t(a[0],a[1],a[2]);break;default:t.apply(n,a)}}(t)}finally{p(e),c=!1}}}}}("undefined"==typeof self?void 0===e?this:e:self)}).call(this,n(1395),n(404))},1483:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=(e,t,n)=>{const a=t.indexOf(e),i=[...t];a>=0?i.splice(a,1):i.push(e),n(i)}},149:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"c",(function(){return m})),n.d(t,"b",(function(){return b}));var a=n(40),i=n(2),l=n.n(i),r=n(114),s=n(311),o=n(454),u=n(561),c=n(455);const d="inspectButtonComponent",m=({children:e,show:t=!0})=>l.a.createElement(s.a,{show:t,targetClassNames:[d]},e),p=({compact:e=!1,inputId:t=r.a.global,inspectIndex:n=0,isDisabled:i,multiple:s=!1,onCloseInspect:m,queryId:p="",showInspectButton:b=!0,title:g=""})=>{const{additionalRequests:f,additionalResponses:y,handleClick:v,handleCloseModal:h,isButtonDisabled:E,isShowingModal:S,loading:x,request:O,response:k}=Object(u.a)({inputId:t,inspectIndex:n,isDisabled:i,multiple:s,onCloseInspect:m,queryId:p});return l.a.createElement(l.a.Fragment,null,t===r.a.timeline&&!e&&b&&l.a.createElement(a.EuiButtonEmpty,{className:d,"aria-label":c.d,"data-test-subj":"inspect-empty-button",color:"text",iconSide:"left",iconType:"inspect",isDisabled:E,isLoading:x,onClick:v},c.d),(t===r.a.global||e)&&b&&l.a.createElement(a.EuiButtonIcon,{className:d,"aria-label":c.d,"data-test-subj":"inspect-icon-button",iconSize:"m",iconType:"inspect",isDisabled:E,title:c.d,onClick:v}),S&&null!==O&&null!==k&&l.a.createElement(o.a,{additionalRequests:f,additionalResponses:y,closeModal:h,"data-test-subj":"inspect-modal",inputId:t,request:O,response:k,title:g}))};p.displayName="InspectButtonComponent";const b=l.a.memo(p)},152:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a="row-renderer-example"},153:function(e,t,n){"use strict";n.d(t,"d",(function(){return c})),n.d(t,"e",(function(){return d})),n.d(t,"c",(function(){return p})),n.d(t,"n",(function(){return b}));var a=n(42),i=n(109),l=n(119),r=n(176),s=n(115),o=n(182),u=n(434);n.d(t,"f",(function(){return i.g})),n.d(t,"h",(function(){return i.i})),n.d(t,"g",(function(){return i.h})),n.d(t,"l",(function(){return i.m})),n.d(t,"k",(function(){return i.l})),n.d(t,"p",(function(){return i.r})),n.d(t,"o",(function(){return i.q})),n.d(t,"m",(function(){return i.n})),n.d(t,"i",(function(){return i.j})),n.d(t,"q",(function(){return i.w})),n.d(t,"r",(function(){return i.x})),n.d(t,"j",(function(){return i.k})),n.d(t,"a",(function(){return i.b})),n.d(t,"b",(function(){return i.e}));const c=({activeTimelineDataProviders:e,dataProviders:t,dispatch:n,result:a,timelineId:l,noProviderFound:r=o.b.noProviderFound,onAddedToTimeline:s})=>{const c=Object(i.p)(a),d=t[c];d?Object(u.b)({dataProviders:e,destination:a.destination,dispatch:n,onAddedToTimeline:s,providerToAdd:d,timelineId:l}):n(r({id:c}))},d=({isAggregatable:e,fieldType:t,fieldName:n,hideTopN:a})=>{const i=["boolean","geo-point","geo-shape","ip","keyword","number","numeric","string"].includes(t),l=["kibana.alert.ancestors.depth","kibana.alert.ancestors.id","kibana.alert.ancestors.rule","kibana.alert.ancestors.type","kibana.alert.original_event.action","kibana.alert.original_event.category","kibana.alert.original_event.code","kibana.alert.original_event.created","kibana.alert.original_event.dataset","kibana.alert.original_event.duration","kibana.alert.original_event.end","kibana.alert.original_event.hash","kibana.alert.original_event.id","kibana.alert.original_event.kind","kibana.alert.original_event.module","kibana.alert.original_event.original","kibana.alert.original_event.outcome","kibana.alert.original_event.provider","kibana.alert.original_event.risk_score","kibana.alert.original_event.risk_score_norm","kibana.alert.original_event.sequence","kibana.alert.original_event.severity","kibana.alert.original_event.start","kibana.alert.original_event.timezone","kibana.alert.original_event.type","kibana.alert.original_time","kibana.alert.rule.created_by","kibana.alert.rule.description","kibana.alert.rule.enabled","kibana.alert.rule.false_positives","kibana.alert.rule.from","kibana.alert.rule.uuid","kibana.alert.rule.immutable","kibana.alert.rule.interval","kibana.alert.rule.max_signals","kibana.alert.rule.name","kibana.alert.rule.note","kibana.alert.rule.references","kibana.alert.risk_score","kibana.alert.rule.rule_id","kibana.alert.severity","kibana.alert.rule.size","kibana.alert.rule.tags","kibana.alert.rule.threat","kibana.alert.rule.threat.tactic.id","kibana.alert.rule.threat.tactic.name","kibana.alert.rule.threat.tactic.reference","kibana.alert.rule.threat.technique.id","kibana.alert.rule.threat.technique.name","kibana.alert.rule.threat.technique.reference","kibana.alert.rule.timeline_id","kibana.alert.rule.timeline_title","kibana.alert.rule.to","kibana.alert.rule.type","kibana.alert.rule.updated_by","kibana.alert.rule.version","kibana.alert.workflow_status"].includes(n);return!a&&(l||e&&i)},m={"kibana.alert.rule.name":"kibana.alert.rule.uuid","event.module":"rule.reference"},p=({browserFields:e,dispatch:t,result:n,scopeId:o,defaultsHeader:u})=>{var c;const d=Object(i.o)(n),p=(e=>Object(a.keyBy)("name",(e=>Object.values(e).reduce(((e,t)=>[...e,...Object.values(null!=t.fields?t.fields:{})]),[]))(e)))(e)[d],b=o!==l.e.alertsOnAlertsPage&&o!==l.e.alertsOnRuleDetailsPage||null===(c=u.find((e=>e.id===d)))||void 0===c?{}:c,g=Object(s.getScopedActions)(o);var f;null!=p&&g?t(g.upsertColumn({column:{category:p.category,columnHeaderType:"not-filtered",description:Object(a.isString)(p.description)?p.description:void 0,example:Object(a.isString)(p.example)?p.example:void 0,id:d,linkField:null!==(f=m[d])&&void 0!==f?f:void 0,type:p.type,aggregatable:p.aggregatable,initialWidth:r.a,...b},id:o,index:null!=n.destination?n.destination.index:0})):g&&t(g.upsertColumn({column:{columnHeaderType:"not-filtered",id:d,initialWidth:r.a},id:o,index:null!=n.destination?n.destination.index:0}))},b=e=>e.slice(e.lastIndexOf(".")+1)},155:function(e,t,n){"use strict";n.d(t,"C",(function(){return i})),n.d(t,"q",(function(){return l})),n.d(t,"v",(function(){return r})),n.d(t,"l",(function(){return s})),n.d(t,"o",(function(){return o})),n.d(t,"p",(function(){return u})),n.d(t,"m",(function(){return c})),n.d(t,"n",(function(){return d})),n.d(t,"B",(function(){return m})),n.d(t,"r",(function(){return p})),n.d(t,"u",(function(){return b})),n.d(t,"y",(function(){return g})),n.d(t,"k",(function(){return f})),n.d(t,"E",(function(){return y})),n.d(t,"w",(function(){return v})),n.d(t,"b",(function(){return h})),n.d(t,"x",(function(){return E})),n.d(t,"z",(function(){return S})),n.d(t,"t",(function(){return x})),n.d(t,"s",(function(){return O})),n.d(t,"a",(function(){return k})),n.d(t,"c",(function(){return j})),n.d(t,"F",(function(){return T})),n.d(t,"g",(function(){return w})),n.d(t,"A",(function(){return M})),n.d(t,"D",(function(){return I})),n.d(t,"e",(function(){return C})),n.d(t,"d",(function(){return A})),n.d(t,"f",(function(){return D})),n.d(t,"i",(function(){return N})),n.d(t,"h",(function(){return F})),n.d(t,"j",(function(){return P}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.alertDetails.threatIntel",{defaultMessage:"Threat Intel"}),l=a.i18n.translate("xpack.securitySolution.alertDetails.overview.investigationGuide",{defaultMessage:"Investigation guide"}),r=a.i18n.translate("xpack.securitySolution.alertDetails.overview",{defaultMessage:"Overview"}),s=a.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields",{defaultMessage:"Highlighted fields"}),o=a.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.field",{defaultMessage:"Field"}),u=a.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.value",{defaultMessage:"Value"}),c=a.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.alertPrevalence",{defaultMessage:"Alert prevalence"}),d=a.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.alertPrevalenceTooltip",{defaultMessage:"The total count of alerts with the same value within the currently selected timerange. This value is not affected by additional filters."}),m=a.i18n.translate("xpack.securitySolution.eventDetails.table",{defaultMessage:"Table"}),p=a.i18n.translate("xpack.securitySolution.eventDetails.jsonView",{defaultMessage:"JSON"}),b=a.i18n.translate("xpack.securitySolution.eventDetails.osqueryView",{defaultMessage:"Osquery Results"}),g=a.i18n.translate("xpack.securitySolution.eventDetails.responseActionsView",{defaultMessage:"Response Results"}),f=a.i18n.translate("xpack.securitySolution.eventDetails.field",{defaultMessage:"Field"}),y=a.i18n.translate("xpack.securitySolution.eventDetails.value",{defaultMessage:"Value"}),v=(a.i18n.translate("xpack.securitySolution.eventDetails.description",{defaultMessage:"Description"}),a.i18n.translate("xpack.securitySolution.eventDetails.filter.placeholder",{defaultMessage:"Filter by Field, Value, or Description..."})),h=a.i18n.translate("xpack.securitySolution.detections.alerts.agentStatus",{defaultMessage:"Agent status"}),E=a.i18n.translate("xpack.securitySolution.detections.alerts.quarantinedFilePath",{defaultMessage:"Quarantined file path"}),S=a.i18n.translate("xpack.securitySolution.detections.alerts.ruleType",{defaultMessage:"Rule type"}),x=a.i18n.translate("xpack.securitySolution.eventDetails.multiFieldTooltipContent",{defaultMessage:"Multi-fields can have multiple values per field"}),O=a.i18n.translate("xpack.securitySolution.eventDetails.multiFieldBadge",{defaultMessage:"multi-field"}),k=a.i18n.translate("xpack.securitySolution.eventDetails.table.actions",{defaultMessage:"Actions"}),j=a.i18n.translate("xpack.securitySolution.eventDetails.alertReason",{defaultMessage:"Alert reason"}),T=a.i18n.translate("xpack.securitySolution.eventDetails.viewAllFields",{defaultMessage:"View all fields in table"}),w=Object.freeze({tried:e=>a.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.tried",{values:{command:e},defaultMessage:"tried to execute {command} command"}),executed:e=>a.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.executed",{values:{command:e},defaultMessage:"executed {command} command"}),pending:e=>a.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.pending",{values:{command:e},defaultMessage:"is executing {command} command"}),failed:e=>a.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.failed",{values:{command:e},defaultMessage:"failed to execute {command} command"})}),M=a.i18n.translate("xpack.securitySolution.eventDetails.summaryView",{defaultMessage:"summary"}),I=a.i18n.translate("xpack.securitySolution.eventDetails.timelineView",{defaultMessage:"Timeline"}),C=a.i18n.translate("xpack.securitySolution.alertSummaryView.alertSummaryViewConversationId",{defaultMessage:"Alert summary"}),A=e=>a.i18n.translate("xpack.securitySolution.alertSummaryView.alertSummaryViewContextDescription",{defaultMessage:"Alert (from {view})",values:{view:e}}),D=a.i18n.translate("xpack.securitySolution.alertSummaryView.alertSummaryViewContextTooltip",{defaultMessage:"Add this alert as context"}),N=a.i18n.translate("xpack.securitySolution.alertSummaryView.eventSummaryViewConversationId",{defaultMessage:"Event summary"}),F=e=>a.i18n.translate("xpack.securitySolution.alertSummaryView.eventSummaryViewContextDescription",{defaultMessage:"Event (from {view})",values:{view:e}}),P=a.i18n.translate("xpack.securitySolution.alertSummaryView.eventSummaryViewContextTooltip",{defaultMessage:"Add this event as context"})},157:function(e,t,n){const a=n(325),{MAX_LENGTH:i,MAX_SAFE_INTEGER:l}=n(326),{safeRe:r,t:s}=n(310),o=n(451),{compareIdentifiers:u}=n(559);class SemVer{constructor(e,t){if(t=o(t),e instanceof SemVer){if(e.loose===!!t.loose&&e.includePrerelease===!!t.includePrerelease)return e;e=e.version}else if("string"!=typeof e)throw new TypeError(`Invalid version. Must be a string. Got type "${typeof e}".`);if(e.length>i)throw new TypeError(`version is longer than ${i} characters`);a("SemVer",e,t),this.options=t,this.loose=!!t.loose,this.includePrerelease=!!t.includePrerelease;const n=e.trim().match(t.loose?r[s.LOOSE]:r[s.FULL]);if(!n)throw new TypeError(`Invalid Version: ${e}`);if(this.raw=e,this.major=+n[1],this.minor=+n[2],this.patch=+n[3],this.major>l||this.major<0)throw new TypeError("Invalid major version");if(this.minor>l||this.minor<0)throw new TypeError("Invalid minor version");if(this.patch>l||this.patch<0)throw new TypeError("Invalid patch version");n[4]?this.prerelease=n[4].split(".").map((e=>{if(/^[0-9]+$/.test(e)){const t=+e;if(t>=0&&t<l)return t}return e})):this.prerelease=[],this.build=n[5]?n[5].split("."):[],this.format()}format(){return this.version=`${this.major}.${this.minor}.${this.patch}`,this.prerelease.length&&(this.version+=`-${this.prerelease.join(".")}`),this.version}toString(){return this.version}compare(e){if(a("SemVer.compare",this.version,this.options,e),!(e instanceof SemVer)){if("string"==typeof e&&e===this.version)return 0;e=new SemVer(e,this.options)}return e.version===this.version?0:this.compareMain(e)||this.comparePre(e)}compareMain(e){return e instanceof SemVer||(e=new SemVer(e,this.options)),u(this.major,e.major)||u(this.minor,e.minor)||u(this.patch,e.patch)}comparePre(e){if(e instanceof SemVer||(e=new SemVer(e,this.options)),this.prerelease.length&&!e.prerelease.length)return-1;if(!this.prerelease.length&&e.prerelease.length)return 1;if(!this.prerelease.length&&!e.prerelease.length)return 0;let t=0;do{const n=this.prerelease[t],i=e.prerelease[t];if(a("prerelease compare",t,n,i),void 0===n&&void 0===i)return 0;if(void 0===i)return 1;if(void 0===n)return-1;if(n!==i)return u(n,i)}while(++t)}compareBuild(e){e instanceof SemVer||(e=new SemVer(e,this.options));let t=0;do{const n=this.build[t],i=e.build[t];if(a("prerelease compare",t,n,i),void 0===n&&void 0===i)return 0;if(void 0===i)return 1;if(void 0===n)return-1;if(n!==i)return u(n,i)}while(++t)}inc(e,t,n){switch(e){case"premajor":this.prerelease.length=0,this.patch=0,this.minor=0,this.major++,this.inc("pre",t,n);break;case"preminor":this.prerelease.length=0,this.patch=0,this.minor++,this.inc("pre",t,n);break;case"prepatch":this.prerelease.length=0,this.inc("patch",t,n),this.inc("pre",t,n);break;case"prerelease":0===this.prerelease.length&&this.inc("patch",t,n),this.inc("pre",t,n);break;case"major":0===this.minor&&0===this.patch&&0!==this.prerelease.length||this.major++,this.minor=0,this.patch=0,this.prerelease=[];break;case"minor":0===this.patch&&0!==this.prerelease.length||this.minor++,this.patch=0,this.prerelease=[];break;case"patch":0===this.prerelease.length&&this.patch++,this.prerelease=[];break;case"pre":{const e=Number(n)?1:0;if(!t&&!1===n)throw new Error("invalid increment argument: identifier is empty");if(0===this.prerelease.length)this.prerelease=[e];else{let a=this.prerelease.length;for(;--a>=0;)"number"==typeof this.prerelease[a]&&(this.prerelease[a]++,a=-2);if(-1===a){if(t===this.prerelease.join(".")&&!1===n)throw new Error("invalid increment argument: identifier already exists");this.prerelease.push(e)}}if(t){let a=[t,e];!1===n&&(a=[t]),0===u(this.prerelease[0],t)?isNaN(this.prerelease[1])&&(this.prerelease=a):this.prerelease=a}break}default:throw new Error(`invalid increment argument: ${e}`)}return this.raw=this.format(),this.build.length&&(this.raw+=`+${this.build.join(".")}`),this}}e.exports=SemVer},159:function(e,t,n){"use strict";n.d(t,"b",(function(){return r})),n.d(t,"a",(function(){return s}));var a=n(2),i=n(102);const l={managed:!0},r=()=>{const{services:{apm:e}}=Object(i.j)();return{startTransaction:Object(a.useCallback)((({name:t,type:n="user-interaction",options:a})=>e.startTransaction(t,n,null!=a?a:l)),[e])}},s=e=>`Timeline search ${e}`},1614:function(e,t,n){"use strict";(function(e){n.d(t,"a",(function(){return r}));var a=n(2),i=n(45),l=n(102);const r=()=>{const{pathname:t}=Object(i.useLocation)(),{executionContext:n}=Object(l.j)().services;Object(a.useEffect)((()=>{e((()=>{n.set({page:t})}))}),[t,n])}}).call(this,n(1448).setImmediate)},164:function(e,t,n){"use strict";n.d(t,"a",(function(){return k})),n.d(t,"e",(function(){return j})),n.d(t,"d",(function(){return T})),n.d(t,"f",(function(){return w})),n.d(t,"g",(function(){return I})),n.d(t,"c",(function(){return V})),n.d(t,"h",(function(){return $})),n.d(t,"b",(function(){return Q}));var a=n(388),i=n(42),l=n(47),r=n(343),s=n.n(r),o=n(114),u=n(118),c=n(106),d=n(241),m=n(151),p=n(12),b=n(133),g=n(190),f=n(176),y=n(718),v=n(150),h=n(387),E=n(158),S=n(110),x=n(286),O=n(209);const k="open-timeline",j=({pinnedEventIds:e})=>null!=e?Object.keys(e).length:0,T=({eventIdToNoteIds:e,noteIds:t})=>(null!=e?Object.keys(e).reduce(((t,n)=>t+e[n].length),0):0)+(null!=t?t.length:0),w=({title:e})=>null==e||0===e.trim().length,M=(e,t)=>"__typename"===e?void 0:t,I=e=>JSON.parse(JSON.stringify(e),M),C=e=>{try{return JSON.parse(e)}catch{return e}},A=e=>Object.entries(e).reduce(((e,[t,n])=>"id"!==t&&null!=n?{...e,[t]:n}:e),{columnHeaderType:g.a,id:null!=e.id?e.id:"unknown",initialWidth:"@timestamp"===e.id?f.b:f.a}),D=e=>({$state:{store:"appState"},meta:{...e.meta,...e.meta&&null!=e.meta.field?{params:C(e.meta.field)}:{},...e.meta&&null!=e.meta.params?{params:C(e.meta.params)}:{},...e.meta&&null!=e.meta.value?{value:C(e.meta.value)}:{}},...null!=e.exists?{exists:C(e.exists)}:{},...null!=e.match_all?{exists:C(e.match_all)}:{},...null!=e.missing?{exists:C(e.missing)}:{},...null!=e.query?{query:C(e.query)}:{},...null!=e.range?{range:C(e.range)}:{},...null!=e.script?{exists:C(e.script)}:{}}),N=(e,t)=>e?{}:null!=t?t.reduce(((e,t)=>{if(null!=t.eventId){const n=Object(i.getOr)([],t.eventId,e);return{...e,[t.eventId]:[...n,t.noteId]}}return e}),{}):{},F=(e,t)=>e?{}:null!=t?t.reduce(((e,t)=>({...e,...null!=t.eventId?{[t.eventId]:t}:{}})),{}):{},P=(e,t)=>e?{}:null!=t?t.reduce(((e,t)=>({...e,[t]:!0})),{}):{},R=(e,t,n)=>n===c.l.default&&e.timelineType===c.l.template?e.templateTimelineId:t&&e.timelineType===c.l.template?Object(l.v4)():e.templateTimelineId,L=({and:e,...t})=>t.type===c.a.template?s()(t,{type:c.a.default,enabled:t.queryMatch.operator!==v.d,queryMatch:{value:t.queryMatch.operator===v.d?"":t.queryMatch.value}}):t,B=(e,t,n)=>e&&t&&n===c.l.default?t.map((e=>{var t,n;return{...L(e),and:null!==(t=null===(n=e.and)||void 0===n?void 0:n.map(L))&&void 0!==t?t:[]}})):t,_=(e,t,n)=>n&&e.timelineType!==n?"":t?`${e.title} - Duplicate`:e.title||"",q=(e,t,n)=>n&&e.timelineType!==n?c.k.draft:t?c.k.active:e.status,z=(e,t,n)=>{const i=e.timelineType===c.l.template,l={...e,columns:null!=e.columns?e.columns.map(A):g.b,defaultColumns:g.b,dateRange:e.status===c.k.immutable&&e.timelineType===c.l.template?{start:x.a.toISOString(),end:x.b.toISOString()}:e.dateRange,dataProviders:B(t,e.dataProviders,n),eventIdToNoteIds:N(t,e.eventIdToNoteIds),filters:null!=e.filters?e.filters.map(D):[],isFavorite:!t&&null!=e.favorite&&e.favorite.length>0,noteIds:t?[]:null!=e.noteIds?e.noteIds:[],pinnedEventIds:P(t,e.pinnedEventIds),pinnedEventsSaveObject:F(t,e.pinnedEventsSaveObject),id:t?"":e.savedObjectId,status:q(e,t,n),savedObjectId:t?null:e.savedObjectId,version:t?null:e.version,timelineType:null!=n?n:e.timelineType,title:_(e,t,n),templateTimelineId:R(e,t,n),templateTimelineVersion:t&&i?1:e.templateTimelineVersion};return Object.entries(l).reduce(((e,[t,n])=>null!=n?Object(a.set)(t,n,e):e),{...b.b,id:""})},V=(e,t=!1,n)=>{const{notes:a,...i}=e;return{notes:a,timeline:z(i,t,n)}},$=({activeTimelineTab:e=u.d.query,duplicate:t=!1,graphEventId:n="",timelineId:a,timelineType:l,onError:r,onOpenTimeline:s,openTimeline:o=!0,updateIsLoading:c,updateTimeline:d})=>{c({id:u.c.active,isLoading:!0}),null==a?(d({id:u.c.active,duplicate:!1,notes:[],from:x.a.toISOString(),to:x.b.toISOString(),timeline:{...b.b,id:u.c.active,activeTab:e,show:o,initialized:!0}})(),c({id:u.c.active,isLoading:!1})):Promise.resolve(Object(O.i)(a)).then((a=>{const r=Object(i.getOr)(null,"data",a);if(!r)return;const c=I(r.timeline),{timeline:m,notes:p}=V(c,t,l);if(null!=s)s(m);else if(d){const{from:a,to:l}=Object(h.a)({from:Object(i.getOr)(null,"dateRange.start",m),to:Object(i.getOr)(null,"dateRange.end",m)});d({duplicate:t,from:a,id:u.c.active,notes:p,resolveTimelineConfig:{outcome:r.outcome,alias_target_id:r.alias_target_id,alias_purpose:r.alias_purpose},timeline:{...m,activeTab:e,graphEventId:n,show:o,dateRange:{start:a,end:l}},to:l})()}})).catch((e=>{null!=r&&r(e,a)})).finally((()=>{c({id:u.c.active,isLoading:!1})}))},Q=e=>({duplicate:t,id:n,forceNotes:a=!1,from:l,notes:r,resolveTimelineConfig:s,timeline:u,to:b,ruleNote:g,ruleAuthor:f})=>()=>{var v;if(Object(i.isEmpty)(u.indexNames)||e(E.a.setSelectedDataView({id:S.SourcererScopeName.timeline,selectedDataViewId:u.dataViewId,selectedPatterns:u.indexNames})),u.status===c.k.immutable&&u.timelineType===c.l.template?e(Object(m.setRelativeRangeDatePicker)({id:o.a.timeline,fromStr:"now-24h",toStr:"now",from:x.a.toISOString(),to:x.b.toISOString()})):e(Object(m.setTimelineRangeDatePicker)({from:l,to:b})),e(Object(p.addTimeline)({id:n,timeline:u,resolveTimelineConfig:s,savedTimeline:t})),null!=u.kqlQuery&&null!=u.kqlQuery.filterQuery&&null!=u.kqlQuery.filterQuery.kuery&&""!==u.kqlQuery.filterQuery.kuery.expression&&e(Object(p.applyKqlFilterQuery)({id:n,filterQuery:{kuery:{kind:null!==(v=u.kqlQuery.filterQuery.kuery.kind)&&void 0!==v?v:"kuery",expression:u.kqlQuery.filterQuery.kuery.expression||""},serializedQuery:u.kqlQuery.filterQuery.serializedQuery||""}})),t&&null!=g&&!Object(i.isEmpty)(g)){const t=Object(y.a)({newNote:g,user:f||"elastic"});e(Object(d.updateNote)({note:t})),e(Object(p.addNote)({noteId:t.id,id:n}))}t&&!a||e(Object(d.addNotes)({notes:null!=r?r.map((e=>{var t,n;return{created:null!=e.created?new Date(e.created):new Date,id:e.noteId,lastEdit:null!=e.updated?new Date(e.updated):new Date,note:e.note||"",user:e.updatedBy||"unknown",saveObjectId:e.noteId,version:e.version,eventId:null!==(t=e.eventId)&&void 0!==t?t:null,timelineId:null!==(n=e.timelineId)&&void 0!==n?n:null}})):[]}))}},166:function(e,t,n){"use strict";n.d(t,"a",(function(){return f}));var a=n(40),i=n(2),l=n.n(i),r=n(41),s=n.n(r),o=n(53),u=n.n(o),c=n(149),d=n(679),m=n(910);const p=s.a.header.withConfig({displayName:"Header",componentId:"sc-1q9aiyj-0"})(["&.toggle-expand{margin-bottom:",";}.no-margin{margin-top:0 !important;margin-bottom:0 !important;}"," margin-bottom:0;user-select:text;",""],(({theme:e})=>e.eui.euiSizeL),(({height:e})=>e&&Object(r.css)(["height:","px;"],e)),(({border:e})=>e&&Object(r.css)(["border-bottom:",";padding-bottom:",";"],(({theme:e})=>e.eui.euiBorderThin),(({theme:e})=>e.eui.euiSizeL))));p.displayName="Header";const b=({alignHeader:e,stackHeader:t})=>null!=e?e:t?void 0:"center",g=({alignHeader:e,border:t,children:n,outerDirection:r="column",growLeftSplit:s=!0,headerFilters:o,height:g,hideSubtitle:f=!1,id:y,inspectMultiple:v=!1,inspectTitle:h,isInspectDisabled:E,showInspectButton:S=!0,split:x,stackHeader:O,subtitle:k,title:j,titleSize:T="m",toggleQuery:w,toggleStatus:M=!0,tooltip:I,tooltipTitle:C})=>{const A=Object(i.useCallback)((()=>{w&&w(!M)}),[w,M]),D=u()({"toggle-expand":M,siemHeaderSection:!0});return l.a.createElement(p,{"data-test-subj":"header-section",border:t,height:g,className:D,$hideSubtitle:f},l.a.createElement(a.EuiFlexGroup,{"data-test-subj":"headerSectionOuterFlexGroup",direction:r,gutterSize:"xs",responsive:!1},l.a.createElement(a.EuiFlexItem,{grow:s},l.a.createElement(a.EuiFlexGroup,{alignItems:b({alignHeader:e,stackHeader:O}),"data-test-subj":"headerSectionInnerFlexGroup",direction:O?"column":"row",gutterSize:"s"},l.a.createElement(a.EuiFlexItem,{grow:s,className:M?"":"no-margin"},l.a.createElement(a.EuiFlexGroup,{alignItems:"center",responsive:!1,gutterSize:"s"},l.a.createElement(a.EuiFlexItem,null,l.a.createElement(a.EuiFlexGroup,{responsive:!1,gutterSize:"none",className:"header-section-titles"},w&&l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiButtonIcon,{"data-test-subj":"query-toggle-header","aria-label":m.a(M),color:"text",display:"empty",iconType:M?"arrowDown":"arrowRight",onClick:A,size:"s",title:m.a(M)})),l.a.createElement(a.EuiFlexItem,null,l.a.createElement(a.EuiTitle,{size:T},l.a.createElement("h4",{"data-test-subj":"header-section-title"},l.a.createElement("span",{className:"eui-textBreakNormal"},j),I&&l.a.createElement(l.a.Fragment,null," ",l.a.createElement(a.EuiIconTip,{color:"subdued",title:C,content:I,size:"l",type:"iInCircle"}))))))),y&&M&&l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(c.b,{isDisabled:E,queryId:y,multiple:v,showInspectButton:S,title:null!=h?h:j})),o&&M&&l.a.createElement(a.EuiFlexItem,{"data-test-subj":"header-section-filters",grow:!1},o))),n&&M&&l.a.createElement(a.EuiFlexItem,{"data-test-subj":"header-section-supplements",grow:!!x},n))),!f&&M&&l.a.createElement(a.EuiFlexItem,null,l.a.createElement(d.a,{"data-test-subj":"header-section-subtitle",items:k}))))},f=l.a.memo(g)},1660:function(e,t,n){"use strict";n.r(t),n.d(t,"renderApp",(function(){return yn})),n.d(t,"createStoreFactory",(function(){return vn.a}));var a=n(2),i=n.n(a),l=n(64),r=n(220),s=n(103),o=n(40),u=n(58),c=n(61),d=n(247),m=n(24),p=n(535),b=n(913),g=n(63),f=n(136),y=n(102),v=n(182),h=n(142),E=n(718),S=n(111),x=n(914);const O=({message:e})=>{const t=Object(y.n)(),{cases:n}=Object(y.j)().services,l=Object(s.useDispatch)(),{showAssistantOverlay:r}=Object(f.b)(),u=Object(a.useCallback)((e=>l(S.a.addNote({id:h.f.active,noteId:e}))),[l]),c=Object(a.useCallback)((e=>l(v.a.updateNote({note:e}))),[l]),d=Object(a.useCallback)((()=>{Object(E.b)({associateNote:u,newNote:e.content,updateNewNote:()=>{},updateNote:c,user:""}),t.addSuccess(x.a)}),[u,e.content,t,c]),m=n.hooks.useCasesAddToExistingCaseModal({onClose:()=>{},onSuccess:()=>{}}),p=Object(a.useCallback)((()=>{r({showOverlay:!1}),m.open({getAttachments:()=>[{comment:e.content,type:g.AttachmentType.user,owner:x.f}]})}),[e.content,m,r]);return i.a.createElement(o.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(o.EuiToolTip,{position:"top",content:x.c},i.a.createElement(o.EuiButtonIcon,{"aria-label":x.b,color:"primary",iconType:"editorComment",onClick:d}))),i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(o.EuiToolTip,{position:"top",content:x.d},i.a.createElement(o.EuiButtonIcon,{"aria-label":x.d,color:"primary",iconType:"addDataApp",onClick:p}))),i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(o.EuiToolTip,{position:"top",content:x.e},i.a.createElement(o.EuiCopy,{textToCopy:e.content},(e=>i.a.createElement(o.EuiButtonIcon,{"aria-label":x.e,color:"primary",iconType:"copyClipboard",onClick:e}))))))},k=i.a.memo(O);var j=n(5);const T=j.i18n.translate("xpack.securitySolution.assistant.getComments.assistant",{defaultMessage:"Assistant"}),w=j.i18n.translate("xpack.securitySolution.assistant.getComments.you",{defaultMessage:"You"}),M=({currentConversation:e,lastCommentRef:t,showAnonymizedValues:n})=>e.messages.map(((a,l)=>{const s="user"===a.role,u=e.replacements,c=null!=u?Object.keys(u).reduce(((e,t)=>e.replaceAll(t,u[t])),a.content):a.content,d={...a,content:c};return{actions:i.a.createElement(k,{message:d}),children:l!==e.messages.length-1?i.a.createElement(o.EuiText,null,i.a.createElement(o.EuiMarkdownFormat,{className:`message-${l}`},n?a.content:d.content)):i.a.createElement(o.EuiText,null,i.a.createElement(o.EuiMarkdownFormat,{className:`message-${l}`},n?a.content:d.content),i.a.createElement("span",{ref:t})),timelineAvatar:s?i.a.createElement(o.EuiAvatar,{name:"user",size:"l",color:"subdued",iconType:"userAvatar"}):i.a.createElement(o.EuiAvatar,{name:"machine",size:"l",color:"subdued",iconType:r.b}),timestamp:(m=0===a.timestamp.length?(new Date).toLocaleString():a.timestamp,j.i18n.translate("xpack.securitySolution.assistant.getComments.at",{defaultMessage:"at: {timestamp}",values:{timestamp:m}})),username:s?w:T};var m}));var I=n(476),C=n(606),A=n(181),D=n(4),N=n(105),F=n(122),P=n(179),R=n(531);const L=({toastLifeTimeMs:e=5e3})=>{const t=Object(s.useDispatch)(),n=Object(a.useMemo)((()=>F.a.errorsSelector()),[]),i=Object(N.a)(n),[{toasts:l},r]=Object(R.f)();return Object(a.useEffect)((()=>{i.forEach((({id:n,title:a,message:i})=>{l.some((e=>e.id===n))||r({type:"addToaster",toast:{color:"danger",id:n,iconType:"error",title:a,errors:i,toastLifeTimeMs:e}}),t(P.a.removeError({id:n}))}))}),[t,r,i,e,l]),null};L.displayName="ErrorToastDispatcherComponent";const B=i.a.memo(L);var _=n(1537),q=n(651),z=n(264),V=n(45);const $=Object(a.memo)((({children:e})=>{const t=Object(V.useLocation)(),n=Object(s.useDispatch)();return Object(a.useEffect)((()=>{n(S.a.showTimeline({id:h.f.active,show:!1}))}),[n,t.pathname]),Object(a.useEffect)((()=>{n({type:"userChangedUrl",payload:t})})),i.a.createElement(i.a.Fragment,null,e)}));$.displayName="RouteCapture";var Q=n(901);const U=({children:e})=>i.a.createElement(Q.a.Provider,{value:Object(a.useReducer)(((e,t)=>{switch(t.type){case"updateRoute":return t.route;case"updateRouteWithOutSearch":return{...e,...t.route};case"updateSearch":return{...e,search:t.search};default:return e}}),Q.b)},e),H=Object(a.memo)(U);var G=n(526),W=n(42),K=n(70),Y=n(130),J=n.n(Y),X=n(109),Z=n(434);j.i18n.translate("xpack.securitySolution.components.mlPopup.hooks.errors.indexPatternFetchFailureTitle",{defaultMessage:"Index pattern fetch failure"}),j.i18n.translate("xpack.securitySolution.components.hooks.eql.partialResponse",{defaultMessage:"EQL Preview Error"}),j.i18n.translate("xpack.securitySolution.components.hooks.errors.timeIntervalsNotDefined",{defaultMessage:"Time intervals are not defined."});var ee=n(118),te=n(106),ne=n(153),ae=n(133),ie=n(190),le=n(176);const re=[{columnHeaderType:ie.a,id:"@timestamp",initialWidth:le.b},{columnHeaderType:ie.a,id:"event.module",linkField:"rule.reference"},{columnHeaderType:ie.a,id:"event.dataset"},{columnHeaderType:ie.a,id:"event.category"},{columnHeaderType:ie.a,id:"event.severity"},{columnHeaderType:ie.a,id:"observer.name"},{columnHeaderType:ie.a,id:"host.name"},{columnHeaderType:ie.a,id:"message"},{columnHeaderType:ie.a,id:"agent.id"},{columnHeaderType:ie.a,id:"agent.type"}];window["__@hello-pangea/dnd-disable-dev-warnings"]=!0;const se=({browserFields:e,children:t})=>{const n=Object(s.useDispatch)(),l=Object(a.useMemo)((()=>S.b.getTimelineByIdSelector()),[]),r=Object(a.useMemo)((()=>F.b.getDataProvidersSelector()),[]),{timelines:o}=Object(y.j)().services,u=[o.getUseAddToTimelineSensor()],{dataProviders:c,timelineType:d}=Object(N.a)((e=>{var t;return Object(W.pick)(["dataProviders","timelineType"],null!==(t=l(e,ee.c.active))&&void 0!==t?t:ae.b)})),m=Object(N.a)(r),[,p]=Object(R.f)(),b=Object(a.useCallback)((e=>{const t=d===te.l.template?(e=>j.i18n.translate("xpack.securitySolution.hooks.useAddToTimeline.template.addedFieldMessage",{values:{fieldOrValue:e},defaultMessage:"Added {fieldOrValue} to timeline template"}))(e):(e=>j.i18n.translate("xpack.securitySolution.hooks.useAddToTimeline.addedFieldMessage",{values:{fieldOrValue:e},defaultMessage:"Added {fieldOrValue} to timeline"}))(e);Object(R.d)(t,p)}),[p,d]),g=Object(a.useCallback)((t=>{try{ce(),null!=m&&(({activeTimelineDataProviders:e,browserFields:t,dataProviders:n,dispatch:a,onAddedToTimeline:i,result:l})=>{if(Object(ne.r)(l))Object(Z.e)({dataProviders:e,destination:l.destination,dispatch:a,source:l.source,timelineId:ee.c.active});else if(Object(ne.q)(l))Object(ne.d)({activeTimelineDataProviders:e,dataProviders:n,dispatch:a,onAddedToTimeline:i,result:l,timelineId:ee.c.active});else if(Object(ne.j)(l)){var r,s;Object(ne.c)({browserFields:t,defaultsHeader:re,dispatch:a,result:l,scopeId:Object(ne.n)(null!==(r=null===(s=l.destination)||void 0===s?void 0:s.droppableId)&&void 0!==r?r:"")})}})({activeTimelineDataProviders:c,browserFields:e,dataProviders:m,dispatch:n,onAddedToTimeline:b,result:t})}finally{document.body.classList.remove(X.d),Object(ne.f)(t)&&document.body.classList.remove(ne.b)}}),[c,e,m,n,b]);return i.a.createElement(K.DragDropContext,{onDragEnd:g,onBeforeCapture:ue,sensors:u},t)};se.displayName="DragDropContextWrapperComponent";const oe=i.a.memo(se,((e,t)=>J()(e.children,t.children)));oe.displayName="DragDropContextWrapper";const ue=e=>{Object(ne.f)(e)||document.body.classList.add(X.d),Object(ne.f)(e)&&document.body.classList.add(ne.b)},ce=()=>window.onscroll=()=>W.noop;var de=n(168),me=n(19);const pe=i.a.memo((()=>{const{chrome:e,docLinks:t}=Object(y.j)().services;return Object(a.useEffect)((()=>{e.setHelpExtension({appName:me.c,links:[{content:j.i18n.translate("xpack.securitySolution.chrome.helpMenu.documentation",{defaultMessage:"Security documentation"}),href:t.links.siem.guide,iconType:"documents",linkType:"custom",target:"_blank",rel:"noopener"},{content:j.i18n.translate("xpack.securitySolution.chrome.helpMenu.documentation.ecs",{defaultMessage:"ECS documentation"}),href:t.links.ecs.guide,iconType:"documents",linkType:"custom",target:"_blank",rel:"noopener"},{linkType:"discuss",href:"https://discuss.elastic.co/c/security",target:"_blank",rel:"noopener"}]})}),[]),null}));pe.displayName="HelpMenu";var be=n(116),ge=n(365),fe=n(44),ye=n(41),ve=n.n(ye),he=n(77);const Ee=j.i18n.translate("xpack.securitySolution.components.mlPopover.jobsTable.filters.searchFilterPlaceholder",{defaultMessage:"e.g. Unusual Linux Process"}),Se=j.i18n.translate("xpack.securitySolution.components.mlPopover.jobsTable.filters.groupsLabel",{defaultMessage:"Groups"}),xe=j.i18n.translate("xpack.securitySolution.components.mlPopover.jobsTable.filters.noGroupsAvailableDescription",{defaultMessage:"No Groups available"}),Oe=j.i18n.translate("xpack.securitySolution.components.mlPopover.jobsTable.filters.showAllJobsLabel",{defaultMessage:"Elastic jobs"}),ke=j.i18n.translate("xpack.securitySolution.components.mlPopover.jobsTable.filters.showSiemJobsLabel",{defaultMessage:"Custom jobs"});var je=n(1483);const Te=({securityJobs:e,onSelectedGroupsChanged:t})=>{const[n,l]=Object(a.useState)(!1),[r,s]=Object(a.useState)([]),u=e.map((e=>e.groups)).flat().filter((e=>"siem"!==e&&"security"!==e)),c=Array.from(new Set(u));return Object(a.useEffect)((()=>{t(r)}),[r.sort().join()]),i.a.createElement(o.EuiPopover,{ownFocus:!0,button:i.a.createElement(o.EuiFilterButton,{"data-test-subj":"groups-filter-popover-button",iconType:"arrowDown",onClick:()=>l(!n),isSelected:n,numFilters:c.length,hasActiveFilters:r.length>0,numActiveFilters:r.length},Se),isOpen:n,closePopover:()=>l(!n),panelPaddingSize:"none",repositionOnScroll:!0},c.map(((e,t)=>i.a.createElement(o.EuiFilterSelectItem,{checked:r.includes(e)?"on":void 0,key:`${t}-${e}`,onClick:()=>Object(je.a)(e,r,s)},`${e} (${u.filter((t=>t===e)).length})`))),0===c.length&&i.a.createElement(o.EuiFlexGroup,{gutterSize:"m",justifyContent:"spaceAround"},i.a.createElement(o.EuiFlexItem,{grow:!0},i.a.createElement(o.EuiIcon,{type:"minusInCircle"}),i.a.createElement(o.EuiSpacer,{size:"xs"}),i.a.createElement("p",null,xe))))};Te.displayName="GroupsFilterPopoverComponent";const we=i.a.memo(Te);we.displayName="GroupsFilterPopover";const Me=({securityJobs:e,onFilterChanged:t})=>{const[n,l]=Object(a.useState)(""),[r,s]=Object(a.useState)([]),[u,c]=Object(a.useState)(!1),[d,m]=Object(a.useState)(!1);Object(a.useEffect)((()=>{t({filterQuery:n,showCustomJobs:u,showElasticJobs:d,selectedGroups:r})}),[n,r,u,d,t]);const p=Object(a.useCallback)((e=>l(e.queryText.trim())),[l]),b=Object(a.useCallback)((()=>{m(!d),c(!1)}),[m,d,c]),g=Object(a.useCallback)((()=>{c(!u),m(!1)}),[m,u,c]);return i.a.createElement(o.EuiFlexGroup,{gutterSize:"m",justifyContent:"flexEnd"},i.a.createElement(o.EuiFlexItem,{grow:!0},i.a.createElement(o.EuiSearchBar,{"data-test-subj":"jobs-filter-bar",box:{placeholder:Ee,incremental:!0},onChange:p})),i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(o.EuiFilterGroup,null,i.a.createElement(we,{securityJobs:e,onSelectedGroupsChanged:s}))),i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(o.EuiFilterGroup,null,i.a.createElement(o.EuiFilterButton,{hasActiveFilters:d,onClick:b,"data-test-subj":"show-elastic-jobs-filter-button",withNext:!0},Oe),i.a.createElement(o.EuiFilterButton,{hasActiveFilters:u,onClick:g,"data-test-subj":"show-custom-jobs-filter-button"},ke))))};Me.displayName="JobsTableFiltersComponent";const Ie=i.a.memo(Me);Ie.displayName="JobsTableFilters";var Ce=n(728);const Ae=j.i18n.translate("xpack.securitySolution.components.mlPopup.jobsTable.jobNameColumn",{defaultMessage:"Job name"}),De=j.i18n.translate("xpack.securitySolution.components.mlPopup.jobsTable.tagsColumn",{defaultMessage:"Groups"}),Ne=j.i18n.translate("xpack.securitySolution.components.mlPopup.jobsTable.runJobColumn",{defaultMessage:"Run job"}),Fe=j.i18n.translate("xpack.securitySolution.components.mlPopup.jobsTable.noItemsDescription",{defaultMessage:"No Security Machine Learning jobs found"}),Pe=j.i18n.translate("xpack.securitySolution.components.mlPopup.jobsTable.createCustomJobButtonLabel",{defaultMessage:"Create custom job"});var Re=n(1415);const Le=ve.a.div.withConfig({displayName:"JobNameWrapper",componentId:"sc-1gfh62-0"})(["margin:5px 0;"]);Le.displayName="JobNameWrapper";const Be=({id:e,name:t,description:n,basePath:a})=>{const{services:{ml:l}}=Object(y.j)(),r=Object(he.useMlHref)(l,a,{page:he.ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE,pageState:{jobId:e}},[e]);return i.a.createElement(Le,null,i.a.createElement(o.EuiText,{size:"s"},i.a.createElement(o.EuiLink,{"data-test-subj":"jobs-table-link",href:r,target:"_blank"},null!=t?t:e)),i.a.createElement(o.EuiText,{color:"subdued",size:"xs"},n.length>200?`${n.substring(0,200)}...`:n))},_e=(e,t,n)=>[{name:Ae,render:({id:e,description:t,customSettings:a})=>{var l;return i.a.createElement(Be,{id:e,name:null!==(l=null==a?void 0:a.security_app_display_name)&&void 0!==l?l:e,description:t,basePath:n})}},{name:De,render:({groups:e})=>i.a.createElement(Ce.a,{items:e,numberOfItemsToDisplay:0,popoverButtonTitle:`${e.length} Groups`,renderItem:(e,t)=>i.a.createElement(o.EuiBadge,{color:"hollow",key:`${e}-${t}`,"data-test-subj":"group"},e),dataTestPrefix:"groups"}),width:"80px"},{name:Ne,render:n=>n.isCompatible?i.a.createElement(Re.a,{job:n,isSecurityJobsLoading:e,onJobStateChange:t}):i.a.createElement(o.EuiIcon,{"aria-label":"Warning",size:"s",type:"warning",color:"warning"}),align:o.CENTER_ALIGNMENT,width:"80px"}],qe=(e,t,n)=>e.slice(t*n,t*n+n),ze=({isLoading:e,jobs:t,onJobStateChange:n,mlNodesAvailable:l})=>{const[r,s]=Object(a.useState)(0),u=Object(y.d)(),c={showPerPageOptions:!1,pageIndex:r,pageSize:5,totalItemCount:t.length};return Object(a.useEffect)((()=>{s(0)}),[t.length]),i.a.createElement(o.EuiBasicTable,{"data-test-subj":"jobs-table",columns:_e(e,n,u),items:qe(t.map((e=>({...e,isCompatible:!!l&&e.isCompatible}))),r,5),loading:e,noItemsMessage:i.a.createElement($e,{basePath:u}),pagination:c,responsive:!1,onChange:({page:e})=>{s(e.index)}})};ze.displayName="JobsTableComponent";const Ve=i.a.memo(ze);Ve.displayName="JobsTable";const $e=i.a.memo((({basePath:e})=>{const{services:{ml:t}}=Object(y.j)(),n=Object(he.useMlHref)(t,e,{page:he.ML_PAGES.ANOMALY_DETECTION_CREATE_JOB_SELECT_INDEX});return i.a.createElement(o.EuiEmptyPrompt,{title:i.a.createElement("h3",null,Fe),titleSize:"xs",actions:i.a.createElement(o.EuiButton,{href:n,iconType:"popout",iconSide:"right",size:"s",target:"_blank"},Pe)})}));$e.displayName="NoItemsMessage";const Qe=ve.a.div.withConfig({displayName:"ShowingContainer",componentId:"sc-1qc9cz9-0"})(["user-select:none;margin-top:5px;"]);Qe.displayName="ShowingContainer";const Ue=({filterResultsLength:e})=>i.a.createElement(Qe,{"data-test-subj":"showing"},i.a.createElement(o.EuiText,{color:"subdued",size:"xs"},i.a.createElement(fe.FormattedMessage,{"data-test-subj":"query-message",id:"xpack.securitySolution.components.mlPopup.showingLabel",defaultMessage:"Showing: {filterResultsLength} {filterResultsLength, plural, one {job} other {jobs}}",values:{filterResultsLength:e}})));Ue.displayName="ShowingCountComponent";const He=i.a.memo(Ue);He.displayName="ShowingCount";const Ge=()=>i.a.createElement(o.EuiText,{size:"s"},i.a.createElement(fe.FormattedMessage,{id:"xpack.securitySolution.components.mlPopup.anomalyDetectionDescription",defaultMessage:"Run any of the Machine Learning jobs below to prepare for creating detection rules that produce alerts for detected anomalies, and to view anomalous events throughout the Security application. We’ve provided a collection of common detection jobs to get you started. If you wish to add your own custom ML jobs, create and add them to the “Security” group from the {machineLearning} application.",values:{machineLearning:i.a.createElement(o.EuiLink,{href:`${Object(y.d)()}/app/ml`,target:"_blank"},i.a.createElement(fe.FormattedMessage,{id:"xpack.securitySolution.components.mlPopup.machineLearningLink",defaultMessage:"Machine Learning"}))}}));Ge.displayName="PopoverDescriptionComponent";const We=i.a.memo(Ge);We.displayName="PopoverDescription";const Ke=j.i18n.translate("xpack.securitySolution.components.mlPopup.mlJobSettingsButtonLabel",{defaultMessage:"ML job settings"}),Ye=j.i18n.translate("xpack.securitySolution.components.mlPopup.upgradeTitle",{defaultMessage:"Upgrade to Elastic Platinum"}),Je=j.i18n.translate("xpack.securitySolution.components.mlPopup.upgradeButtonLabel",{defaultMessage:"Subscription plans"}),Xe=j.i18n.translate("xpack.securitySolution.components.mlPopup.licenseButtonLabel",{defaultMessage:"Manage license"}),Ze=e=>j.i18n.translate("xpack.securitySolution.components.mlPopup.moduleNotCompatibleTitle",{values:{incompatibleJobCount:e},defaultMessage:"{incompatibleJobCount} {incompatibleJobCount, plural, =1 {job is} other {jobs are}} currently unavailable"}),et=j.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.AnomalyDetectionDocsTitle",{defaultMessage:"Anomaly Detection with Machine Learning"}),tt=ve.a.div.withConfig({displayName:"PopoverContentsDiv",componentId:"sc-1kq19yh-0"})(["width:384px;"]);tt.displayName="PopoverContentsDiv";const nt=()=>i.a.createElement(tt,{"data-test-subj":"ml-popover-upgrade-contents"},i.a.createElement(o.EuiPopoverTitle,null,Ye),i.a.createElement(o.EuiText,{size:"s"},i.a.createElement(fe.FormattedMessage,{id:"xpack.securitySolution.components.mlPopup.upgradeDescription",defaultMessage:"To access SIEM’s anomaly detection features, you must update your license to Platinum, start a free 30-day trial, or spin up a {cloudLink} on AWS, GCP, or Azure. You can then run Machine Learning jobs and view anomalies.",values:{cloudLink:i.a.createElement(o.EuiLink,{href:"https://www.elastic.co/cloud/",target:"_blank"},i.a.createElement(fe.FormattedMessage,{id:"xpack.securitySolution.components.mlPopup.cloudLink",defaultMessage:"cloud deployment"}))}})),i.a.createElement(o.EuiSpacer,null),i.a.createElement(o.EuiFlexGroup,{gutterSize:"s",wrap:!0},i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(o.EuiButton,{href:"https://www.elastic.co/subscriptions",iconType:"popout",iconSide:"right",target:"_blank"},Je)),i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(o.EuiButton,{href:`${Object(y.d)()}/app/management/stack/license_management`,iconType:"gear",target:"_blank"},Xe)))),at=i.a.memo(nt);at.displayName="UpgradeContents";var it=n(474),lt=n(957);const rt=ve.a.div.withConfig({displayName:"PopoverContentsDiv",componentId:"sc-1wz4ps6-0"})(["max-width:684px;max-height:90vh;overflow-y:auto;overflow-x:hidden;padding-bottom:15px;"]);rt.displayName="PopoverContentsDiv";const st={filterQuery:"",showCustomJobs:!1,showElasticJobs:!1,selectedGroups:[]},ot=i.a.memo((()=>{const[e,t]=Object(a.useState)(!1),[n,l]=Object(a.useState)(st),[r,s]=Object(a.useState)(!1),{isMlAdmin:u,isLicensed:c,loading:d,jobs:m,refetch:p}=Object(it.a)(),b=Object(y.j)().services.docLinks,{enableDatafeed:g,disableDatafeed:f,isLoading:v}=Object(lt.a)(),h=Object(a.useCallback)((async(e,t,n)=>{n?await g(e,t):await f(e),p()}),[p,g,f]),E=(({jobs:e,selectedGroups:t,showCustomJobs:n,showElasticJobs:a,filterQuery:i})=>((e,t)=>{const n=null==t?void 0:t.toLowerCase();return e.filter((e=>{var t,a,i;return null==n||e.id.includes(n)||(null===(t=e.customSettings)||void 0===t||null===(a=t.security_app_display_name)||void 0===a||null===(i=a.toLowerCase())||void 0===i?void 0:i.includes(n))||e.description.toLowerCase().includes(n)}))})(e.filter((e=>!n||n&&!e.isElasticJob)).filter((e=>!a||a&&e.isElasticJob)).filter((e=>0===t.length||t.some((t=>e.groups.includes(t))))),i))({jobs:m,...n}),S=m.filter((e=>!e.isCompatible)).length,x=Object(a.useMemo)((()=>m.filter((e=>e.isInstalled)).map((e=>e.id))),[m]);return c?u?i.a.createElement(o.EuiPopover,{anchorPosition:"downRight",id:"integrations-popover",button:i.a.createElement(o.EuiHeaderSectionItemButton,{"aria-expanded":e,"aria-haspopup":"true","aria-label":Ke,color:"primary","data-test-subj":"integrations-button",iconType:"arrowDown",iconSide:"right",onClick:()=>{t(!e),p()},textProps:{style:{fontSize:"1rem"}}},Ke),isOpen:e,closePopover:()=>t(!e),repositionOnScroll:!0},i.a.createElement(rt,{"data-test-subj":"ml-popover-contents"},i.a.createElement(o.EuiPopoverTitle,null,Ke),i.a.createElement(We,null),i.a.createElement(o.EuiSpacer,null),i.a.createElement(Ie,{securityJobs:m,onFilterChanged:l}),i.a.createElement(He,{filterResultsLength:E.length}),i.a.createElement(o.EuiSpacer,{size:"m"}),S>0&&i.a.createElement(i.a.Fragment,null,i.a.createElement(o.EuiCallOut,{title:Ze(S),color:"warning",iconType:"warning",size:"s"},i.a.createElement("p",null,i.a.createElement(fe.FormattedMessage,{defaultMessage:"We could not find any data, see {mlDocs} for more information on Machine Learning job requirements.",id:"xpack.securitySolution.components.mlPopup.moduleNotCompatibleDescription",values:{mlDocs:i.a.createElement("a",{href:`${b.links.siem.ml}`,rel:"noopener noreferrer",target:"_blank"},et)}}))),i.a.createElement(o.EuiSpacer,{size:"m"})),i.a.createElement(he.MLJobsAwaitingNodeWarning,{jobIds:x}),i.a.createElement(he.MlNodeAvailableWarningShared,{size:"s",nodeAvailableCallback:s}),i.a.createElement(Ve,{isLoading:d||v,jobs:E,onJobStateChange:h,mlNodesAvailable:r}))):null:i.a.createElement(o.EuiPopover,{anchorPosition:"downRight",id:"integrations-popover",button:i.a.createElement(o.EuiHeaderSectionItemButton,{"aria-expanded":e,"aria-haspopup":"true","aria-label":Ke,color:"primary","data-test-subj":"integrations-button",iconType:"arrowDown",iconSide:"right",onClick:()=>t(!e),textProps:{style:{fontSize:"1rem"}}},Ke),isOpen:e,closePopover:()=>t(!e),repositionOnScroll:!0},i.a.createElement(at,null))}));ot.displayName="MlPopover";var ut=n(115),ct=n(1445),dt=n(293);const mt=navigator.platform.toLowerCase().indexOf("mac")>=0,pt=i.a.memo((()=>{const{showAssistantOverlay:e}=Object(f.b)(),t=mt?"⌘ ;":"Ctrl ;",n=j.i18n.translate("xpack.securitySolution.globalHeader.assistantHeaderLinkShortcutTooltip",{values:{keyboardShortcut:t},defaultMessage:"Keyboard shortcut {keyboardShortcut}"}),l=Object(a.useCallback)((()=>e({showOverlay:!0})),[e]);return i.a.createElement(o.EuiToolTip,{content:n},i.a.createElement(o.EuiHeaderLink,{"data-test-subj":"assistantHeaderLink",color:"primary",onClick:l},i.a.createElement(o.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(r.b,{size:"xs"})),i.a.createElement(o.EuiFlexItem,{grow:!1},j.i18n.translate("xpack.securitySolution.globalHeader.assistantHeaderLink",{defaultMessage:"AI Assistant"})))))}));pt.displayName="AssistantHeaderLink";var bt=n(309);const gt=j.i18n.translate("xpack.securitySolution.globalHeader.buttonAddData",{defaultMessage:"Add integrations"}),ft=i.a.memo((({setHeaderActionMenu:e})=>{const t=Object(a.useMemo)((()=>Object(ge.c)()),[]),{theme:n}=Object(y.j)().services,{pathname:l}=Object(V.useLocation)(),r=Object(a.useMemo)((()=>S.b.getTimelineByIdSelector()),[]),s=Object(N.b)((e=>{var t;return(null!==(t=r(e,ee.c.active))&&void 0!==t?t:ae.b).show})),c=Object(be.a)(l),d=Object(be.b)(l),{href:m,onClick:p}=(()=>{const{http:{basePath:{prepend:e}},cloudExperiments:t}=Object(y.j)().services,{pathname:n}=Object(V.useLocation)(),{navigateTo:i}=Object(y.k)(),l=Object(ut.isThreatIntelligencePath)(n)?D.b:D.a,[r,s]=Object(a.useState)(l);Object(dt.c)(t,"security-solutions.add-integrations-url",l,s);const o=Object(a.useMemo)((()=>e(r)),[e,r]),u=Object(a.useCallback)((e=>{e.preventDefault(),i({url:o})}),[o,i]);return{href:o,onClick:u}})(),{hasAssistantPrivilege:b}=Object(bt.a)();return Object(a.useEffect)((()=>(e((e=>Object(u.toMountPoint)(i.a.createElement(ge.b,{node:t}),{theme$:n.theme$})(e))),()=>{t.unmount(),e(void 0)})),[t,e,n.theme$]),i.a.createElement(ge.a,{node:t},i.a.createElement(o.EuiHeaderSection,{side:"right"},Object(ut.isDetectionsPath)(l)&&i.a.createElement(o.EuiHeaderSectionItem,null,i.a.createElement(ot,null)),i.a.createElement(o.EuiHeaderSectionItem,null,i.a.createElement(o.EuiHeaderLinks,null,i.a.createElement(o.EuiHeaderLink,{color:"primary","data-test-subj":"add-data",href:m,iconType:"indexOpen",onClick:p},gt),d&&!s&&i.a.createElement(ct.a,{scope:c,"data-test-subj":"sourcerer"}),b&&i.a.createElement(pt,null)))))}));ft.displayName="GlobalHeader";var yt=n(1076),vt=n(363),ht=n(221),Et=n(26),St=n(36);const xt=(e,t)=>{if(!t)return null;for(const a of t){var n;if(null!==(n=a.links)&&void 0!==n&&n.length){const t=xt(e,a.links);if(t)return t}if(e(a))return a}return null};var Ot=n(1614),kt=n(1434),jt=n(505),Tt=n(1073),wt=n(958);const Mt=i.a.memo((()=>{const{pathname:e}=Object(V.useLocation)(),{browserFields:t,indexPattern:n}=Object(be.d)(Object(be.a)(e)),{services:{topValuesPopover:l}}=Object(y.j)(),r=Object(Tt.useObservable)(l.getObservable()),s=Object(a.useCallback)((()=>{l.closePopover()}),[l]);return r&&r.nodeRef?i.a.createElement(o.EuiWrappingPopover,{isOpen:!0,button:r.nodeRef,closePopover:s,anchorPosition:"downCenter",hasArrow:!1,repositionOnScroll:!0,ownFocus:!0,attachToAnchor:!1},i.a.createElement(wt.a,{field:r.fieldName,showLegend:!0,scopeId:r.scopeId,toggleTopN:s,indexPattern:n,browserFields:t})):null}));Mt.displayName="TopValuesPopover";const It=({children:e,setHeaderActionMenu:t})=>{const{pathname:n}=Object(V.useLocation)();Object(be.c)(Object(be.a)(n)),Object(ht.b)(),(()=>{const e=(e=>{const{getAppUrl:t}=Object(y.c)(),n=Object(y.d)(),{pathname:i}=Object(V.useLocation)(),l=Object(a.useCallback)((e=>{const a=t({deepLinkId:e.id});return!!Object(V.matchPath)(`${n}${St.APP_PATH}${i}`,{path:a,strict:!1})}),[n,t,i]);return Object(a.useMemo)((()=>xt(l,e)),[e,l])})(Object(Et.b)());Object(a.useEffect)((()=>{var t;document.title=`${null!==(t=null==e?void 0:e.title)&&void 0!==t?t:""} - Kibana`}),[e])})(),Object(Ot.a)();const{browserFields:l}=Object(be.d)(Object(be.a)(n));return Object(kt.b)(),Object(jt.f)(),i.a.createElement(de.h,{id:"security-solution-app",className:"kbnAppWrapper"},i.a.createElement(yt.a,null,i.a.createElement(vt.a,null,i.a.createElement(i.a.Fragment,null,i.a.createElement(ft,{setHeaderActionMenu:t}),i.a.createElement(oe,{browserFields:l},e),i.a.createElement(pe,null),i.a.createElement(Mt,null)))))};It.displayName="HomePage";const Ct=i.a.memo(It),At=({children:e,history:t,onAppLeave:n,setHeaderActionMenu:l})=>{const{cases:r}=Object(y.j)().services,o=r.ui.getCasesContext(),u=Object(y.h)(),c=Object(s.useDispatch)();return Object(a.useEffect)((()=>()=>{c({type:"userChangedUrl",payload:{pathname:"",search:"",hash:""}})}),[c]),i.a.createElement(H,null,i.a.createElement(z.b,{history:t},i.a.createElement($,null,i.a.createElement(z.c,null,i.a.createElement(z.a,{path:"/"},i.a.createElement(o,{owner:[D.i],permissions:u},i.a.createElement(Ct,{setHeaderActionMenu:l},e))),i.a.createElement(z.a,null,i.a.createElement(G.a,null))))))},Dt=Object(a.memo)(At);var Nt=n(1059),Ft=n(1427);const Pt=["@timestamp","cloud.availability_zone","cloud.provider","cloud.region","destination.ip","dns.question.name","dns.question.type","event.action","event.category","event.dataset","event.module","event.outcome","event.type","file.Ext.original.path","file.hash.sha256","file.name","file.path","host.name","kibana.alert.rule.name","network.protocol","process.args","process.exit_code","process.hash.md5","process.hash.sha1","process.hash.sha256","process.parent.name","process.parent.pid","process.name","process.pid","source.ip","user.domain","user.name"],Rt=["cloud.availability_zone","cloud.provider","cloud.region","destination.ip","file.Ext.original.path","file.name","file.path","host.ip","host.name","source.ip","user.domain","user.name"];var Lt=n(1063);const Bt=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.alertSummarizationTitle",{defaultMessage:"Alert summarization"}),_t=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.alertSummarizationPrompt",{defaultMessage:"As an expert in security operations and incident response, provide a breakdown of the attached alert and summarize what it might mean for my organization."}),qt=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.ruleCreationTitle",{defaultMessage:"Query generation"}),zt=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.ruleCreationPrompt",{defaultMessage:"As an expert user of Elastic Security, please generate an accurate and valid EQL query to detect the use case below. Your response should be formatted to be able to use immediately in an Elastic Security timeline or detection rule. If Elastic Security already has a prebuilt rule for the use case, or a similar one, please provide a link to it and describe it."}),Vt=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.workflowAnalysisTitle",{defaultMessage:"Workflow suggestions"}),$t=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.workflowAnalysisPrompt",{defaultMessage:"As an expert user of Elastic Security, please suggest a workflow, with step by step instructions on how to:"}),Qt=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.threatInvestigationGuidesTitle",{defaultMessage:"Custom data ingestion helper"}),Ut=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.threatInvestigationGuidesPrompt",{defaultMessage:"As an expert user of Elastic Security, Elastic Agent, and Ingest pipelines, please list accurate and formatted, step by step instructions on how to ingest the following data using Elastic Agent and Fleet in Kibana and convert it to the Elastic Common Schema:"}),Ht=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.splQueryConversionTitle",{defaultMessage:"Query conversion"}),Gt=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.splQueryConversionPrompt",{defaultMessage:"I have the following query from a previous SIEM platform. As an expert user of Elastic Security, please suggest an Elastic EQL equivalent. I should be able to copy it immediately into an Elastic security timeline."}),Wt=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.AutomationTitle",{defaultMessage:"Agent integration advice"}),Kt=j.i18n.translate("xpack.securitySolution.assistant.quickPrompts.AutomationPrompt",{defaultMessage:"Which Fleet enabled Elastic Agent integration should I use to collect logs and events from:"}),Yt=[{title:Bt,prompt:_t,color:"#F68FBE",categories:[Lt.b],isDefault:!0},{title:qt,prompt:zt,categories:[Lt.c],color:"#7DDED8",isDefault:!0},{title:Vt,prompt:$t,color:"#36A2EF",isDefault:!0},{title:Qt,prompt:Ut,categories:[Lt.d],color:"#F3D371",isDefault:!0},{title:Ht,prompt:Gt,color:"#BADA55",isDefault:!0},{title:Wt,prompt:Kt,color:"#FFA500",isDefault:!0}],Jt=j.i18n.translate("xpack.securitySolution.assistant.content.prompts.system.youAreAHelpfulExpertAssistant",{defaultMessage:"You are a helpful, expert assistant who answers questions about Elastic Security."}),Xt=j.i18n.translate("xpack.securitySolution.assistant.content.prompts.system.useTheFollowingContextToAnswer",{defaultMessage:"Use the following context to answer questions:"}),Zt=j.i18n.translate("xpack.securitySolution.assistant.content.prompts.system.ifYouDontKnowTheAnswer",{defaultMessage:"Do not answer questions unrelated to Elastic Security."}),en=j.i18n.translate("xpack.securitySolution.assistant.content.prompts.system.superheroPersonality",{defaultMessage:"Provide the most detailed and relevant answer possible, as if you were relaying this information back to a cyber security expert."}),tn=j.i18n.translate("xpack.securitySolution.assistant.content.prompts.system.outputFormatting",{defaultMessage:'If you answer a question related to KQL or EQL, it should be immediately usable within an Elastic Security timeline; please always format the output correctly with back ticks. Any answer provided for Query DSL should also be usable in a security timeline. This means you should only ever include the "filter" portion of the query.'}),nn=[{id:"default-system-prompt",content:`${Jt} ${Zt}\n${tn}\n${Xt}`,name:j.i18n.translate("xpack.securitySolution.assistant.content.prompts.system.defaultSystemPromptName",{defaultMessage:"Default system prompt"}),promptType:"system",isDefault:!0,isNewConversationDefault:!0},{id:"CB9FA555-B59F-4F71-AFF9-8A891AC5BC28",content:`${Jt} ${Zt}\n${en}\n${tn}\n${Xt}`,name:j.i18n.translate("xpack.securitySolution.assistant.content.prompts.system.superheroSystemPromptName",{defaultMessage:"Enhanced system prompt"}),promptType:"system",isDefault:!0}];var an=n(680);const ln=`${I.a}.defaultAllow`,rn=`${I.a}.defaultAllowReplacement`,sn=({children:e,history:t,setHeaderActionMenu:n,onAppLeave:l,store:g,theme$:f})=>{const v=Object(y.j)().services,{i18n:h,application:{capabilities:E},http:S,triggersActionsUi:{actionTypeRegistry:x},uiActions:O,upselling:k}=v,j=Object(bt.a)(),{conversations:T,setConversations:w}=Object(C.a)(),{defaultAllow:N,defaultAllowReplacement:F,setDefaultAllow:P,setDefaultAllowReplacement:L}=(()=>{const[e,t]=Object(an.a)({defaultValue:Pt,key:ln,isInvalidDefault:e=>!Array.isArray(e)}),[n,a]=Object(an.a)({defaultValue:Rt,key:rn,isInvalidDefault:e=>!Array.isArray(e)});return{defaultAllow:e,defaultAllowReplacement:n,setDefaultAllow:t,setDefaultAllowReplacement:a}})(),z=Object(a.useCallback)((()=>T),[T]),V=`${D.i}.${I.a}`,[$]=Object(y.p)(D.B),{ELASTIC_WEBSITE_URL:Q,DOC_LINK_VERSION:U}=Object(y.j)().services.docLinks,H=Object(b.a)();return i.a.createElement(o.EuiErrorBoundary,null,i.a.createElement(h.Context,null,i.a.createElement(R.b,null,i.a.createElement(s.Provider,{store:g},i.a.createElement(u.KibanaThemeProvider,{theme$:f},i.a.createElement(c.EuiThemeProvider,{darkMode:$},i.a.createElement(r.d,{actionTypeRegistry:x,augmentMessageCodeBlocks:I.b,assistantAvailability:j,assistantTelemetry:H,defaultAllow:N,defaultAllowReplacement:F,docLinks:{ELASTIC_WEBSITE_URL:Q,DOC_LINK_VERSION:U},baseAllow:Pt,baseAllowReplacement:Rt,basePromptContexts:Object.values(Lt.a),baseQuickPrompts:Yt,baseSystemPrompts:nn,getInitialConversations:z,getComments:M,http:S,nameSpace:V,setConversations:w,setDefaultAllow:P,setDefaultAllowReplacement:L,title:q.c},i.a.createElement(_.b,null,i.a.createElement(Nt.b,{kibanaCapabilities:E},i.a.createElement(A.a,null,i.a.createElement(m.b,{core:v},i.a.createElement(Ft.a,null,i.a.createElement(d.c,{getTriggerCompatibleActions:O.getTriggerCompatibleActions},i.a.createElement(p.a,{upsellingService:k},i.a.createElement(Dt,{history:t,onAppLeave:l,setHeaderActionMenu:n},e))))))))))),i.a.createElement(B,null),i.a.createElement(R.a,null)))))},on=Object(a.memo)(sn),un=({children:e,history:t,onAppLeave:n,services:a,setHeaderActionMenu:l,store:r,theme$:s})=>{var o,u;const c=null!==(o=null===(u=a.cloud)||void 0===u?void 0:u.CloudContextProvider)&&void 0!==o?o:i.a.Fragment;return i.a.createElement(y.a,{services:{appName:D.j,...a}},i.a.createElement(c,null,i.a.createElement(on,{history:t,onAppLeave:n,setHeaderActionMenu:l,store:r,theme$:s},e)))},cn=Object(a.memo)(un);var dn=n(104),mn=n.n(dn),pn=n(10),bn=n.n(pn);const gn=({services:e,subPluginRoutes:t})=>{var n;const a=bn()(e.extraRoutes$,null);return i.a.createElement(z.c,null,t.map(((e,t)=>i.a.createElement(z.a,mn()({key:`route-${t}`},e)))),null!==(n=null==a?void 0:a.map(((e,t)=>i.a.createElement(z.a,mn()({key:`extra-route-${t}`},e)))))&&void 0!==n?n:i.a.createElement(z.a,null,i.a.createElement(o.EuiLoadingElastic,{size:"xl",style:{display:"flex",margin:"auto"}})),i.a.createElement(z.a,null,i.a.createElement(fn,{capabilities:e.application.capabilities})))},fn=i.a.memo((function({capabilities:e}){return!0===e[D.tc].show?i.a.createElement(V.Redirect,{to:D.Hb}):!0===e[D.q].read_cases?i.a.createElement(V.Redirect,{to:D.r}):i.a.createElement(G.a,null)})),yn=({element:e,history:t,onAppLeave:n,setHeaderActionMenu:a,services:r,store:s,usageCollection:o,subPluginRoutes:u,theme$:c})=>{var d;const m=null!==(d=null==o?void 0:o.components.ApplicationUsageTrackingProvider)&&void 0!==d?d:i.a.Fragment;return Object(l.render)(i.a.createElement(cn,{history:t,onAppLeave:n,services:r,setHeaderActionMenu:a,store:s,theme$:c},i.a.createElement(m,null,i.a.createElement(gn,{subPluginRoutes:u,services:r}))),e),()=>{r.data.search.session.clear(),Object(l.unmountComponentAtNode)(e)}};var vn=n(398)},177:function(e,t,n){"use strict";n.d(t,"a",(function(){return r}));var a=n(2),i=n(102),l=n(175);const r=e=>{var t;const[{pageName:n}]=Object(l.a)(),{services:{storage:r}}=Object(i.j)(),s=((e,t)=>t&&e.length>0?`kibana.siem:${t}.query.toggle:${e}`:null)(n,e),[o,u]=Object(a.useState)(null==s||null===(t=r.get(s))||void 0===t||t);Object(a.useEffect)((()=>{var e;null!=s&&u(null===(e=r.get(s))||void 0===e||e)}),[r,s]);const c=Object(a.useCallback)((e=>{null!=s&&(r.set(s,e),u(e))}),[r,s]);return e?{toggleStatus:o,setToggleStatus:c}:{toggleStatus:!0,setToggleStatus:()=>{}}}},181:function(e,t,n){"use strict";n.d(t,"b",(function(){return d})),n.d(t,"a",(function(){return m})),n.d(t,"c",(function(){return p}));var a=n(42),i=n(2),l=n.n(i),r=n(285),s=n(299);const o={canUserCRUD:null,canUserREAD:null,hasIndexManage:null,hasIndexMaintenance:null,hasIndexWrite:null,hasIndexRead:null,hasIndexUpdateDelete:null,isSignalIndexExists:null,isAuthenticated:null,hasEncryptionKey:null,loading:!0,signalIndexName:null,signalIndexMappingOutdated:null},u=(e,t)=>{switch(t.type){case"updateLoading":return{...e,loading:t.loading};case"updateHasIndexManage":return{...e,hasIndexManage:t.hasIndexManage};case"updateHasIndexMaintenance":return{...e,hasIndexMaintenance:t.hasIndexMaintenance};case"updateHasIndexWrite":return{...e,hasIndexWrite:t.hasIndexWrite};case"updateHasIndexRead":return{...e,hasIndexRead:t.hasIndexRead};case"updateHasIndexUpdateDelete":return{...e,hasIndexUpdateDelete:t.hasIndexUpdateDelete};case"updateIsSignalIndexExists":return{...e,isSignalIndexExists:t.isSignalIndexExists};case"updateIsAuthenticated":return{...e,isAuthenticated:t.isAuthenticated};case"updateHasEncryptionKey":return{...e,hasEncryptionKey:t.hasEncryptionKey};case"updateSignalIndexName":return{...e,signalIndexName:t.signalIndexName};case"updateSignalIndexMappingOutdated":return{...e,signalIndexMappingOutdated:t.signalIndexMappingOutdated};case"updateCanUserCRUD":return{...e,canUserCRUD:t.canUserCRUD};case"updateCanUserREAD":return{...e,canUserREAD:t.canUserREAD};default:return e}},c=Object(i.createContext)([o,()=>a.noop]),d=()=>Object(i.useContext)(c),m=({children:e})=>l.a.createElement(c.Provider,{value:Object(i.useReducer)(u,o)},e),p=()=>{const[{canUserCRUD:e,canUserREAD:t,hasIndexManage:n,hasIndexMaintenance:a,hasIndexWrite:l,hasIndexRead:o,hasIndexUpdateDelete:u,isSignalIndexExists:c,isAuthenticated:m,hasEncryptionKey:p,loading:b,signalIndexName:g,signalIndexMappingOutdated:f},y]=d(),{loading:v,isAuthenticated:h,hasEncryptionKey:E,hasIndexManage:S,hasIndexMaintenance:x,hasIndexUpdateDelete:O,hasIndexWrite:k,hasIndexRead:j,hasKibanaCRUD:T,hasKibanaREAD:w}=Object(r.a)(),{loading:M,signalIndexExists:I,signalIndexName:C,signalIndexMappingOutdated:A,createDeSignalIndex:D}=Object(s.a)();return Object(i.useEffect)((()=>{b||e===T||y({type:"updateCanUserCRUD",canUserCRUD:T})}),[y,b,e,T]),Object(i.useEffect)((()=>{b||t===w||y({type:"updateCanUserREAD",canUserREAD:w})}),[y,b,t,w]),Object(i.useEffect)((()=>{b!==(v||M)&&y({type:"updateLoading",loading:v||M})}),[y,b,v,M]),Object(i.useEffect)((()=>{b||n===S||null==S||y({type:"updateHasIndexManage",hasIndexManage:S})}),[y,b,n,S]),Object(i.useEffect)((()=>{b||l===k||null==k||y({type:"updateHasIndexWrite",hasIndexWrite:k})}),[y,b,l,k]),Object(i.useEffect)((()=>{b||o===j||null==j||y({type:"updateHasIndexRead",hasIndexRead:j})}),[y,b,o,j]),Object(i.useEffect)((()=>{b||u===O||null==O||y({type:"updateHasIndexUpdateDelete",hasIndexUpdateDelete:O})}),[y,b,u,O]),Object(i.useEffect)((()=>{b||a===x||null==x||y({type:"updateHasIndexMaintenance",hasIndexMaintenance:x})}),[y,b,a,x]),Object(i.useEffect)((()=>{b||c===I||null==I||y({type:"updateIsSignalIndexExists",isSignalIndexExists:I})}),[y,b,c,I]),Object(i.useEffect)((()=>{b||m===h||null==h||y({type:"updateIsAuthenticated",isAuthenticated:h})}),[y,b,m,h]),Object(i.useEffect)((()=>{b||p===E||null==E||y({type:"updateHasEncryptionKey",hasEncryptionKey:E})}),[y,b,p,E]),Object(i.useEffect)((()=>{b||g===C||null==C||y({type:"updateSignalIndexName",signalIndexName:C})}),[y,b,g,C]),Object(i.useEffect)((()=>{b||f===A||null==A||y({type:"updateSignalIndexMappingOutdated",signalIndexMappingOutdated:A})}),[y,b,f,A]),Object(i.useEffect)((()=>{m&&p&&n&&(null!=c&&!c||null!=f&&f)&&null!=D&&D()}),[D,m,p,c,n,f]),{loading:b,isSignalIndexExists:c,isAuthenticated:m,hasEncryptionKey:p,canUserCRUD:e,canUserREAD:t,hasIndexManage:n,hasIndexMaintenance:a,hasIndexWrite:l,hasIndexRead:o,hasIndexUpdateDelete:u,signalIndexName:g,signalIndexMappingOutdated:f}}},183:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return g}));var a=n(42),i=n(240),l=n.n(i),r=n(2),s=n(102),o=n(513),u=n(377),c=n(108);const d=e=>Object(a.keyBy)("name",function(e){const t=[];for(const n of Object.values(e))n.fields&&t.push(...Object.values(n.fields));return t}(e)),m=l()(((e,t)=>t&&t.length>0?{fields:t.map((e=>Object(a.pick)(["name","searchable","type","aggregatable","esTypes","subType","conflictDescriptions"],e))),title:e}:{fields:[],title:e}),((e,t)=>e[0]===t[0]&&e[1].length===t[1].length)),p={},b={fields:[],title:""},g=(e,t=!1,n="indexFields")=>{const{data:i}=Object(s.j)().services,l=Object(r.useRef)(new AbortController),d=Object(r.useRef)([]),[g,f]=Object(r.useState)({browserFields:p,indexes:e,indexExists:!0,indexPatterns:b,dataView:void 0,loading:!1}),{addError:y}=Object(c.a)(),v=Object(r.useCallback)((t=>{(async()=>{try{f({...g,loading:!0}),l.current=new AbortController;const e=await i.dataViews.create({title:t.join(","),allowNoIndex:!0}),n=e.toSpec(),{browserFields:a}=Object(u.a)(t,n.fields);d.current=e.getIndexPattern().split(","),f({loading:!1,dataView:n,browserFields:a,indexes:e.getIndexPattern().split(","),indexExists:e.getIndexPattern().split(",").length>0,indexPatterns:m(e.getIndexPattern(),e.fields)})}catch(t){f({browserFields:p,indexes:e,indexExists:!0,indexPatterns:b,dataView:void 0,loading:!1}),y(null==t?void 0:t.message,{title:o.a})}})()}),[y,i.dataViews,e,g]);return Object(r.useEffect)((()=>(Object(a.isEmpty)(e)||Object(a.isEqual)(d.current,e)||v(e),()=>{l.current.abort()})),[e,d]),[g.loading,g]}},187:function(e,t,n){"use strict";n.d(t,"g",(function(){return c})),n.d(t,"a",(function(){return d})),n.d(t,"e",(function(){return m})),n.d(t,"i",(function(){return p})),n.d(t,"b",(function(){return b})),n.d(t,"c",(function(){return g})),n.d(t,"j",(function(){return f})),n.d(t,"d",(function(){return y})),n.d(t,"h",(function(){return v})),n.d(t,"f",(function(){return h}));var a=n(8),i=n(139),l=n(114);const r=e=>e.policy,s=e=>e.timerange,o=e=>e.queries,u=(e,t)=>{const n=e.inputs[t];return Object(a.isEmpty)(n.linkTo)?n.queries:n.linkTo.reduce(((t,n)=>{if(n===l.a.socTrends)return t;const a=e.inputs[n];return[...t,...a.queries]}),n.queries)},c=()=>Object(i.createSelector)(r,(e=>e.kind)),d=()=>Object(i.createSelector)(r,(e=>e.duration)),m=()=>Object(i.createSelector)(s,(e=>e.kind)),p=()=>Object(i.createSelector)(s,(e=>e.from)),b=()=>Object(i.createSelector)(s,(e=>e.to)),g=()=>Object(i.createSelector)(s,(e=>e.fromStr)),f=()=>Object(i.createSelector)(s,(e=>e.toStr)),y=()=>Object(i.createSelector)(o,(e=>e.some((e=>!0===e.loading)))),v=()=>Object(i.createSelector)(u,(e=>e.filter((e=>"kql"!==e.id)))),h=()=>Object(i.createSelector)(o,(e=>e.find((e=>"kql"===e.id))))},196:function(e,t,n){"use strict";n.d(t,"e",(function(){return i})),n.d(t,"b",(function(){return l})),n.d(t,"d",(function(){return r})),n.d(t,"f",(function(){return s})),n.d(t,"a",(function(){return o})),n.d(t,"c",(function(){return u}));var a=n(4);const i={ENABLE:`${a.l} singleRuleActions enable`,DISABLE:`${a.l} singleRuleActions disable`,DUPLICATE:`${a.l} singleRuleActions duplicate`,EXPORT:`${a.l} singleRuleActions export`,DELETE:`${a.l} singleRuleActions delete`,PREVIEW:`${a.l} singleRuleActions preview`,SAVE:`${a.l} singleRuleActions save`},l={ENABLE:`${a.l} bulkRuleActions enable`,DISABLE:`${a.l} bulkRuleActions disable`,DUPLICATE:`${a.l} bulkRuleActions duplicate`,EXPORT:`${a.l} bulkRuleActions export`,DELETE:`${a.l} bulkRuleActions delete`,EDIT:`${a.l} bulkRuleActions edit`},r={REFRESH:`${a.l} rulesTable refresh`,FILTER:`${a.l} rulesTable filter`,LOAD_PREBUILT:`${a.l} rulesTable loadPrebuilt`},s={SAVE:`${a.l} timeline save`,DUPLICATE:`${a.l} timeline duplicate`,DELETE:`${a.l} timeline delete`,BULK_DELETE:`${a.l} timeline bulkDelete`},o={OPEN_ANALYZER:`${a.l} alerts openAnalyzer`,OPEN_SESSION_VIEW:`${a.l} alerts openSessionView`,INVESTIGATE_IN_TIMELINE:`${a.l} alerts investigateInTimeline`},u={FIELD_SAVED:`${a.l} fieldBrowser fieldSaved`,FIELD_DELETED:`${a.l} fieldBrowser fieldDeleted`}},200:function(e,t,n){"use strict";let a,i;n.r(t),n.d(t,"HostsType",(function(){return a})),n.d(t,"HostsTableType",(function(){return i})),function(e){e.page="page",e.details="details"}(a||(a={})),function(e){e.authentications="authentications",e.hosts="allHosts",e.events="events",e.uncommonProcesses="uncommonProcesses",e.anomalies="anomalies",e.risk="hostRisk",e.sessions="sessions"}(i||(i={}))},211:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"c",(function(){return r})),n.d(t,"b",(function(){return s})),n.d(t,"e",(function(){return o})),n.d(t,"h",(function(){return u})),n.d(t,"d",(function(){return c})),n.d(t,"f",(function(){return d})),n.d(t,"g",(function(){return m}));var a=n(4);const i="histogram-actions-trigger",l={[a.wc.hosts]:"host",[a.wc.users]:"user"},r=(e,t)=>{const n=l[e];return n&&t?[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:`${n}.name`,params:{query:t}},query:{match_phrase:{[`${n}.name`]:t}}}]:[]},s=e=>{const t=l[e];return t&&e?[{query:{bool:{should:[{exists:{field:`${t}.name`}}],minimum_should_match:1}},meta:{alias:"",disabled:!1,key:"bool",negate:!1,type:"custom",value:`{"query": {"bool": {"filter": [{"bool": {"should": [{"exists": {"field": "${t}.name"}}],"minimum_should_match": 1}}]}}}`}}]:[]},o=e=>e?[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:"source.ip",params:{query:e}},query:{bool:{should:[{match_phrase:{"source.ip":e}},{match_phrase:{"destination.ip":e}}],minimum_should_match:1}}}]:[],u=[{query:{bool:{should:[{exists:{field:"source.ip"}},{exists:{field:"destination.ip"}}],minimum_should_match:1}},meta:{alias:"",disabled:!1,key:"bool",negate:!1,type:"custom",value:'{"bool":{"filter":[{"bool":{"should":[{"bool":{"should":[{"exists":{"field": "source.ip"}}],"minimum_should_match":1}},{"bool":{"should":[{"exists":{"field": "destination.ip"}}],"minimum_should_match":1}}],"minimum_should_match":1}}]}}'}}],c=e=>e.length>=1?[{meta:{type:"phrases",key:"_index",params:e,alias:null,negate:!1,disabled:!1},query:{bool:{should:e.map((e=>({match_phrase:{_index:e}}))),minimum_should_match:1}}}]:[],d=e=>(null!=e?e:[]).reduce(((e,t)=>{var n,a,i,l,r,s;return{requests:[...e.requests,JSON.stringify({body:null==t?void 0:t.json,index:(null!==(n=null==t||null===(a=t.stats)||void 0===a||null===(i=a.indexFilter)||void 0===i?void 0:i.value)&&void 0!==n?n:"").split(",")},null,2)],responses:[...e.responses,JSON.stringify(null!==(l=null==t||null===(r=t.response)||void 0===r||null===(s=r.json)||void 0===s?void 0:s.rawResponse)&&void 0!==l?l:{},null,2)]}}),{requests:[],responses:[]}),m=e=>e.reduce(((e,t)=>{try{return[...e,JSON.parse(t)]}catch(t){return e}}),[])},216:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(42);const i=e=>Object(a.isString)(e)?e:JSON.stringify(e)},221:function(e,t,n){"use strict";n.d(t,"b",(function(){return w})),n.d(t,"a",(function(){return M}));var a=n(160),i=n(103),l=n(2),r=n(114),s=n(102),o=n(122),u=n(138),c=n(42),d=n(124),m=n(387),p=n(378);var b=n(246),g=n.n(b),f=n(254),y=n(175);var v=n(164),h=n(111),E=n(142),S=n(105),x=n(45),O=n(56);const k=({search:e,urlKey:t})=>Object(f.b)(Object(f.c)(e),t);var j=n(119),T=n(4);const w=()=>{Object(a.c)(),(()=>{const e=Object(i.useDispatch)(),{filterManager:t,savedQueries:n}=Object(s.j)().services.data.query,c=Object(l.useMemo)((()=>o.d.globalFiltersQuerySelector()),[]),d=Object(i.useSelector)(c),m=Object(l.useCallback)((t=>{null!=t&&e(u.b.setFilterQuery({id:r.a.global,query:t.query,language:t.language}))}),[e]),p=Object(l.useCallback)((n=>{null!=n?(t.setFilters(n),e(u.b.setSearchBarFilter({id:r.a.global,filters:n}))):(t.setAppFilters(d),e(u.b.setSearchBarFilter({id:r.a.global,filters:t.getFilters()})))}),[t,e,d]),b=Object(l.useCallback)((a=>{null!=a&&""!==a&&n.getSavedQuery(a).then((n=>{const a=n.attributes.filters||[],i=n.attributes.query;t.setFilters(a),e(u.b.setSearchBarFilter({id:r.a.global,filters:a})),e(u.b.setFilterQuery({id:r.a.global,...i})),e(u.b.setSavedQuery({id:r.a.global,savedQuery:n}))}))}),[e,t,n]);Object(a.b)(M.appQuery,m),Object(a.b)(M.filters,p),Object(a.b)(M.savedQuery,b)})(),(()=>{const e=Object(i.useDispatch)(),t=Object(d.a)("socTrendsEnabled"),n=Object(l.useCallback)((n=>((e,t,n)=>{if(null!=e){const a={linkTo:Object(c.get)("global.linkTo",e)},i=Object(c.get)("global.timerange.kind",e),l={linkTo:Object(c.get)("timeline.linkTo",e)},s=Object(c.get)("timeline.timerange.kind",e),o={linkTo:Object(c.get)("socTrends.linkTo",e)},d=Object(c.get)("socTrends.timerange.kind",e);if(n&&(Object(c.isEmpty)(o.linkTo)?t(u.b.removeLinkTo([r.a.global,r.a.socTrends])):t(u.b.addLinkTo([r.a.global,r.a.socTrends]))),Object(c.isEmpty)(a.linkTo)?(t(u.b.removeLinkTo([r.a.global,r.a.timeline])),n&&t(u.b.removeLinkTo([r.a.global,r.a.socTrends]))):(t(u.b.addLinkTo([r.a.global,r.a.timeline])),n&&t(u.b.addLinkTo([r.a.global,r.a.socTrends]))),Object(c.isEmpty)(l.linkTo)?t(u.b.removeLinkTo([r.a.global,r.a.timeline])):t(u.b.addLinkTo([r.a.global,r.a.timeline])),s){if("absolute"===s){const n=Object(m.a)(Object(c.get)("timeline.timerange",e));t(u.b.setAbsoluteRangeDatePicker({...n,id:r.a.timeline}))}if("relative"===s){const n=Object(m.a)(Object(c.get)("timeline.timerange",e));n.from=Object(p.c)(n.fromStr),n.to=Object(p.c)(n.toStr,{roundUp:!0}),t(u.b.setRelativeRangeDatePicker({...n,id:r.a.timeline}))}}if(i){if("absolute"===i){const n=Object(m.a)(Object(c.get)("global.timerange",e));t(u.b.setAbsoluteRangeDatePicker({...n,id:r.a.global}))}if("relative"===i){const n=Object(m.a)(Object(c.get)("global.timerange",e));n.from=Object(p.c)(n.fromStr),n.to=Object(p.c)(n.toStr,{roundUp:!0}),t(u.b.setRelativeRangeDatePicker({...n,id:r.a.global}))}}if(n&&d){if("absolute"===d){const n=Object(m.a)(Object(c.get)("socTrends.timerange",e));t(u.b.setAbsoluteRangeDatePicker({...n,id:r.a.socTrends}))}if("relative"===d){const n=Object(m.a)(Object(c.get)("socTrends.timerange",e));n.from=Object(p.c)(n.fromStr),n.to=Object(p.c)(n.toStr,{roundUp:!0}),t(u.b.setRelativeRangeDatePicker({...n,id:r.a.socTrends}))}}}})(n,e,t)),[e,t]);Object(a.b)(M.timerange,n)})(),(()=>{const[{pageName:e}]=Object(y.a)(),t=Object(i.useDispatch)(),n=g()(e),a=Object(l.useMemo)((()=>o.d.inputsSelector()),[]),s=Object(i.useSelector)(a),{timerange:c}=s.global,{timerange:d}=s.timeline;Object(l.useEffect)((()=>{((e,t)=>e&&t&&t!==e&&Object(f.d)(e))(e,n)&&("relative"===d.kind&&t(u.b.setRelativeRangeDatePicker({...d,from:Object(p.c)(d.fromStr),to:Object(p.c)(d.toStr,{roundUp:!0}),id:r.a.timeline})),"relative"===c.kind&&t(u.b.setRelativeRangeDatePicker({...c,from:Object(p.c)(c.fromStr),to:Object(p.c)(c.toStr,{roundUp:!0}),id:r.a.global})))}),[e,n,t,d,c])})(),(()=>{const e=Object(i.useDispatch)(),t=Object(l.useCallback)((t=>{null!=t&&Object(v.h)({activeTimelineTab:t.activeTab,duplicate:!1,graphEventId:t.graphEventId,timelineId:t.id,openTimeline:t.isOpen,updateIsLoading:t=>e(h.a.updateIsLoading(t)),updateTimeline:Object(v.b)(e)})}),[e]);Object(a.b)(M.timeline,t)})(),(()=>{const e=Object(a.d)(M.timeline),t=Object(l.useMemo)((()=>h.b.getTimelineByIdSelector()),[]),{activeTab:n,graphEventId:i,show:r,savedObjectId:s}=Object(S.b)((e=>{var n;return null!==(n=t(e,E.f.active))&&void 0!==n?n:{}}));Object(l.useEffect)((()=>{const t={...s?{id:s}:{},isOpen:r,activeTab:n,graphEventId:null!=i?i:""};e(t)}),[n,i,s,r,e])})(),(()=>{var e;const t=Object(l.useMemo)((()=>h.b.getTimelineByIdSelector()),[]),n=Object(S.b)((e=>t(e,E.f.active))),{search:a}=Object(x.useLocation)(),r=g()(a),s=null!==(e=null==n?void 0:n.savedObjectId)&&void 0!==e?e:"",o=Object(i.useDispatch)(),[u,c]=Object(l.useMemo)((()=>{const e=k({urlKey:M.timeline,search:null!=r?r:""}),t=k({urlKey:M.timeline,search:a});return null!=e&&null!=t?[Object(O.safeDecode)(e),Object(O.safeDecode)(t)]:[null,null]}),[r,a]),d=null==u?void 0:u.id,{id:m,activeTab:p,graphEventId:b}=c||{};Object(l.useEffect)((()=>{m&&m!==d&&m!==s&&Object(v.h)({activeTimelineTab:null!=p?p:E.g.query,duplicate:!1,graphEventId:b,timelineId:m,openTimeline:!0,updateIsLoading:e=>o(h.a.updateIsLoading(e)),updateTimeline:Object(v.b)(o)})}),[s,o,d,m,p,b])})(),(()=>{const[e]=Object(s.p)(T.lb),[t,n]=Object(l.useState)(null),[r,o]=Object(l.useState)(!1),u=Object(i.useDispatch)(),c=j.j.getTableByIdSelector(),d=Object(S.b)((e=>{var t;return null!==(t=c(e,j.e.alertsOnAlertsPage))&&void 0!==t?t:j.q})),m=Object(l.useCallback)((t=>{!e&&null!=t&&t.panelView&&n(t)}),[e]),p=Object(l.useCallback)((()=>{const{initialized:n,isLoading:a,totalCount:i,additionalFilters:l}=d,r=n&&!a&&i>0;!e&&t&&(l&&l.showBuildingBlockAlerts||u(j.h.updateShowBuildingBlockAlertsFilter({id:j.e.alertsOnAlertsPage,showBuildingBlockAlerts:!0})),r&&(o(!0),u(j.h.toggleDetailPanel({id:j.e.alertsOnAlertsPage,...t}))))}),[d,u,e,t]);Object(l.useEffect)((()=>{r||p()}),[r,p]);const b=e?"":M.eventFlyout;Object(a.b)(b,m)})(),(()=>{const e=Object(a.d)(M.eventFlyout),{pathname:t}=Object(x.useLocation)(),n=Object(i.useDispatch)(),r=j.j.getTableByIdSelector(),{expandedDetail:s}=Object(S.b)((e=>{var t;return null!==(t=r(e,j.e.alertsOnAlertsPage))&&void 0!==t?t:j.q}));Object(l.useEffect)((()=>{var a;const i=t===T.d;i&&null!=s&&null!=s&&s.query?e(s.query.panelView?s.query:null):!i&&null!=s&&null!==(a=s.query)&&void 0!==a&&a.panelView&&(n(j.h.toggleDetailPanel({id:j.e.alertsOnAlertsPage})),e(null))}),[n,s,t,e])})()};let M;!function(e){e.appQuery="query",e.eventFlyout="eventFlyout",e.filters="filters",e.savedQuery="savedQuery",e.sourcerer="sourcerer",e.timeline="timeline",e.timerange="timerange",e.pageFilter="pageFilters",e.rulesTable="rulesTable"}(M||(M={}))},230:function(e,t,n){"use strict";n.d(t,"k",(function(){return i})),n.d(t,"j",(function(){return l})),n.d(t,"l",(function(){return r})),n.d(t,"c",(function(){return s})),n.d(t,"b",(function(){return o})),n.d(t,"a",(function(){return u})),n.d(t,"m",(function(){return c})),n.d(t,"h",(function(){return d})),n.d(t,"n",(function(){return m})),n.d(t,"e",(function(){return p})),n.d(t,"i",(function(){return b})),n.d(t,"d",(function(){return g})),n.d(t,"p",(function(){return f})),n.d(t,"o",(function(){return y})),n.d(t,"f",(function(){return v})),n.d(t,"g",(function(){return h}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.visualizationActions.moreActions",{defaultMessage:"More actions"}),l=a.i18n.translate("xpack.securitySolution.visualizationActions.inspect",{defaultMessage:"Inspect"}),r=a.i18n.translate("xpack.securitySolution.visualizationActions.openInLens",{defaultMessage:"Open in Lens"}),s=a.i18n.translate("xpack.securitySolution.visualizationActions.addToNewCase",{defaultMessage:"Add to new case"}),o=a.i18n.translate("xpack.securitySolution.visualizationActions.addToExistingCase",{defaultMessage:"Add to existing case"}),u=a.i18n.translate("xpack.securitySolution.visualizationActions.addToCaseSuccessContent",{defaultMessage:"Successfully added visualization to the case"}),c=a.i18n.translate("xpack.securitySolution.visualizationActions.uniqueIps.sourceChartLabel",{defaultMessage:"Src."}),d=a.i18n.translate("xpack.securitySolution.visualizationActions.uniqueIps.destinationChartLabel",{defaultMessage:"Dest."}),m=a.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.successChartLabel",{defaultMessage:"Succ."}),p=a.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.authentication.successChartLabel",{defaultMessage:"Success"}),b=a.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.failChartLabel",{defaultMessage:"Fail"}),g=a.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.authentication.failureChartLabel",{defaultMessage:"Failure"}),f=e=>a.i18n.translate("xpack.securitySolution.visualizationActions.uniqueCountLabel",{values:{field:e},defaultMessage:"Unique count of {field}"}),y=e=>a.i18n.translate("xpack.securitySolution.visualizationActions.topValueLabel",{values:{field:e},defaultMessage:"Top values of {field}"}),v=a.i18n.translate("xpack.securitySolution.visualizationActions.countLabel",{defaultMessage:"Count of records"}),h=e=>a.i18n.translate("xpack.securitySolution.visualizationActions.countOfFieldLabel",{values:{field:e},defaultMessage:"Count of {field}"})},232:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(4);const i={ADD_EXCEPTION_FLYOUT:`${a.l} fetchAlerts addExceptionFlyout`,ALERTS_COUNT_BY_STATUS:`${a.l} fetchAlerts byRulebyCount`,ALERTS_GROUPING:`${a.l} fetchAlerts grouping`,BY_ID:`${a.l} fetchAlerts byId`,BY_RULE_BY_STATUS:`${a.l} fetchAlerts byRulebyStatus`,BY_RULE_ID:`${a.l} fetchAlerts byRuleId`,BY_SEVERITY:`${a.l} fetchAlerts bySeverity`,BY_STATUS:`${a.l} fetchAlerts byStatus`,CASES:`${a.l} fetchAlerts cases`,COUNT:`${a.l} fetchAlerts count`,HISTOGRAM:`${a.l} fetchAlerts histogram`,PREVALENCE:`${a.l} fetchAlerts prevalence`,SOC_TRENDS:`${a.l} fetchAlerts socTrends`,TREE_MAP:`${a.l} fetchAlerts treeMap`,VULNERABLE_HOSTS:`${a.l} fetchAlerts vulnerableHosts`,VULNERABLE_USERS:`${a.l} fetchAlerts vulnerableUsers`}},233:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(8),i=n(2),l=n(239),r=n(303);const s=({fetchMethod:e=l.e,query:t,indexName:n,skip:s,queryName:o})=>{const[u,c]=Object(i.useState)(t),[d,m]=Object(i.useState)({data:null,response:"",request:"",setQuery:c,refetch:null}),[p,b]=Object(i.useState)(!1),g=((e,t)=>{const{startTracking:n}=Object(r.a)();return Object(i.useMemo)((()=>async a=>{const{endTracking:i}=n({name:t});let l;try{l=await e(a),i("success")}catch(e){throw i(a.signal.aborted?"aborted":"error"),e}return l}),[e,t,n])})(e,o);return Object(i.useEffect)((()=>{let e=!0;const t=new AbortController,i=async()=>{try{b(!0);const l=await g({query:u,signal:t.signal});var a;e&&m({data:l,response:JSON.stringify(l,null,2),request:JSON.stringify({index:null!==(a=[n])&&void 0!==a?a:[""],body:u},null,2),setQuery:c,refetch:i})}catch(t){e&&m({data:null,response:"",request:"",setQuery:c,refetch:i})}e&&b(!1)};return Object(a.isEmpty)(u)||s||i(),s&&(b(!1),e=!1,t.abort()),()=>{e=!1,t.abort()}}),[u,n,s,g]),{loading:p,...d}}},242:function(e,t,n){"use strict";n.d(t,"a",(function(){return E})),n.d(t,"b",(function(){return S}));var a=n(104),i=n.n(a),l=n(2),r=n.n(l),s=n(103),o=n(40),u=n(114),c=n(190),d=n(111),m=n(178),p=n(118),b=n(106),g=n(105),f=n(138),y=n(158),v=n(110),h=n(179);const E=({timelineId:e,timelineType:t,closeGearMenu:n})=>{const a=Object(s.useDispatch)(),i=Object(l.useMemo)((()=>y.d.defaultDataViewSelector()),[]),{id:r,patternList:o}=Object(g.a)(i),{timelineFullScreen:b,setTimelineFullScreen:E}=Object(m.c)(),S=Object(g.a)(f.d.globalTimeRangeSelector),x=Object(l.useCallback)((({id:e,show:n,timeRange:i})=>{const l=null!=i?i:S;e===p.c.active&&b&&E(!1),a(y.a.setSelectedDataView({id:v.SourcererScopeName.timeline,selectedDataViewId:r,selectedPatterns:o})),a(d.a.createTimeline({columns:c.b,dataViewId:r,id:e,indexNames:o,show:n,timelineType:t})),a(d.a.setTimelineUpdatedAt({id:p.c.active,updated:void 0})),a(f.b.addLinkTo([u.a.global,u.a.timeline])),a(h.a.addNotes({notes:[]})),i&&a(f.b.removeLinkTo([u.a.timeline,u.a.global])),"absolute"===l.kind?a(f.b.setAbsoluteRangeDatePicker({...l,id:u.a.timeline})):"relative"===l.kind&&a(f.b.setRelativeRangeDatePicker({...l,id:u.a.timeline}))}),[a,S,r,o,E,b,t]);return Object(l.useCallback)((a=>{x({id:e,show:!0,timelineType:t,timeRange:null==a?void 0:a.timeRange}),"function"==typeof n&&n()}),[x,e,t,n])},S=({timelineId:e,timelineType:t,closeGearMenu:n})=>{const a=E({timelineId:e,timelineType:t,closeGearMenu:n});return{getButton:Object(l.useCallback)((({outline:e,title:n,iconType:l="plusInCircle",fill:s=!0,isDisabled:u=!1})=>{const c={iconType:l,onClick:()=>a(),fill:s},d=t===b.l.template?"template-timeline-new":"timeline-new",{fill:m,...p}=c;return e?r.a.createElement(o.EuiButton,i()({"data-test-subj":`${d}-with-border`},c),n):r.a.createElement(o.EuiButtonEmpty,i()({"data-test-subj":d,color:"text"},p),n)}),[a,t])}}},248:function(e,t,n){"use strict";n.d(t,"b",(function(){return i})),n.d(t,"j",(function(){return l})),n.d(t,"l",(function(){return r})),n.d(t,"k",(function(){return s})),n.d(t,"f",(function(){return o})),n.d(t,"i",(function(){return u})),n.d(t,"h",(function(){return c})),n.d(t,"g",(function(){return d})),n.d(t,"a",(function(){return m})),n.d(t,"c",(function(){return p})),n.d(t,"e",(function(){return b})),n.d(t,"d",(function(){return g}));var a=n(5);a.i18n.translate("xpack.securitySolution.timeline.properties.timelineDescription",{defaultMessage:"Timeline Description"});const i=a.i18n.translate("xpack.securitySolution.timeline.properties.addToFavoriteButtonLabel",{defaultMessage:"Add to favorites"}),l=a.i18n.translate("xpack.securitySolution.timeline.properties.removeFromFavoritesButtonLabel",{defaultMessage:"Remove from favorites"}),r=a.i18n.translate("xpack.securitySolution.timeline.properties.untitledTimelinePlaceholder",{defaultMessage:"Untitled timeline"}),s=a.i18n.translate("xpack.securitySolution.timeline.properties.untitledTemplatePlaceholder",{defaultMessage:"Untitled template"}),o=a.i18n.translate("xpack.securitySolution.timeline.properties.descriptionPlaceholder",{defaultMessage:"Add a description"}),u=a.i18n.translate("xpack.securitySolution.timeline.properties.notesButtonLabel",{defaultMessage:"Notes"}),c=a.i18n.translate("xpack.securitySolution.timeline.properties.newTimelineButtonLabel",{defaultMessage:"Create new timeline"}),d=a.i18n.translate("xpack.securitySolution.timeline.properties.newTemplateTimelineButtonLabel",{defaultMessage:"Create new timeline template"}),m=a.i18n.translate("xpack.securitySolution.timeline.properties.addTimelineButtonLabel",{defaultMessage:"Add new timeline or template"}),p=a.i18n.translate("xpack.securitySolution.timeline.properties.attachToCaseButtonLabel",{defaultMessage:"Attach to case"}),b=a.i18n.translate("xpack.securitySolution.timeline.properties.attachToNewCaseButtonLabel",{defaultMessage:"Attach to new case"}),g=a.i18n.translate("xpack.securitySolution.timeline.properties.attachToExistingCaseButtonLabel",{defaultMessage:"Attach to existing case"})},255:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(8);const i=(e,t=!1)=>{if(Array.isArray(e))return e;const n={};return Object.entries(e).forEach((([e,i])=>{const l=t&&Array.isArray(i)&&1===i.length;Object(a.merge)(n,Object(a.setWith)({},e,l?i[0]:i,Object))})),n}},258:function(e,t,n){e.exports=n(33)(284)},271:function(e,t,n){"use strict";n.d(t,"a",(function(){return E}));var a=n(104),i=n.n(a),l=n(2),r=n.n(l),s=n(40),o=n(103),u=n(122),c=n(114),d=n(138),m=n(12),p=n(182),b=n(110),g=n(118),f=n(106),y=n(242),v=n(135),h=n(105);const E=({asEmptyButton:e,children:t,dataProviders:n,filters:a,timeRange:E,keepDataView:S,iconType:x,...O})=>{const k=Object(o.useDispatch)(),j=Object(l.useMemo)((()=>u.e.getSourcererDataViewsSelector()),[]),{defaultDataView:T,signalIndexName:w}=Object(h.a)((e=>j(e))),M=n&&n.find((e=>"template"===e.type)),I=Object(y.a)({timelineId:g.c.active,timelineType:M?f.l.template:f.l.default}),C=Object(l.useCallback)((()=>{(n||a)&&(E?I({timeRange:E}):I(),n&&k(Object(m.updateProviders)({id:g.c.active,providers:n})),a&&k(Object(m.setFilters)({id:g.c.active,filters:a})),S||k(p.d.setSelectedDataView({id:b.SourcererScopeName.timeline,selectedDataViewId:T.id,selectedPatterns:[w||""]})),k(d.b.removeLinkTo([c.a.timeline,c.a.global])))}),[n,I,k,T.id,w,a,E,S]);return e?r.a.createElement(s.EuiButtonEmpty,{"aria-label":v.h,onClick:C,flush:"right",size:"xs",iconType:x},t):r.a.createElement(s.EuiButton,i()({"aria-label":v.h,onClick:C},O),t)};E.displayName="InvestigateInTimelineButton"},272:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"c",(function(){return b})),n.d(t,"d",(function(){return y})),n.d(t,"b",(function(){return v}));var a=n(129),i=n(119),l=n(118),r=n(110),s=n(641);const o=[i.e.alertsOnAlertsPage,i.e.alertsOnRuleDetailsPage,i.e.alertsOnCasePage,l.c.casePage],u=[{value:"all",inputDisplay:s.b,"data-test-subj":"option-all"}],c=[{value:"raw",inputDisplay:s.d,"data-test-subj":"option-raw"}],d=[{value:"alert",inputDisplay:s.a,"data-test-subj":"option-alert"}],m=[...c,...d],p=e=>{switch(e){case"all":return u;case"raw":return c;case"alert":return d;default:return m}},b=e=>!!e&&o.includes(e),g=[a.a,a.b,a.e,a.f,a.g,a.h,a.l,a.o,a.E,a.t,a.H,a.p,a.q,a.W,a.ib,a.jb,a.lb,a.r,a.u,a.v,a.w,a.x,a.A,a.B,a.C,a.D,a.F,a.G,a.I,a.K,a.L,a.M,a.N,a.O,a.P,a.Q,a.R,a.S,a.s,a.T,a.U,a.V,a.eb,a.hb,"signal.rule.building_block_type","signal.rule.id","signal.rule.name","signal.rule.threat_mapping","signal.status"],f=({tableId:e,view:t})=>"raw"===t&&b(e),y=({filters:e,tableId:t,view:n})=>f({tableId:t,view:n})?e.filter((e=>!g.includes(`${e.meta.key}`))):e,v=({scopeId:e,view:t})=>f({tableId:e,view:t})?r.SourcererScopeName.default:b(e)?r.SourcererScopeName.detections:e===l.c.active?r.SourcererScopeName.timeline:r.SourcererScopeName.default},273:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n(103),l=n(122),r=n(179),s=n(108),o=n(105);const u=({id:e,filterQuery:t,kqlError:n,query:u,startDate:c,endDate:d})=>{const{addError:m}=Object(s.a)(),p=Object(i.useDispatch)(),b=Object(a.useMemo)((()=>l.a.errorsSelector()),[]),g=Object(o.a)(b),f=null==n?void 0:n.name,y=null==n?void 0:n.message;Object(a.useEffect)((()=>{if(!t&&y&&f){const t=y.split("").reduce(((e,t)=>(e<<5)-e+t.charCodeAt(0)|0),0).toString();p(r.a.addErrorHash({id:e,hash:t,title:f,message:[y]}))}}),[e,t,m,u,c,d,p,y,f]),Object(a.useEffect)((()=>{const t=g.find((t=>t.id===e));null!=t&&t.displayError&&null!=n&&(delete n.stack,m(n,{title:n.name}))}),[m,g,e,n])}},285:function(e,t,n){"use strict";n.d(t,"a",(function(){return l}));var a=n(2),i=n(126);const l=()=>{const[e,t]=Object(a.useState)({isAuthenticated:null,hasEncryptionKey:null,hasIndexManage:null,hasIndexRead:null,hasIndexWrite:null,hasIndexUpdateDelete:null,hasIndexMaintenance:null,hasKibanaCRUD:!1,hasKibanaREAD:!1}),{detectionEnginePrivileges:n,kibanaSecuritySolutionsPrivileges:{crud:l,read:r}}=Object(i.a)();return Object(a.useEffect)((()=>{null!=n.error&&t({isAuthenticated:!1,hasEncryptionKey:!1,hasIndexManage:!1,hasIndexRead:!1,hasIndexWrite:!1,hasIndexUpdateDelete:!1,hasIndexMaintenance:!1,hasKibanaCRUD:l,hasKibanaREAD:r})}),[n.error,l,r]),Object(a.useEffect)((()=>{if(null!=n.result){const e=n.result;if(null!=e.index&&Object.keys(e.index).length>0){const n=Object.keys(e.index)[0];t({isAuthenticated:e.is_authenticated,hasEncryptionKey:e.has_encryption_key,hasIndexManage:e.index[n].manage&&e.cluster.manage,hasIndexMaintenance:e.index[n].maintenance,hasIndexRead:e.index[n].read,hasIndexWrite:e.index[n].create||e.index[n].create_doc||e.index[n].index||e.index[n].write,hasIndexUpdateDelete:e.index[n].write,hasKibanaCRUD:l,hasKibanaREAD:r})}}}),[n.result,l,r]),{loading:n.loading,...e}}},288:function(e,t,n){e.exports=n(33)(1654)},292:function(e,t,n){const a=n(157);e.exports=(e,t,n=!1)=>{if(e instanceof a)return e;try{return new a(e,t)}catch(e){if(!n)return null;throw e}}},293:function(e,t,n){"use strict";n.d(t,"a",(function(){return c})),n.d(t,"b",(function(){return d})),n.d(t,"c",(function(){return m}));var a=n(42),i=n(2),l=n(1038),r=n.n(l),s=n(57),o=n(76),u=n.n(o);const c=(e,t)=>{const n=null!=t?t:((e,t)=>{const n=t.diff(e,"days");return n<=1&&!e.isSame(t)?2:n})(u()(e[0]),u()(e[1])),a=Object(s.niceTimeFormatByDay)(n);return Object(s.timeFormatter)(a)},d=(e=100)=>{const[t,n]=Object(i.useState)({width:0,height:0}),l=Object(i.useMemo)((()=>Object(a.throttle)(e,n)),[e]),{ref:s}=r()({onResize:l});return{ref:s,...t}},m=(e,t,n,a)=>{Object(i.useEffect)((()=>{!async function(){const i=await(null==e?void 0:e.getVariation(t,n));i&&a(i)}()}),[e,t,n,a])}},294:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(40),i=n(5),l=n(44),r=n(2),s=n.n(r);const o=({count:e})=>{const[t,n,o]=Object(r.useMemo)((()=>function(e){var t;if(!Number.isFinite(e))return[e,"",""];const n=Math.pow(10,3*Math.min(Math.floor(Math.floor(Math.log10(e))/3),4)),a={compactThousands:i.i18n.translate("xpack.securitySolution.formattedNumber.compactThousands",{defaultMessage:"k"}),compactMillions:i.i18n.translate("xpack.securitySolution.formattedNumber.compactMillions",{defaultMessage:"M"}),compactBillions:i.i18n.translate("xpack.securitySolution.formattedNumber.compactBillions",{defaultMessage:"B"}),compactTrillions:i.i18n.translate("xpack.securitySolution.formattedNumber.compactTrillions",{defaultMessage:"T"})},l=new Map([[1,""],[1e3,a.compactThousands],[1e6,a.compactMillions],[1e9,a.compactBillions],[1e12,a.compactTrillions]]),r=i.i18n.translate("xpack.securitySolution.formattedNumber.compactOverflow",{defaultMessage:"+"}),s=null!==(t=l.get(n))&&void 0!==t?t:"";return[Math.floor(e/n),s,e/n%1>Number.EPSILON?r:""]}(e||0)),[e]);return null==e?null:0===e?s.a.createElement(s.a.Fragment,null,0):s.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.formattedNumber.countsLabel",description:"",defaultMessage:"{mantissa}{scale}{hasRemainder}",values:{mantissa:s.a.createElement(a.EuiI18nNumber,{value:t}),scale:n,hasRemainder:o}})},u=s.a.memo(o)},297:function(e,t,n){"use strict";n.d(t,"c",(function(){return p})),n.d(t,"i",(function(){return f})),n.d(t,"e",(function(){return y})),n.d(t,"g",(function(){return v})),n.d(t,"h",(function(){return h})),n.d(t,"f",(function(){return E})),n.d(t,"d",(function(){return S})),n.d(t,"b",(function(){return x})),n.d(t,"a",(function(){return O}));var a=n(57),i=n(40),l=n(2),r=n.n(l),s=n(41),o=n.n(s),u=n(4),c=n(102);const d="100%",m=o.a.div.withConfig({displayName:"WrappedByAutoSizerComponent",componentId:"sc-1gxuxf9-0"})([""," position:relative;&:hover{z-index:100;}"],(e=>`\n    height: ${null!=e.height?e.height:d};\n  `));m.displayName="WrappedByAutoSizer";const p=r.a.memo(m);let b;!function(e){e.BAR="bar",e.AREA="area",e.LINE="line"}(b||(b={}));const g={chartMargins:{left:0,right:0,top:4,bottom:0},chartPaddings:{left:0,right:0,top:0,bottom:0},scales:{barsPadding:.05}},f=()=>({baseTheme:Object(c.o)(u.B)?a.DARK_THEME:a.LIGHT_THEME,theme:g}),y={rotation:0,rendering:"canvas",showLegend:!1,showLegendExtra:!1,debug:!1,legendPosition:a.Position.Bottom},v=(e,t)=>{const n=e||t;return n?`${n}px`:d},h=(e,t)=>{const n=e||t;return n?`${n}px`:"100%"},E=e=>Array.isArray(e)&&e.every((e=>Array.isArray(e.value)&&e.value.every((({y:e})=>0===e)))),S=o.a.div.withConfig({displayName:"Wrapper",componentId:"sc-1gxuxf9-1"})(["position:relative;"]),x=o()(i.EuiFlexGroup).withConfig({displayName:"ChartWrapper",componentId:"sc-1gxuxf9-2"})(["z-index:0;"]),O=o()(i.EuiFlexGroup).withConfig({displayName:"BarChartWrapper",componentId:"sc-1gxuxf9-3"})(["z-index:0;padding-right:20px;"])},299:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n(109),l=n(108),r=n(239),s=n(375),o=n(285);const u=()=>{const[e,t]=Object(a.useState)(!0),[n,u]=Object(a.useState)({signalIndexExists:null,signalIndexName:null,signalIndexMappingOutdated:null,createDeSignalIndex:null}),{addError:c}=Object(l.a)(),{hasIndexRead:d}=Object(o.a)();return Object(a.useEffect)((()=>{let e=!0;const n=new AbortController,a=async()=>{try{t(!0);const a=await Object(r.h)({signal:n.signal});e&&null!=a&&u({signalIndexExists:!0,signalIndexName:a.name,signalIndexMappingOutdated:a.index_mapping_outdated,createDeSignalIndex:l})}catch(t){e&&(u({signalIndexExists:!1,signalIndexName:null,signalIndexMappingOutdated:null,createDeSignalIndex:l}),Object(i.v)(t)&&404!==t.body.status_code&&c(t,{title:s.c}))}e&&t(!1)},l=async()=>{let o=!1;try{t(!0),await Object(r.d)({signal:n.signal}),e&&(o=!0,a())}catch(t){e&&(Object(i.v)(t)&&409===t.body.status_code?a():(u({signalIndexExists:!1,signalIndexName:null,signalIndexMappingOutdated:null,createDeSignalIndex:l}),c(t,{title:s.d})))}e&&!o&&t(!1)};return d?a():t(!1),()=>{e=!1,n.abort()}}),[c,d]),{loading:e,...n}}},303:function(e,t,n){"use strict";n.d(t,"a",(function(){return l}));var a=n(2),i=n(159);const l=()=>{const{startTransaction:e}=Object(i.b)();return{startTracking:Object(a.useCallback)((({name:t,spanName:n="fetch"})=>{const a=e({name:t,type:"http-request",options:{managed:!1}}),i=null==a?void 0:a.startSpan(n,"http-request",{blocking:!0});return{endTracking:e=>{null==a||a.addLabels({result:e}),null==i||i.end()}}}),[e])}}},310:function(e,t,n){const{MAX_SAFE_COMPONENT_LENGTH:a,MAX_SAFE_BUILD_LENGTH:i,MAX_LENGTH:l}=n(326),r=n(325),s=(t=e.exports={}).re=[],o=t.safeRe=[],u=t.src=[],c=t.t={};let d=0;const m="[a-zA-Z0-9-]",p=[["\\s",1],["\\d",l],[m,i]],b=(e,t,n)=>{const a=(e=>{for(const[t,n]of p)e=e.split(`${t}*`).join(`${t}{0,${n}}`).split(`${t}+`).join(`${t}{1,${n}}`);return e})(t),i=d++;r(e,i,t),c[e]=i,u[i]=t,s[i]=new RegExp(t,n?"g":void 0),o[i]=new RegExp(a,n?"g":void 0)};b("NUMERICIDENTIFIER","0|[1-9]\\d*"),b("NUMERICIDENTIFIERLOOSE","\\d+"),b("NONNUMERICIDENTIFIER",`\\d*[a-zA-Z-]${m}*`),b("MAINVERSION",`(${u[c.NUMERICIDENTIFIER]})\\.(${u[c.NUMERICIDENTIFIER]})\\.(${u[c.NUMERICIDENTIFIER]})`),b("MAINVERSIONLOOSE",`(${u[c.NUMERICIDENTIFIERLOOSE]})\\.(${u[c.NUMERICIDENTIFIERLOOSE]})\\.(${u[c.NUMERICIDENTIFIERLOOSE]})`),b("PRERELEASEIDENTIFIER",`(?:${u[c.NUMERICIDENTIFIER]}|${u[c.NONNUMERICIDENTIFIER]})`),b("PRERELEASEIDENTIFIERLOOSE",`(?:${u[c.NUMERICIDENTIFIERLOOSE]}|${u[c.NONNUMERICIDENTIFIER]})`),b("PRERELEASE",`(?:-(${u[c.PRERELEASEIDENTIFIER]}(?:\\.${u[c.PRERELEASEIDENTIFIER]})*))`),b("PRERELEASELOOSE",`(?:-?(${u[c.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${u[c.PRERELEASEIDENTIFIERLOOSE]})*))`),b("BUILDIDENTIFIER",`${m}+`),b("BUILD",`(?:\\+(${u[c.BUILDIDENTIFIER]}(?:\\.${u[c.BUILDIDENTIFIER]})*))`),b("FULLPLAIN",`v?${u[c.MAINVERSION]}${u[c.PRERELEASE]}?${u[c.BUILD]}?`),b("FULL",`^${u[c.FULLPLAIN]}$`),b("LOOSEPLAIN",`[v=\\s]*${u[c.MAINVERSIONLOOSE]}${u[c.PRERELEASELOOSE]}?${u[c.BUILD]}?`),b("LOOSE",`^${u[c.LOOSEPLAIN]}$`),b("GTLT","((?:<|>)?=?)"),b("XRANGEIDENTIFIERLOOSE",`${u[c.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`),b("XRANGEIDENTIFIER",`${u[c.NUMERICIDENTIFIER]}|x|X|\\*`),b("XRANGEPLAIN",`[v=\\s]*(${u[c.XRANGEIDENTIFIER]})(?:\\.(${u[c.XRANGEIDENTIFIER]})(?:\\.(${u[c.XRANGEIDENTIFIER]})(?:${u[c.PRERELEASE]})?${u[c.BUILD]}?)?)?`),b("XRANGEPLAINLOOSE",`[v=\\s]*(${u[c.XRANGEIDENTIFIERLOOSE]})(?:\\.(${u[c.XRANGEIDENTIFIERLOOSE]})(?:\\.(${u[c.XRANGEIDENTIFIERLOOSE]})(?:${u[c.PRERELEASELOOSE]})?${u[c.BUILD]}?)?)?`),b("XRANGE",`^${u[c.GTLT]}\\s*${u[c.XRANGEPLAIN]}$`),b("XRANGELOOSE",`^${u[c.GTLT]}\\s*${u[c.XRANGEPLAINLOOSE]}$`),b("COERCE",`(^|[^\\d])(\\d{1,${a}})(?:\\.(\\d{1,${a}}))?(?:\\.(\\d{1,${a}}))?(?:$|[^\\d])`),b("COERCERTL",u[c.COERCE],!0),b("LONETILDE","(?:~>?)"),b("TILDETRIM",`(\\s*)${u[c.LONETILDE]}\\s+`,!0),t.tildeTrimReplace="$1~",b("TILDE",`^${u[c.LONETILDE]}${u[c.XRANGEPLAIN]}$`),b("TILDELOOSE",`^${u[c.LONETILDE]}${u[c.XRANGEPLAINLOOSE]}$`),b("LONECARET","(?:\\^)"),b("CARETTRIM",`(\\s*)${u[c.LONECARET]}\\s+`,!0),t.caretTrimReplace="$1^",b("CARET",`^${u[c.LONECARET]}${u[c.XRANGEPLAIN]}$`),b("CARETLOOSE",`^${u[c.LONECARET]}${u[c.XRANGEPLAINLOOSE]}$`),b("COMPARATORLOOSE",`^${u[c.GTLT]}\\s*(${u[c.LOOSEPLAIN]})$|^$`),b("COMPARATOR",`^${u[c.GTLT]}\\s*(${u[c.FULLPLAIN]})$|^$`),b("COMPARATORTRIM",`(\\s*)${u[c.GTLT]}\\s*(${u[c.LOOSEPLAIN]}|${u[c.XRANGEPLAIN]})`,!0),t.comparatorTrimReplace="$1$2$3",b("HYPHENRANGE",`^\\s*(${u[c.XRANGEPLAIN]})\\s+-\\s+(${u[c.XRANGEPLAIN]})\\s*$`),b("HYPHENRANGELOOSE",`^\\s*(${u[c.XRANGEPLAINLOOSE]})\\s+-\\s+(${u[c.XRANGEPLAINLOOSE]})\\s*$`),b("STAR","(<|>)?=?\\s*\\*"),b("GTE0","^\\s*>=\\s*0\\.0\\.0\\s*$"),b("GTE0PRE","^\\s*>=\\s*0\\.0\\.0-0\\s*$")},311:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),l=n(41),r=n.n(l),s=n(42);const o=r.a.div.withConfig({displayName:"StyledDiv",componentId:"sc-we8ln-0"})(["width:100%;display:flex;flex-grow:1;> *{max-width:100%;}",""],(({targetClassNames:e})=>Object(l.css)(["","{pointer-events:none;opacity:0;transition:opacity "," ease;}","{pointer-events:auto;opacity:1;}"],e.map((e=>`.${e}`)).join(", "),(e=>Object(s.getOr)(250,"theme.eui.euiAnimSpeedNormal",e)),e.map((e=>`&:hover .${e}`)).join(", ")))),u=i.a.memo((({show:e=!0,targetClassNames:t,children:n})=>e?i.a.createElement(o,{"data-test-subj":"hoverVisibilityContainer",targetClassNames:t},n):i.a.createElement(i.a.Fragment,null,n)));u.displayName="HoverVisibilityContainer"},312:function(e,t,n){"use strict";n.d(t,"a",(function(){return r})),n.d(t,"b",(function(){return s})),n.d(t,"c",(function(){return o})),n.d(t,"d",(function(){return u})),n.d(t,"e",(function(){return c})),n.d(t,"f",(function(){return d})),n.d(t,"g",(function(){return m})),n.d(t,"h",(function(){return p}));var a=n(129),i=n(119),l=n(328);const r=e=>{const t="acknowledged"===e?{bool:{should:[{term:{[a.jb]:e}},{term:{[a.jb]:"in-progress"}}]}}:{term:{[a.jb]:e}};return[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:a.jb,params:{query:e}},query:t}]},s=e=>[{meta:{alias:null,negate:!1,disabled:!1},query:{bool:{should:e.map((e=>({term:{[a.jb]:e}})))}}}],o=e=>e?[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:a.K,params:{query:e}},query:{match_phrase:{[a.K]:e}}}]:[],u=e=>e?[]:[{meta:{alias:null,negate:!0,disabled:!1,type:"exists",key:a.b,value:"exists"},query:{exists:{field:a.b}}}],c=e=>e?[{meta:{alias:null,disabled:!1,negate:!1,key:"kibana.alert.rule.type",type:"term"},query:{term:{"kibana.alert.rule.type":"threat_match"}}}]:[],d=e=>({...i.q,columns:Object(l.b)(e),showCheckboxes:!0}),m=e=>({...d(e),columns:Object(l.b)(e),defaultColumns:Object(l.c)(e),sort:[{columnId:"kibana.alert.original_time",columnType:"date",esTypes:["date"],sortDirection:"desc"}],showCheckboxes:!1}),p=["@timestamp","kibana.alert.workflow_status","kibana.alert.workflow_tags","kibana.alert.group.id","kibana.alert.original_time","kibana.alert.building_block_type","kibana.alert.rule.from","kibana.alert.rule.name","kibana.alert.rule.to","kibana.alert.rule.uuid","kibana.alert.rule.rule_id","kibana.alert.rule.type","kibana.alert.suppression.docs_count","kibana.alert.original_event.kind","kibana.alert.original_event.module","file.path","file.Ext.code_signature.subject_name","file.Ext.code_signature.trusted","file.hash.sha256","host.os.family","event.code","process.entry_leader.entity_id"]},317:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return v})),n.d(t,"c",(function(){return h})),n.d(t,"d",(function(){return E})),n.d(t,"e",(function(){return S}));var a=n(2),i=n.n(a),l=n(41),r=n.n(l);const s=r.a.aside.attrs({className:"siemUtilityBar"}).withConfig({displayName:"Bar",componentId:"sc-yj1vvr-0"})(["",""],(({border:e,theme:t})=>Object(l.css)([""," @media only screen and (min-width:","){display:flex;justify-content:space-between;}"],e&&Object(l.css)(["border-bottom:",";padding-bottom:",";align-items:center;"],t.eui.euiBorderThin,t.eui.euiSizeXS),t.eui.euiBreakpoints.l)));s.displayName="Bar";const o=r.a.div.attrs({className:"siemUtilityBar__section"}).withConfig({displayName:"BarSection",componentId:"sc-yj1vvr-1"})(["",""],(({grow:e,theme:t})=>Object(l.css)(["& + &{margin-top:",";align-items:center;}@media only screen and (min-width:","){display:flex;flex-wrap:wrap;}@media only screen and (min-width:","){& + &{margin-top:0;margin-left:",";}}",""],t.eui.euiSizeS,t.eui.euiBreakpoints.m,t.eui.euiBreakpoints.l,t.eui.euiSize,e&&Object(l.css)(["flex:1;"]))));o.displayName="BarSection";const u=r.a.div.attrs({className:"siemUtilityBar__group"}).withConfig({displayName:"BarGroup",componentId:"sc-yj1vvr-2"})(["",""],(({grow:e,theme:t})=>Object(l.css)(["align-items:flex-start;display:flex;flex-wrap:wrap;& + &{margin-top:",";}@media only screen and (min-width:","){border-right:",";flex-wrap:nowrap;margin-right:",";padding-right:",";& + &{margin-top:0;}&:last-child{border-right:none;margin-right:0;padding-right:0;}}& > *{margin-right:",";&:last-child{margin-right:0;}}",""],t.eui.euiSizeS,t.eui.euiBreakpoints.m,t.eui.euiBorderThin,t.eui.euiSizeM,t.eui.euiSizeM,t.eui.euiSize,e&&Object(l.css)(["flex:1;"]))));u.displayName="BarGroup";const c=r.a.p.attrs((({className:e})=>({className:e||"siemUtilityBar__text"}))).withConfig({displayName:"BarText",componentId:"sc-yj1vvr-3"})(["",""],(({shouldWrap:e,theme:t})=>Object(l.css)(["color:",";font-size:",";line-height:",";white-space:",";"],t.eui.euiTextSubduedColor,t.eui.euiFontSizeXS,t.eui.euiLineHeight,e?"normal":"nowrap")));c.displayName="BarText";const d=r.a.div.attrs({className:"siemUtilityBar__action"}).withConfig({displayName:"BarAction",componentId:"sc-yj1vvr-4"})(["",""],(({theme:e})=>Object(l.css)(["font-size:",";"],e.eui.euiFontSizeXS)));d.displayName="BarAction";const m=r.a.div.attrs({className:"siemUtilityBar__spacer"}).withConfig({displayName:"BarSpacer",componentId:"sc-yj1vvr-5"})(["",""],(()=>Object(l.css)(["flex:1;"])));m.displayName="BarSpacer";const p=i.a.memo((({border:e,children:t})=>i.a.createElement(s,{border:e},t)));p.displayName="UtilityBar";var b=n(40),g=n(674);const f=r()(b.EuiButtonEmpty).withConfig({displayName:"LoadingButtonEmpty",componentId:"sc-ou55gk-0"})(["",""],(({theme:e})=>Object(l.css)(["&.euiButtonEmpty{height:",";}"],e.eui.euiSize))),y=i.a.memo((({children:e,color:t,iconSide:n,iconSize:l,iconType:r,popoverContent:s,disabled:o,ownFocus:u,dataTestSubj:c,popoverPanelPaddingSize:d,onClick:m})=>{const[p,f]=Object(a.useState)(!1),y=Object(a.useCallback)((()=>f(!1)),[f]),v=Object(a.useCallback)((()=>{null==m||m(),f(!p)}),[p,m]);return i.a.createElement(b.EuiPopover,{ownFocus:u,panelPaddingSize:d,button:i.a.createElement(g.a,{dataTestSubj:c,color:t,iconSide:n,iconSize:l,iconType:r,disabled:o,onClick:v},e),closePopover:y,isOpen:p,repositionOnScroll:!0},null==s?void 0:s(y))}));y.displayName="Popover";const v=i.a.memo((({children:e,color:t,dataTestSubj:n,disabled:a,href:l,iconSide:r,iconSize:s,iconType:o,ownFocus:u,onClick:c,popoverContent:m,popoverPanelPaddingSize:p,inProgress:b})=>b?i.a.createElement(d,null,i.a.createElement(f,{"data-test-subj":`${n}-progress`,size:"xs",className:"eui-alignTop",isLoading:!0,iconSide:"right",flush:"both"},e)):i.a.createElement(d,{"data-test-subj":n},m?i.a.createElement(y,{dataTestSubj:`${n}-popover`,disabled:a,color:t,iconSide:r,iconSize:s,iconType:o,ownFocus:u,popoverPanelPaddingSize:p,popoverContent:m,onClick:c},e):i.a.createElement(g.a,{color:t,dataTestSubj:`${n}-linkIcon`,disabled:a,href:l,iconSide:r,iconSize:s,iconType:o,onClick:c},e))));v.displayName="UtilityBarAction";const h=i.a.memo((({grow:e,children:t})=>i.a.createElement(u,{grow:e},t)));h.displayName="UtilityBarGroup";const E=i.a.memo((({grow:e,children:t,dataTestSubj:n})=>i.a.createElement(o,{grow:e,"data-test-subj":n},t)));E.displayName="UtilityBarSection",i.a.memo((({dataTestSubj:e})=>i.a.createElement(m,{"data-test-subj":e}))).displayName="UtilityBarSpacer";const S=i.a.memo((({children:e,dataTestSubj:t,shouldWrap:n=!1,className:a})=>i.a.createElement(c,{"data-test-subj":t,shouldWrap:n,className:a},e)));S.displayName="UtilityBarText"},321:function(e,t,n){"use strict";n.d(t,"a",(function(){return W})),n.d(t,"c",(function(){return Y})),n.d(t,"b",(function(){return ee}));var a=n(104),i=n.n(a),l=n(40),r=n(109),s=n(2),o=n.n(s),u=n(70),c=n(103),d=n(41),m=n.n(d),p=n(119),b=n(227),g=n(152),f=n(339),y=n(637),v=n(153),h=n(638),E=n(670),S=n(658),x=n(5),O=n(59),k=n(118),j=n(8),T=n(13),w=n(115),M=n(111),I=n(102),C=n(958),A=n(110),D=n(116),N=n(699);const F=({field:e,value:t})=>null==t?e:Array.isArray(t)?`${e} ${t.join(" ")}`:`${e} ${t}`;var P=n(272);const R=o.a.memo((({className:e,Component:t,enablePopOver:n,field:a,flush:i,iconSide:r,iconType:u,isExpandable:c,onClick:d,onFilterAdded:m,ownFocus:p,paddingSize:b,showLegend:g,showTooltip:f=!0,showTopN:y,scopeId:v,title:h,value:E,globalFilters:S})=>{const O=Object(w.isActiveTimeline)(null!=v?v:"")?A.SourcererScopeName.timeline:null!=v&&Object(P.c)(v)?A.SourcererScopeName.detections:A.SourcererScopeName.default,{browserFields:k,indexPattern:j}=Object(D.d)(O),T=null!=u?u:"visBarVertical",M=null!=r?r:"left",I=null!=h?h:(R=a,x.i18n.translate("xpack.securitySolution.hoverActions.showTopTooltip",{values:{fieldName:R},defaultMessage:"Show top {fieldName}"}));var R;const L=Object(s.useMemo)((()=>t?o.a.createElement(t,{"aria-label":I,className:e,"data-test-subj":"show-top-field",icon:T,iconType:T,iconSide:M,flush:i,onClick:d,title:I},I):o.a.createElement(l.EuiButtonIcon,{"aria-label":I,className:"securitySolution__hoverActionButton","data-test-subj":"show-top-field",iconSize:"s",iconType:T,onClick:d})),[t,I,e,i,T,d,M]),B=Object(s.useMemo)((()=>f&&!y?o.a.createElement(l.EuiToolTip,{content:o.a.createElement(N.a,{additionalScreenReaderOnlyContext:F({field:a,value:E}),content:I,shortcut:"t",showShortcut:p})},L):L),[L,I,a,p,f,y,E]),_=Object(s.useMemo)((()=>o.a.createElement(C.a,{browserFields:k,field:a,indexPattern:j,onFilterAdded:m,paddingSize:b,showLegend:g,scopeId:null!=v?v:void 0,toggleTopN:d,globalFilters:S})),[k,a,j,m,b,g,v,d,S]);return c?o.a.createElement(o.a.Fragment,null,L,y&&_):y?n?o.a.createElement(l.EuiPopover,{button:L,isOpen:y,closePopover:d,panelClassName:"withHoverActions__popover","data-test-subj":"showTopNContainer"},_):_:B}));R.displayName="ShowTopNButton";var L=n(12),B=n(105),_=n(131);const q=m.a.div.withConfig({displayName:"AdditionalContent",componentId:"sc-hbiy4s-0"})(["padding:2px;"]);q.displayName="AdditionalContent";const z=m.a.div.withConfig({displayName:"StyledHoverActionsContainer",componentId:"sc-hbiy4s-1"})(["display:flex;"," ",""],(e=>e.$isActive?"\n    .hoverActions-active {\n      .timelines__hoverActionButton,\n      .securitySolution__hoverActionButton {\n        opacity: 1;\n      }\n    }\n  ":""),(e=>e.$showOwnFocus?`\n    &:focus-within {\n      .timelines__hoverActionButton,\n      .securitySolution__hoverActionButton {\n        opacity: 1;\n      }\n    }\n\n    &:hover {\n      .timelines__hoverActionButton,\n      .securitySolution__hoverActionButton {\n        opacity: 1;\n      }\n    }\n\n  .timelines__hoverActionButton,\n  .securitySolution__hoverActionButton {\n    opacity: ${e.$showTopN?1:0};\n\n      &:focus {\n        opacity: 1;\n      }\n    }\n  `:"")),V=m()(z).withConfig({displayName:"StyledHoverActionsContainerWithPaddingsAndMinWidth",componentId:"sc-hbiy4s-2"})(["min-width:",";padding:",";position:relative;"],(({$hiddenActionsCount:e})=>138-26*e+"px"),(e=>`0 ${e.theme.eui.euiSizeS}`)),$=({ownFocus:e,showTopN:t})=>!t&&!e,Q=o.a.memo((({additionalContent:e=null,closePopOver:t,closeTopN:n,dataProvider:a,dataType:i,draggableId:r,enableOverflowButton:u=!1,applyWidthAndPadding:d=!0,field:m,fieldType:p,isAggregatable:b,goGetTimelineId:g,isObjectArray:f,hideAddToTimeline:y=!1,hideTopN:h=!1,onFilterAdded:E,ownFocus:S,showOwnFocus:C=!0,showTopN:A,scopeId:D,toggleColumn:N,toggleTopN:F,values:P})=>{const[Q,U]=Object(s.useState)(),[H,G]=Object(s.useState)(!1),[W,K]=Object(s.useState)(!1),Y=Object(s.useCallback)((()=>{G((e=>!e)),K(!W)}),[W,K]),J=Object(s.useCallback)((()=>{n&&n(),G(!1),K(!1),t&&t()}),[t,n]),X=Object(s.useRef)(!0),Z=Object(s.useRef)(null);Object(s.useEffect)((()=>{X.current&&null!=g&&null==D&&(X.current=!1,g(!0))}),[g,D]),Object(s.useEffect)((()=>{S&&setTimeout((()=>{var e;null===(e=Z.current)||void 0===e||e.focus()}),0)}),[S]);const ee=Object(s.useCallback)((e=>{if(S)switch(e.key){case"t":Object(O.stopPropagationAndPreventDefault)(e),F();break;case"Enter":break;case"Escape":Object(O.stopPropagationAndPreventDefault)(e);break;default:U(e)}}),[S,F]),te=D===k.c.casePage,ne=D===k.c.active,ae=D===k.c.detectionsAlertDetailsPage,ie=D===_.a.entityAnalytics,le=Object(s.useMemo)((()=>(ae||ie)&&!ne),[ne,ae,ie]),re=Object(s.useMemo)((()=>(h?1:0)+(le?2:0)),[le,h]),{overflowActionItems:se,allActionItems:oe}=(({dataProvider:e,dataType:t,defaultFocusedButtonRef:n,draggableId:a,enableOverflowButton:i,field:r,fieldType:u,isAggregatable:d,handleHoverActionClicked:m,hideFilters:p,hideTopN:b,hideAddToTimeline:g,isCaseView:f,isObjectArray:y,isOverflowPopoverOpen:h,itemsToShow:E=2,onFilterAdded:S,onOverflowButtonClick:x,ownFocus:O,showTopN:C,stKeyboardEvent:A,scopeId:D,toggleColumn:N,toggleTopN:F,values:P})=>{const _=Object(I.j)(),q=Object(c.useDispatch)(),{timelines:z,uiSettings:V}=_.services,{getAddToTimelineButton:$,getColumnToggleButton:Q,getCopyButton:U,getFilterForValueButton:H,getFilterOutValueButton:G,getOverflowButton:W}=z.getHoverActions(),K=Object(s.useMemo)((()=>_.services.data.query.filterManager),[_.services.data.query.filterManager]),Y=Object(s.useMemo)((()=>M.b.getTimelineByIdSelector()),[]),J=Object(B.a)((e=>{var t;return Object(w.isActiveTimeline)(null!=D?D:"")?null===(t=Y(e,null!=D?D:""))||void 0===t?void 0:t.filterManager:void 0})),X=Object(s.useMemo)((()=>Object(w.isActiveTimeline)(null!=D?D:"")?null!=J?J:new T.FilterManager(V):K),[D,J,V,K]),Z=Object(s.useCallback)((()=>{e&&!Object(j.isEmpty)(e)&&q(Object(L.addProvider)({id:k.c.active,providers:e instanceof Array?e:[e]}))}),[e,q]),ee=Object(s.useCallback)((()=>{m&&m(),Z()}),[m,Z]),te=Object(s.useMemo)((()=>!p&&null!=P&&(i||!C&&!i)&&!f),[i,p,f,C,P]),ne=y&&"geo_point"!==r||f,ae=Object(s.useMemo)((()=>o.a.createElement(R,{Component:i?l.EuiContextMenuItem:void 0,"data-test-subj":"hover-actions-show-top-n",enablePopOver:!i&&f,field:r,key:"hover-actions-show-top-n",onClick:F,onFilterAdded:S,ownFocus:O,showTopN:C,showTooltip:!i,scopeId:D,value:P})),[i,f,r,F,S,O,C,D,P]),ie=Object(s.useMemo)((()=>[te?o.a.createElement("div",{"data-test-subj":"hover-actions-filter-for",key:"hover-actions-filter-for"},H({defaultFocusedButtonRef:n,field:r,filterManager:X,keyboardEvent:A,onClick:m,onFilterAdded:S,ownFocus:O,showTooltip:!i,value:P})):null,te?o.a.createElement("div",{"data-test-subj":"hover-actions-filter-out",key:"hover-actions-filter-out"},G({field:r,filterManager:X,keyboardEvent:A,onFilterAdded:S,ownFocus:O,onClick:m,showTooltip:!i,value:P})):null,N&&!ne?o.a.createElement("div",{"data-test-subj":"hover-actions-toggle-column",key:"hover-actions-toggle-column"},Q({Component:i?l.EuiContextMenuItem:void 0,field:r,isDisabled:y&&"geo_point"!==t,isObjectArray:y,keyboardEvent:A,ownFocus:O,onClick:m,showTooltip:!i,toggleColumn:N,value:P})):null,null==P||null==a&&Object(j.isEmpty)(e)||g?null:o.a.createElement("div",{"data-test-subj":"hover-actions-add-timeline",key:"hover-actions-add-timeline"},$({Component:i?l.EuiContextMenuItem:void 0,dataProvider:e,draggableId:a,field:r,keyboardEvent:A,ownFocus:O,onClick:ee,showTooltip:!i,value:P})),Object(v.e)({fieldType:u,isAggregatable:d,fieldName:r,hideTopN:b})?ae:null,null!=r?o.a.createElement("div",{"data-test-subj":"hover-actions-copy-button",key:"hover-actions-copy-button"},U({Component:i?l.EuiContextMenuItem:void 0,field:r,isHoverAction:!0,keyboardEvent:A,ownFocus:O,onClick:m,showTooltip:!i,value:P})):null].filter((e=>null!=e))),[e,t,n,a,i,r,u,d,X,$,Q,U,H,G,m,ee,g,b,y,S,O,ne,te,ae,A,N,P]);return{overflowActionItems:Object(s.useMemo)((()=>[...ie.slice(0,E),...i&&E>0&&E<ie.length?[W({closePopOver:m,field:r,keyboardEvent:A,ownFocus:O,onClick:x,showTooltip:!i,value:P,items:C?[ae]:ie.slice(E),isOverflowPopoverOpen:!!h})]:[]].filter((e=>null!=e))),[ie,i,r,W,m,h,E,x,ae,O,C,A,P]),allActionItems:Object(s.useMemo)((()=>!C||i||f?ie:[ae]),[C,i,f,ae,ie])}})({dataProvider:a,dataType:i,defaultFocusedButtonRef:Z,draggableId:r,enableOverflowButton:u&&!te,field:m,fieldType:p,hideFilters:le,isAggregatable:b,handleHoverActionClicked:J,hideAddToTimeline:y,hideTopN:h,isCaseView:te,isObjectArray:f,isOverflowPopoverOpen:W,onFilterAdded:E,onOverflowButtonClick:Y,ownFocus:S,showTopN:A,stKeyboardEvent:Q,toggleColumn:N,toggleTopN:F,values:P,scopeId:D}),ue=d?V:z;return o.a.createElement(l.EuiFocusTrap,{disabled:$({ownFocus:S,showTopN:A})},o.a.createElement(ue,{"data-test-subj":"hover-actions-container",onKeyDown:ee,$showTopN:A,$showOwnFocus:C,$hiddenActionsCount:re,$isActive:H,className:H?"hoverActions-active":""},o.a.createElement(l.EuiScreenReaderOnly,null,o.a.createElement("p",null,(ce=m,x.i18n.translate("xpack.securitySolution.dragAndDrop.youAreInADialogContainingOptionsScreenReaderOnly",{values:{fieldName:ce},defaultMessage:"You are in a dialog, containing options for field {fieldName}. Press tab to navigate options. Press escape to exit."})))),null!=e&&o.a.createElement(q,null,e),u&&!te?se:oe));var ce}));Q.displayName="HoverActions";var U=n(922);const H=({dataProvider:e,isAggregatable:t,fieldType:n,hideTopN:a,isDraggable:i,onFilterAdded:l,render:r,scopeId:u})=>{const{timelineId:c}=Object(s.useContext)(S.b),{tableId:d}=Object(s.useContext)(U.b),m=Object(s.useRef)(null),p=Object(s.useRef)(null),[b,g]=Object(s.useState)(!1),[f,y]=Object(s.useState)(!1),h=Object(s.useMemo)((()=>u||(null!=c?c:d)),[u,d,c]),E=Object(s.useCallback)((()=>{g((e=>!e)),y((e=>(e&&setTimeout((()=>{var e;null===(e=p.current)||void 0===e||e.focus()}),0),!1))),setTimeout((()=>{y(!1)}),0)}),[p]),{closeTopN:x,toggleTopN:O,isShowingTopN:k}=(e=>{const[t,n]=Object(s.useState)(!1),a=Object(s.useCallback)((()=>{n((t=>{const n=!t;return e&&e(n),n}))}),[e]);return{closeTopN:Object(s.useCallback)((()=>{n(!1)}),[]),toggleTopN:a,isShowingTopN:t}})(E),j=Object(s.useMemo)((()=>{const t=e.queryMatch.value;return"number"==typeof t||"boolean"==typeof t?t.toString():Array.isArray(t)?t.map((e=>String(e))):t}),[e.queryMatch.value]),T=Object(s.useMemo)((()=>{const s=f&&!k&&(null!==(c=null==(u=m.current)?void 0:u.querySelectorAll(".euiLink"))&&void 0!==c?c:[]).length>0?o.a.createElement(Y,{"data-test-subj":`draggable-link-content-${e.queryMatch.field}`},r(e,null,{isDragging:!1,isDropAnimating:!1,isClone:!1,dropAnimation:null,draggingOver:null,combineWith:null,combineTargetFor:null,mode:null})):null;var u,c;return o.a.createElement(Q,{additionalContent:s,closeTopN:x,closePopOver:E,dataProvider:e,draggableId:i?Object(v.l)(e.id):void 0,field:e.queryMatch.field,isAggregatable:t,fieldType:n,hideTopN:a,isObjectArray:!1,onFilterAdded:l,ownFocus:f,showOwnFocus:!1,showTopN:k,scopeId:h,toggleTopN:O,values:j})}),[f,k,e,r,x,E,i,t,n,a,l,h,O,j]),w=Object(s.useCallback)((e=>{m.current=e}),[]),M=Object(s.useCallback)((()=>{var e;f||null===(e=p.current)||void 0===e||e.focus()}),[f,p]),I=Object(s.useCallback)((()=>{x(),f&&(y(!1),setTimeout((()=>{M()}),0))}),[M,f,x]),C=Object(s.useCallback)((()=>{y(!0)}),[]);return Object(s.useMemo)((()=>({closePopOverTrigger:b,handleClosePopOverTrigger:E,hoverActionsOwnFocus:f,hoverContent:T,keyboardHandlerRef:p,onCloseRequested:I,onFocus:M,openPopover:C,setContainerRef:w,isShowingTopN:k})),[b,E,f,T,I,M,C,w,k])};var G=n(662);const W=m.a.div.withConfig({displayName:"DragEffects",componentId:"sc-1n4vnmw-0"})([""]);W.displayName="DragEffects";class draggable_wrapper_DragDropErrorBoundary extends o.a.PureComponent{componentDidCatch(){this.forceUpdate()}render(){return this.props.children}}const K=m.a.div.withConfig({displayName:"Wrapper",componentId:"sc-1n4vnmw-1"})(["display:inline-block;max-width:100%;[data-rbd-placeholder-context-id]{display:none !important;}",""],(({disabled:e})=>e&&"\n    [data-rbd-draggable-id]:hover,\n    .euiBadge:hover,\n    .euiBadge__text:hover {\n      cursor: default;\n    }\n  "));K.displayName="Wrapper";const Y=m.a.span.withConfig({displayName:"ProviderContentWrapper",componentId:"sc-1n4vnmw-2"})(["> span.euiToolTipAnchor{display:block;}> span.euiToolTipAnchor.eui-textTruncate{display:inline-block;}"]),J=(e,t)=>t.isDropAnimating?{...e,transitionDuration:"0.00000001s"}:e,X=({dataProvider:e,hideTopN:t=!1,onFilterAdded:n,render:a,fieldType:d="",isAggregatable:m=!1,scopeId:p,truncate:S})=>{const[x,O]=Object(s.useState)(!1),k=e.id.includes(`-${g.a}-`),j=Object(c.useDispatch)(),{closePopOverTrigger:T,handleClosePopOverTrigger:w,hoverActionsOwnFocus:M,hoverContent:I,keyboardHandlerRef:C,onCloseRequested:A,openPopover:D,onFocus:N,setContainerRef:F,isShowingTopN:P}=H({dataProvider:e,hideTopN:t,onFilterAdded:n,render:a,fieldType:d,isAggregatable:m,scopeId:p,truncate:S}),R=Object(s.useCallback)((()=>{k||(j(b.a.registerProvider({provider:e})),O(!0))}),[k,j,e]),L=Object(s.useCallback)((()=>x&&j(b.a.unRegisterProvider({id:e.id}))),[x,j,e.id]);Object(s.useEffect)((()=>()=>{L()}),[L]);const B=Object(s.useCallback)(((t,n)=>o.a.createElement(te,{registerProvider:R},o.a.createElement("div",i()({},t.draggableProps,t.dragHandleProps,{style:J(t.draggableProps.style,n),ref:t.innerRef,"data-test-subj":"providerContainer",tabIndex:-1}),o.a.createElement(Y,{"data-test-subj":`draggable-content-${e.queryMatch.field}`},a(e,t,n))))),[e,R,a]),_=Object(s.useCallback)(((t,n)=>o.a.createElement(h.a,i()({},t.draggableProps,t.dragHandleProps,{ref:e=>{t.innerRef(e),F(e)},"data-test-subj":"providerContainer",isDragging:n.isDragging,registerProvider:R,tabIndex:-1}),o.a.createElement(l.EuiScreenReaderOnly,{"data-test-subj":"screenReaderOnlyField"},o.a.createElement("p",null,e.queryMatch.field)),S&&!n.isDragging?o.a.createElement(f.b,{"data-test-subj":"draggable-truncatable-content"},a(e,t,n)):o.a.createElement(Y,{"data-test-subj":`draggable-content-${e.queryMatch.field}`},a(e,t,n)),!n.isDragging&&o.a.createElement(l.EuiScreenReaderOnly,{"data-test-subj":"draggableKeyboardInstructionsNotDragging"},o.a.createElement("p",null,E.b)))),[e,R,a,F,S]),{onBlur:q,onKeyDown:z}=Object(G.a)({closePopover:w,draggableId:Object(v.l)(e.id),fieldName:e.queryMatch.field,keyboardHandlerRef:C,openPopover:D}),V=Object(s.useCallback)((t=>o.a.createElement("div",i()({ref:t.innerRef},t.droppableProps),o.a.createElement("div",{className:r.a,"data-test-subj":"draggableWrapperKeyboardHandler",onClick:N,onBlur:q,onKeyDown:z,ref:C,role:"button",tabIndex:0},o.a.createElement(u.Draggable,{draggableId:Object(v.l)(e.id),index:0,key:Object(v.l)(e.id),isDragDisabled:k},_)),t.placeholder)),[_,e.id,k,C,q,N,z]),$=Object(s.useMemo)((()=>o.a.createElement(K,{"data-test-subj":"draggableWrapperDiv",disabled:k},o.a.createElement(draggable_wrapper_DragDropErrorBoundary,null,o.a.createElement(u.Droppable,{isDropDisabled:!0,droppableId:Object(v.m)(e.id),renderClone:B},V)))),[V,B,e.id,k]),Q=Object(s.useCallback)((()=>$),[$]);return k?o.a.createElement(o.a.Fragment,null,$):o.a.createElement(y.a,{alwaysShow:P||M,closePopOverTrigger:T,hoverContent:I,onCloseRequested:A,render:Q})},Z=({dataProvider:e,hideTopN:t=!1,isDraggable:n=!1,onFilterAdded:a,render:i,isAggregatable:l=!1,fieldType:r="",scopeId:u,truncate:c})=>{const{closePopOverTrigger:d,hoverActionsOwnFocus:m,hoverContent:b,onCloseRequested:h,setContainerRef:E,isShowingTopN:S}=H({dataProvider:e,hideTopN:t,isDraggable:n,isAggregatable:l,fieldType:r,onFilterAdded:a,render:i,scopeId:u,truncate:c}),x=Object(s.useCallback)((()=>o.a.createElement("div",{ref:e=>{E(e)},tabIndex:-1,"data-provider-id":Object(v.l)(e.id)},c?o.a.createElement(f.b,{"data-test-subj":"render-truncatable-content"},i(e,null,{isDragging:!1,isDropAnimating:!1,isClone:!1,dropAnimation:null,draggingOver:null,combineWith:null,combineTargetFor:null,mode:null})):o.a.createElement(Y,{"data-test-subj":`render-content-${e.queryMatch.field}`},i(e,null,{isDragging:!1,isDropAnimating:!1,isClone:!1,dropAnimation:null,draggingOver:null,combineWith:null,combineTargetFor:null,mode:null})))),[e,i,E,c]);return n?o.a.createElement(X,{dataProvider:e,hideTopN:t,onFilterAdded:a,fieldType:r,isAggregatable:l,render:i,scopeId:u,truncate:c}):o.a.createElement(y.a,{alwaysShow:S||m,closePopOverTrigger:d,hoverContent:(O=u,[p.e.rulePreview,g.a].includes(null!=O?O:"")?void 0:b),onCloseRequested:h,render:x});var O},ee=o.a.memo(Z);ee.displayName="DraggableWrapper";const te=o.a.memo((({children:e,registerProvider:t})=>(Object(s.useEffect)((()=>{t()}),[t]),o.a.createElement(o.a.Fragment,null,e))));te.displayName="ConditionalPortal"},325:function(e,t,n){(function(t){const n="object"==typeof t&&Object({IS_KIBANA_DISTRIBUTABLE:"true"})&&Object({IS_KIBANA_DISTRIBUTABLE:"true"}).NODE_DEBUG&&/\bsemver\b/i.test(Object({IS_KIBANA_DISTRIBUTABLE:"true"}).NODE_DEBUG)?(...e)=>console.error("SEMVER",...e):()=>{};e.exports=n}).call(this,n(404))},326:function(e,t){const n=Number.MAX_SAFE_INTEGER||9007199254740991;e.exports={MAX_LENGTH:256,MAX_SAFE_COMPONENT_LENGTH:16,MAX_SAFE_BUILD_LENGTH:250,MAX_SAFE_INTEGER:n,RELEASE_TYPES:["major","premajor","minor","preminor","patch","prepatch","prerelease"],SEMVER_SPEC_VERSION:"2.0.0",FLAG_INCLUDE_PRERELEASE:1,FLAG_LOOSE:2}},327:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"b",(function(){return l})),n.d(t,"c",(function(){return r}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.chart.dataAllValuesZerosTitle",{defaultMessage:"All values returned zero"}),l=a.i18n.translate("xpack.securitySolution.chart.dataNotAvailableTitle",{defaultMessage:"Chart Data Not Available"}),r=a.i18n.translate("xpack.securitySolution.chart.emptyValueLabel",{defaultMessage:"empty value"})},328:function(e,t,n){"use strict";n.d(t,"b",(function(){return o})),n.d(t,"c",(function(){return u})),n.d(t,"a",(function(){return c}));var a=n(190),i=n(176),l=n(135),r=n(682);const s=e=>{var t,n;const i=null!==(t=null==e||null===(n=e.isPlatinumPlus)||void 0===n?void 0:n.call(e))&&void 0!==t&&t;return[{columnHeaderType:a.a,displayAsText:l.s,id:"kibana.alert.severity",initialWidth:105},{columnHeaderType:a.a,displayAsText:l.o,id:"kibana.alert.risk_score",initialWidth:100},{columnHeaderType:a.a,displayAsText:l.n,id:"kibana.alert.reason",initialWidth:450},{columnHeaderType:a.a,id:"host.name"},i?{columnHeaderType:a.a,id:"host.risk.calculated_level"}:null,{columnHeaderType:a.a,id:"user.name"},i?{columnHeaderType:a.a,id:"user.risk.calculated_level"}:null,{columnHeaderType:a.a,id:"process.name"},{columnHeaderType:a.a,id:"file.name"},{columnHeaderType:a.a,id:"source.ip"},{columnHeaderType:a.a,id:"destination.ip"}].filter((e=>null!=e))},o=e=>[{columnHeaderType:a.a,id:"@timestamp",initialWidth:i.b+10},{columnHeaderType:a.a,displayAsText:l.p,id:"kibana.alert.rule.name",initialWidth:i.a,linkField:"kibana.alert.rule.uuid"},...s(e)],u=e=>[{columnHeaderType:a.a,id:"kibana.alert.original_time",initialWidth:i.b+10},...s(e)],c=[{columnHeaderType:a.a,id:"@timestamp",displayAsText:l.B.timestamp,initialWidth:r.b+50,actions:!1,isExpandable:!1,isResizable:!1},{columnHeaderType:a.a,displayAsText:l.B.rule,id:"kibana.alert.rule.name",initialWidth:r.a+50,linkField:"kibana.alert.rule.uuid",actions:!1,isExpandable:!1,isResizable:!1},{columnHeaderType:a.a,id:"eventSummary",displayAsText:l.B.eventSummary,actions:!1,isExpandable:!1,isResizable:!1}]},339:function(e,t,n){"use strict";n.d(t,"a",(function(){return c})),n.d(t,"b",(function(){return d}));var a=n(104),i=n.n(a),l=n(2),r=n.n(l),s=n(41),o=n.n(s),u=n(40);const c=o.a.span.withConfig({displayName:"EllipsisText",componentId:"sc-saif2w-0"})(["&,& *{display:inline-block;max-width:100%;overflow:hidden;text-overflow:ellipsis;vertical-align:top;white-space:nowrap;}"]);function d({tooltipContent:e,children:t,dataTestSubj:n,...a}){return e?r.a.createElement(u.EuiToolTip,{display:"block",content:e},r.a.createElement(c,i()({"data-test-subj":n},a),t)):r.a.createElement(c,i()({"data-test-subj":n},a),t)}c.displayName="EllipsisText"},341:function(e,t,n){var a=n(436),i=n(437);e.exports=function(e){return function(){var t=arguments;switch(t.length){case 0:return new e;case 1:return new e(t[0]);case 2:return new e(t[0],t[1]);case 3:return new e(t[0],t[1],t[2]);case 4:return new e(t[0],t[1],t[2],t[3]);case 5:return new e(t[0],t[1],t[2],t[3],t[4]);case 6:return new e(t[0],t[1],t[2],t[3],t[4],t[5]);case 7:return new e(t[0],t[1],t[2],t[3],t[4],t[5],t[6])}var n=a(e.prototype),l=e.apply(n,t);return i(l)?l:n}}},342:function(e,t,n){e.exports=n(33)(315)},343:function(e,t,n){"use strict";var a=function(e){return function(e){return!!e&&"object"==typeof e}(e)&&!function(e){var t=Object.prototype.toString.call(e);return"[object RegExp]"===t||"[object Date]"===t||function(e){return e.$$typeof===i}(e)}(e)},i="function"==typeof Symbol&&Symbol.for?Symbol.for("react.element"):60103;function l(e,t){return!1!==t.clone&&t.isMergeableObject(e)?u((n=e,Array.isArray(n)?[]:{}),e,t):e;var n}function r(e,t,n){return e.concat(t).map((function(e){return l(e,n)}))}function s(e){return Object.keys(e).concat(function(e){return Object.getOwnPropertySymbols?Object.getOwnPropertySymbols(e).filter((function(t){return e.propertyIsEnumerable(t)})):[]}(e))}function o(e,t){try{return t in e}catch(e){return!1}}function u(e,t,n){(n=n||{}).arrayMerge=n.arrayMerge||r,n.isMergeableObject=n.isMergeableObject||a,n.cloneUnlessOtherwiseSpecified=l;var i=Array.isArray(t);return i===Array.isArray(e)?i?n.arrayMerge(e,t,n):function(e,t,n){var a={};return n.isMergeableObject(e)&&s(e).forEach((function(t){a[t]=l(e[t],n)})),s(t).forEach((function(i){(function(e,t){return o(e,t)&&!(Object.hasOwnProperty.call(e,t)&&Object.propertyIsEnumerable.call(e,t))})(e,i)||(o(e,i)&&n.isMergeableObject(t[i])?a[i]=function(e,t){if(!t.customMerge)return u;var n=t.customMerge(e);return"function"==typeof n?n:u}(i,n)(e[i],t[i],n):a[i]=l(t[i],n))})),a}(e,t,n):l(t,n)}u.all=function(e,t){if(!Array.isArray(e))throw new Error("first argument should be an array");return e.reduce((function(e,n){return u(e,n,t)}),{})};var c=u;e.exports=c},346:function(e,t,n){"use strict";n.d(t,"i",(function(){return r})),n.d(t,"b",(function(){return s})),n.d(t,"g",(function(){return o})),n.d(t,"c",(function(){return u})),n.d(t,"f",(function(){return c})),n.d(t,"d",(function(){return d})),n.d(t,"h",(function(){return m})),n.d(t,"e",(function(){return p})),n.d(t,"a",(function(){return b}));var a=n(42),i=n(106),l=n(389);const r=(e,t)=>"__typename"!==e&&null!=t?t:void 0,s=e=>!Object(a.isEmpty)(e),o=({isAlert:e,isPinned:t,eventHasNotes:n,timelineType:a})=>a===i.l.template?l.b(e):t&&n?l.d(e):t?l.c(e):l.g(e),u=({eventId:e,pinnedEventIds:t})=>!0===t[e],c=({allowUnpinning:e,eventId:t,onPinEvent:n,onUnPinEvent:a,isEventPinned:i})=>{e&&(i?a(t):n(t))},d=(e,t,n)=>e.reduce(((e,a)=>({...e,...t.includes(a._id)?{[a._id]:a.data.filter((e=>n.includes(e.field)))}:{}})),{}),m=e=>{var t;if(!Object(a.isEmpty)(null===(t=e.eql)||void 0===t?void 0:t.sequenceNumber))try{var n,i;const t=(null!==(n=null===(i=e.eql)||void 0===i?void 0:i.sequenceNumber)&&void 0!==n?n:"").split("-")[0];return parseInt(t,10)%2==0}catch{return!1}return!1},p=e=>{var t,n,i,l;return Object(a.isEmpty)(null===(t=e.kibana)||void 0===t||null===(n=t.alert)||void 0===n||null===(i=n.rule)||void 0===i?void 0:i.uuid)?Object(a.isEmpty)(null===(l=e.eql)||void 0===l?void 0:l.parentId)?"raw":"eql":"signal"},b="note-content"},365:function(e,t,n){"use strict";n.d(t,"c",(function(){return m})),n.d(t,"a",(function(){return c})),n.d(t,"b",(function(){return d}));var a,i=n(2),l=n(64),r=(a=function(e,t){return a=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])},a(e,t)},function(e,t){function n(){this.constructor=e}a(e,t),e.prototype=null===t?Object.create(t):(n.prototype=t.prototype,new n)}),s="html",o="svg",u=function(e,t){var n,a,i,l={};if(e===s)i=document.createElement("div");else{if(e!==o)throw new Error('Invalid element type "'+e+'" for createPortalNode: must be "html" or "svg".');i=document.createElementNS("http://www.w3.org/2000/svg","g")}if(t&&"object"==typeof t)for(var r=0,u=Object.entries(t.attributes);r<u.length;r++){var c=u[r],d=c[0],m=c[1];i.setAttribute(d,m)}var p={element:i,elementType:e,setPortalProps:function(e){l=e},getInitialPortalProps:function(){return l},mount:function(t,i){if(i!==a){if(p.unmount(),t!==n&&!function(e,t){if(t===s)return e instanceof HTMLElement;if(t===o)return e instanceof SVGElement;throw new Error('Unrecognized element type "'+t+'" for validateElementType.')}(t,e))throw new Error('Invalid element type for portal: "'+e+'" portalNodes must be used with '+e+" elements, but OutPortal is within <"+t.tagName+">.");t.replaceChild(p.element,i),n=t,a=i}},unmount:function(e){e&&e!==a||n&&a&&(n.replaceChild(a,p.element),n=void 0,a=void 0)}};return p},c=function(e){function t(t){var n=e.call(this,t)||this;return n.addPropsChannel=function(){Object.assign(n.props.node,{setPortalProps:function(e){n.setState({nodeProps:e})}})},n.state={nodeProps:n.props.node.getInitialPortalProps()},n}return r(t,e),t.prototype.componentDidMount=function(){this.addPropsChannel()},t.prototype.componentDidUpdate=function(){this.addPropsChannel()},t.prototype.render=function(){var e=this,t=this.props,n=t.children,a=t.node;return l.createPortal(i.Children.map(n,(function(t){return i.isValidElement(t)?i.cloneElement(t,e.state.nodeProps):t})),a.element)},t}(i.PureComponent),d=function(e){function t(t){var n=e.call(this,t)||this;return n.placeholderNode=i.createRef(),n.passPropsThroughPortal(),n}return r(t,e),t.prototype.passPropsThroughPortal=function(){var e=Object.assign({},this.props,{node:void 0});this.props.node.setPortalProps(e)},t.prototype.componentDidMount=function(){var e=this.props.node;this.currentPortalNode=e;var t=this.placeholderNode.current,n=t.parentNode;e.mount(n,t),this.passPropsThroughPortal()},t.prototype.componentDidUpdate=function(){var e=this.props.node;this.currentPortalNode&&e!==this.currentPortalNode&&(this.currentPortalNode.unmount(this.placeholderNode.current),this.currentPortalNode=e);var t=this.placeholderNode.current,n=t.parentNode;e.mount(n,t),this.passPropsThroughPortal()},t.prototype.componentWillUnmount=function(){this.props.node.unmount(this.placeholderNode.current)},t.prototype.render=function(){return i.createElement("div",{ref:this.placeholderNode})},t}(i.PureComponent),m=u.bind(null,s);u.bind(null,o)},375:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"d",(function(){return l})),n.d(t,"b",(function(){return r})),n.d(t,"a",(function(){return s}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.containers.detectionEngine.alerts.errorGetAlertDescription",{defaultMessage:"Failed to get signal index name"}),l=a.i18n.translate("xpack.securitySolution.containers.detectionEngine.alerts.errorPostAlertDescription",{defaultMessage:"Failed to create signal index"}),r=a.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.failedToIsolate.title",{defaultMessage:"Failed to isolate host"}),s=a.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.casesFromAlerts.title",{defaultMessage:"Failed to find associated cases"})},378:function(e,t,n){"use strict";n.d(t,"c",(function(){return E})),n.d(t,"b",(function(){return S})),n.d(t,"a",(function(){return x}));var a=n(62),i=n.n(a),l=n(40),r=n(42),s=n(2),o=n.n(s),u=n(103),c=n(130),d=n.n(c),m=n(707),p=n(4),b=n(111),g=n(102),f=n(182),y=n(114),v=n(187);const h=o.a.memo((({duration:e,end:t,fromStr:n,id:a,isLoading:i,kqlQuery:u,policy:c,queries:d,setDuration:m,showUpdateButton:b=!0,start:f,startAutoReload:y,stopAutoReload:v,timelineId:h,toStr:S,updateReduxTime:x,disabled:O,width:k="restricted",compressed:j=!1})=>{const[T,w]=Object(s.useState)([]),M=Object(s.useCallback)((({start:e,end:n})=>{const i=e.includes("now")||n.includes("now"),{kqlHaveBeenUpdated:l}=x({end:n,id:a,isInvalid:!1,isQuickSelection:i,kql:u,start:e,timelineId:h}),r=E(e),s=i?E(n,{roundUp:!0}):E(n);!d||l||i&&(f!==r||t!==s)||C(d)}),[t,a,u,d,f,h,x]),I=Object(s.useCallback)((({isPaused:t,refreshInterval:i})=>{const l=null!=n&&n.includes("now")||null!=S&&S.includes("now");e!==i&&m({id:a,duration:i}),t&&"interval"===c?v({id:a}):t||"manual"!==c||y({id:a}),d&&!t&&(!l||l&&"now"!==S)&&C(d)}),[n,S,e,c,m,a,v,y,d]),C=e=>{e.forEach((e=>e.refetch&&e.refetch()))},A=Object(s.useCallback)((({start:e,end:t,isInvalid:n})=>{const i=e.includes("now")||t.includes("now");if(!n){x({end:t,id:a,isInvalid:n,isQuickSelection:i,kql:u,start:e,timelineId:h});const l=[{start:e,end:t},...Object(r.take)(9,T.filter((n=>!(n.start===e&&n.end===t))))];w(l)}}),[x,a,u,h,T]),D=null!=S?S:new Date(t).toISOString(),N=null!=n?n:new Date(f).toISOString(),[F]=Object(g.p)(p.V),P=Object(r.isEmpty)(F)?[]:F.map((({from:e,to:t,display:n})=>({start:e,end:t,label:n})));return o.a.createElement(l.EuiSuperDatePicker,{commonlyUsedRanges:P,end:D,isLoading:i,isPaused:"manual"===c,onRefresh:M,onRefreshChange:I,onTimeChange:A,recentlyUsedRanges:T,refreshInterval:e,showUpdateButton:b,start:N,isDisabled:O,width:k,compressed:j})}),((e,t)=>e.duration===t.duration&&e.end===t.end&&e.fromStr===t.fromStr&&e.id===t.id&&e.isLoading===t.isLoading&&e.policy===t.policy&&e.setDuration===t.setDuration&&e.start===t.start&&e.startAutoReload===t.startAutoReload&&e.stopAutoReload===t.stopAutoReload&&e.timelineId===t.timelineId&&e.disabled===t.disabled&&e.toStr===t.toStr&&e.updateReduxTime===t.updateReduxTime&&d()(e.kqlQuery,t.kqlQuery)&&d()(e.queries,t.queries))),E=(e,t)=>{const n=i.a.parse(e,t);return null!=n&&n.isValid()?n.toISOString():""},S=e=>({end:t,id:n,isQuickSelection:a,kql:i,start:l,timelineId:r})=>{const s=E(l);let o=E(t,{roundUp:!0});var u;return a?e(t===l?f.c.setAbsoluteRangeDatePicker({id:n,fromStr:l,toStr:t,from:s,to:o}):f.c.setRelativeRangeDatePicker({id:n,fromStr:l,toStr:t,from:s,to:o})):(o=E(t),e(f.c.setAbsoluteRangeDatePicker({id:n,from:E(l),to:E(t)}))),null!=r&&e(b.a.updateRange({id:r,start:s,end:o})),i&&i.refetch?{kqlHaveBeenUpdated:null!==(u=i.refetch(e))&&void 0!==u&&u}:{kqlHaveBeenUpdated:!1}};h.displayName="SuperDatePickerComponent";const x=Object(u.connect)((()=>{const e=Object(v.a)(),t=Object(v.b)(),n=Object(v.c)(),a=Object(v.d)(),i=Object(v.e)(),l=Object(v.f)(),s=Object(v.g)(),o=Object(v.h)(),u=Object(v.i)(),c=Object(v.j)();return(d,{id:p})=>{const b=Object(r.getOr)({},`inputs.${p}`,d);return{duration:e(b),end:t(b),fromStr:n(b),kind:i(b),policy:s(b),start:u(b),toStr:c(b),isLoading:!1,...Object(m.c)(b)&&(p===y.a.timeline||p===y.a.global)&&{isLoading:a(b),kqlQuery:l(b),queries:o(d,p)}}}}),(e=>({startAutoReload:({id:t})=>e(f.c.startAutoReload({id:t})),stopAutoReload:({id:t})=>e(f.c.stopAutoReload({id:t})),setDuration:({id:t,duration:n})=>e(f.c.setDuration({id:t,duration:n})),updateReduxTime:S(e)})))(h)},379:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(42),i=n(2),l=n.n(i),r=n(150),s=n(950);const o=l.a.memo((({dataProvider:e})=>{var t;const[n,o]=Object(i.useState)(!1);return l.a.createElement(s.a,{deleteProvider:a.noop,field:e.queryMatch.displayField||e.queryMatch.field,kqlQuery:e.kqlQuery,isEnabled:e.enabled,isExcluded:e.excluded,providerId:e.id,isPopoverOpen:n,setIsPopoverOpen:o,toggleExcludedProvider:a.noop,toggleEnabledProvider:a.noop,toggleTypeProvider:a.noop,displayValue:String(null!==(t=e.queryMatch.displayValue)&&void 0!==t?t:e.queryMatch.value),val:e.queryMatch.value,operator:e.queryMatch.operator||r.d,type:e.type||r.a.default})}));o.displayName="Provider"},383:function(e,t,n){"use strict";n.d(t,"b",(function(){return S})),n.d(t,"a",(function(){return x.a}));var a=n(104),i=n.n(a),l=n(2),r=n.n(l),s=n(42),o=n(40),u=n(496),c=n.n(u),d=n(44),m=n(654);const p=({disableLinks:e,href:t,target:n,children:a,...i})=>r.a.createElement(o.EuiToolTip,{content:t},r.a.createElement(o.EuiLink,{href:e?void 0:t,"data-test-subj":"markdown-link",rel:"nofollow",target:"_blank"},a)),b=Object(l.memo)(p);var g=n(102),f=n(17),y=n(5);const v=y.i18n.translate("xpack.securitySolution.markdown.platinumWarning",{defaultMessage:"The following markdown may make use of subscription features"}),h=y.i18n.translate("xpack.securitySolution.markdown.invalid",{defaultMessage:"Invalid markdown detected"}),E=({children:e,disableLinks:t,textSize:n="m"})=>{const a=Object(l.useMemo)((()=>e=>r.a.createElement(b,i()({},e,{disableLinks:t}))),[t]),u=Object(s.cloneDeep)(m.c);u[1][1].components.a=a;const p=Object(f.b)().isAtLeast("platinum"),{application:y}=Object(g.j)().services,E=Object(l.useMemo)((()=>{if(!1===p){const t=String(e);return m.b.some((e=>new RegExp(e).test(t)))}return!1}),[e,p]),S=Object(l.useMemo)((()=>c()().use(m.a).use(u)),[u]),x=Object(l.useMemo)((()=>{try{return S.processSync(e),null}catch(e){return String(e.message)}}),[e,S]);return r.a.createElement(r.a.Fragment,null,E&&r.a.createElement(r.a.Fragment,null,r.a.createElement(o.EuiCallOut,{title:v,color:"primary",iconType:"lock"},r.a.createElement(d.FormattedMessage,{id:"xpack.securitySolution.markdown.premiumPluginLinkPrefix",defaultMessage:"To use these interactive markdown features, you must {link}.",values:{link:r.a.createElement(o.EuiLink,{href:y.getUrlForApp("management",{path:"stack/license_management/home"})},r.a.createElement(d.FormattedMessage,{id:"xpack.securitySolution.markdown.premiumPluginLinkSuffix",defaultMessage:"start a trial or upgrade your subscription"}))}})),r.a.createElement(o.EuiSpacer,{size:"s"})),null!==x&&r.a.createElement(r.a.Fragment,null,r.a.createElement(o.EuiCallOut,{title:h,color:"danger",iconType:"error"},x),r.a.createElement(o.EuiSpacer,{size:"s"})),r.a.createElement(o.EuiMarkdownFormat,{parsingPluginList:m.a,processingPluginList:u,textSize:n},e))};E.displayName="MarkdownRendererComponent";const S=Object(l.memo)(E);var x=n(452);n(481)},388:function(e,t,n){t.set=t.assoc=t.assocPath=n(972),t.setWith=n(1030)},389:function(e,t,n){"use strict";n.d(t,"g",(function(){return i})),n.d(t,"c",(function(){return l})),n.d(t,"d",(function(){return r})),n.d(t,"e",(function(){return s})),n.d(t,"f",(function(){return o})),n.d(t,"b",(function(){return u})),n.d(t,"a",(function(){return c}));var a=n(5);const i=e=>a.i18n.translate("xpack.securitySolution.timeline.body.pinning.pinTooltip",{values:{isAlert:e},defaultMessage:"Pin {isAlert, select, true{alert} other{event}}"}),l=e=>a.i18n.translate("xpack.securitySolution.timeline.body.pinning.unpinTooltip",{values:{isAlert:e},defaultMessage:"Unpin {isAlert, select, true{alert} other{event}}"}),r=e=>a.i18n.translate("xpack.securitySolution.timeline.body.pinning.pinnnedWithNotesTooltip",{values:{isAlert:e},defaultMessage:"This {isAlert, select, true{alert} other{event}} cannot be unpinned because it has notes"}),s=a.i18n.translate("xpack.securitySolution.timeline.body.sort.sortedAscendingTooltip",{defaultMessage:"Sorted ascending"}),o=a.i18n.translate("xpack.securitySolution.timeline.body.sort.sortedDescendingTooltip",{defaultMessage:"Sorted descending"}),u=e=>a.i18n.translate("xpack.securitySolution.timeline.body.pinning.disablePinnnedTooltip",{values:{isAlert:e},defaultMessage:"This {isAlert, select, true{alert} other{event}} may not be pinned while editing a template timeline"}),c=({ariaRowindex:e,columnValues:t})=>a.i18n.translate("xpack.securitySolution.timeline.body.actions.attachAlertToCaseForRowAriaLabel",{values:{ariaRowindex:e,columnValues:t},defaultMessage:"Attach the alert or event in row {ariaRowindex} to a case, with columns {columnValues}"})},390:function(e,t,n){"use strict";n.d(t,"a",(function(){return E}));var a=n(40),i=n(2),l=n.n(i),r=n(41),s=n.n(r),o=n(114),u=n(407),c=n(454),d=n(561),m=n(642),p=n(643),b=n(644),g=n(230),f=n(211),y=n(110);const v=s.a.div.withConfig({displayName:"Wrapper",componentId:"sc-9cci34-0"})(["&.viz-actions{position:absolute;top:0;right:0;z-index:1;}&.histogram-viz-actions{padding:",";}"],(({theme:e})=>e.eui.euiSizeS)),h=({applyGlobalQueriesAndFilters:e=!0,className:t,extraActions:n,extraOptions:r,getLensAttributes:s,inputId:h=o.a.global,inspectIndex:E=0,isInspectButtonDisabled:S,isMultipleQuery:x,lensAttributes:O,onCloseInspect:k,queryId:j,timerange:T,title:w,scopeId:M=y.SourcererScopeName.default,stackByField:I,withDefaultActions:C=!0})=>{const{lens:A}=Object(u.b)().services,{canUseEditor:D,navigateToPrefilledEditor:N}=A,[F,P]=Object(i.useState)(!1),[R,L]=Object(i.useState)(!1),B=Object(i.useCallback)((()=>{P(!F)}),[F]),_=()=>{P(!1)},q=Object(m.a)({applyGlobalQueriesAndFilters:e,extraOptions:r,getLensAttributes:s,lensAttributes:O,scopeId:M,stackByField:I,title:""}),z=`stat-${j}`,{disabled:V,onAddToExistingCaseClicked:$}=Object(p.a)({onAddToCaseClicked:_,lensAttributes:q,timeRange:T}),{onAddToNewCaseClicked:Q,disabled:U}=Object(b.a)({onClick:_,timeRange:T,lensAttributes:q}),H=Object(i.useCallback)((()=>{_(),T&&q&&N({id:"",timeRange:T,attributes:q},{openInNewTab:!0})}),[q,N,T]),G=Object(i.useCallback)((()=>{_(),L(!0)}),[]),W=Object(i.useCallback)((()=>{L(!1),k&&k()}),[k]),{additionalRequests:K,additionalResponses:Y,handleClick:J,handleCloseModal:X,isButtonDisabled:Z,request:ee,response:te}=Object(d.a)({inputId:h,inspectIndex:E,isDisabled:S,multiple:x,onCloseInspect:W,onClick:G,queryId:j}),ne=Object(i.useMemo)((()=>!D()||null==q),[q,D]),ae=Object(i.useMemo)((()=>{var e;const t={};return[...(null!==(e=null==n?void 0:n.map((e=>l.a.createElement(a.EuiContextMenuItem,{icon:null==e?void 0:e.getIconType(t),key:e.id,onClick:()=>e.execute(t),"data-test-subj":`viz-actions-${e.id}`},e.getDisplayName(t)))))&&void 0!==e?e:[])||[],...C?[l.a.createElement(a.EuiContextMenuItem,{icon:"inspect",key:"visualizationActionsInspect",onClick:J,disabled:Z,"data-test-subj":"viz-actions-inspect"},g.j),l.a.createElement(a.EuiContextMenuItem,{disabled:U,icon:"plusInCircle",key:"visualizationActionsAddToNewCase",onClick:Q,"data-test-subj":"viz-actions-add-to-new-case"},g.c),l.a.createElement(a.EuiContextMenuItem,{disabled:V,"data-test-subj":"viz-actions-add-to-existing-case",icon:"plusInCircle",key:"visualizationActionsAddToExistingCase",onClick:$},g.b),l.a.createElement(a.EuiContextMenuItem,{icon:"visArea",key:"visualizationActionsOpenInLens","data-test-subj":"viz-actions-open-in-lens",disabled:ne,onClick:H},g.l)]:[]]}),[Z,ne,n,J,V,U,$,Q,H,C]),ie=Object(i.useMemo)((()=>l.a.createElement(a.EuiButtonIcon,{"aria-label":g.k,className:f.a,"data-test-subj":z,iconType:"boxesHorizontal",onClick:B})),[z,B]);return l.a.createElement(v,{className:t},ae.length>0&&l.a.createElement(a.EuiPopover,{button:ie,isOpen:F,closePopover:_,panelPaddingSize:"none",anchorPosition:"downLeft",panelClassName:"withHoverActions__popover","data-test-subj":"viz-actions-popover"},l.a.createElement(a.EuiContextMenuPanel,{"data-test-subj":"viz-actions-panel",size:"s",items:ae})),R&&null!==ee&&null!==te&&l.a.createElement(c.a,{additionalRequests:K,additionalResponses:Y,closeModal:X,inputId:h,request:ee,response:te,title:w}))};h.displayName="VisualizationActionsComponent";const E=l.a.memo(h)},391:function(e,t,n){"use strict";n.d(t,"a",(function(){return o})),n.d(t,"b",(function(){return d}));var a=n(2),i=n(45),l=n(116),r=n(183),s=n(921);const o=({setQuery:e,response:t,request:n,refetch:i,uniqueQueryId:l,deleteQuery:r,loading:s,searchSessionId:o})=>{Object(a.useEffect)((()=>(null!=i&&null!=e&&e({id:l,inspect:{dsl:[n],response:[t]},loading:s,refetch:i,searchSessionId:o}),()=>{r&&r({id:l})})),[e,s,t,n,i,l,r,o])};function u(e){var t;const n=null==e?void 0:e.subType;return!(null==n||null===(t=n.nested)||void 0===t||!t.path)}function c(e,t){const n=[];for(const[a,i]of Object.entries(e))t?i.aggregatable&&Object(s.a)(i.type)&&!u(i)&&n.push({label:a,value:a}):!0===i.aggregatable&&n.push({label:a,value:a});return n}const d=e=>{const{pathname:t}=Object(i.useLocation)(),{browserFields:n}=Object(l.d)(Object(l.a)(t)),s=Object(a.useMemo)((()=>Object(r.a)(n)),[n]),[o,u]=Object(a.useState)((()=>c(s,e)));return Object(a.useEffect)((()=>{u(c(s,e))}),[s,e]),Object(a.useMemo)((()=>o),[o])}},402:function(e,t,n){"use strict";n.d(t,"a",(function(){return E})),n.d(t,"b",(function(){return x}));var a=n(40),i=n(2),l=n.n(i),r=n(41),s=n.n(r),o=n(155),u=n(383),c=n(639),d=n(5);const m=d.i18n.translate("xpack.securitySolution.alertDetails.summary.readMore",{defaultMessage:"Read More"}),p=d.i18n.translate("xpack.securitySolution.alertDetails.summary.readLess",{defaultMessage:"Read Less"}),b=s()(a.EuiButtonEmpty).withConfig({displayName:"ReadMore",componentId:"sc-1cdn95f-0"})(["span.euiButtonContent{padding:0;}"]),g=s.a.div.withConfig({displayName:"ExpandedContent",componentId:"sc-1cdn95f-1"})(["max-height:33vh;overflow-wrap:break-word;overflow-x:hidden;overflow-y:auto;"]),f=s.a.div.withConfig({displayName:"StyledLineClamp",componentId:"sc-1cdn95f-2"})(["display:-webkit-box;-webkit-line-clamp:",";-webkit-box-orient:vertical;overflow:hidden;max-height:","em;height:","em;"],3,(({lineClampHeight:e})=>e),(({lineClampHeight:e})=>e)),y=({children:e,lineClampHeight:t=5.5})=>{const[n,a]=Object(i.useState)(null),[r,s]=Object(c.a)(e),o=Object(i.useCallback)((()=>{a((e=>!e))}),[]);return n?l.a.createElement(l.a.Fragment,null,l.a.createElement(g,{"data-test-subj":"expanded-line-clamp"},l.a.createElement("p",null,e)),r&&l.a.createElement(b,{onClick:o,size:"s","data-test-subj":"summary-view-readmore"},p)):l.a.createElement(l.a.Fragment,null,null==r||!0===r?l.a.createElement(f,{"data-test-subj":"styled-line-clamp",ref:s,lineClampHeight:t},e):e,r&&l.a.createElement(b,{onClick:o,size:"s","data-test-subj":"summary-view-readmore"},m))},v=l.a.memo(y),h=s.a.div.withConfig({displayName:"Indent",componentId:"sc-1pv3muo-0"})(["padding:0 8px;word-break:break-word;"]),E=Object(i.createContext)({}),S=({basicData:e,ruleNote:t,showFullView:n=!1,showTitle:i=!0})=>l.a.createElement(E.Provider,{value:e},i&&l.a.createElement(l.a.Fragment,null,l.a.createElement(a.EuiSpacer,{size:"l"}),l.a.createElement(a.EuiTitle,{size:"xxxs","data-test-subj":"summary-view-guide"},l.a.createElement("h5",null,o.q)),l.a.createElement(a.EuiSpacer,{size:"s"})),l.a.createElement(h,null,n?l.a.createElement(a.EuiText,{size:"xs","data-test-subj":"investigation-guide-full-view"},l.a.createElement(u.b,null,t)):l.a.createElement(a.EuiText,{size:"xs","data-test-subj":"investigation-guide-clamped"},l.a.createElement(v,{lineClampHeight:4.5},l.a.createElement(u.b,null,t))))),x=l.a.memo(S)},403:function(e,t,n){"use strict";n.d(t,"a",(function(){return Q}));var a=n(104),i=n.n(a),l=n(2),r=n.n(l),s=n(103),o=n(41),u=n.n(o),c=n(723),d=n(105),m=n(138),p=n(724),b=n(114),g=n(482),f=n(44),y=n(73),v=n(40),h=n(151),E=n(102),S=n(642),x=n(407),O=n(643),k=n(644),j=n(230),T=n(455);const w=({callback:e})=>({id:"openInLens",getDisplayName:e=>j.l,getIconType:e=>"visArea",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},order:1}),M=({callback:e,disabled:t})=>({id:"addToNewCase",getDisplayName:e=>j.c,getIconType:e=>"casesApp",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},disabled:t,order:3}),I=({callback:e,disabled:t})=>({id:"inspect",getDisplayName:e=>T.d,getIconType:e=>"inspect",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},disabled:t,order:4}),C=({callback:e,disabled:t})=>({id:"addToExistingCase",getDisplayName:e=>j.b,getIconType:e=>"casesApp",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},disabled:t,order:2});var A=n(122),D=n(454),N=n(211),F=n(110),P=n(390);const R=u.a.div.withConfig({displayName:"LensComponentWrapper",componentId:"sc-1ajgxgj-0"})(["height:",";width:",";"," .embPanel__header{z-index:2;position:absolute;right:0;}.expExpressionRenderer__expression{padding:2px 0 0 0 !important;}.legacyMtrVis__container{padding:0;}"],(({$height:e})=>e?`${e}px`:"auto"),(({width:e})=>null!=e?e:"auto"),(({$addHoverActionsPadding:e})=>e?".embPanel__header { top: -24px; }":"")),L={requests:void 0,responses:void 0,isLoading:!0},B=({applyGlobalQueriesAndFilters:e=!0,extraActions:t,extraOptions:n,getLensAttributes:a,height:i,id:o,inputsModelId:u=b.a.global,inspectTitle:c,lensAttributes:m,onLoad:p,scopeId:g=F.SourcererScopeName.default,stackByField:j,timerange:T,width:B,withActions:q=!0})=>{var z,V,$,Q;const U=Object(l.useMemo)((()=>({height:null!=i?i:"100%",minWidth:"100px",width:null!=B?B:"100%"})),[i,B]),{lens:H,data:{actions:{createFiltersFromValueClickAction:G}}}=Object(E.j)().services,W=Object(s.useDispatch)(),[K,Y]=Object(l.useState)(!1),[J,X]=Object(l.useState)(L),Z=A.d.globalQueryByIdSelector(),{searchSessionId:ee}=Object(d.a)((e=>Z(e,o))),te=Object(S.a)({applyGlobalQueriesAndFilters:e,extraOptions:n,getLensAttributes:a,lensAttributes:m,scopeId:g,stackByField:j,title:""}),ne=null==te||null===(z=te.state)||void 0===z||null===(V=z.visualization)||void 0===V?void 0:V.preferredSeriesType,ae="lnsLegacyMetric"!==(null==te?void 0:te.visualizationType)&&"lnsPie"!==(null==te?void 0:te.visualizationType),ie=H.EmbeddableComponent,le=Object(l.useMemo)((()=>({onInspectActionClicked:()=>{Y(!0)},isDisabled:J.isLoading})),[J.isLoading]),re=(({attributes:e,extraActions:t,inspectActionProps:n,timeRange:a,withActions:i})=>{const{lens:r}=Object(x.b)().services,{navigateToPrefilledEditor:s}=r,[o,u]=Object(l.useState)(["inspect","addToNewCase","addToExistingCase","openInLens"]);Object(l.useEffect)((()=>{!1===i&&u([])}),[i]);const c=Object(l.useCallback)((()=>{a&&e&&s({id:"",timeRange:a,attributes:e},{openInNewTab:!0})}),[e,s,a]),{disabled:d,onAddToExistingCaseClicked:m}=Object(O.a)({lensAttributes:e,timeRange:a}),{onAddToNewCaseClicked:p,disabled:b}=Object(k.a)({timeRange:a,lensAttributes:e});return Object(l.useMemo)((()=>null==o?void 0:o.reduce(((e,t)=>"inspect"===t&&null!=n?[...e,I({callback:null==n?void 0:n.onInspectActionClicked,disabled:null==n?void 0:n.isDisabled})]:"addToExistingCase"===t?[...e,C({callback:m,disabled:d})]:"addToNewCase"===t?[...e,M({callback:p,disabled:b})]:"openInLens"===t?[...e,w({callback:c})]:e),[])),[o,n,m,d,p,b,c]).concat(null!=t?t:[])})({attributes:te,extraActions:t,inspectActionProps:le,timeRange:T,withActions:q}),se=Object(l.useCallback)((()=>{Y(!1)}),[]),oe=Object(l.useCallback)((({range:e})=>{const[t,n]=e;W(Object(h.setAbsoluteRangeDatePicker)({id:u,from:new Date(t).toISOString(),to:new Date(n).toISOString()}))}),[W,u]),ue=Object(l.useMemo)((()=>{var e;const[t,...n]=null!==(e=J.requests)&&void 0!==e?e:[];return{request:t,additionalRequests:n}}),[J.requests]),ce=Object(l.useMemo)((()=>{var e;const[t,...n]=null!==(e=J.responses)&&void 0!==e?e:[];return{response:t,additionalResponses:n}}),[J.responses]),de=Object(l.useCallback)(((e,t)=>{var n;if(!t)return;const a=Object(N.f)(null==t||null===(n=t.requests)||void 0===n?void 0:n.getRequests());X({requests:a.requests,responses:a.responses,isLoading:e}),null!=p&&p({requests:a.requests,responses:a.responses,isLoading:e})}),[p]),me=Object(l.useCallback)((async e=>{if(!_(e)||"area"!==ne)return;const[{query:t}]=await G({data:e.data,negate:e.negate}),n=null==t?void 0:t.range["@timestamp"];null!=n&&n.gte&&null!=n&&n.lt&&oe({range:[n.gte,n.lt]})}),[G,oe,ne]),pe=Object(l.useMemo)((()=>{var e,t;return null!=(null==te||null===(e=te.state)||void 0===e?void 0:e.adHocDataViews)?Object.values(null==te||null===(t=te.state)||void 0===t?void 0:t.adHocDataViews).reduce(((e,t)=>(null!=(null==t?void 0:t.name)&&e.push(null==t?void 0:t.name),e)),[]):null}),[null==te||null===($=te.state)||void 0===$?void 0:$.adHocDataViews]);return ee?!te||null!=(null==J?void 0:J.responses)&&0===(null==J||null===(Q=J.responses)||void 0===Q?void 0:Q.length)?r.a.createElement(v.EuiFlexGroup,null,r.a.createElement(v.EuiFlexItem,{grow:1},r.a.createElement(v.EuiEmptyPrompt,{body:r.a.createElement(v.EuiText,{size:"xs"},r.a.createElement(f.FormattedMessage,{id:"xpack.securitySolution.lensEmbeddable.NoDataToDisplay.title",defaultMessage:"No data to display"}))})),r.a.createElement(v.EuiFlexItem,{grow:!1},r.a.createElement(P.a,{extraActions:t,getLensAttributes:a,inputId:u,isInspectButtonDisabled:!0,lensAttributes:te,queryId:o,stackByField:j,timerange:T,title:c,withDefaultActions:!1}))):r.a.createElement(r.a.Fragment,null,te&&ee&&r.a.createElement(R,{$height:i,width:B,$addHoverActionsPadding:ae},r.a.createElement(ie,{id:o,style:U,timeRange:T,attributes:te,onLoad:de,onBrushEnd:oe,onFilter:me,viewMode:y.ViewMode.VIEW,withDefaultActions:!1,extraActions:re,searchSessionId:ee,showInspector:!1,syncTooltips:!1,syncCursor:!1})),K&&null!=ue.request&&null!=ce.response&&r.a.createElement(D.a,{adHocDataViews:pe,additionalRequests:ue.additionalRequests,additionalResponses:ce.additionalResponses,closeModal:se,"data-test-subj":"inspect-modal",inputId:u,request:ue.request,response:ce.response,title:c})):null},_=e=>Array.isArray(e.data)&&"column"in e.data[0],q=r.a.memo(B);var z=n(116),V=n(413);const $=e=>{var t,n;const a=Object(s.useDispatch)(),{inputId:u=b.a.global,id:f,isDonut:y,label:v,donutTextWrapperClassName:h,onLoad:E,...S}=e,{session:x,refetchByRestartingSession:O,refetchByDeletingSession:k}=Object(g.a)({inputId:u,queryId:f}),{indicesExist:j}=Object(z.d)(S.scopeId),T=Object(l.useRef)(S.timerange),w=m.d.globalQueryByIdSelector(),{searchSessionId:M}=Object(d.a)((e=>w(e,f))),I=Object(V.a)({visualizationId:f}),C=null!=I&&0!==(null===(t=I[0])||void 0===t||null===(n=t.hits)||void 0===n?void 0:n.total),A=C?Object(o.css)(["top:40%;right:12%;"]):Object(o.css)(["top:66%;right:12%;"]),D=Object(l.useCallback)((({requests:e,responses:t,isLoading:n})=>{a(m.b.setQuery({inputId:u,id:f,searchSessionId:x.current.start(),refetch:O,loading:n,inspect:{dsl:e,response:t}})),"function"==typeof E&&E({requests:e,responses:t,isLoading:n})}),[a,u,f,x,O,E]);return Object(l.useEffect)((()=>{var e,t;(!j&&(null===(e=T.current)||void 0===e?void 0:e.from)!==S.timerange.from||(null===(t=T.current)||void 0===t?void 0:t.to)!==S.timerange.to)&&(T.current=S.timerange,a(m.b.deleteOneQuery({inputId:u,id:f})))}),[a,f,j,u,S.timerange]),Object(l.useEffect)((()=>{M||setTimeout((()=>{a(m.b.setQuery({inputId:u,id:f,searchSessionId:x.current.start(),refetch:C?O:k,loading:!1,inspect:null}))}),200)}),[a,u,f,x,C,O,M,k]),Object(l.useEffect)((()=>()=>{a(m.b.deleteOneQuery({inputId:u,id:f}))}),[a,f,u]),(S.getLensAttributes||S.lensAttributes)&&S.timerange?y?r.a.createElement(p.b,{isChartEmbeddablesEnabled:!0,dataExists:C,label:v,title:C?r.a.createElement(c.a,{count:null===(N=I[0])||void 0===N||null===(F=N.hits)||void 0===F?void 0:F.total}):null,donutTextWrapperClassName:h,donutTextWrapperStyles:A},r.a.createElement(q,i()({},S,{id:f,onLoad:D}))):r.a.createElement(q,i()({},S,{id:f,onLoad:D})):null;var N,F},Q=r.a.memo($)},412:function(e,t,n){"use strict";n.d(t,"a",(function(){return f})),n.d(t,"c",(function(){return y})),n.d(t,"b",(function(){return v})),n.d(t,"d",(function(){return E}));var a=n(40),i=n(2),l=n.n(i),r=n(41),s=n.n(r),o=n(103),u=n(106),c=n(111),d=n(105),m=n(248),p=n(242),b=n(133);s()(a.EuiBadge).withConfig({displayName:"NotesCountBadge",componentId:"sc-v4xtfs-0"})(["margin-left:5px;"]).displayName="NotesCountBadge";const g=({timelineId:e})=>{const t=Object(o.useDispatch)(),n=Object(i.useMemo)((()=>c.b.getTimelineByIdSelector()),[]),r=Object(d.b)((t=>{var a;return(null!==(a=n(t,e))&&void 0!==a?a:b.b).isFavorite})),s=Object(d.b)((t=>{var a;return(null!==(a=n(t,e))&&void 0!==a?a:b.b).status}))===u.k.immutable,p=Object(i.useCallback)((()=>t(c.a.updateIsFavorite({id:e,isFavorite:!r}))),[t,e,r]);return l.a.createElement(a.EuiButton,{isSelected:r,fill:r,iconType:r?"starFilled":"starEmpty",onClick:p,"data-test-subj":`timeline-favorite-${r?"filled":"empty"}-star`,disabled:s},r?m.j:m.b)};g.displayName="AddToFavoritesButtonComponent";const f=l.a.memo(g),y=l.a.memo((({closeGearMenu:e,outline:t=!1,timelineId:n,title:a=m.h})=>{const{getButton:i}=Object(p.b)({timelineId:n,timelineType:u.l.default,closeGearMenu:e});return i({outline:t,title:a})}));y.displayName="NewTimeline";const v="notes-button",h=l.a.memo((({ariaLabel:e=m.i,isDisabled:t,toggleShowNotes:n,timelineType:i})=>{const r=i===u.l.template;return l.a.createElement(a.EuiButtonIcon,{"aria-label":e,className:v,"data-test-subj":"timeline-notes-button-small",disabled:t,iconType:"editorComment",onClick:n,size:"s",isDisabled:r})}));h.displayName="SmallNotesButton";const E=l.a.memo((({ariaLabel:e,isDisabled:t,showNotes:n,timelineType:i,toggleShowNotes:r,toolTip:s})=>n?l.a.createElement(h,{ariaLabel:e,isDisabled:t,toggleShowNotes:r,timelineType:i}):l.a.createElement(a.EuiToolTip,{content:s||"","data-test-subj":"timeline-notes-tool-tip"},l.a.createElement(h,{ariaLabel:e,isDisabled:t,toggleShowNotes:r,timelineType:i}))));E.displayName="NotesButton"},413:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(2),i=n(211),l=n(105),r=n(122);const s=({visualizationId:e})=>{const t=r.d.globalQueryByIdSelector(),{inspect:n}=Object(l.a)((n=>t(n,e)));return Object(a.useMemo)((()=>n?Object(i.g)(null==n?void 0:n.response):null),[n])}},424:function(e,t,n){"use strict";n.d(t,"a",(function(){return x}));var a=n(40),i=n(287),l=n(2),r=n.n(l),s=n(41),o=n.n(s),u=n(55),c=n.n(u),d=n(4),m=n(121),p=n(102),b=n(327),g=n(228);const f=o()(a.EuiFlexItem).withConfig({displayName:"CountFlexItem",componentId:"sc-1yje3m6-0"})(["",""],(({theme:e})=>`margin-right: ${e.eui.euiSizeS};`)),y=r.a.memo((({value:e})=>Object(g.a)(e)?r.a.createElement(r.a.Fragment,null,e):r.a.createElement("em",{"data-test-subj":"value-wrapper-empty"},b.c)));y.displayName="ValueWrapper";const v=({legendItem:e})=>{const[t]=Object(p.p)(d.O),{color:n,count:i,dataProviderId:l,field:s,scopeId:o,value:u}=e;return r.a.createElement(a.EuiText,{size:"xs"},r.a.createElement(a.EuiFlexGroup,{alignItems:"center",gutterSize:"none",responsive:!1},null!=n&&r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiHealth,{"data-test-subj":"legend-color",color:n})),r.a.createElement(a.EuiFlexItem,{grow:!0},r.a.createElement(a.EuiFlexGroup,{alignItems:"center",justifyContent:"spaceBetween",gutterSize:"none",responsive:!1},r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(m.b,{"data-test-subj":`legend-item-${l}`,field:s,hideTopN:!0,id:l,isDraggable:!1,scopeId:o,value:u},null==e.render?r.a.createElement(y,{value:u}):e.render({field:s,value:u}))),null!=i&&r.a.createElement(f,{"data-test-subj":"legendItemCount",grow:!1},c()(i).format(t))))))};v.displayName="DraggableLegendItemComponent";const h=r.a.memo(v),E=o.a.div.withConfig({displayName:"DraggableLegendContainer",componentId:"sc-94chus-0"})(["height:",";overflow:auto;scrollbar-width:thin;width:100%;@media only screen and (min-width:","){width:165px;}min-width:",";&::-webkit-scrollbar{height:",";width:",";}&::-webkit-scrollbar-thumb{background-clip:content-box;background-color:",";border:"," solid transparent;}&::-webkit-scrollbar-corner,&::-webkit-scrollbar-track{background-color:transparent;}"],(({height:e})=>`${e}px`),(({theme:e})=>e.eui.euiBreakpoints.m),(({$minWidth:e})=>`${e}px`),(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>Object(i.rgba)(e.eui.euiColorDarkShade,.5)),(({theme:e})=>e.eui.euiScrollBarCorner)),S=({className:e,height:t=0,legendItems:n,minWidth:i=165})=>0===n.length?null:r.a.createElement(E,{className:e,"data-test-subj":"draggable-legend",height:0===t?175:t,$minWidth:i},r.a.createElement(a.EuiText,{size:"xs"},r.a.createElement(a.EuiFlexGroup,{direction:"column",gutterSize:"none"},n.map((e=>r.a.createElement(a.EuiFlexItem,{key:e.dataProviderId,grow:!1},r.a.createElement(h,{legendItem:e}),r.a.createElement(a.EuiSpacer,{"data-test-subj":"draggable-legend-spacer",size:"s"})))))));S.displayName="DraggableLegendComponent";const x=r.a.memo(S)},435:function(e,t,n){var a=n(613),i=n(977),l=n(978),r=n(617),s=n(996),o=n(621),u=n(997),c=n(623),d=n(624),m=n(627),p=Math.max;e.exports=function(e,t,n,b,g,f,y,v){var h=2&t;if(!h&&"function"!=typeof e)throw new TypeError("Expected a function");var E=b?b.length:0;if(E||(t&=-97,b=g=void 0),y=void 0===y?y:p(m(y),0),v=void 0===v?v:m(v),E-=g?g.length:0,64&t){var S=b,x=g;b=g=void 0}var O=h?void 0:o(e),k=[e,t,n,b,g,S,x,f,y,v];if(O&&u(k,O),e=k[0],t=k[1],n=k[2],b=k[3],g=k[4],!(v=k[9]=void 0===k[9]?h?0:e.length:p(k[9]-E,0))&&24&t&&(t&=-25),t&&1!=t)j=8==t||16==t?l(e,t,v):32!=t&&33!=t||g.length?r.apply(void 0,k):s(e,t,n,b);else var j=i(e,t,n);return d((O?a:c)(j,k),e,t)}},436:function(e,t,n){e.exports=n(33)(3657)},437:function(e,t,n){e.exports=n(33)(360)},438:function(e,t,n){var a=n(436),i=n(439),l=4294967295;function r(e){this.__wrapped__=e,this.__actions__=[],this.__dir__=1,this.__filtered__=!1,this.__iteratees__=[],this.__takeCount__=l,this.__views__=[]}r.prototype=a(i.prototype),r.prototype.constructor=r,e.exports=r},439:function(e,t){e.exports=function(){}},440:function(e,t,n){e.exports=n(33)(282)},441:function(e,t,n){e.exports=n(33)(3647)},442:function(e,t,n){e.exports=n(33)(1609)},443:function(e,t){var n="__lodash_placeholder__";e.exports=function(e,t){for(var a=-1,i=e.length,l=0,r=[];++a<i;){var s=e[a];s!==t&&s!==n||(e[a]=n,r[l++]=a)}return r}},450:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var a,i=(a=n(2))&&"object"==typeof a&&"default"in a?a:{default:a},l=e=>"checkbox"===e.type,r=e=>e instanceof Date,s=e=>null==e;const o=e=>"object"==typeof e;var u=e=>!s(e)&&!Array.isArray(e)&&o(e)&&!r(e),c=e=>u(e)&&e.target?l(e.target)?e.target.checked:e.target.value:e,d=(e,t)=>e.has((e=>e.substring(0,e.search(/\.\d+(\.|$)/))||e)(t)),m="undefined"!=typeof window&&void 0!==window.HTMLElement&&"undefined"!=typeof document;function p(e){let t;const n=Array.isArray(e);if(e instanceof Date)t=new Date(e);else if(e instanceof Set)t=new Set(e);else{if(m&&(e instanceof Blob||e instanceof FileList)||!n&&!u(e))return e;if(t=n?[]:{},n||(e=>{const t=e.constructor&&e.constructor.prototype;return u(t)&&t.hasOwnProperty("isPrototypeOf")})(e))for(const n in e)e.hasOwnProperty(n)&&(t[n]=p(e[n]));else t=e}return t}var b=e=>Array.isArray(e)?e.filter(Boolean):[],g=e=>void 0===e,f=(e,t,n)=>{if(!t||!u(e))return n;const a=b(t.split(/[,[\].]+?/)).reduce(((e,t)=>s(e)?e:e[t]),e);return g(a)||a===e?g(e[t])?n:e[t]:a};const y="blur",v="focusout",h="change",E="onChange",S="onSubmit",x="all",O="pattern",k="required",j=i.default.createContext(null),T=()=>i.default.useContext(j);var w=(e,t,n,a=!0)=>{const i={defaultValues:t._defaultValues};for(const l in e)Object.defineProperty(i,l,{get:()=>{const i=l;return t._proxyFormState[i]!==x&&(t._proxyFormState[i]=!a||x),n&&(n[i]=!0),e[i]}});return i},M=e=>u(e)&&!Object.keys(e).length,I=(e,t,n,a)=>{n(e);const{name:i,...l}=e;return M(l)||Object.keys(l).length>=Object.keys(t).length||Object.keys(l).find((e=>t[e]===(!a||x)))},C=e=>Array.isArray(e)?e:[e],A=(e,t,n)=>n&&t?e===t:!e||!t||e===t||C(e).some((e=>e&&(e.startsWith(t)||t.startsWith(e))));function D(e){const t=i.default.useRef(e);t.current=e,i.default.useEffect((()=>{const n=!e.disabled&&t.current.subject&&t.current.subject.subscribe({next:t.current.next});return()=>{n&&n.unsubscribe()}}),[e.disabled])}function N(e){const t=T(),{control:n=t.control,disabled:a,name:l,exact:r}=e||{},[s,o]=i.default.useState(n._formState),u=i.default.useRef(!0),c=i.default.useRef({isDirty:!1,isLoading:!1,dirtyFields:!1,touchedFields:!1,isValidating:!1,isValid:!1,errors:!1}),d=i.default.useRef(l);return d.current=l,D({disabled:a,next:e=>u.current&&A(d.current,e.name,r)&&I(e,c.current,n._updateFormState)&&o({...n._formState,...e}),subject:n._subjects.state}),i.default.useEffect((()=>(u.current=!0,c.current.isValid&&n._updateValid(!0),()=>{u.current=!1})),[n]),w(s,n,c.current,!1)}var F=e=>"string"==typeof e,P=(e,t,n,a,i)=>F(e)?(a&&t.watch.add(e),f(n,e,i)):Array.isArray(e)?e.map((e=>(a&&t.watch.add(e),f(n,e)))):(a&&(t.watchAll=!0),n);function R(e){const t=T(),{control:n=t.control,name:a,defaultValue:l,disabled:r,exact:s}=e||{},o=i.default.useRef(a);o.current=a,D({disabled:r,subject:n._subjects.values,next:e=>{A(o.current,e.name,s)&&c(p(P(o.current,n._names,e.values||n._formValues,!1,l)))}});const[u,c]=i.default.useState(n._getWatch(a,l));return i.default.useEffect((()=>n._removeUnmounted())),u}var L=e=>/^\w*$/.test(e),B=e=>b(e.replace(/["|']|\]/g,"").split(/\.|\[/));function _(e,t,n){let a=-1;const i=L(t)?[t]:B(t),l=i.length,r=l-1;for(;++a<l;){const t=i[a];let l=n;if(a!==r){const n=e[t];l=u(n)||Array.isArray(n)?n:isNaN(+i[a+1])?{}:[]}e[t]=l,e=e[t]}return e}function q(e){const t=T(),{name:n,control:a=t.control,shouldUnregister:l}=e,r=d(a._names.array,n),s=R({control:a,name:n,defaultValue:f(a._formValues,n,f(a._defaultValues,n,e.defaultValue)),exact:!0}),o=N({control:a,name:n}),u=i.default.useRef(a.register(n,{...e.rules,value:s}));return u.current=a.register(n,e.rules),i.default.useEffect((()=>{const e=a._options.shouldUnregister||l,t=(e,t)=>{const n=f(a._fields,e);n&&(n._f.mount=t)};if(t(n,!0),e){const e=p(f(a._options.defaultValues,n));_(a._defaultValues,n,e),g(f(a._formValues,n))&&_(a._formValues,n,e)}return()=>{(r?e&&!a._state.action:e)?a.unregister(n):t(n,!1)}}),[n,a,r,l]),{field:{name:n,value:s,onChange:i.default.useCallback((e=>u.current.onChange({target:{value:c(e),name:n},type:h})),[n]),onBlur:i.default.useCallback((()=>u.current.onBlur({target:{value:f(a._formValues,n),name:n},type:y})),[n,a]),ref:e=>{const t=f(a._fields,n);t&&e&&(t._f.ref={focus:()=>e.focus(),select:()=>e.select(),setCustomValidity:t=>e.setCustomValidity(t),reportValidity:()=>e.reportValidity()})}},formState:o,fieldState:Object.defineProperties({},{invalid:{enumerable:!0,get:()=>!!f(o.errors,n)},isDirty:{enumerable:!0,get:()=>!!f(o.dirtyFields,n)},isTouched:{enumerable:!0,get:()=>!!f(o.touchedFields,n)},error:{enumerable:!0,get:()=>f(o.errors,n)}})}}const z="post";var V=(e,t,n,a,i)=>t?{...n[e],types:{...n[e]&&n[e].types?n[e].types:{},[a]:i||!0}}:{};const $=(e,t,n)=>{for(const a of n||Object.keys(e)){const n=f(e,a);if(n){const{_f:e,...a}=n;if(e&&t(e.name)){if(e.ref.focus){e.ref.focus();break}if(e.refs&&e.refs[0].focus){e.refs[0].focus();break}}else u(a)&&$(a,t)}}};var Q=()=>{const e="undefined"==typeof performance?Date.now():1e3*performance.now();return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,(t=>{const n=(16*Math.random()+e)%16|0;return("x"==t?n:3&n|8).toString(16)}))},U=(e,t,n={})=>n.shouldFocus||g(n.shouldFocus)?n.focusName||`${e}.${g(n.focusIndex)?t:n.focusIndex}.`:"",H=e=>({isOnSubmit:!e||e===S,isOnBlur:"onBlur"===e,isOnChange:e===E,isOnAll:e===x,isOnTouch:"onTouched"===e}),G=(e,t,n)=>!n&&(t.watchAll||t.watch.has(e)||[...t.watch].some((t=>e.startsWith(t)&&/^\.\w+/.test(e.slice(t.length))))),W=(e,t,n)=>{const a=b(f(e,n));return _(a,"root",t[n]),_(e,n,a),e},K=e=>"boolean"==typeof e,Y=e=>"file"===e.type,J=e=>"function"==typeof e,X=e=>{if(!m)return!1;const t=e?e.ownerDocument:0;return e instanceof(t&&t.defaultView?t.defaultView.HTMLElement:HTMLElement)},Z=e=>F(e),ee=e=>"radio"===e.type,te=e=>e instanceof RegExp;const ne={value:!1,isValid:!1},ae={value:!0,isValid:!0};var ie=e=>{if(Array.isArray(e)){if(e.length>1){const t=e.filter((e=>e&&e.checked&&!e.disabled)).map((e=>e.value));return{value:t,isValid:!!t.length}}return e[0].checked&&!e[0].disabled?e[0].attributes&&!g(e[0].attributes.value)?g(e[0].value)||""===e[0].value?ae:{value:e[0].value,isValid:!0}:ae:ne}return ne};const le={isValid:!1,value:null};var re=e=>Array.isArray(e)?e.reduce(((e,t)=>t&&t.checked&&!t.disabled?{isValid:!0,value:t.value}:e),le):le;function se(e,t,n="validate"){if(Z(e)||Array.isArray(e)&&e.every(Z)||K(e)&&!e)return{type:n,message:Z(e)?e:"",ref:t}}var oe=e=>u(e)&&!te(e)?e:{value:e,message:""},ue=async(e,t,n,a,i)=>{const{ref:r,refs:o,required:c,maxLength:d,minLength:m,min:p,max:b,pattern:y,validate:v,name:h,valueAsNumber:E,mount:S,disabled:x}=e._f,j=f(t,h);if(!S||x)return{};const T=o?o[0]:r,w=e=>{a&&T.reportValidity&&(T.setCustomValidity(K(e)?"":e||""),T.reportValidity())},I={},C=ee(r),A=l(r),D=C||A,N=(E||Y(r))&&g(r.value)&&g(j)||X(r)&&""===r.value||""===j||Array.isArray(j)&&!j.length,P=V.bind(null,h,n,I),R=(e,t,n,a="maxLength",i="minLength")=>{const l=e?t:n;I[h]={type:e?a:i,message:l,ref:r,...P(e?a:i,l)}};if(i?!Array.isArray(j)||!j.length:c&&(!D&&(N||s(j))||K(j)&&!j||A&&!ie(o).isValid||C&&!re(o).isValid)){const{value:e,message:t}=Z(c)?{value:!!c,message:c}:oe(c);if(e&&(I[h]={type:k,message:t,ref:T,...P(k,t)},!n))return w(t),I}if(!(N||s(p)&&s(b))){let e,t;const a=oe(b),i=oe(p);if(s(j)||isNaN(j)){const n=r.valueAsDate||new Date(j),l=e=>new Date((new Date).toDateString()+" "+e),s="time"==r.type,o="week"==r.type;F(a.value)&&j&&(e=s?l(j)>l(a.value):o?j>a.value:n>new Date(a.value)),F(i.value)&&j&&(t=s?l(j)<l(i.value):o?j<i.value:n<new Date(i.value))}else{const n=r.valueAsNumber||(j?+j:j);s(a.value)||(e=n>a.value),s(i.value)||(t=n<i.value)}if((e||t)&&(R(!!e,a.message,i.message,"max","min"),!n))return w(I[h].message),I}if((d||m)&&!N&&(F(j)||i&&Array.isArray(j))){const e=oe(d),t=oe(m),a=!s(e.value)&&j.length>+e.value,i=!s(t.value)&&j.length<+t.value;if((a||i)&&(R(a,e.message,t.message),!n))return w(I[h].message),I}if(y&&!N&&F(j)){const{value:e,message:t}=oe(y);if(te(e)&&!j.match(e)&&(I[h]={type:O,message:t,ref:r,...P(O,t)},!n))return w(t),I}if(v)if(J(v)){const e=se(await v(j,t),T);if(e&&(I[h]={...e,...P("validate",e.message)},!n))return w(e.message),I}else if(u(v)){let e={};for(const a in v){if(!M(e)&&!n)break;const i=se(await v[a](j,t),T,a);i&&(e={...i,...P(a,i.message)},w(i.message),n&&(I[h]=e))}if(!M(e)&&(I[h]={ref:T,...e},!n))return I}return w(!0),I};function ce(e,t){return[...e,...C(t)]}var de=e=>Array.isArray(e)?e.map((()=>{})):void 0;function me(e,t,n){return[...e.slice(0,t),...C(n),...e.slice(t)]}var pe=(e,t,n)=>Array.isArray(e)?(g(e[n])&&(e[n]=void 0),e.splice(n,0,e.splice(t,1)[0]),e):[];function be(e,t){return[...C(t),...C(e)]}var ge=(e,t)=>g(t)?[]:function(e,t){let n=0;const a=[...e];for(const e of t)a.splice(e-n,1),n++;return b(a).length?a:[]}(e,C(t).sort(((e,t)=>e-t))),fe=(e,t,n)=>{e[t]=[e[n],e[n]=e[t]][0]};function ye(e,t){const n=Array.isArray(t)?t:L(t)?[t]:B(t),a=1===n.length?e:function(e,t){const n=t.slice(0,-1).length;let a=0;for(;a<n;)e=g(e)?a++:e[t[a++]];return e}(e,n),i=n.length-1,l=n[i];return a&&delete a[l],0!==i&&(u(a)&&M(a)||Array.isArray(a)&&function(e){for(const t in e)if(e.hasOwnProperty(t)&&!g(e[t]))return!1;return!0}(a))&&ye(e,n.slice(0,-1)),e}var ve=(e,t,n)=>(e[t]=n,e);function he(){let e=[];return{get observers(){return e},next:t=>{for(const n of e)n.next&&n.next(t)},subscribe:t=>(e.push(t),{unsubscribe:()=>{e=e.filter((e=>e!==t))}}),unsubscribe:()=>{e=[]}}}var Ee=e=>s(e)||!o(e);function Se(e,t){if(Ee(e)||Ee(t))return e===t;if(r(e)&&r(t))return e.getTime()===t.getTime();const n=Object.keys(e),a=Object.keys(t);if(n.length!==a.length)return!1;for(const i of n){const n=e[i];if(!a.includes(i))return!1;if("ref"!==i){const e=t[i];if(r(n)&&r(e)||u(n)&&u(e)||Array.isArray(n)&&Array.isArray(e)?!Se(n,e):n!==e)return!1}}return!0}var xe=e=>"select-multiple"===e.type,Oe=e=>X(e)&&e.isConnected,ke=e=>{for(const t in e)if(J(e[t]))return!0;return!1};function je(e,t={}){const n=Array.isArray(e);if(u(e)||n)for(const n in e)Array.isArray(e[n])||u(e[n])&&!ke(e[n])?(t[n]=Array.isArray(e[n])?[]:{},je(e[n],t[n])):s(e[n])||(t[n]=!0);return t}function Te(e,t,n){const a=Array.isArray(e);if(u(e)||a)for(const a in e)Array.isArray(e[a])||u(e[a])&&!ke(e[a])?g(t)||Ee(n[a])?n[a]=Array.isArray(e[a])?je(e[a],[]):{...je(e[a])}:Te(e[a],s(t)?{}:t[a],n[a]):n[a]=!Se(e[a],t[a]);return n}var we=(e,t)=>Te(e,t,je(t)),Me=(e,{valueAsNumber:t,valueAsDate:n,setValueAs:a})=>g(e)?e:t?""===e?NaN:e?+e:e:n&&F(e)?new Date(e):a?a(e):e;function Ie(e){const t=e.ref;if(!(e.refs?e.refs.every((e=>e.disabled)):t.disabled))return Y(t)?t.files:ee(t)?re(e.refs).value:xe(t)?[...t.selectedOptions].map((({value:e})=>e)):l(t)?ie(e.refs).value:Me(g(t.value)?e.ref.value:t.value,e)}var Ce=e=>g(e)?e:te(e)?e.source:u(e)?te(e.value)?e.value.source:e.value:e;function Ae(e,t,n){const a=f(e,n);if(a||L(n))return{error:a,name:n};const i=n.split(".");for(;i.length;){const a=i.join("."),l=f(t,a),r=f(e,a);if(l&&!Array.isArray(l)&&n!==a)return{name:n};if(r&&r.type)return{name:a,error:r};i.pop()}return{name:n}}const De={mode:S,reValidateMode:E,shouldFocusError:!0};function Ne(e={},t){let n,a={...De,...e},i={submitCount:0,isDirty:!1,isLoading:J(a.defaultValues),isValidating:!1,isSubmitted:!1,isSubmitting:!1,isSubmitSuccessful:!1,isValid:!1,touchedFields:{},dirtyFields:{},errors:{}},o={},h=(u(a.defaultValues)||u(a.values))&&p(a.defaultValues||a.values)||{},E=a.shouldUnregister?{}:p(h),S={action:!1,mount:!1,watch:!1},O={mount:new Set,unMount:new Set,array:new Set,watch:new Set},k=0;const j={isDirty:!1,dirtyFields:!1,touchedFields:!1,isValidating:!1,isValid:!1,errors:!1},T={values:he(),array:he(),state:he()},w=e.resetOptions&&e.resetOptions.keepDirtyValues,I=H(a.mode),A=H(a.reValidateMode),D=a.criteriaMode===x,N=async e=>{if(j.isValid||e){const e=a.resolver?M((await z()).errors):await V(o,!0);e!==i.isValid&&T.state.next({isValid:e})}},R=e=>j.isValidating&&T.state.next({isValidating:e}),L=(e,t,n,a)=>{const i=f(o,e);if(i){const l=f(E,e,g(n)?f(h,e):n);g(l)||a&&a.defaultChecked||t?_(E,e,t?l:Ie(i._f)):Z(e,l),S.mount&&N()}},B=(e,t,n,a,l)=>{let r=!1,s=!1;const o={name:e};if(!n||a){j.isDirty&&(s=i.isDirty,i.isDirty=o.isDirty=Q(),r=s!==o.isDirty);const n=Se(f(h,e),t);s=f(i.dirtyFields,e),n?ye(i.dirtyFields,e):_(i.dirtyFields,e,!0),o.dirtyFields=i.dirtyFields,r=r||j.dirtyFields&&s!==!n}if(n){const t=f(i.touchedFields,e);t||(_(i.touchedFields,e,n),o.touchedFields=i.touchedFields,r=r||j.touchedFields&&t!==n)}return r&&l&&T.state.next(o),r?o:{}},q=(t,a,l,r)=>{const s=f(i.errors,t),o=j.isValid&&K(a)&&i.isValid!==a;var u;if(e.delayError&&l?(u=()=>((e,t)=>{_(i.errors,e,t),T.state.next({errors:i.errors})})(t,l),n=e=>{clearTimeout(k),k=setTimeout(u,e)},n(e.delayError)):(clearTimeout(k),n=null,l?_(i.errors,t,l):ye(i.errors,t)),(l?!Se(s,l):s)||!M(r)||o){const e={...r,...o&&K(a)?{isValid:a}:{},errors:i.errors,name:t};i={...i,...e},T.state.next(e)}R(!1)},z=async e=>a.resolver(E,a.context,((e,t,n,a)=>{const i={};for(const n of e){const e=f(t,n);e&&_(i,n,e._f)}return{criteriaMode:n,names:[...e],fields:i,shouldUseNativeValidation:a}})(e||O.mount,o,a.criteriaMode,a.shouldUseNativeValidation)),V=async(e,t,n={valid:!0})=>{for(const l in e){const r=e[l];if(r){const{_f:e,...l}=r;if(e){const l=O.array.has(e.name),s=await ue(r,E,D,a.shouldUseNativeValidation&&!t,l);if(s[e.name]&&(n.valid=!1,t))break;!t&&(f(s,e.name)?l?W(i.errors,s,e.name):_(i.errors,e.name,s[e.name]):ye(i.errors,e.name))}l&&await V(l,t,n)}}return n.valid},Q=(e,t)=>(e&&t&&_(E,e,t),!Se(le(),h)),U=(e,t,n)=>P(e,O,{...S.mount?E:g(t)?h:F(e)?{[e]:t}:t},n,t),Z=(e,t,n={})=>{const a=f(o,e);let i=t;if(a){const n=a._f;n&&(!n.disabled&&_(E,e,Me(t,n)),i=X(n.ref)&&s(t)?"":t,xe(n.ref)?[...n.ref.options].forEach((e=>e.selected=i.includes(e.value))):n.refs?l(n.ref)?n.refs.length>1?n.refs.forEach((e=>(!e.defaultChecked||!e.disabled)&&(e.checked=Array.isArray(i)?!!i.find((t=>t===e.value)):i===e.value))):n.refs[0]&&(n.refs[0].checked=!!i):n.refs.forEach((e=>e.checked=e.value===i)):Y(n.ref)?n.ref.value="":(n.ref.value=i,n.ref.type||T.values.next({name:e,values:{...E}})))}(n.shouldDirty||n.shouldTouch)&&B(e,i,n.shouldTouch,n.shouldDirty,!0),n.shouldValidate&&ie(e)},te=(e,t,n)=>{for(const a in t){const i=t[a],l=`${e}.${a}`,s=f(o,l);!O.array.has(e)&&Ee(i)&&(!s||s._f)||r(i)?Z(l,i,n):te(l,i,n)}},ne=(e,n,a={})=>{const l=f(o,e),r=O.array.has(e),u=p(n);_(E,e,u),r?(T.array.next({name:e,values:{...E}}),(j.isDirty||j.dirtyFields)&&a.shouldDirty&&T.state.next({name:e,dirtyFields:we(h,E),isDirty:Q(e,u)})):!l||l._f||s(u)?Z(e,u,a):te(e,u,a),G(e,O)&&T.state.next({...i}),T.values.next({name:e,values:{...E}}),!S.mount&&t()},ae=async e=>{const t=e.target;let l=t.name,r=!0;const s=f(o,l);if(s){let d,m;const p=t.type?Ie(s._f):c(e),b=e.type===y||e.type===v,g=!((u=s._f).mount&&(u.required||u.min||u.max||u.maxLength||u.minLength||u.pattern||u.validate)||a.resolver||f(i.errors,l)||s._f.deps)||((e,t,n,a,i)=>!i.isOnAll&&(!n&&i.isOnTouch?!(t||e):(n?a.isOnBlur:i.isOnBlur)?!e:!(n?a.isOnChange:i.isOnChange)||e))(b,f(i.touchedFields,l),i.isSubmitted,A,I),h=G(l,O,b);_(E,l,p),b?(s._f.onBlur&&s._f.onBlur(e),n&&n(0)):s._f.onChange&&s._f.onChange(e);const S=B(l,p,b,!1),x=!M(S)||h;if(!b&&T.values.next({name:l,type:e.type,values:{...E}}),g)return j.isValid&&N(),x&&T.state.next({name:l,...h?{}:S});if(!b&&h&&T.state.next({...i}),R(!0),a.resolver){const{errors:e}=await z([l]),t=Ae(i.errors,o,l),n=Ae(e,o,t.name||l);d=n.error,l=n.name,m=M(e)}else d=(await ue(s,E,D,a.shouldUseNativeValidation))[l],r=isNaN(p)||p===f(E,l,p),r&&(d?m=!1:j.isValid&&(m=await V(o,!0)));r&&(s._f.deps&&ie(s._f.deps),q(l,m,d,S))}var u},ie=async(e,t={})=>{let n,l;const r=C(e);if(R(!0),a.resolver){const t=await(async e=>{const{errors:t}=await z();if(e)for(const n of e){const e=f(t,n);e?_(i.errors,n,e):ye(i.errors,n)}else i.errors=t;return t})(g(e)?e:r);n=M(t),l=e?!r.some((e=>f(t,e))):n}else e?(l=(await Promise.all(r.map((async e=>{const t=f(o,e);return await V(t&&t._f?{[e]:t}:t)})))).every(Boolean),(l||i.isValid)&&N()):l=n=await V(o);return T.state.next({...!F(e)||j.isValid&&n!==i.isValid?{}:{name:e},...a.resolver||!e?{isValid:n}:{},errors:i.errors,isValidating:!1}),t.shouldFocus&&!l&&$(o,(e=>e&&f(i.errors,e)),e?r:O.mount),l},le=e=>{const t={...h,...S.mount?E:{}};return g(e)?t:F(e)?f(t,e):e.map((e=>f(t,e)))},re=(e,t)=>({invalid:!!f((t||i).errors,e),isDirty:!!f((t||i).dirtyFields,e),isTouched:!!f((t||i).touchedFields,e),error:f((t||i).errors,e)}),se=(e,t,n)=>{const a=(f(o,e,{_f:{}})._f||{}).ref;_(i.errors,e,{...t,ref:a}),T.state.next({name:e,errors:i.errors,isValid:!1}),n&&n.shouldFocus&&a&&a.focus&&a.focus()},oe=(e,t={})=>{for(const n of e?C(e):O.mount)O.mount.delete(n),O.array.delete(n),t.keepValue||(ye(o,n),ye(E,n)),!t.keepError&&ye(i.errors,n),!t.keepDirty&&ye(i.dirtyFields,n),!t.keepTouched&&ye(i.touchedFields,n),!a.shouldUnregister&&!t.keepDefaultValue&&ye(h,n);T.values.next({values:{...E}}),T.state.next({...i,...t.keepDirty?{isDirty:Q()}:{}}),!t.keepIsValid&&N()},ce=(e,t={})=>{let n=f(o,e);const i=K(t.disabled);return _(o,e,{...n||{},_f:{...n&&n._f?n._f:{ref:{name:e}},name:e,mount:!0,...t}}),O.mount.add(e),n?i&&_(E,e,t.disabled?void 0:f(E,e,Ie(n._f))):L(e,!0,t.value),{...i?{disabled:t.disabled}:{},...a.progressive?{required:!!t.required,min:Ce(t.min),max:Ce(t.max),minLength:Ce(t.minLength),maxLength:Ce(t.maxLength),pattern:Ce(t.pattern)}:{},name:e,onChange:ae,onBlur:ae,ref:i=>{if(i){ce(e,t),n=f(o,e);const a=g(i.value)&&i.querySelectorAll&&i.querySelectorAll("input,select,textarea")[0]||i,r=(e=>ee(e)||l(e))(a),s=n._f.refs||[];if(r?s.find((e=>e===a)):a===n._f.ref)return;_(o,e,{_f:{...n._f,...r?{refs:[...s.filter(Oe),a,...Array.isArray(f(h,e))?[{}]:[]],ref:{type:a.type,name:e}}:{ref:a}}}),L(e,!1,void 0,a)}else n=f(o,e,{}),n._f&&(n._f.mount=!1),(a.shouldUnregister||t.shouldUnregister)&&(!d(O.array,e)||!S.action)&&O.unMount.add(e)}}},de=()=>a.shouldFocusError&&$(o,(e=>e&&f(i.errors,e)),O.mount),me=(e,t)=>async n=>{n&&(n.preventDefault&&n.preventDefault(),n.persist&&n.persist());let l=p(E);if(T.state.next({isSubmitting:!0}),a.resolver){const{errors:e,values:t}=await z();i.errors=e,l=t}else await V(o);ye(i.errors,"root"),M(i.errors)?(T.state.next({errors:{}}),await e(l,n)):(t&&await t({...i.errors},n),de(),setTimeout(de)),T.state.next({isSubmitted:!0,isSubmitting:!1,isSubmitSuccessful:M(i.errors),submitCount:i.submitCount+1,errors:i.errors})},pe=(n,a={})=>{const l=n||h,r=p(l),s=n&&!M(n)?r:h;if(a.keepDefaultValues||(h=l),!a.keepValues){if(a.keepDirtyValues||w)for(const e of O.mount)f(i.dirtyFields,e)?_(s,e,f(E,e)):ne(e,f(s,e));else{if(m&&g(n))for(const e of O.mount){const t=f(o,e);if(t&&t._f){const e=Array.isArray(t._f.refs)?t._f.refs[0]:t._f.ref;if(X(e)){const t=e.closest("form");if(t){t.reset();break}}}}o={}}E=e.shouldUnregister?a.keepDefaultValues?p(h):{}:p(s),T.array.next({values:{...s}}),T.values.next({values:{...s}})}O={mount:new Set,unMount:new Set,array:new Set,watch:new Set,watchAll:!1,focus:""},!S.mount&&t(),S.mount=!j.isValid||!!a.keepIsValid,S.watch=!!e.shouldUnregister,T.state.next({submitCount:a.keepSubmitCount?i.submitCount:0,isDirty:a.keepDirty?i.isDirty:!(!a.keepDefaultValues||Se(n,h)),isSubmitted:!!a.keepIsSubmitted&&i.isSubmitted,dirtyFields:a.keepDirtyValues?i.dirtyFields:a.keepDefaultValues&&n?we(h,n):{},touchedFields:a.keepTouched?i.touchedFields:{},errors:a.keepErrors?i.errors:{},isSubmitting:!1,isSubmitSuccessful:!1})},be=(e,t)=>pe(J(e)?e(E):e,t);return{control:{register:ce,unregister:oe,getFieldState:re,handleSubmit:me,setError:se,_executeSchema:z,_getWatch:U,_getDirty:Q,_updateValid:N,_removeUnmounted:()=>{for(const e of O.unMount){const t=f(o,e);t&&(t._f.refs?t._f.refs.every((e=>!Oe(e))):!Oe(t._f.ref))&&oe(e)}O.unMount=new Set},_updateFieldArray:(e,t=[],n,a,l=!0,r=!0)=>{if(a&&n){if(S.action=!0,r&&Array.isArray(f(o,e))){const t=n(f(o,e),a.argA,a.argB);l&&_(o,e,t)}if(r&&Array.isArray(f(i.errors,e))){const t=n(f(i.errors,e),a.argA,a.argB);l&&_(i.errors,e,t),((e,t)=>{!b(f(e,t)).length&&ye(e,t)})(i.errors,e)}if(j.touchedFields&&r&&Array.isArray(f(i.touchedFields,e))){const t=n(f(i.touchedFields,e),a.argA,a.argB);l&&_(i.touchedFields,e,t)}j.dirtyFields&&(i.dirtyFields=we(h,E)),T.state.next({name:e,isDirty:Q(e,t),dirtyFields:i.dirtyFields,errors:i.errors,isValid:i.isValid})}else _(E,e,t)},_getFieldArray:t=>b(f(S.mount?E:h,t,e.shouldUnregister?f(h,t,[]):[])),_reset:pe,_resetDefaultValues:()=>J(a.defaultValues)&&a.defaultValues().then((e=>{be(e,a.resetOptions),T.state.next({isLoading:!1})})),_updateFormState:e=>{i={...i,...e}},_subjects:T,_proxyFormState:j,get _fields(){return o},get _formValues(){return E},get _state(){return S},set _state(e){S=e},get _defaultValues(){return h},get _names(){return O},set _names(e){O=e},get _formState(){return i},set _formState(e){i=e},get _options(){return a},set _options(e){a={...a,...e}}},trigger:ie,register:ce,handleSubmit:me,watch:(e,t)=>J(e)?T.values.subscribe({next:n=>e(U(void 0,t),n)}):U(e,t,!0),setValue:ne,getValues:le,reset:be,resetField:(e,t={})=>{f(o,e)&&(g(t.defaultValue)?ne(e,f(h,e)):(ne(e,t.defaultValue),_(h,e,t.defaultValue)),t.keepTouched||ye(i.touchedFields,e),t.keepDirty||(ye(i.dirtyFields,e),i.isDirty=t.defaultValue?Q(e,f(h,e)):Q()),t.keepError||(ye(i.errors,e),j.isValid&&N()),T.state.next({...i}))},clearErrors:e=>{e&&C(e).forEach((e=>ye(i.errors,e))),T.state.next({errors:e?i.errors:{}})},unregister:oe,setError:se,setFocus:(e,t={})=>{const n=f(o,e),a=n&&n._f;if(a){const e=a.refs?a.refs[0]:a.ref;e.focus&&(e.focus(),t.shouldSelect&&e.select())}},getFieldState:re}}t.Controller=e=>e.render(q(e)),t.Form=function(e){const t=T(),[n,a]=i.default.useState(!1),{control:l=t.control,onSubmit:r,children:s,action:o,method:u=z,headers:c,encType:d,onError:m,render:p,onSuccess:b,validateStatus:g,...y}=e,v=async t=>{let n=!1,a="";await l.handleSubmit((async e=>{const i=new FormData;let s="";try{s=JSON.stringify(e)}catch(e){}for(const t of l._names.mount)i.append(t,f(e,t));if(r&&r({data:e,event:t,method:u,formData:i,formDataJson:s}),o)try{const e=[c&&c["Content-Type"],d].some((e=>e&&e.includes("json"))),t=await fetch(o,{method:u,headers:{...c,...d?{"Content-Type":d}:{}},body:e?s:i});t&&(g?!g(t.status):t.status<200||t.status>=300)?(n=!0,m&&m({response:t}),a=String(t.status)):b&&b({response:t})}catch(e){n=!0,m&&m({error:e})}}))(t),n&&e.control&&(e.control._subjects.state.next({isSubmitSuccessful:!1}),e.control.setError("root.server",{type:a}))};return i.default.useEffect((()=>{a(!0)}),[]),p?i.default.createElement(i.default.Fragment,null,p({submit:v})):i.default.createElement("form",{noValidate:n,action:o,method:u,encType:d,onSubmit:v,...y},s)},t.FormProvider=e=>{const{children:t,...n}=e;return i.default.createElement(j.Provider,{value:n},t)},t.appendErrors=V,t.get=f,t.set=_,t.useController=q,t.useFieldArray=function(e){const t=T(),{control:n=t.control,name:a,keyName:l="id",shouldUnregister:r}=e,[s,o]=i.default.useState(n._getFieldArray(a)),u=i.default.useRef(n._getFieldArray(a).map(Q)),c=i.default.useRef(s),d=i.default.useRef(a),m=i.default.useRef(!1);d.current=a,c.current=s,n._names.array.add(a),e.rules&&n.register(a,e.rules),D({next:({values:e,name:t})=>{if(t===d.current||!t){const t=f(e,d.current);Array.isArray(t)&&(o(t),u.current=t.map(Q))}},subject:n._subjects.array});const b=i.default.useCallback((e=>{m.current=!0,n._updateFieldArray(a,e)}),[n,a]);return i.default.useEffect((()=>{if(n._state.action=!1,G(a,n._names)&&n._subjects.state.next({...n._formState}),m.current&&(!H(n._options.mode).isOnSubmit||n._formState.isSubmitted))if(n._options.resolver)n._executeSchema([a]).then((e=>{const t=f(e.errors,a),i=f(n._formState.errors,a);(i?!t&&i.type||t&&(i.type!==t.type||i.message!==t.message):t&&t.type)&&(t?_(n._formState.errors,a,t):ye(n._formState.errors,a),n._subjects.state.next({errors:n._formState.errors}))}));else{const e=f(n._fields,a);e&&e._f&&ue(e,n._formValues,n._options.criteriaMode===x,n._options.shouldUseNativeValidation,!0).then((e=>!M(e)&&n._subjects.state.next({errors:W(n._formState.errors,e,a)})))}n._subjects.values.next({name:a,values:{...n._formValues}}),n._names.focus&&$(n._fields,(e=>!!e&&e.startsWith(n._names.focus||""))),n._names.focus="",n._updateValid()}),[s,a,n]),i.default.useEffect((()=>(!f(n._formValues,a)&&n._updateFieldArray(a),()=>{(n._options.shouldUnregister||r)&&n.unregister(a)})),[a,n,l,r]),{swap:i.default.useCallback(((e,t)=>{const i=n._getFieldArray(a);fe(i,e,t),fe(u.current,e,t),b(i),o(i),n._updateFieldArray(a,i,fe,{argA:e,argB:t},!1)}),[b,a,n]),move:i.default.useCallback(((e,t)=>{const i=n._getFieldArray(a);pe(i,e,t),pe(u.current,e,t),b(i),o(i),n._updateFieldArray(a,i,pe,{argA:e,argB:t},!1)}),[b,a,n]),prepend:i.default.useCallback(((e,t)=>{const i=C(p(e)),l=be(n._getFieldArray(a),i);n._names.focus=U(a,0,t),u.current=be(u.current,i.map(Q)),b(l),o(l),n._updateFieldArray(a,l,be,{argA:de(e)})}),[b,a,n]),append:i.default.useCallback(((e,t)=>{const i=C(p(e)),l=ce(n._getFieldArray(a),i);n._names.focus=U(a,l.length-1,t),u.current=ce(u.current,i.map(Q)),b(l),o(l),n._updateFieldArray(a,l,ce,{argA:de(e)})}),[b,a,n]),remove:i.default.useCallback((e=>{const t=ge(n._getFieldArray(a),e);u.current=ge(u.current,e),b(t),o(t),n._updateFieldArray(a,t,ge,{argA:e})}),[b,a,n]),insert:i.default.useCallback(((e,t,i)=>{const l=C(p(t)),r=me(n._getFieldArray(a),e,l);n._names.focus=U(a,e,i),u.current=me(u.current,e,l.map(Q)),b(r),o(r),n._updateFieldArray(a,r,me,{argA:e,argB:de(t)})}),[b,a,n]),update:i.default.useCallback(((e,t)=>{const i=p(t),l=ve(n._getFieldArray(a),e,i);u.current=[...l].map(((t,n)=>t&&n!==e?u.current[n]:Q())),b(l),o([...l]),n._updateFieldArray(a,l,ve,{argA:e,argB:i},!0,!1)}),[b,a,n]),replace:i.default.useCallback((e=>{const t=C(p(e));u.current=t.map(Q),b([...t]),o([...t]),n._updateFieldArray(a,[...t],(e=>e),{},!0,!1)}),[b,a,n]),fields:i.default.useMemo((()=>s.map(((e,t)=>({...e,[l]:u.current[t]||Q()})))),[s,l])}},t.useForm=function(e={}){const t=i.default.useRef(),[n,a]=i.default.useState({isDirty:!1,isValidating:!1,isLoading:J(e.defaultValues),isSubmitted:!1,isSubmitting:!1,isSubmitSuccessful:!1,isValid:!1,submitCount:0,dirtyFields:{},touchedFields:{},errors:{},defaultValues:J(e.defaultValues)?void 0:e.defaultValues});t.current||(t.current={...Ne(e,(()=>a((e=>({...e}))))),formState:n});const l=t.current.control;return l._options=e,D({subject:l._subjects.state,next:e=>{I(e,l._proxyFormState,l._updateFormState,!0)&&a({...l._formState})}}),i.default.useEffect((()=>{e.values&&!Se(e.values,l._defaultValues)?l._reset(e.values,l._options.resetOptions):l._resetDefaultValues()}),[e.values,l]),i.default.useEffect((()=>{l._state.mount||(l._updateValid(),l._state.mount=!0),l._state.watch&&(l._state.watch=!1,l._subjects.state.next({...l._formState})),l._removeUnmounted()})),t.current.formState=w(n,l),t.current},t.useFormContext=T,t.useFormState=N,t.useWatch=R},451:function(e,t){const n=Object.freeze({loose:!0}),a=Object.freeze({});e.exports=e=>e?"object"!=typeof e?n:e:a},452:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),l=n(40),r=n(654),s=n(453);const o=Object(a.forwardRef)((({onChange:e,value:t,ariaLabel:n,editorId:o,dataTestSubj:u,height:c,autoFocusDisabled:d,setIsMarkdownInvalid:m},p)=>{const[b,g]=Object(a.useState)([]),f=Object(a.useCallback)(((e,{messages:t})=>{g(e?[e]:t),m(!!e)}),[m]),y=Object(a.useRef)(null);Object(a.useEffect)((()=>{var e,t;d||null===(e=y.current)||void 0===e||null===(t=e.textarea)||void 0===t||t.focus()}),[d]);const v=Object(s.b)("investigation_guide"),h=Object(a.useMemo)((()=>Object(r.d)({insightsUpsellingMessage:v})),[v]);return Object(a.useImperativeHandle)(p,(()=>{var e,t;if(!y.current)return null;const n=null===(e=y.current)||void 0===e||null===(t=e.textarea)||void 0===t?void 0:t.closest(".euiMarkdownEditor");return{...y.current,toolbar:null==n?void 0:n.querySelector(".euiMarkdownEditorToolbar")}})),i.a.createElement(l.EuiMarkdownEditor,{ref:y,"aria-label":n,editorId:o,onChange:e,value:t,uiPlugins:h,parsingPluginList:r.a,processingPluginList:r.c,onParse:f,errors:b,"data-test-subj":u,height:c})}));o.displayName="MarkdownEditorComponent";const u=Object(a.memo)(o)},453:function(e,t,n){"use strict";n.d(t,"a",(function(){return s})),n.d(t,"b",(function(){return o})),n.d(t,"c",(function(){return u}));var a=n(2),i=n(10),l=n.n(i),r=n(535);const s=e=>{const t=Object(r.b)(),n=l()(t.sections$,t.getSectionsValue());return Object(a.useMemo)((()=>{var t;return null!==(t=null==n?void 0:n.get(e))&&void 0!==t?t:null}),[e,n])},o=e=>{const t=Object(r.b)(),n=l()(t.messages$,t.getMessagesValue());return Object(a.useMemo)((()=>{var t;return null!==(t=null==n?void 0:n.get(e))&&void 0!==t?t:null}),[e,n])},u=e=>{const t=Object(r.b)(),n=Object(a.useMemo)((()=>t.getPageUpselling(e)),[e,t]);return null!=n?n:null}},454:function(e,t,n){"use strict";n.d(t,"a",(function(){return h}));var a=n(40),i=n(55),l=n.n(i),r=n(2),s=n.n(r),o=n(41),u=n.n(o),c=n(45),d=n(4),m=n(455),p=n(116),b=n(110);const g=u()(a.EuiDescriptionList).withConfig({displayName:"DescriptionListStyled",componentId:"sc-67qpo8-0"})(["@media only screen and (min-width:","){.euiDescriptionList__title{width:30% !important;}.euiDescriptionList__description{width:70% !important;}}"],(e=>e.theme.eui.euiBreakpoints.s));g.displayName="DescriptionListStyled";const f=u()(a.EuiModal).withConfig({displayName:"MyEuiModal",componentId:"sc-67qpo8-1"})(["width:min(768px,calc(100vw - 16px));min-height:41vh;.euiModal__flex{width:60vw;}.euiCodeBlock{height:auto !important;max-width:718px;}"]);f.displayName="MyEuiModal";const y=function(e){try{return e.map((e=>JSON.parse(e)))}catch{return[]}},v=(e=[])=>1===e.length&&e[0]===d.Sb?s.a.createElement("i",null,m.f):e.length>0?e.filter((e=>e!==d.Sb)).join(", "):m.k,h=({adHocDataViews:e,additionalRequests:t,additionalResponses:n,closeModal:i,inputId:o,request:u,response:d,title:h})=>{var E,S,x,O;const{pathname:k}=Object(c.useLocation)(),{selectedPatterns:j}=Object(p.d)("timeline"===o?b.SourcererScopeName.timeline:Object(p.a)(k)),T=[u,...null!=t?t:[]],w=[d,...null!=n?n:[]],M=y(T),I=y(w),C=Object(r.useMemo)((()=>{var e,t;return(null!==(e=null===(t=M[0])||void 0===t?void 0:t.index)&&void 0!==e?e:[]).every((e=>j.includes(e.trim())))}),[M,j]),A=[{title:s.a.createElement("span",{"data-test-subj":"index-pattern-title"},m.b," ",s.a.createElement(a.EuiIconTip,{color:"subdued",content:m.c,type:"iInCircle"})),description:s.a.createElement("span",{"data-test-subj":"index-pattern-description"},s.a.createElement("p",null,v(null!=e&&e.length>0?e:null!==(E=null===(S=M[0])||void 0===S?void 0:S.index)&&void 0!==E?E:[])),!C&&s.a.createElement("p",null,s.a.createElement("small",null,s.a.createElement("i",{"data-test-subj":"not-sourcerer-msg"},m.e))))},{title:s.a.createElement("span",{"data-test-subj":"query-time-title"},m.g," ",s.a.createElement(a.EuiIconTip,{color:"subdued",content:m.h,type:"iInCircle"})),description:s.a.createElement("span",{"data-test-subj":"query-time-description"},0===(null===(x=I[0])||void 0===x?void 0:x.took)?"0ms":null!==(O=I[0])&&void 0!==O&&O.took?`${l()(I[0].took).format("0,0")}ms`:m.k)},{title:s.a.createElement("span",{"data-test-subj":"request-timestamp-title"},m.i," ",s.a.createElement(a.EuiIconTip,{color:"subdued",content:m.j,type:"iInCircle"})),description:s.a.createElement("span",{"data-test-subj":"request-timestamp-description"},(new Date).toISOString())}],D=[{id:"statistics",name:"Statistics",content:s.a.createElement(s.a.Fragment,null,s.a.createElement(a.EuiSpacer,null),s.a.createElement(g,{listItems:A,type:"column"}))},{id:"request",name:"Request",content:M.length>0?M.map(((e,t)=>s.a.createElement(r.Fragment,{key:t},s.a.createElement(a.EuiSpacer,null),s.a.createElement(a.EuiCodeBlock,{language:"js",fontSize:"m",paddingSize:"m",color:"dark",overflowHeight:300,isCopyable:!0},(e=>{try{return JSON.stringify(e,null,2)}catch{return m.k}})(e.body))))):s.a.createElement(a.EuiCodeBlock,null,m.k)},{id:"response",name:"Response",content:I.length>0?w.map(((e,t)=>s.a.createElement(r.Fragment,{key:t},s.a.createElement(a.EuiSpacer,null),s.a.createElement(a.EuiCodeBlock,{language:"js",fontSize:"m",paddingSize:"m",color:"dark",overflowHeight:300,isCopyable:!0},e)))):s.a.createElement(a.EuiCodeBlock,null,m.k)}];return s.a.createElement(f,{onClose:i,"data-test-subj":"modal-inspect-euiModal"},s.a.createElement(a.EuiModalHeader,null,s.a.createElement(a.EuiModalHeaderTitle,null,m.d," ",h)),s.a.createElement(a.EuiModalBody,null,s.a.createElement(a.EuiTabbedContent,{tabs:D,initialSelectedTab:D[0],autoFocus:"selected"})),s.a.createElement(a.EuiModalFooter,null,s.a.createElement(a.EuiButton,{onClick:i,fill:!0,"data-test-subj":"modal-inspect-close"},m.a)))}},455:function(e,t,n){"use strict";n.d(t,"d",(function(){return i})),n.d(t,"a",(function(){return l})),n.d(t,"k",(function(){return r})),n.d(t,"b",(function(){return s})),n.d(t,"c",(function(){return o})),n.d(t,"e",(function(){return u})),n.d(t,"g",(function(){return c})),n.d(t,"h",(function(){return d})),n.d(t,"i",(function(){return m})),n.d(t,"j",(function(){return p})),n.d(t,"f",(function(){return b}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.inspectDescription",{defaultMessage:"Inspect"}),l=a.i18n.translate("xpack.securitySolution.inspect.modal.closeTitle",{defaultMessage:"Close"}),r=a.i18n.translate("xpack.securitySolution.inspect.modal.somethingWentWrongDescription",{defaultMessage:"Sorry about that, something went wrong."}),s=a.i18n.translate("xpack.securitySolution.inspect.modal.indexPatternLabel",{defaultMessage:"Index pattern"}),o=a.i18n.translate("xpack.securitySolution.inspect.modal.indexPatternDescription",{defaultMessage:"The index pattern that connected to the Elasticsearch indices. These indices can be configured in Kibana > Advanced Settings."}),u=a.i18n.translate("xpack.securitySolution.inspectPatternDifferent",{defaultMessage:"This element has a unique index pattern separate from the data view setting."}),c=a.i18n.translate("xpack.securitySolution.inspect.modal.queryTimeLabel",{defaultMessage:"Query time"}),d=a.i18n.translate("xpack.securitySolution.inspect.modal.queryTimeDescription",{defaultMessage:"The time it took to process the query. Does not include the time to send the request or parse it in the browser."}),m=a.i18n.translate("xpack.securitySolution.inspect.modal.reqTimestampLabel",{defaultMessage:"Request timestamp"}),p=a.i18n.translate("xpack.securitySolution.inspect.modal.reqTimestampDescription",{defaultMessage:"Time when the start of the request has been logged"}),b=a.i18n.translate("xpack.securitySolution.inspect.modal.noAlertIndexFound",{defaultMessage:"No alert index found"})},456:function(e,t,n){"use strict";n.d(t,"b",(function(){return s})),n.d(t,"a",(function(){return o})),n.d(t,"c",(function(){return c}));var a=n(57),i=n(42),l=n(293);const r=e=>e.toLocaleString(),s=({chartHeight:e,from:t,legendPosition:n,to:i,onBrushEnd:s,yTickFormatter:o,showLegend:u})=>({series:{xScaleType:a.ScaleType.Time,yScaleType:a.ScaleType.Linear,stackAccessors:["g"]},axis:{xTickFormatter:Object(l.a)([t,i]),yTickFormatter:null!=o?o:r,tickSize:8},settings:{legendPosition:null!=n?n:a.Position.Right,onBrushEnd:s,showLegend:null==u||u,showLegendExtra:!0,theme:{scales:{barsPadding:.08},chartMargins:{left:0,right:0,top:0,bottom:0},chartPaddings:{left:0,right:0,top:0,bottom:0}}},customHeight:null!=e?e:174}),o=["#1EA593","#2B70F7","#CE0060","#38007E","#FCA5D3","#F37020","#E49E29","#B0916F","#7B000B","#34130C","#GGGGGG"],u=([e,t])=>({key:e,value:t}),c=(e,t)=>{if(!e)return[];const n=Object(i.groupBy)("g",e),a=Object(i.toPairs)(n);return Object(i.map)(u,a).map(((e,n)=>{var a;const l=Object(i.get)(e.key,t);return{...e,color:null!==(a=null==l?void 0:l.color)&&void 0!==a?a:o[n]}}))}},457:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"c",(function(){return l})),n.d(t,"d",(function(){return r})),n.d(t,"f",(function(){return s})),n.d(t,"g",(function(){return o})),n.d(t,"h",(function(){return u})),n.d(t,"i",(function(){return c})),n.d(t,"j",(function(){return d})),n.d(t,"b",(function(){return m})),n.d(t,"k",(function(){return p})),n.d(t,"l",(function(){return b})),n.d(t,"m",(function(){return g})),n.d(t,"n",(function(){return f})),n.d(t,"o",(function(){return y})),n.d(t,"e",(function(){return v}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.dataQualityDashboard.addToCaseSuccessToast",{defaultMessage:"Successfully added data quality results to the case"}),l=(a.i18n.translate("xpack.securitySolution.dataQualityDashboard.betaBadge",{defaultMessage:"Beta"}),a.i18n.translate("xpack.securitySolution.overview.ilmPhaseCold",{defaultMessage:"cold"})),r=a.i18n.translate("xpack.securitySolution.dataQualityDashboard.pageTitle",{defaultMessage:"Data Quality"}),s=a.i18n.translate("xpack.securitySolution.dataQualityDashboard.elasticCommonSchemaReferenceLink",{defaultMessage:"Elastic Common Schema (ECS)"}),o=(a.i18n.translate("xpack.securitySolution.overview.eventsTitle",{defaultMessage:"Event count"}),a.i18n.translate("xpack.securitySolution.overview.ilmPhaseFrozen",{defaultMessage:"frozen"})),u=a.i18n.translate("xpack.securitySolution.overview.ilmPhaseHot",{defaultMessage:"hot"}),c=a.i18n.translate("xpack.securitySolution.overview.newsFeedSidebarTitle",{defaultMessage:"Security news"}),d=a.i18n.translate("xpack.securitySolution.overview.recentTimelinesSidebarTitle",{defaultMessage:"Recent timelines"}),m=a.i18n.translate("xpack.securitySolution.overview.signalCountTitle",{defaultMessage:"Alert trend"}),p=e=>a.i18n.translate("xpack.securitySolution.overview.topNLabel",{values:{fieldName:e},defaultMessage:"Top {fieldName}"}),b=a.i18n.translate("xpack.securitySolution.overview.ilmPhaseUnmanaged",{defaultMessage:"unmanaged"}),g=a.i18n.translate("xpack.securitySolution.overview.viewAlertsButtonLabel",{defaultMessage:"View alerts"}),f=a.i18n.translate("xpack.securitySolution.overview.viewEventsButtonLabel",{defaultMessage:"View events"}),y=a.i18n.translate("xpack.securitySolution.overview.ilmPhaseWarm",{defaultMessage:"warm"}),v=a.i18n.translate("xpack.securitySolution.detectionResponse.pageTitle",{defaultMessage:"Detection & Response"});a.i18n.translate("xpack.securitySolution.entityAnalytics.technicalPreviewLabel",{defaultMessage:"Technical Preview"})},476:function(e,t,n){"use strict";n.d(t,"a",(function(){return O})),n.d(t,"c",(function(){return k})),n.d(t,"d",(function(){return j})),n.d(t,"b",(function(){return w}));var a=n(40),i=n(220),l=n(2),r=n.n(l),s=n(104),o=n.n(s),u=n(103),c=n(105),d=n(122),m=n(182),p=n(138),b=n(114),g=n(110),f=n(118),y=n(106),v=n(135),h=n(242),E=n(12);const S=({asEmptyButton:e,children:t,dataProviders:n,filters:i,timeRange:s,keepDataView:S,...x})=>{const O=Object(u.useDispatch)(),k=Object(l.useMemo)((()=>d.e.getSourcererDataViewsSelector()),[]),{defaultDataView:j,signalIndexName:T}=Object(c.a)((e=>k(e))),w=n&&n.find((e=>"template"===e.type)),M=Object(h.a)({timelineId:f.c.active,timelineType:w?y.l.template:y.l.default}),I=Object(l.useCallback)((()=>{if(n||i){if(s?M({timeRange:s}):M(),n)switch(O(Object(E.updateDataView)({id:f.c.active,dataViewId:"security-solution-default",indexNames:["logs-*"]})),n[0].queryType){case"eql":O(Object(E.updateEqlOptions)({id:f.c.active,field:"query",value:n[0].kqlQuery})),O(Object(E.setActiveTabTimeline)({id:f.c.active,activeTab:f.d.eql}));break;case"kql":O(Object(E.applyKqlFilterQuery)({id:f.c.active,filterQuery:{kuery:{kind:"kuery",expression:n[0].kqlQuery},serializedQuery:n[0].kqlQuery}})),O(Object(E.setActiveTabTimeline)({id:f.c.active,activeTab:f.d.query}));break;case"dsl":const e={meta:{type:"custom",disabled:!1,negate:!1,alias:n[0].name,key:"query",value:n[0].kqlQuery},query:JSON.parse(n[0].kqlQuery)};O(Object(E.setFilters)({id:f.c.active,filters:[e]})),O(Object(E.setActiveTabTimeline)({id:f.c.active,activeTab:f.d.query}))}i&&O(Object(E.setFilters)({id:f.c.active,filters:i})),S||O(m.d.setSelectedDataView({id:g.SourcererScopeName.timeline,selectedDataViewId:j.id,selectedPatterns:[T||""]})),O(p.b.removeLinkTo([b.a.timeline,b.a.global]))}}),[n,M,O,j.id,T,i,s,S]);return e?r.a.createElement(a.EuiButtonEmpty,{"aria-label":v.h,onClick:I,color:"text",flush:"both",size:"xs"},t):r.a.createElement(a.EuiButton,o()({"aria-label":v.h,onClick:I},x),t)};S.displayName="SendToTimelineButton";var x=n(721);const O="securityAssistant",k=e=>e.map((e=>`Rule Name:${e.name}\nRule Description:${e.description}`)).join("\n\n"),j=e=>e.filter((({field:e})=>!e.startsWith("signal."))).reduce(((e,{field:t,values:n})=>({...e,[t]:null!=n?n:[]})),{}),T=["kql","dsl","eql"],w=e=>e.messages.map((({content:t})=>Object(i.i)((({messageContent:e,replacements:t})=>null!=t?Object.keys(t).reduce(((e,n)=>e.replaceAll(n,t[n])),e):e)({messageContent:t,replacements:e.replacements})))).map(((t,n)=>t.map(((t,i)=>{var l;return{...t,getControlContainer:()=>document.querySelectorAll(`.message-${n} .euiCodeBlock__controls`)[i],button:T.includes(t.type)?r.a.createElement(S,{asEmptyButton:!0,dataProviders:[{id:"assistant-data-provider",name:`Assistant Query from conversation ${e.id}`,enabled:!0,excluded:!1,queryType:t.type,kqlQuery:null!==(l=t.content)&&void 0!==l?l:"",queryMatch:{field:"host.name",operator:":",value:"test"},and:[]}],keepDataView:!0},r.a.createElement(a.EuiToolTip,{position:"right",content:x.f},r.a.createElement(a.EuiIcon,{type:"timeline"}))):null}}))))},480:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=function(){const e=this.Parser,t=e.prototype.blockTokenizers,n=e.prototype.blockMethods;t.osquery=function(e,t,n){if(!1===t.startsWith("!{osquery"))return!1;const a=t[9];if("{"!==a&&"}"!==a)return!1;if(n)return!0;let i="!{osquery",l={};if("{"===a){let n="",a=0;for(let e=9;e<t.length;e++){const i=t[e];if("{"===i)a++,n+=i;else if("}"===i){if(a--,-1===a)break;n+=i}else n+=i}i+=n;try{l=JSON.parse(n)}catch(t){const n=e.now();this.file.fail(`Unable to parse osquery JSON configuration: ${t}`,{line:n.line,column:n.column+9})}}return i+="}",e(i)({type:"osquery",configuration:l})},n.splice(n.indexOf("text"),0,"osquery")}},481:function(e,t,n){"use strict";n.d(t,"a",(function(){return d}));var a=n(2),i=n.n(a),l=n(41),r=n.n(l),s=n(40),o=n(125),u=n(452);const c=r()(s.EuiFlexGroup).withConfig({displayName:"BottomContentWrapper",componentId:"sc-1819ayg-0"})(["",""],(({theme:e})=>`\n    padding: ${e.eui.euiSizeM} 0;\n  `)),d=i.a.memo(Object(a.forwardRef)((({id:e,field:t,dataTestSubj:n,idAria:l,bottomRightContent:r},d)=>{const{isInvalid:m,errorMessage:p}=Object(o.i)(t),[b,g]=Object(a.useState)(!1);return i.a.createElement(s.EuiFormRow,{"data-test-subj":n,describedByIds:l?[l]:void 0,error:p,fullWidth:!0,helpText:t.helpText,isInvalid:m||b,label:t.label,labelAppend:t.labelAppend},i.a.createElement(i.a.Fragment,null,i.a.createElement(u.a,{ref:d,ariaLabel:l,editorId:e,onChange:t.setValue,value:t.value,"data-test-subj":`${n}-markdown-editor`,setIsMarkdownInvalid:g}),r&&i.a.createElement(c,{justifyContent:"flexEnd"},i.a.createElement(s.EuiFlexItem,{grow:!1},r))))})));d.displayName="MarkdownEditorForm"},482:function(e,t,n){"use strict";n.d(t,"a",(function(){return c}));var a=n(2),i=n(103),l=n(105),r=n(102),s=n(122),o=n(182),u=n(114);const c=({inputId:e,queryId:t,skip:n})=>{const c=Object(i.useDispatch)(),{data:d}=Object(r.j)().services,m=Object(a.useRef)(d.search.session),p=s.d.globalQueryByIdSelector(),b=s.d.timelineQueryByIdSelector(),{selectedInspectIndex:g}=Object(l.a)((n=>e===u.a.global?p(n,t):b(n,t))),f=Object(a.useCallback)((()=>{const e=m.current.start();c(o.c.setInspectionParameter({id:t,selectedInspectIndex:g,isInspected:!1,inputId:u.a.global,searchSessionId:n?void 0:e}))}),[c,t,g,n]),y=Object(a.useCallback)((()=>{c(o.c.deleteOneQuery({inputId:u.a.global,id:t}))}),[c,t]);return{session:m,refetchByRestartingSession:f,refetchByDeletingSession:y}}},483:function(e,t,n){"use strict";n.d(t,"d",(function(){return i})),n.d(t,"a",(function(){return l})),n.d(t,"e",(function(){return r})),n.d(t,"c",(function(){return s})),n.d(t,"b",(function(){return o}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.stackByLabel",{defaultMessage:"Stack by"}),l=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.groupByLabel",{defaultMessage:"Group by"}),r=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.stackByPlaceholder",{defaultMessage:"Select a field to stack by"}),s=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.stackByAriaLabel",{defaultMessage:"Stack the alerts histogram by a field value"}),o=a.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.groupByTopLabel",{defaultMessage:"Group by top"})},484:function(e,t,n){"use strict";n.d(t,"e",(function(){return i})),n.d(t,"f",(function(){return l})),n.d(t,"g",(function(){return r})),n.d(t,"h",(function(){return s})),n.d(t,"i",(function(){return o})),n.d(t,"j",(function(){return u})),n.d(t,"k",(function(){return c})),n.d(t,"c",(function(){return d})),n.d(t,"d",(function(){return m})),n.d(t,"n",(function(){return p})),n.d(t,"m",(function(){return b})),n.d(t,"o",(function(){return g})),n.d(t,"p",(function(){return f})),n.d(t,"q",(function(){return y})),n.d(t,"t",(function(){return v})),n.d(t,"s",(function(){return h})),n.d(t,"u",(function(){return E})),n.d(t,"w",(function(){return S})),n.d(t,"a",(function(){return x})),n.d(t,"b",(function(){return O})),n.d(t,"v",(function(){return k})),n.d(t,"r",(function(){return j})),n.d(t,"l",(function(){return T}));var a=n(5);a.i18n.translate("xpack.securitySolution.dataProviders.and",{defaultMessage:"AND"});const i=a.i18n.translate("xpack.securitySolution.dataProviders.deleteDataProvider",{defaultMessage:"Delete"}),l=a.i18n.translate("xpack.securitySolution.dataProviders.dropAnything",{defaultMessage:"Drop anything"}),r=(a.i18n.translate("xpack.securitySolution.dataProviders.edit",{defaultMessage:"Edit"}),a.i18n.translate("xpack.securitySolution.dataProviders.editMenuItem",{defaultMessage:"Edit filter"})),s=a.i18n.translate("xpack.securitySolution.dataProviders.editTitle",{defaultMessage:"EDIT FILTER"}),o=a.i18n.translate("xpack.securitySolution.dataProviders.excludeDataProvider",{defaultMessage:"Exclude results"}),u=a.i18n.translate("xpack.securitySolution.dataProviders.existsLabel",{defaultMessage:"exists"}),c=(a.i18n.translate("xpack.securitySolution.dataProviders.fieldLabel",{defaultMessage:"Field"}),a.i18n.translate("xpack.securitySolution.dataProviders.filterForFieldPresentLabel",{defaultMessage:"Filter for field present"})),d=a.i18n.translate("xpack.securitySolution.dataProviders.convertToFieldLabel",{defaultMessage:"Convert to field"}),m=a.i18n.translate("xpack.securitySolution.dataProviders.convertToTemplateFieldLabel",{defaultMessage:"Convert to template field"}),p=a.i18n.translate("xpack.securitySolution.dataProviders.highlighted",{defaultMessage:"highlighted"}),b=a.i18n.translate("xpack.securitySolution.dataProviders.hereToBuildAn",{defaultMessage:"here to build an"}),g=a.i18n.translate("xpack.securitySolution.dataProviders.includeDataProvider",{defaultMessage:"Include results"}),f=a.i18n.translate("xpack.securitySolution.dataProviders.not",{defaultMessage:"NOT"}),y=(a.i18n.translate("xpack.securitySolution.dataProviders.or",{defaultMessage:"or"}),a.i18n.translate("xpack.securitySolution.dataProviders.query",{defaultMessage:"query"})),v=(a.i18n.translate("xpack.securitySolution.dataProviders.toggle",{defaultMessage:"toggle"}),a.i18n.translate("xpack.securitySolution.dataProviders.reEnableDataProvider",{defaultMessage:"Re-enable"})),h=a.i18n.translate("xpack.securitySolution.dataProviders.removeDataProvider",{defaultMessage:"Remove Data Provider"}),E=({field:e,value:t})=>a.i18n.translate("xpack.securitySolution.dataProviders.showOptionsDataProviderAriaLabel",{values:{field:e,value:t},defaultMessage:"{field} {value} Press enter for options, or press space to begin dragging"}),S=a.i18n.translate("xpack.securitySolution.dataProviders.temporaryDisableDataProvider",{defaultMessage:"Temporarily disable"}),x=(a.i18n.translate("xpack.securitySolution.dataProviders.valuePlaceholder",{defaultMessage:"value"}),a.i18n.translate("xpack.securitySolution.dataProviders.addFieldPopoverButtonLabel",{defaultMessage:"Add field"})),O=a.i18n.translate("xpack.securitySolution.dataProviders.addTemplateFieldPopoverButtonLabel",{defaultMessage:"Add template field"}),k=a.i18n.translate("xpack.securitySolution.dataProviders.templateFieldLabel",{defaultMessage:"Template field"}),j=a.i18n.translate("xpack.securitySolution.dataProviders.queryAreaAriaLabel",{defaultMessage:"You are in the timeline query area, which contains groups of data providers that query for events"}),T=e=>a.i18n.translate("xpack.securitySolution.dataProviders.groupAreaAriaLabel",{values:{group:e},defaultMessage:"You are in group {group}"})},495:function(e,t,n){"use strict";n.d(t,"a",(function(){return r}));var a=n(2),i=n(13),l=n(102);const r=()=>{const e=Object(l.j)(),{http:t}=e.services,[n,r]=Object(a.useState)(Object(i.createSavedQueryService)(t));return Object(a.useEffect)((()=>{r(Object(i.createSavedQueryService)(t))}),[t]),n}},496:function(e,t,n){e.exports=n(33)(1061)},497:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=n(5).i18n.translate("xpack.securitySolution.exitFullScreenButton",{defaultMessage:"Exit full screen"})},511:function(e,t,n){"use strict";n.d(t,"a",(function(){return f}));var a=n(2),i=n.n(a),l=n(41),r=n.n(l),s=n(40),o=n(46),u=n(102),c=n(44);const d=({handleClick:e})=>i.a.createElement(s.EuiFlexGroup,{justifyContent:"flexEnd"},i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(s.EuiButtonEmpty,{onClick:e,"data-test-subj":"osquery-empty-button"},i.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.footer.cancel",defaultMessage:"Cancel"})))),m=i.a.memo(d);var p=n(677);const b=r.a.div.withConfig({displayName:"OsqueryActionWrapper",componentId:"sc-flf6q3-0"})(["padding:8px;"]),g=({agentId:e,defaultValues:t,onClose:n,ecsData:l})=>{const{services:{osquery:r}}=Object(u.j)(),c=Object(o.useQueryClient)(),d=Object(a.useCallback)((()=>{var e;c.invalidateQueries({queryKey:["actions",{alertId:null==t||null===(e=t.alertIds)||void 0===e?void 0:e[0]}]})}),[null==t?void 0:t.alertIds,c]);return null!=r&&r.OsqueryAction?i.a.createElement(s.EuiFlyout,{size:"m",onClose:n},i.a.createElement(s.EuiFlyoutHeader,{hasBorder:!0,"data-test-subj":"flyout-header-osquery"},i.a.createElement(s.EuiTitle,null,i.a.createElement("h2",null,p.a))),i.a.createElement(s.EuiFlyoutBody,null,i.a.createElement(b,{"data-test-subj":"flyout-body-osquery"},i.a.createElement(r.OsqueryAction,{agentId:e,formType:"steps",defaultValues:t,ecsData:l,onSuccess:d}))),i.a.createElement(s.EuiFlyoutFooter,null,i.a.createElement(m,{handleClick:n,"data-test-subj":"flyout-footer-osquery"}))):null},f=i.a.memo(g)},519:function(e,t,n){"use strict";n.d(t,"d",(function(){return o})),n.d(t,"b",(function(){return u})),n.d(t,"c",(function(){return c})),n.d(t,"a",(function(){return d}));var a=n(2),i=n.n(a),l=n(365);const r=Object(l.c)(),s=Object(l.c)(),o=()=>{const[e]=Object(a.useState)(r);return{portalNode:e}},u=i.a.memo((()=>{const{portalNode:e}=o();return i.a.createElement(l.b,{node:e})}));u.displayName="TimelineEventsCountBadge";const c=()=>{const[e]=Object(a.useState)(s);return{portalNode:e}},d=i.a.memo((()=>{const{portalNode:e}=c();return i.a.createElement(l.b,{node:e})}));d.displayName="EqlEventsCountBadge"},520:function(e,t,n){"use strict";n.d(t,"a",(function(){return c}));var a=n(104),i=n.n(a),l=n(41),r=n.n(l),s=n(2),o=n.n(s),u=n(40);const c=r()((({loading:e,...t})=>o.a.createElement(u.EuiPanel,i()({},t,{hasBorder:!0})))).withConfig({displayName:"Panel",componentId:"sc-h09jgf-0"})(["position:relative;",""],(({loading:e})=>e&&"\n    overflow: hidden;\n  "));c.displayName="Panel"},521:function(e,t,n){"use strict";n.d(t,"a",(function(){return a})),n.d(t,"b",(function(){return i})),n.d(t,"d",(function(){return l})),n.d(t,"c",(function(){return r}));const a="kibana.alert.rule.name",i="host.name",l=300,r=500},526:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(2),i=n.n(a),l=n(44),r=n(40),s=n(222);const o=i.a.memo((()=>i.a.createElement(s.a,null,i.a.createElement(r.EuiPageTemplate_Deprecated,{template:"centeredContent"},i.a.createElement(r.EuiEmptyPrompt,{"data-test-subj":"notFoundPage",iconColor:"default",iconType:"logoElastic",title:i.a.createElement("p",null,i.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.pages.fourohfour.pageNotFoundDescription",defaultMessage:"Page not found"}))})))));o.displayName="NotFoundPage"},535:function(e,t,n){"use strict";n.d(t,"a",(function(){return r})),n.d(t,"b",(function(){return s}));var a=n(2),i=n.n(a);const l=i.a.createContext(null),r=Object(a.memo)((({upsellingService:e,children:t})=>i.a.createElement(l.Provider,{value:e},t)));r.displayName="UpsellingProvider";const s=()=>{const e=Object(a.useContext)(l);if(!e)throw new Error("UpsellingProviderContext not found");return e}},549:function(e,t,n){var a=n(973),i=n(974);e.exports=function(e,t,n){return a(i,e,t,n)}},550:function(e,t,n){e.exports=n(33)(3824)},551:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"d",(function(){return l})),n.d(t,"e",(function(){return r})),n.d(t,"f",(function(){return s})),n.d(t,"b",(function(){return o})),n.d(t,"g",(function(){return u})),n.d(t,"h",(function(){return c})),n.d(t,"c",(function(){return d}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.notes.addNoteButtonLabel",{defaultMessage:"Add Note"}),l=a.i18n.translate("xpack.securitySolution.notes.noteLabel",{defaultMessage:"Note"}),r=a.i18n.translate("xpack.securitySolution.notes.notesTitle",{defaultMessage:"Notes"}),s=a.i18n.translate("xpack.securitySolution.notes.search.FilterByUserOrNotePlaceholder",{defaultMessage:"Filter by User or Note"}),o=a.i18n.translate("xpack.securitySolution.notes.cancelButtonLabel",{defaultMessage:"Cancel"}),u=a.i18n.translate("xpack.securitySolution.notes.youAreEditingANoteScreenReaderOnly",{defaultMessage:"You are editing a note. Click Add Note when finished, or press escape to cancel."}),c=e=>a.i18n.translate("xpack.securitySolution.notes.youAreViewingNotesScreenReaderOnly",{values:{row:e},defaultMessage:"You are viewing notes for the event in row {row}. Press the up arrow key when finished to return to the event."}),d=a.i18n.translate("xpack.securitySolution.notes.createdByLabel",{defaultMessage:"Created by"})},559:function(e,t){const n=/^[0-9]+$/,a=(e,t)=>{const a=n.test(e),i=n.test(t);return a&&i&&(e=+e,t=+t),e===t?0:a&&!i?-1:i&&!a?1:e<t?-1:1};e.exports={compareIdentifiers:a,rcompareIdentifiers:(e,t)=>a(t,e)}},560:function(e,t,n){"use strict";n.d(t,"b",(function(){return l})),n.d(t,"a",(function(){return r})),n.d(t,"f",(function(){return s})),n.d(t,"k",(function(){return o})),n.d(t,"l",(function(){return u})),n.d(t,"j",(function(){return c})),n.d(t,"g",(function(){return d})),n.d(t,"h",(function(){return m})),n.d(t,"d",(function(){return p})),n.d(t,"e",(function(){return b})),n.d(t,"c",(function(){return g})),n.d(t,"p",(function(){return f})),n.d(t,"o",(function(){return y})),n.d(t,"n",(function(){return v})),n.d(t,"m",(function(){return h})),n.d(t,"i",(function(){return E}));var a=n(5),i=n(106);const l=a.i18n.translate("xpack.securitySolution.timeline.callOut.unauthorized.message.description",{defaultMessage:"You can use Timeline to investigate events, but you do not have the required permissions to save timelines for future use. If you need to save timelines, contact your Kibana administrator."}),r=a.i18n.translate("xpack.securitySolution.timeline.callOut.immutable.message.description",{defaultMessage:"This prebuilt timeline template cannot be modified. To make changes, please duplicate this template and make modifications to the duplicate template."}),s=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.button",{defaultMessage:"Edit timeline name and description"}),o=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.header",{defaultMessage:"Save Timeline"}),u=a.i18n.translate("xpack.securitySolution.timeline.saveTimelineTemplate.modal.header",{defaultMessage:"Save Timeline Template"}),c=a.i18n.translate("xpack.securitySolution.timeline.nameTimeline.save.title",{defaultMessage:"Save"}),d=a.i18n.translate("xpack.securitySolution.timeline.nameTimeline.modal.header",{defaultMessage:"Name Timeline"}),m=a.i18n.translate("xpack.securitySolution.timeline.nameTimelineTemplate.modal.header",{defaultMessage:"Name Timeline Template"}),p=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.discard.title",{defaultMessage:"Discard Timeline"}),b=a.i18n.translate("xpack.securitySolution.timeline.saveTimelineTemplate.modal.discard.title",{defaultMessage:"Discard Timeline Template"}),g=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.close.title",{defaultMessage:"Close"}),f=e=>a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.warning.title",{values:{timeline:e===i.l.template?"timeline template":"timeline"},defaultMessage:"You have an unsaved {timeline}. Do you wish to save it?"}),y=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.titleTitle",{defaultMessage:"Title"}),v=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.titleAriaLabel",{defaultMessage:"Title"}),h=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.descriptionLabel",{defaultMessage:"Description"}),E=a.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.optionalLabel",{defaultMessage:"Optional"})},561:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n(103),l=n(114),r=n(105),s=n(122),o=n(182);const u=({inputId:e=l.a.global,inspectIndex:t=0,isDisabled:n,multiple:u=!1,onClick:c,onCloseInspect:d,queryId:m})=>{const p=Object(i.useDispatch)(),b=s.d.globalQueryByIdSelector(),g=s.d.timelineQueryByIdSelector(),{loading:f,inspect:y,selectedInspectIndex:v,isInspected:h}=Object(r.a)((t=>e===l.a.global?b(t,m):g(t,m))),E=Object(a.useCallback)((()=>{c&&c(),p(o.c.setInspectionParameter({id:m,inputId:e,isInspected:!0,selectedInspectIndex:t}))}),[c,p,m,e,t]),S=Object(a.useCallback)((()=>{null!=d&&d(),p(o.c.setInspectionParameter({id:m,inputId:e,isInspected:!1,selectedInspectIndex:t}))}),[d,p,m,e,t]);let x=null,O=null;null!=y&&y.dsl.length>0&&(u?[x,...O]=y.dsl:x=y.dsl[t]);let k=null,j=null;null!=y&&y.response.length>0&&(u?[k,...j]=y.response:k=y.response[t]);const T=Object(a.useMemo)((()=>!f&&v===t&&h),[t,h,f,v]);return{additionalRequests:O,additionalResponses:j,handleClick:E,handleCloseModal:S,isButtonDisabled:Object(a.useMemo)((()=>f||n||null==x||null==k||null==m),[n,f,m,x,k]),isShowingModal:T,loading:f,request:x,response:k}}},562:function(e,t,n){"use strict";let a;n.d(t,"a",(function(){return a})),function(e){e.flows="flows",e.dns="dns",e.anomalies="anomalies",e.tls="tls",e.http="http",e.events="events"}(a||(a={}))},604:function(e,t,n){"use strict";n.d(t,"d",(function(){return m})),n.d(t,"c",(function(){return p})),n.d(t,"b",(function(){return b})),n.d(t,"a",(function(){return f}));var a=n(55),i=n.n(a),l=n(338),r=n(230),s=n(47);const o=Object(s.v4)();var u,c,d=n(918);const m=(e,t)=>n=>`${d.g}: ${i()(n).format(e)} ${t?d.f(n):d.e(n)}`,p=[{text:"event.action",value:"event.action"},{text:"event.dataset",value:"event.dataset"},{text:"event.module",value:"event.module"}],b={defaultStackByOption:null!==(u=p.find((e=>"event.action"===e.text)))&&void 0!==u?u:p[0],errorMessage:d.c,histogramType:l.j.events,stackByOptions:p,subtitle:void 0,title:d.d,getLensAttributes:(e="event.action",t={})=>{var n;return{title:"Events",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:o,accessors:["e09e0380-0740-4105-becc-0a4ca12e3944"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"aac9d7d0-13a3-480a-892b-08207a787926",splitAccessor:"34919782-4546-43a5-b668-06ac934d3acd"}],yRightExtent:{mode:"full"},yLeftExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},valuesInLegend:!0},query:{query:"",language:"kuery"},filters:null!==(n=t.filters)&&void 0!==n?n:[],datasourceStates:{formBased:{layers:{[o]:{columns:{"aac9d7d0-13a3-480a-892b-08207a787926":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"e09e0380-0740-4105-becc-0a4ca12e3944":{label:"Count of records",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___"},"34919782-4546-43a5-b668-06ac934d3acd":{label:`Top values of ${e}`,dataType:"string",operationType:"terms",scale:"ordinal",sourceField:`${e}`,isBucketed:!0,params:{size:10,orderBy:{type:"column",columnId:"e09e0380-0740-4105-becc-0a4ca12e3944"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"}}}},columnOrder:["34919782-4546-43a5-b668-06ac934d3acd","aac9d7d0-13a3-480a-892b-08207a787926","e09e0380-0740-4105-becc-0a4ca12e3944"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:`indexpattern-datasource-layer-${o}`}]}}},g=[{text:"event.category",value:"event.category"},{text:"event.module",value:"event.module"}],f={defaultStackByOption:null!==(c=g.find((e=>"event.module"===e.text)))&&void 0!==c?c:g[0],errorMessage:d.b,histogramType:l.j.alerts,stackByOptions:g,subtitle:void 0,title:d.a,getLensAttributes:(e="event.module")=>({title:"External alerts",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:"a3c54471-615f-4ff9-9fda-69b5b2ea3eef",accessors:["0a923af2-c880-4aa3-aa93-a0b9c2801f6d"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"37bdf546-3c11-4b08-8c5d-e37debc44f1d",splitAccessor:"42334c6e-98d9-47a2-b4cb-a445abb44c93"}],yRightExtent:{mode:"full"},yLeftExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},valuesInLegend:!0},query:{query:"",language:"kuery"},filters:[{meta:{index:"a04472fc-94a3-4b8d-ae05-9d30ea8fbd6a",alias:null,negate:!1,disabled:!1,type:"phrase",key:"event.kind",params:{query:"alert"}},query:{match_phrase:{"event.kind":"alert"}},$state:{store:"appState"}}],datasourceStates:{formBased:{layers:{"a3c54471-615f-4ff9-9fda-69b5b2ea3eef":{columns:{"37bdf546-3c11-4b08-8c5d-e37debc44f1d":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"0a923af2-c880-4aa3-aa93-a0b9c2801f6d":{label:r.f,dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___"},"42334c6e-98d9-47a2-b4cb-a445abb44c93":{label:Object(r.o)(`${e}`),dataType:"string",operationType:"terms",scale:"ordinal",sourceField:`${e}`,isBucketed:!0,params:{size:10,orderBy:{type:"column",columnId:"0a923af2-c880-4aa3-aa93-a0b9c2801f6d"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"}}}},columnOrder:["42334c6e-98d9-47a2-b4cb-a445abb44c93","37bdf546-3c11-4b08-8c5d-e37debc44f1d","0a923af2-c880-4aa3-aa93-a0b9c2801f6d"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-a3c54471-615f-4ff9-9fda-69b5b2ea3eef"},{type:"index-pattern",name:"723c4653-681b-4105-956e-abef287bf025",id:"{dataViewId}"},{type:"index-pattern",name:"a04472fc-94a3-4b8d-ae05-9d30ea8fbd6a",id:"{dataViewId}"}]})}},606:function(e,t,n){"use strict";n.d(t,"a",(function(){return m}));var a=n(680),i=n(476),l=n(220),r=n(795),s=n(137),o=n(155),u=n(914),c=n(640);const d={[o.e]:{id:o.e,isDefault:!0,messages:[],apiConfig:{}},[r.a]:{id:r.a,isDefault:!0,messages:[],apiConfig:{}},[s.yb]:{id:s.yb,isDefault:!0,messages:[],apiConfig:{}},[o.i]:{id:o.i,isDefault:!0,messages:[],apiConfig:{}},[c.a]:{excludeFromLastConversationStorage:!0,id:c.a,isDefault:!0,messages:[],apiConfig:{}},[l.h]:{id:l.h,isDefault:!0,theme:{title:l.e,titleIcon:"logoSecurity",assistant:{name:u.f,icon:"logoSecurity"},system:{icon:"logoElastic"},user:{}},messages:[],apiConfig:{}}},m=()=>{const[e,t]=Object(a.a)({defaultValue:d,key:i.a,isInvalidDefault:e=>!e});return{conversations:e,setConversations:t}}},613:function(e,t,n){var a=n(614),i=n(615),l=i?function(e,t){return i.set(e,t),e}:a;e.exports=l},614:function(e,t,n){e.exports=n(33)(1650)},615:function(e,t,n){var a=n(976),i=a&&new a;e.exports=i},616:function(e,t,n){e.exports=n(33)(3673)},617:function(e,t,n){var a=n(618),i=n(619),l=n(979),r=n(341),s=n(620),o=n(626),u=n(995),c=n(443),d=n(342);e.exports=function e(t,n,m,p,b,g,f,y,v,h){var E=128&n,S=1&n,x=2&n,O=24&n,k=512&n,j=x?void 0:r(t);return function T(){for(var w=arguments.length,M=Array(w),I=w;I--;)M[I]=arguments[I];if(O)var C=o(T),A=l(M,C);if(p&&(M=a(M,p,b,O)),g&&(M=i(M,g,f,O)),w-=A,O&&w<h){var D=c(M,C);return s(t,n,e,T.placeholder,m,M,D,y,v,h-w)}var N=S?m:this,F=x?N[t]:t;return w=M.length,y?M=u(M,y):k&&w>1&&M.reverse(),E&&v<w&&(M.length=v),this&&this!==d&&this instanceof T&&(F=j||r(F)),F.apply(N,M)}}},618:function(e,t){var n=Math.max;e.exports=function(e,t,a,i){for(var l=-1,r=e.length,s=a.length,o=-1,u=t.length,c=n(r-s,0),d=Array(u+c),m=!i;++o<u;)d[o]=t[o];for(;++l<s;)(m||l<r)&&(d[a[l]]=e[l]);for(;c--;)d[o++]=e[l++];return d}},619:function(e,t){var n=Math.max;e.exports=function(e,t,a,i){for(var l=-1,r=e.length,s=-1,o=a.length,u=-1,c=t.length,d=n(r-o,0),m=Array(d+c),p=!i;++l<d;)m[l]=e[l];for(var b=l;++u<c;)m[b+u]=t[u];for(;++s<o;)(p||l<r)&&(m[b+a[s]]=e[l++]);return m}},620:function(e,t,n){var a=n(980),i=n(623),l=n(624);e.exports=function(e,t,n,r,s,o,u,c,d,m){var p=8&t;t|=p?32:64,4&(t&=~(p?64:32))||(t&=-4);var b=[e,t,s,p?o:void 0,p?u:void 0,p?void 0:o,p?void 0:u,c,d,m],g=n.apply(void 0,b);return a(e)&&i(g,b),g.placeholder=r,l(g,e,t)}},621:function(e,t,n){var a=n(615),i=n(667),l=a?function(e){return a.get(e)}:i;e.exports=l},622:function(e,t,n){var a=n(436),i=n(439);function l(e,t){this.__wrapped__=e,this.__actions__=[],this.__chain__=!!t,this.__index__=0,this.__values__=void 0}l.prototype=a(i.prototype),l.prototype.constructor=l,e.exports=l},623:function(e,t,n){var a=n(613),i=n(985)(a);e.exports=i},624:function(e,t,n){var a=n(986),i=n(987),l=n(988),r=n(989);e.exports=function(e,t,n){var s=t+"";return l(e,i(s,r(a(s),n)))}},625:function(e,t,n){e.exports=n(33)(3641)},626:function(e,t){e.exports=function(e){return e.placeholder}},627:function(e,t,n){e.exports=n(33)(3629)},628:function(e,t,n){e.exports=n(33)(3640)},629:function(e,t,n){e.exports=n(33)(938)},630:function(e,t,n){e.exports=n(33)(3303)},631:function(e,t,n){var a=n(437);e.exports=function(e){return e==e&&!a(e)}},632:function(e,t){e.exports=function(e,t){return function(n){return null!=n&&n[e]===t&&(void 0!==t||e in Object(n))}}},633:function(e,t,n){e.exports=n(33)(1234)},634:function(e,t,n){e.exports=n(33)(3635)},635:function(e,t,n){var a=n(1029),i=n(633),l=n(629),r=n(442),s=n(437),o=n(288);e.exports=function(e,t,n,u){if(!s(e))return e;for(var c=-1,d=(t=i(t,e)).length,m=d-1,p=e;null!=p&&++c<d;){var b=o(t[c]),g=n;if("prototype"==b&&l(p))throw new Error("Illegal access of function prototype");if(c!=m){var f=hasOwnProperty.call(p,b)?p[b]:void 0;void 0===(g=u?u(f,b,p):void 0)&&(g=s(f)?f:r(t[c+1])?[]:{})}a(p,b,g),p=p[b]}return e}},637:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(40),i=n(109),l=n(2),r=n.n(l),s=n(41);const o=n.n(s)()(a.EuiPopover).withConfig({displayName:"WithHoverActionsPopover",componentId:"sc-1w6un7x-0"})([".euiPopover__anchor{width:100%;}"]),u=r.a.memo((({alwaysShow:e=!1,closePopOverTrigger:t,hoverContent:n,onCloseRequested:a,render:s})=>{const[u,c]=Object(l.useState)(null!=n&&e),[d,m]=Object(l.useState)(!1),[,p]=Object(l.useState)(void 0),b=Object(l.useRef)(null),g=Object(l.useCallback)((()=>{p((e=>{clearTimeout(e)})),m(!1),null!=a&&setTimeout((()=>{a()}))}),[a]),f=Object(l.useCallback)((()=>{p(Number(setTimeout((()=>{document.body.classList.contains(i.d)||m(!0)}),100)))}),[p,m]),y=Object(l.useCallback)((()=>{e||g()}),[e,g]),v=Object(l.useCallback)((e=>{u&&"Escape"===e.key&&y()}),[u,y]),h=Object(l.useMemo)((()=>r.a.createElement("div",{"data-test-subj":"withHoverActionsButton",onMouseEnter:f},s(d))),[f,s,d]);return Object(l.useEffect)((()=>{c(null!=n&&(d||e))}),[n,d,e]),Object(l.useEffect)((()=>{m(!1)}),[t]),Object(l.useEffect)((()=>{var e;u&&(null==b||null===(e=b.current)||void 0===e||e.positionPopoverFluid())}),[n,u]),r.a.createElement("div",{className:e?i.c:"",onMouseLeave:y},r.a.createElement(o,{ref:b,anchorPosition:"downCenter",button:h,closePopover:g,hasArrow:!1,isOpen:u,ownFocus:!1,panelPaddingSize:"none",panelClassName:"withHoverActions__popover",repositionOnScroll:!0},u?r.a.createElement("div",{onKeyDown:v},n):null))}));u.displayName="WithHoverActions"},638:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),l=n(41),r=n.n(l),s=n(148);const o=r.a.div.withConfig({displayName:"ProviderContainerComponent",componentId:"sc-11ewwh0-0"})([""," ",""],(({isDragging:e})=>!e&&Object(l.css)(["&{border-radius:2px;padding:0 4px 0 8px;position:relative;z-index:"," !important;&::before{background-image:linear-gradient( 135deg,"," 25%,transparent 25% ),linear-gradient( -135deg,"," 25%,transparent 25% ),linear-gradient( 135deg,transparent 75%,"," 75% ),linear-gradient( -135deg,transparent 75%,"," 75% );background-position:0 0,1px 0,1px -1px,0px 1px;background-size:2px 2px;bottom:2px;content:'';display:block;left:2px;position:absolute;top:2px;width:4px;}}&:hover{&,& .euiBadge,& .euiBadge__text{cursor:move;cursor:grab;}}.",":hover &,tr:hover &{&::before{background-image:linear-gradient( 135deg,"," 25%,transparent 25% ),linear-gradient( -135deg,"," 25%,transparent 25% ),linear-gradient( 135deg,transparent 75%,"," 75% ),linear-gradient( -135deg,transparent 75%,"," 75% );}}&:hover,&:focus,.",":hover &:hover,.",":focus &:focus,tr:hover &:hover,tr:hover &:focus{background-color:",";&,& a,& a:hover{color:",";}&::before{background-image:linear-gradient( 135deg,"," 25%,transparent 25% ),linear-gradient( -135deg,"," 25%,transparent 25% ),linear-gradient( 135deg,transparent 75%,"," 75% ),linear-gradient( -135deg,transparent 75%,"," 75% );}}"],(({theme:e})=>e.eui.euiZLevel0),(({theme:e})=>e.eui.euiColorMediumShade),(({theme:e})=>e.eui.euiColorMediumShade),(({theme:e})=>e.eui.euiColorMediumShade),(({theme:e})=>e.eui.euiColorMediumShade),s.f,(({theme:e})=>e.eui.euiColorDarkShade),(({theme:e})=>e.eui.euiColorDarkShade),(({theme:e})=>e.eui.euiColorDarkShade),(({theme:e})=>e.eui.euiColorDarkShade),s.f,s.f,(({theme:e})=>e.eui.euiColorPrimary),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade))),(({isDragging:e})=>e&&Object(l.css)(["&{z-index:9999 !important;}"])));o.displayName="ProviderContainerComponent";const u=i.a.memo(o);u.displayName="ProviderContainer"},639:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(2);const i=e=>{const[t,n]=Object(a.useState)(null),i=Object(a.useRef)(null);return Object(a.useEffect)((()=>{var e,t,a,l,r,s,o,u,c;null!=(null===(e=i.current)||void 0===e?void 0:e.clientHeight)&&((null!==(t=null==i||null===(a=i.current)||void 0===a?void 0:a.scrollHeight)&&void 0!==t?t:0)>(null!==(l=null==i||null===(r=i.current)||void 0===r?void 0:r.clientHeight)&&void 0!==l?l:0)&&n(!0),(null!==(s=null===(o=i.current)||void 0===o?void 0:o.scrollHeight)&&void 0!==s?s:0)<=(null!==(u=null==i||null===(c=i.current)||void 0===c?void 0:c.clientHeight)&&void 0!==u?u:0)&&n(!1))}),[i,e]),[t,i]}},640:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=n(5).i18n.translate("xpack.securitySolution.assistant.conversations.timelineConversationTitle",{defaultMessage:"Timeline"})},641:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"b",(function(){return l})),n.d(t,"d",(function(){return r})),n.d(t,"a",(function(){return s}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.topN.closeButtonLabel",{defaultMessage:"Close"}),l=a.i18n.translate("xpack.securitySolution.topN.allEventsSelectLabel",{defaultMessage:"Alerts and events"}),r=a.i18n.translate("xpack.securitySolution.topN.rawEventsSelectLabel",{defaultMessage:"Raw events"}),s=a.i18n.translate("xpack.securitySolution.topN.alertEventsSelectLabel",{defaultMessage:"Detection alerts"})},642:function(e,t,n){"use strict";n.d(t,"a",(function(){return m}));var a=n(2),i=n(4),l=n(562),r=n(116),s=n(105),o=n(122),u=n(110),c=n(175),d=n(211);const m=({applyGlobalQueriesAndFilters:e=!0,extraOptions:t,getLensAttributes:n,lensAttributes:m,scopeId:p=u.SourcererScopeName.default,stackByField:b,title:g})=>{var f,y;const{selectedPatterns:v,dataViewId:h,indicesExist:E}=Object(r.d)(p),S=Object(a.useMemo)((()=>o.d.globalQuerySelector()),[]),x=Object(a.useMemo)((()=>o.d.globalFiltersQuerySelector()),[]),O=Object(s.a)(S),k=Object(s.a)(x),[{detailName:j,pageName:T,tabName:w}]=Object(c.a)(),M=Object(a.useMemo)((()=>w===l.a.events?T===i.wc.network?d.h:Object(d.b)(T):[]),[T,w]),I=Object(a.useMemo)((()=>[i.wc.hosts,i.wc.users].indexOf(T)>=0&&null!=j?Object(d.c)(T,j):i.wc.network===T?Object(d.e)(j):[]),[j,T]),C=Object(a.useMemo)((()=>null!=m?m:n&&b&&n(b,t)),[t,n,m,b]),A=Object.values(null!==(f=null==C||null===(y=C.state)||void 0===y?void 0:y.adHocDataViews)&&void 0!==f?f:{}).length>0,D=Object(a.useMemo)((()=>{var t;if(null==m&&(null==n||null==b||0===(null==b?void 0:b.length)))return null;const a=A?[]:Object(d.d)(v);return{...C,...null!=g?{title:g}:{},state:{...C.state,...e?{query:O}:{},filters:[...C.state.filters,...I,...M,...a,...e?k:[]]},references:null==C||null===(t=C.references)||void 0===t?void 0:t.map((e=>({...e,id:h})))}}),[e,C,h,k,n,A,m,I,O,v,b,M,g]);return A||!A&&E?D:null}},643:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(2),i=n(63),l=n(102),r=n(230);const s=({onAddToCaseClicked:e,lensAttributes:t,timeRange:n})=>{const s=Object(l.h)(),{cases:o}=Object(l.j)().services,u=Object(a.useMemo)((()=>[{persistableStateAttachmentState:{attributes:t,timeRange:n},persistableStateAttachmentTypeId:i.LENS_ATTACHMENT_TYPE,type:i.AttachmentType.persistableState}]),[t,n]),c=o.hooks.useCasesAddToExistingCaseModal({onClose:e,successToaster:{title:r.a}});return{onAddToExistingCaseClicked:Object(a.useCallback)((()=>{e&&e(),c.open({getAttachments:()=>u})}),[u,e,c]),disabled:null==t||null==n||!s.create||!s.read}}},644:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(2),i=n(63),l=n(102),r=n(230);const s=({onClick:e,timeRange:t,lensAttributes:n})=>{const s=Object(l.h)(),{cases:o}=Object(l.j)().services,u=Object(a.useMemo)((()=>[{persistableStateAttachmentState:{attributes:n,timeRange:t},persistableStateAttachmentTypeId:i.LENS_ATTACHMENT_TYPE,type:i.AttachmentType.persistableState}]),[n,t]),c=o.hooks.useCasesAddToNewCaseFlyout({toastContent:r.a});return{onAddToNewCaseClicked:Object(a.useCallback)((()=>{e&&e(),c.open({attachments:u})}),[u,c,e]),disabled:null==n||null==t||!s.create||!s.read}}},645:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),l=n(40),r=n(41);const s=n.n(r)()(l.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-1tb0fg5-0"})(["flex:1;"]),o=()=>i.a.createElement(s,{alignItems:"center",justifyContent:"center",gutterSize:"none"},i.a.createElement(l.EuiFlexItem,{grow:!1},i.a.createElement(l.EuiLoadingSpinner,{size:"xl"}))),u=i.a.memo(o)},646:function(e,t,n){"use strict";n.d(t,"a",(function(){return d})),n.d(t,"b",(function(){return p}));var a=n(40),i=n(41),l=n.n(i),r=n(2),s=n.n(r),o=n(521),u=n(391),c=n(483);const d=l()(a.EuiPanel).withConfig({displayName:"KpiPanel",componentId:"sc-12zc7xr-0"})(["display:flex;flex-direction:column;position:relative;overflow-x:hidden;overflow-y:",";@media only screen and (min-width:","){","}",""],(({$overflowY:e})=>null!=e?e:"hidden"),(e=>e.theme.eui.euiBreakpoints.m),(({height:e,$toggleStatus:t})=>t&&`\n      height: ${null!=e?e:o.d}px;\n  `),(({$toggleStatus:e})=>e&&`\n    height: ${o.c}px;\n  `)),m=l.a.div.withConfig({displayName:"StackByComboBoxWrapper",componentId:"sc-12zc7xr-1"})(["max-width:400px;width:","px;"],(({width:e})=>e)),p=s.a.forwardRef((({"aria-label":e=c.c,"data-test-subj":t,isDisabled:n=!1,onSelect:i,prepend:l=c.d,selected:o,inputRef:d,width:p=400,dropDownoptions:b,useLensCompatibleFields:g},f)=>{const y=Object(r.useCallback)((e=>{e&&e.length>0?i(e[0].value):i("")}),[i]),v=Object(r.useMemo)((()=>[{label:o,value:o}]),[o]),h=Object(u.b)(g),E=Object(r.useMemo)((()=>({asPlainText:!0})),[]);return s.a.createElement(m,{width:p},s.a.createElement(a.EuiComboBox,{"data-test-subj":t,"aria-label":e,inputRef:d,isDisabled:n,placeholder:c.e,prepend:l,ref:f,singleSelection:E,isClearable:!1,sortMatchesBy:"startsWith",options:null!=b?b:h,selectedOptions:v,compressed:!0,onChange:y}))}));p.displayName="StackByComboBox"},651:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"v",(function(){return l})),n.d(t,"h",(function(){return r})),n.d(t,"l",(function(){return s})),n.d(t,"i",(function(){return o})),n.d(t,"k",(function(){return u})),n.d(t,"q",(function(){return c})),n.d(t,"p",(function(){return d})),n.d(t,"g",(function(){return m})),n.d(t,"e",(function(){return p})),n.d(t,"u",(function(){return b})),n.d(t,"C",(function(){return g})),n.d(t,"s",(function(){return f})),n.d(t,"y",(function(){return y})),n.d(t,"z",(function(){return v})),n.d(t,"a",(function(){return h})),n.d(t,"n",(function(){return E})),n.d(t,"b",(function(){return S})),n.d(t,"A",(function(){return x})),n.d(t,"j",(function(){return O})),n.d(t,"w",(function(){return k})),n.d(t,"B",(function(){return j})),n.d(t,"m",(function(){return T})),n.d(t,"r",(function(){return w})),n.d(t,"o",(function(){return M})),n.d(t,"t",(function(){return I})),n.d(t,"d",(function(){return C})),n.d(t,"x",(function(){return A})),n.d(t,"f",(function(){return D}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.assistant.title",{defaultMessage:"Elastic AI Assistant"}),l=a.i18n.translate("xpack.securitySolution.navigation.overview",{defaultMessage:"Overview"}),r=a.i18n.translate("xpack.securitySolution.navigation.ecsDataQualityDashboard",{defaultMessage:"Data Quality"}),s=a.i18n.translate("xpack.securitySolution.navigation.entityRiskScore",{defaultMessage:"Entity Risk Score"}),o=a.i18n.translate("xpack.securitySolution.navigation.detectionResponse",{defaultMessage:"Detection & Response"}),u=a.i18n.translate("xpack.securitySolution.navigation.entityAnalytics",{defaultMessage:"Entity Analytics"}),c=a.i18n.translate("xpack.securitySolution.navigation.hosts",{defaultMessage:"Hosts"}),d=a.i18n.translate("xpack.securitySolution.navigation.gettingStarted",{defaultMessage:"Get started"}),m=a.i18n.translate("xpack.securitySolution.navigation.dashboards",{defaultMessage:"Dashboards"}),p=a.i18n.translate("xpack.securitySolution.navigation.coverageOverviewDashboard",{defaultMessage:"MITRE ATT&CK® Coverage"}),b=a.i18n.translate("xpack.securitySolution.navigation.network",{defaultMessage:"Network"}),g=a.i18n.translate("xpack.securitySolution.navigation.users",{defaultMessage:"Users"}),f=a.i18n.translate("xpack.securitySolution.navigation.kubernetes",{defaultMessage:"Kubernetes"}),y=a.i18n.translate("xpack.securitySolution.navigation.rules",{defaultMessage:"Rules"}),v=a.i18n.translate("xpack.securitySolution.navigation.detectionRules",{defaultMessage:"Detection rules (SIEM)"}),h=a.i18n.translate("xpack.securitySolution.navigation.addRules",{defaultMessage:"Add Rules"}),E=a.i18n.translate("xpack.securitySolution.navigation.exceptions",{defaultMessage:"Shared exception lists"}),S=a.i18n.translate("xpack.securitySolution.navigation.alerts",{defaultMessage:"Alerts"}),x=a.i18n.translate("xpack.securitySolution.navigation.timelines",{defaultMessage:"Timelines"}),O=(a.i18n.translate("xpack.securitySolution.navigation.case",{defaultMessage:"Cases"}),a.i18n.translate("xpack.securitySolution.navigation.administration",{defaultMessage:"Administration"}),a.i18n.translate("xpack.securitySolution.search.administration.endpoints",{defaultMessage:"Endpoints"})),k=a.i18n.translate("xpack.securitySolution.navigation.administration.policies",{defaultMessage:"Policies"}),j=a.i18n.translate("xpack.securitySolution.search.administration.trustedApps",{defaultMessage:"Trusted applications"}),T=a.i18n.translate("xpack.securitySolution.search.administration.eventFilters",{defaultMessage:"Event filters"}),w=a.i18n.translate("xpack.securitySolution.search.administration.hostIsolationExceptions",{defaultMessage:"Host isolation exceptions"}),M=(a.i18n.translate("xpack.securitySolution.navigation.detect",{defaultMessage:"Detect"}),a.i18n.translate("xpack.securitySolution.navigation.findings",{defaultMessage:"Findings"}),a.i18n.translate("xpack.securitySolution.navigation.explore",{defaultMessage:"Explore"})),I=a.i18n.translate("xpack.securitySolution.navigation.manage",{defaultMessage:"Manage"}),C=a.i18n.translate("xpack.securitySolution.navigation.blocklist",{defaultMessage:"Blocklist"}),A=a.i18n.translate("xpack.securitySolution.navigation.responseActionsHistory",{defaultMessage:"Response actions history"}),D=a.i18n.translate("xpack.securitySolution.navigation.newRuleTitle",{defaultMessage:"Create new rule"});a.i18n.translate("xpack.securitySolution.navigation.threatIntelligence",{defaultMessage:"Intelligence"})},654:function(e,t,n){"use strict";n.d(t,"a",(function(){return Me})),n.d(t,"c",(function(){return Ie})),n.d(t,"b",(function(){return Ce})),n.d(t,"d",(function(){return Ae}));var a=n(40),i=n(942),l=n(450),r=n(2),s=n.n(r),o=n(8),u=n(44),c=n(5),d=n(104),m=n.n(d);const p=({euiFieldProps:e})=>{const{field:{onChange:t,value:n,name:i},fieldState:{error:o}}=Object(l.useController)({name:"label",defaultValue:""}),u=Object(r.useMemo)((()=>!(null==o||!o.message)),[null==o?void 0:o.message]);return s.a.createElement(a.EuiFormRow,{label:c.i18n.translate("xpack.securitySolution.markdown.osquery.labelFieldText",{defaultMessage:"Label"}),error:null==o?void 0:o.message,isInvalid:u,fullWidth:!0},s.a.createElement(a.EuiFieldText,m()({isInvalid:u,onChange:t,value:n,name:i,fullWidth:!0,"data-test-subj":"input"},e)))},b=s.a.memo(p),g=c.i18n.translate("xpack.securitySolution.markdown.osquery.permissionDenied",{defaultMessage:"Permission denied"}),f=()=>s.a.createElement(a.EuiEmptyPrompt,{iconType:"logoOsquery",title:s.a.createElement("h2",null,g),titleSize:"xs",body:s.a.createElement("p",null,s.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.missingPrivileges",defaultMessage:"To access this page, ask your administrator for {osquery} Kibana privileges.",values:{osquery:s.a.createElement(a.EuiCode,null,"osquery")}}))});var y=n(102);const v=({node:e,onSave:t,onCancel:n})=>{var i,d,m;const p=null!=e,{osquery:g,application:{capabilities:{osquery:v}}}=Object(y.j)().services,h=Object(l.useForm)({defaultValues:{label:null==e||null===(i=e.configuration)||void 0===i?void 0:i.label,query:null==e||null===(d=e.configuration)||void 0===d?void 0:d.query,ecs_mapping:null==e||null===(m=e.configuration)||void 0===m?void 0:m.ecs_mapping}}),E=Object(r.useCallback)((e=>{t(`!{osquery${JSON.stringify(Object(o.pickBy)({query:e.query,label:e.label,ecs_mapping:e.ecs_mapping},(e=>!Object(o.isEmpty)(e))))}}`,{block:!0})}),[t]),S=Object(r.useMemo)((()=>!(v.runSavedQueries&&v.readSavedQueries||v.writeLiveQueries)),[v.readSavedQueries,v.runSavedQueries,v.writeLiveQueries]),x=Object(r.useMemo)((()=>{if(null!=g&&g.LiveQueryField){const{LiveQueryField:e}=g;return s.a.createElement(l.FormProvider,h,s.a.createElement(b,null),s.a.createElement(a.EuiSpacer,{size:"m"}),s.a.createElement(e,{formMethods:h}))}return null}),[h,g]);return S?s.a.createElement(f,null):s.a.createElement(s.a.Fragment,null,s.a.createElement(a.EuiModalHeader,null,s.a.createElement(a.EuiModalHeaderTitle,null,s.a.createElement("h1",null,p?s.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.editModalTitle",defaultMessage:"Edit query"}):s.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.addModalTitle",defaultMessage:"Add query"})))),s.a.createElement(a.EuiModalBody,null,s.a.createElement(s.a.Fragment,null,x)),s.a.createElement(a.EuiModalFooter,null,s.a.createElement(a.EuiButtonEmpty,{onClick:n},c.i18n.translate("xpack.securitySolution.markdown.osquery.modalCancelButtonLabel",{defaultMessage:"Cancel"})),s.a.createElement(a.EuiButton,{onClick:h.handleSubmit(E),fill:!0},p?s.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.addModalConfirmButtonLabel",defaultMessage:"Add query"}):s.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.editModalConfirmButtonLabel",defaultMessage:"Save changes"}))))},h=s.a.memo(v),E={name:"osquery",button:{label:"Osquery",iconType:"logoOsquery"},helpText:s.a.createElement("div",null,s.a.createElement(a.EuiCodeBlock,{language:"md",fontSize:"l",paddingSize:"s",isCopyable:!0},"!{osquery{options}}"),s.a.createElement(a.EuiSpacer,{size:"s"})),editor:h};var S=n(480),x=n(41),O=n.n(x),k=n(402),j=n(255),T=n(1037),w=n.n(T),M=n(511);const I=O()(a.EuiButton).withConfig({displayName:"StyledEuiButton",componentId:"sc-14wavsd-0"})(["> span > img{margin-block-end:0;}"]);var C=n(50),A=n.n(C),D=n(55),N=n.n(D),F=(n(21),n(83)),P=n(49),R=n(108),L=n(51),B=n(118),_=n(161),q=n(660),z=n(116),V=n(110),$=n(106),Q=n(150);const U=e=>e===P.FILTERS.EXISTS?Q.b:e===P.FILTERS.PHRASES?Q.c:Q.d,H={$state:{store:P.FilterStateStore.APP_STATE},meta:{disabled:!1,negate:!1,alias:null,index:void 0}},G={and:[],enabled:!0,id:"",name:"",excluded:!1,kqlQuery:"",type:$.a.default,queryMatch:{field:"",value:"",operator:Q.b}},W=e=>{const t={...H,meta:{...H.meta,negate:e.excluded,type:e.queryType}};if(e.queryType===P.FILTERS.EXISTS)return{...t,meta:{...t.meta,params:void 0,value:"exists"},query:{exists:{field:e.field}}};if(e.queryType===P.FILTERS.PHRASES){var n;let a=JSON.parse(String(e.value));return"number"===e.valueType?a=a.map(Number):"boolean"===e.valueType&&(a=a.map(Boolean)),{...t,meta:{...t.meta},query:{bool:{minimum_should_match:1,should:null===(n=a)||void 0===n?void 0:n.map((t=>({match_phrase:{[e.field]:t}})))}}}}var a;if(e.queryType===P.FILTERS.PHRASE)return{...t,meta:{...t.meta,params:{query:e.value},value:void 0},query:{match_phrase:{[e.field]:null!==(a=e.value)&&void 0!==a?a:""}}};if(e.queryType===P.FILTERS.RANGE){let n,a;try{const t=JSON.parse(String(e.value));n=t.gte,a=t.lt}catch{n="",a=""}const i={gte:n,lt:a};return{...t,meta:{...t.meta,params:i},query:{range:{[e.field]:i}}}}return t},K=({providers:e,alertData:t})=>{const n=Object(r.useMemo)((()=>e.some((e=>e.some((e=>"range"===e.queryType))))),[e]);return{dataProviders:Object(r.useMemo)((()=>n?[]:((e,t)=>e.map((e=>e.reduce(((e,n,a)=>{const{field:i,value:l,excluded:r,queryType:s}=n,{result:u,matchedBrackets:c}=((e,t)=>{if("number"==typeof e||"boolean"==typeof e)return{result:e,skipped:!0,matchedBrackets:null};const n=/\{{([^}]+)\}}/g,a=e.match(new RegExp(n));let i=e;a&&t&&Object(o.each)(a,(e=>{const n=e.replace(/{{|}}/g,"").trim();if(i.includes(e)){const a=t.find((({field:e})=>e===n));if(a&&a.values){const{values:[t]}=a;i=i.replace(e,t)}}}));const l=new RegExp(n).test(i);return{result:i,skipped:l,matchedBrackets:a}})(l,t),d=!t&&c;if(0===a)return{and:[],enabled:!0,id:JSON.stringify(i+l),name:i,excluded:r,kqlQuery:"",type:d?$.a.template:$.a.default,queryMatch:{field:i,value:u,operator:U(s)}};{const t={enabled:!0,id:JSON.stringify(i+l),name:i,excluded:r,kqlQuery:"",type:d?$.a.template:$.a.default,queryMatch:{field:i,value:u,operator:U(s)}};e.and.push(t)}return e}),G))))(e,t)),[t,e,n]),filters:Object(r.useMemo)((()=>n?((e,t)=>{const n=[];for(let t=0;t<e.length;t++){const a=e[t];if(a.length>1){const e=a.map((e=>W(e))),t={$state:{store:P.FilterStateStore.APP_STATE},meta:{type:P.FILTERS.COMBINED,relation:P.BooleanRelation.AND,params:e,index:void 0,disabled:!1,negate:!1}};n.push(t)}else{const e=a[0],t=W(e);n.push(t)}}return n})(e):[]),[n,e,t])}};var Y=n(271),J=n(286),X=n(4);const Z=e=>{var t,n,a,i,l,r;const s=null!==(t=null===(n=e.meta)||void 0===n?void 0:n.key)&&void 0!==t?t:"",o={field:s,excluded:null!==(a=null===(i=e.meta)||void 0===i?void 0:i.negate)&&void 0!==a&&a,queryType:null!==(l=null===(r=e.meta)||void 0===r?void 0:r.type)&&void 0!==l?l:P.FILTERS.PHRASE};if(Object(P.isRangeFilter)(e)){var u;const{gte:t,lt:n}=e.query.range[s],a=JSON.stringify({gte:t,lt:n});return{...o,value:a,queryType:null!==(u=e.meta.type)&&void 0!==u?u:P.FILTERS.RANGE}}if(Object(P.isPhrasesFilter)(e)){var c,d,m,p;const t=typeof(null===(c=e.meta)||void 0===c?void 0:c.params[0]);return{...o,value:JSON.stringify(null!==(d=null===(m=e.meta)||void 0===m?void 0:m.params)&&void 0!==d?d:[]),valueType:t,queryType:null!==(p=e.meta.type)&&void 0!==p?p:P.FILTERS.PHRASES}}var b;if(Object(P.isExistsFilter)(e))return{...o,value:"",queryType:null!==(b=e.meta.type)&&void 0!==b?b:P.FILTERS.EXISTS};if(Object(P.isPhraseFilter)(e)){var g,f,y,v,h,E;const t=typeof(null===(g=e.meta)||void 0===g||null===(f=g.params)||void 0===f?void 0:f.query);return{...o,value:null!==(y=null===(v=e.meta)||void 0===v||null===(h=v.params)||void 0===h?void 0:h.query)&&void 0!==y?y:"",valueType:t,queryType:null!==(E=e.meta.type)&&void 0!==E?E:P.FILTERS.PHRASE}}return{...o,value:"",queryType:P.FILTERS.PHRASE}},ee=e=>e.map((e=>Z(e))),te=e=>!1===e.some(P.isCombinedFilter)?[ee(e)]:e.reduce(((e,t)=>{if(Object(P.isCombinedFilter)(t)){const n=t.meta.params;if(t.meta.relation===P.BooleanRelation.OR){const t=n.map((e=>{const t=te([e]);return Object(o.flatten)(t)}));return[...e,...t]}{const t=te(n);return[...e,...t]}}return[...e,[Z(t)]]}),[]);var ne=n(17),ae=n(62),ie=n.n(ae),le=n(678),re=n.n(le),se=n(374);function oe(e,t,n){var a;if(void 0===t||"undefined"===n)return!1;switch(e.type){case"date":const n="string"==typeof t?ie.a.parse(t):null;return Boolean("string"==typeof t&&n&&n.isValid());case"ip":if("string"==typeof t||"number"==typeof t)try{return Boolean(new L.IpAddress(t))}catch(e){return!1}return!1;case"string":return"string"==typeof t&&null!==(a=e.esTypes)&&void 0!==a&&a.includes(se.a.VERSION)?Boolean(re()(t)):"string"==typeof t&&t.trim().length>0;case"boolean":return"boolean"==typeof t;case"number":return"number"==typeof t||"string"==typeof t&&!isNaN(parseFloat(t));default:return!0}}const ue=c.i18n.translate("xpack.securitySolution.markdown.insight.label",{defaultMessage:"Label"}),ce=c.i18n.translate("xpack.securitySolution.markdown.insight.title",{defaultMessage:"Investigate"}),de=c.i18n.translate("xpack.securitySolution.markdown.insight.labelText",{defaultMessage:"Label on the query button."}),me=c.i18n.translate("xpack.securitySolution.markdown.insight.description",{defaultMessage:"Description"}),pe=c.i18n.translate("xpack.securitySolution.markdown.insight.descriptionText",{defaultMessage:"Additional description of the query."}),be=c.i18n.translate("xpack.securitySolution.markdown.insight.formDescription",{defaultMessage:"Create a query to investigate an alert in Timeline, using a clickable query button in the investigation guide. The button also displays a count of matching documents."}),ge=c.i18n.translate("xpack.securitySolution.markdown.insight.filterBuilder",{defaultMessage:"Filters"}),fe=c.i18n.translate("xpack.securitySolution.markdown.insight.filterBuilderText",{defaultMessage:"Create filters to populate the Timeline query builder. To use a value from the alert document, enter the field name in double braces {example} as a custom option in the value field.",values:{example:"{{kibana.alert.example}}"}}),ye=c.i18n.translate("xpack.securitySolution.markdown.insight.relativeTimerange",{defaultMessage:"Relative time range"}),ve=c.i18n.translate("xpack.securitySolution.markdown.insight.relativeTimerangeText",{defaultMessage:"Select a time range to limit the query, relative to the alert's creation time (optional)."}),he=c.i18n.translate("xpack.securitySolution.markdown.insight.modalCancelButtonLabel",{defaultMessage:"Cancel"}),Ee=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.insightProviderError",{defaultMessage:"Unable to parse insight provider configuration"}),Se="!{investigate",xe=({label:e,description:t,providers:n,relativeFrom:i,relativeTo:l})=>{const{addError:o}=Object(R.a)();let u=[];try{void 0!==n&&(u=JSON.parse(n))}catch(e){o(e,{title:Ee})}const{data:c,timestamp:d}=Object(r.useContext)(k.a),{dataProviders:m,filters:p}=K({providers:u,alertData:c}),b=Object(r.useMemo)((()=>{if(i&&l){const e=d?A()(d):A()();return{kind:"absolute",from:Object(J.e)(i,J.a,!1,A.a,e.toDate()).toISOString(),to:Object(J.e)(l,J.b,!0,A.a,e.toDate()).toISOString()}}return null}),[i,l,d]),{totalCount:g,isQueryLoading:f,oldestTimestamp:v,hasError:h}=(({dataProviders:e,filters:t,relativeTimerange:n})=>{const{uiSettings:a}=Object(y.j)().services,i=Object(r.useMemo)((()=>Object(L.getEsQueryConfig)(a)),[a]),{browserFields:l,selectedPatterns:s,indexPattern:o,dataViewId:u}=Object(z.d)(V.SourcererScopeName.timeline),[c,d]=Object(r.useState)(!1),m=Object(r.useMemo)((()=>{try{if(!1===c)return Object(_.d)({config:i,dataProviders:e,indexPattern:o,browserFields:l,filters:t,kqlQuery:{query:"",language:"kuery"},kqlMode:"filter"})}catch(e){return d(!0),null}}),[l,e,i,c,o,t]),[p,{events:b,totalCount:g}]=Object(q.a)({dataViewId:u,fields:["*"],filterQuery:null==m?void 0:m.filterQuery,id:B.c.active,indexNames:s,language:"kuery",limit:1,runtimeMappings:{},...n?{startDate:null==n?void 0:n.from,endDate:null==n?void 0:n.to}:{}}),[f]=b,v=f&&f.data&&f.data.find((e=>"@timestamp"===e.field));return{isQueryLoading:p,totalCount:g,oldestTimestamp:v&&v.value&&v.value[0],hasError:c}})({dataProviders:m,filters:p,relativeTimerange:b}),E=Object(r.useMemo)((()=>{if(b)return b;if(null!=v)return{kind:"absolute",from:v,to:(new Date).toISOString()};{const{to:e,from:t,fromStr:n,toStr:a}=Object(J.d)();return{kind:"relative",to:e,from:t,fromStr:n,toStr:a}}}),[v,b]);return f?s.a.createElement(a.EuiLoadingSpinner,null):s.a.createElement(s.a.Fragment,null,s.a.createElement(Y.a,{asEmptyButton:!1,isDisabled:h,dataProviders:m,filters:p,timeRange:E,keepDataView:!0,"data-test-subj":"insight-investigate-in-timeline-button"},s.a.createElement(a.EuiIcon,{type:"timeline"}),` ${e} (${N()(g).format("0,0.[000]a")})`),s.a.createElement("div",null,t))},Oe=({node:e,onSave:t,onCancel:n})=>{const i=null!=e,{sourcererDataView:c,indexPattern:d}=Object(z.d)(V.SourcererScopeName.default),{unifiedSearch:{ui:{FiltersBuilderLazy:p}},uiSettings:b,fieldFormats:g}=Object(y.j)().services,f=Object(r.useMemo)((()=>null!=c?new F.DataView({spec:c,fieldFormats:g}):null),[c,g]),[v,h]=Object(r.useState)([[]]),E=Object(r.useMemo)((()=>[{value:"0",text:""},...b.get(X.V).map((({display:e},t)=>({value:String(t),text:e})))]),[b]),S=Object(l.useForm)({defaultValues:{label:null==e?void 0:e.label,description:null==e?void 0:e.description,relativeTimerange:(null==e?void 0:e.relativeTimerange)||"0"},shouldUnregister:!0}),x=Object(l.useController)({name:"label",control:S.control}),O=Object(l.useController)({name:"description",control:S.control}),k=Object(l.useController)({name:"relativeTimerange",control:S.control}),j=Object(r.useCallback)((e=>{const t=E.find((t=>t.value===e));if(t&&"0"!==t.value){const e=Number(t.value),n=b.get(X.V);return{relativeFrom:n[e].from,relativeTo:n[e].to}}return{}}),[E,b]),T=Object(r.useCallback)((()=>{t(`${Se}${JSON.stringify(Object(o.pickBy)({label:x.field.value,description:O.field.value,providers:v,...j(k.field.value)},(e=>!Object(o.isEmpty)(e))))}}`,{block:!0})}),[t,v,x.field.value,O.field.value,k.field.value,j]),w=Object(r.useCallback)((e=>{h(te(e))}),[]),M=Object(r.useCallback)((e=>{k.field.onChange(e.target.value)}),[k.field]),I=Object(r.useMemo)((()=>{var e;const t=null!==(e=x.field.value)&&void 0!==e?e:"",n=v.flat();return""===t.trim()||0===n.length||n.some((e=>!function(e,t){if(!t||!e.field)return!1;switch(e.queryType){case"phrase":return oe(t,e.value,e.valueType);case"phrases":const n="string"==typeof e.value?JSON.parse(`${e.value}`):null;return!(!Array.isArray(n)||!n.length)&&n.every((n=>oe(t,n,e.valueType)));case"range":const a=JSON.parse("string"==typeof e.value?e.value:"");return"object"==typeof a&&(!a.gte||oe(t,a.gte,e.valueType))&&(!a.lt||oe(t,a.lt,e.valueType));case"exists":return!0;default:throw new Error(`Unknown operator type: ${e.queryType}`)}}(e,null==f?void 0:f.getFieldByName(e.field))))}),[x.field.value,v,f]),C=Object(r.useMemo)((()=>{const e=d&&d.getName?d.getName():"*";return[{$state:{store:P.FilterStateStore.APP_STATE},meta:{disabled:!1,negate:!1,alias:null,index:e}}]}),[d]),A=Object(ne.b)().isAtLeast("platinum");return s.a.createElement(s.a.Fragment,null,s.a.createElement(Te,null,s.a.createElement(a.EuiModalHeaderTitle,null,s.a.createElement(a.EuiFlexGroup,{gutterSize:"s"},s.a.createElement(a.EuiFlexItem,null,i?s.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.editModalTitle",defaultMessage:"Edit investigation query"}):s.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.addModalTitle",defaultMessage:"Add investigation query"}))))),!1===A&&s.a.createElement(a.EuiCallOut,{title:"To add suggested queries to an investigation guide, please upgrade to platinum",iconType:"timeline"}),s.a.createElement(a.EuiModalBody,null,s.a.createElement(l.FormProvider,S,s.a.createElement(a.EuiForm,{fullWidth:!0},s.a.createElement(a.EuiFormRow,{label:be,fullWidth:!0},s.a.createElement(s.a.Fragment,null)),s.a.createElement(a.EuiFormRow,{label:ue,helpText:de,isInvalid:void 0!==x.field.value&&0===x.field.value.trim().length,fullWidth:!0},s.a.createElement(a.EuiFieldText,m()({},S.register("label"),{ref:null,name:"label",onChange:x.field.onChange}))),s.a.createElement(a.EuiFormRow,{label:me,helpText:pe,fullWidth:!0},s.a.createElement(a.EuiFieldText,m()({},S.register("description"),{ref:null,name:"description",onChange:O.field.onChange}))),s.a.createElement(a.EuiFormRow,{label:ge,helpText:fe,fullWidth:!0},f?s.a.createElement(p,{filters:C,onChange:w,dataView:f,maxDepth:1}):s.a.createElement(s.a.Fragment,null)),s.a.createElement(a.EuiFormRow,{label:ye,helpText:ve,fullWidth:!0},s.a.createElement(a.EuiSelect,m()({},S.register("relativeTimerange"),{ref:null,onChange:M,options:E})))))),s.a.createElement(a.EuiModalFooter,null,s.a.createElement(a.EuiButtonEmpty,{onClick:n},he),s.a.createElement(a.EuiButton,{onClick:S.handleSubmit(T),fill:!0,disabled:I},i?s.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.addModalConfirmButtonLabel",defaultMessage:"Add query"}):s.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.editModalConfirmButtonLabel",defaultMessage:"Save changes"}))))},ke=s.a.memo(Oe),je=`${Se}{\n  "label": "Test action",\n  "description": "Click to investigate",\n  "providers": [\n    [\n      {"field": "event.id", "value": "{{kibana.alert.original_event.id}}", "queryType": "phrase", "excluded": "false"}\n    ],\n    [\n      {"field": "event.action", "value": "", "queryType": "exists", "excluded": "false"},\n      {"field": "process.pid", "value": "{{process.pid}}", "queryType": "phrase", "excluded":"false"}\n    ]\n  ]\n}}`;var Te=O()(a.EuiModalHeader).withConfig({displayName:"_StyledEuiModalHeader",componentId:"sc-1kbgjgu-0"})(["min-width:700px;"]);const{uiPlugins:we,parsingPlugins:Me,processingPlugins:Ie}={uiPlugins:Object(a.getDefaultEuiMarkdownUiPlugins)(),parsingPlugins:Object(a.getDefaultEuiMarkdownParsingPlugins)(),processingPlugins:Object(a.getDefaultEuiMarkdownProcessingPlugins)()},Ce=[Se],Ae=({insightsUpsellingMessage:e})=>{const t=we.map((e=>e.name)),n=(({insightsUpsellingMessage:e})=>({name:"insights",button:{label:null!=e?e:ce,iconType:"timelineWithArrow",isDisabled:!!e},helpText:s.a.createElement("div",null,s.a.createElement(a.EuiCodeBlock,{language:"md",fontSize:"l",paddingSize:"s",isCopyable:!0},je),s.a.createElement(a.EuiSpacer,{size:"s"})),editor:ke}))({insightsUpsellingMessage:e});if(!1===t.includes(n.name))we.push(i.b),we.push(E),we.push(n);else{const e=we.findIndex((e=>e.name===n.name));we[e]=n}return we};Me.push((function(){const e=this.Parser,t=e.prototype.inlineTokenizers,n=e.prototype.inlineMethods,a=function(e,t,n){if(!1===t.startsWith(Se))return!1;const a=t[Se.length];if("{"!==a&&"}"!==a)return!1;if(n)return!0;let i={};if("{"===a){let n="",a=0;for(let e=Se.length;e<t.length;e++){const i=t[e];if("{"===i)a++,n+=i;else if("}"===i){if(a--,-1===a)break;n+=i}else n+=i}try{return i=JSON.parse(n),e(t)({type:"insight",...i,providers:JSON.stringify(i.providers)})}catch(t){const n=e.now();this.file.fail((e=>c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.insightConfigError",{values:{err:e},defaultMessage:"Unable to parse insight JSON configuration: {err}"}))(t),{line:n.line,column:n.column+Se.length})}}return!1};a.locator=(e,t)=>e.indexOf(Se,t),t.insight=a,n.splice(n.indexOf("text"),0,"insight")})),Me.push(i.a),Me.push(S.a),Ie[1][1].components.insight=({label:e,description:t,providers:n,relativeFrom:i,relativeTo:l})=>!1===Object(ne.b)().isPlatinumPlus()?s.a.createElement(s.a.Fragment,null,s.a.createElement(a.EuiButton,{isDisabled:!0,iconSide:"left",iconType:"timeline","data-test-subj":"insight-investigate-in-timeline-button"},`${e}`),s.a.createElement("div",null,t)):s.a.createElement(xe,{label:e,description:t,providers:n,relativeFrom:i,relativeTo:l}),Ie[1][1].components.timeline=i.c,Ie[1][1].components.osquery=({configuration:e})=>{var t;const[n,a]=Object(r.useState)(!1),{agentId:i,alertId:l,data:u}=Object(r.useContext)(k.a),d=Object(r.useCallback)((()=>a(!0)),[a]),m=Object(r.useCallback)((()=>a(!1)),[a]),p=Object(r.useMemo)((()=>{const e=Object(o.reduce)(u,((e,t)=>{var n;return{...e,[t.field]:null==t||null===(n=t.values)||void 0===n?void 0:n[0]}}),{});return Object(j.a)(e)}),[u]);return s.a.createElement(s.a.Fragment,null,s.a.createElement(I,{iconType:w.a,onClick:d},null!==(t=e.label)&&void 0!==t?t:c.i18n.translate("xpack.securitySolution.markdown.osquery.runOsqueryButtonLabel",{defaultMessage:"Run Osquery"})),n&&s.a.createElement(M.a,{defaultValues:{...l?{alertIds:[l]}:{},query:e.query,ecs_mapping:e.ecs_mapping,queryField:!1},agentId:i,onClose:m,ecsData:p}))}},656:function(e,t,n){"use strict";n.d(t,"a",(function(){return ne}));var a=n(40),i=n(2),l=n.n(i),r=n(41),s=n.n(r),o=n(42),u=n(47),c=n(49),d=n(51),m=n(134),p=n(4),b=n(153),g=n(166),f=n(233),y=n(232),v=n(169),h=n(456),E=n(149),S=n(645),x=n(102),O=n(919),k=n(57),j=n(297),T=n(293),w=n(228),M=n(424),I=n(327);const C=l.a.memo((({chartHeight:e=174,data:t,from:n,legendItems:r,legendPosition:s=k.Position.Right,legendMinWidth:o,loading:u,showLegend:c,to:d,updateDateRange:m})=>{const{baseTheme:p,theme:b}=Object(j.i)(),g=Object(i.useMemo)((()=>["100%",e]),[e]),f=Object(i.useMemo)((()=>["y"]),[]),y=Object(i.useMemo)((()=>[e=>Object(w.a)(e.g)?e.g:I.c]),[]),v=Object(i.useMemo)((()=>Object(T.a)([n,d])),[n,d]);return l.a.createElement(l.a.Fragment,null,u&&l.a.createElement(a.EuiProgress,{"data-test-subj":"loadingPanelAlertsHistogram",size:"xs",position:"absolute",color:"accent"}),l.a.createElement(a.EuiFlexGroup,{gutterSize:"none"},l.a.createElement(a.EuiFlexItem,{grow:!0},l.a.createElement(k.Chart,{size:g},l.a.createElement(k.Settings,{legendPosition:s,onBrushEnd:m,showLegend:c&&0===r.length,showLegendExtra:c,theme:b,baseTheme:p}),l.a.createElement(k.Axis,{id:"alertsHistogramAxisX",position:k.Position.Bottom,tickFormat:v}),l.a.createElement(k.Axis,{id:"alertsHistogramAxisY",position:k.Position.Left}),l.a.createElement(k.HistogramBarSeries,{id:"alertsHistogram",xScaleType:k.ScaleType.Time,yScaleType:k.ScaleType.Linear,xAccessor:"x",yAccessors:f,splitSeriesAccessors:y,data:t}))),l.a.createElement(a.EuiFlexItem,{grow:!1},r.length>0&&l.a.createElement(M.a,{legendItems:r,height:e,minWidth:o}))))}));C.displayName="AlertsHistogram";var A=n(5);const D=A.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.headerTitle",{defaultMessage:"Trend"}),N=A.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.notAvailableTooltip",{defaultMessage:"Not available for trend view"}),F=A.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.viewAlertsButtonLabel",{defaultMessage:"View alerts"}),P=(e,t,n)=>A.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.showingAlertsTitle",{values:{totalAlertsFormatted:e,totalAlerts:t,modifier:n},defaultMessage:"Showing: {modifier}{totalAlertsFormatted} {totalAlerts, plural, =1 {alert} other {alerts}}"});var R=n(123),L=n(131),B=n(521),_=n(646),q=n(391),z=n(177),V=n(483),$=n(124);const Q=Object(u.v4)(),U=(e="kibana.alert.rule.name",t)=>({title:"Alerts",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:Q,accessors:["e09e0380-0740-4105-becc-0a4ca12e3944"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"aac9d7d0-13a3-480a-892b-08207a787926",splitAccessor:"34919782-4546-43a5-b668-06ac934d3acd"}],yRightExtent:{mode:"full"},yLeftExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},valuesInLegend:!0},query:{query:"",language:"kuery"},filters:null!=t&&t.filters?t.filters:[],datasourceStates:{formBased:{layers:{[Q]:{columns:{"aac9d7d0-13a3-480a-892b-08207a787926":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"e09e0380-0740-4105-becc-0a4ca12e3944":{label:"Count of records",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___"},"34919782-4546-43a5-b668-06ac934d3acd":{label:`Top values of ${e}`,dataType:"string",operationType:"terms",scale:"ordinal",sourceField:e,isBucketed:!0,params:{size:1e3,orderBy:{type:"column",columnId:"e09e0380-0740-4105-becc-0a4ca12e3944"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"},secondaryFields:[]}}},columnOrder:["34919782-4546-43a5-b668-06ac934d3acd","aac9d7d0-13a3-480a-892b-08207a787926","e09e0380-0740-4105-becc-0a4ca12e3944"],incompleteColumns:{}}}}},internalReferences:[],adHocDataViews:{}},references:[{type:"index-pattern",id:"{dataViewId}",name:`indexpattern-datasource-layer-${Q}`}]});var H=n(110),G=n(403),W=n(55),K=n.n(W),Y=n(413);const J={value:0,relation:"eq"},X="detections-histogram",Z=s()(a.EuiFlexItem).withConfig({displayName:"ViewAlertsFlexItem",componentId:"sc-tvqkga-0"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeL)),ee=s()(a.EuiFlexItem).withConfig({displayName:"OptionsFlexItem",componentId:"sc-tvqkga-1"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeS)),te=[],ne=Object(i.memo)((({alignHeader:e,chartHeight:t=155,chartOptionsContextMenu:n,combinedQueries:r,comboboxRef:s,defaultStackByOption:k=B.a,extraActions:j,filters:T,headerChildren:w,inspectTitle:M,legendPosition:I="right",onFieldSelected:Q,onlyField:W,paddingSize:ne="m",panelHeight:ae=B.d,query:ie,runtimeMappings:le,setComboboxInputRef:re,showCountsInLegend:se=!1,showGroupByPlaceholder:oe=!1,showLegend:ue=!0,showLinkToAlerts:ce=!1,showStackBy:de=!0,showTotalAlertsCount:me=!1,signalIndexName:pe,stackByLabel:be,stackByWidth:ge,timelineId:fe,title:ye=D,titleSize:ve="m",updateDateRange:he,hideQueryToggle:Ee=!1,isExpanded:Se,setIsExpanded:xe})=>{var Oe;const{to:ke,from:je,deleteQuery:Te,setQuery:we}=Object(m.a)(),Me=Object(i.useMemo)((()=>`${X}-${Object(u.v4)()}`),[]),Ie=`alerts-trend-embeddable-${Me}`,[Ce,Ae]=Object(i.useState)(!0),[De,Ne]=Object(i.useState)(!1),[Fe,Pe]=Object(i.useState)(J),[Re,Le]=Object(i.useState)(null==W?k:W),Be=Object($.a)("chartEmbeddablesEnabled"),_e=Object($.a)("alertsPageChartsEnabled"),qe=Object(i.useCallback)((e=>{Le(e),null!=Q&&Q(e)}),[Q]);Object(i.useEffect)((()=>{Le(null==W?k:W)}),[k,W]);const{toggleStatus:ze,setToggleStatus:Ve}=Object(z.a)(X),$e=Object(i.useCallback)((e=>{_e&&void 0!==xe?xe(e):Ve(e)}),[Ve,xe,_e]),Qe=Object(i.useMemo)((()=>_e&&void 0!==xe?!Se:!ze),[_e,xe,Se,ze]),Ue=Object(i.useMemo)((()=>({from:je,to:ke})),[je,ke]),{loading:He,data:Ge,setQuery:We,response:Ke,request:Ye,refetch:Je}=Object(f.a)({query:Object(O.d)(Re,je,ke,Object(O.a)(r),le),indexName:pe,skip:Qe||Be,queryName:y.a.HISTOGRAM}),Xe=Object(x.j)(),{navigateToApp:Ze}=Xe.services.application,{formatUrl:et,search:tt}=Object(v.m)(L.a.alerts),nt=(({totalAlertsObj:e,visualizationId:t,isChartEmbeddablesEnabled:n})=>{const[a]=Object(x.p)(p.O),l=Object(Y.a)({visualizationId:t}),r=Object(i.useMemo)((()=>P(K()(e.value).format(a),e.value,"gte"===e.relation?">":"lte"===e.relation?"<":"")),[e.value,e.relation,a]),s=Object(i.useMemo)((()=>{const e=null!=l?l[0].hits.total:0;return P(K()(e).format(a),e,"")}),[a,l]);return n?s:r})({totalAlertsObj:Fe,visualizationId:Ie,isChartEmbeddablesEnabled:Be}),at=Object(i.useCallback)((e=>{e.preventDefault(),Ze(p.l,{deepLinkId:L.a.alerts,path:Object(v.d)(tt)})}),[Ze,tt]),it=Object(i.useMemo)((()=>Object(O.c)(Ge)),[Ge]),lt=Object(i.useMemo)((()=>{var e,t;return ue&&null!=(null==Ge||null===(e=Ge.aggregations)||void 0===e||null===(t=e.alertsByGrouping)||void 0===t?void 0:t.buckets)?Ge.aggregations.alertsByGrouping.buckets.map(((e,t)=>{var n;return{color:t<h.a.length?h.a[t]:void 0,count:se?e.doc_count:void 0,dataProviderId:Object(b.i)(`draggable-legend-item-${Object(u.v4)()}-${Re}-${e.key}`),field:Re,timelineId:fe,value:null!==(n=null==e?void 0:e.key_as_string)&&void 0!==n?n:e.key}})):te}),[null==Ge||null===(Oe=Ge.aggregations)||void 0===Oe?void 0:Oe.alertsByGrouping.buckets,Re,se,ue,fe]);Object(i.useEffect)((()=>{let e=!1;return e||Object(O.f)({isInitialLoading:Ce,isLoadingAlerts:He})||Ae(!1),()=>{e=!0}}),[Ce,He,Ae]),Object(q.a)({deleteQuery:Te,loading:He,refetch:Je,request:Ye,response:Ke,setQuery:we,uniqueQueryId:Me}),Object(i.useEffect)((()=>{var e;Pe(null!==(e=null==Ge?void 0:Ge.hits.total)&&void 0!==e?e:{value:0,relation:"eq"})}),[Ge]),Object(i.useEffect)((()=>{try{let t=null;var e;t=null!=r?Object(O.e)(r):Object(c.buildEsQuery)(void 0,null!=ie?[ie]:[],null!==(e=null==T?void 0:T.filter((e=>!1===e.meta.disabled)))&&void 0!==e?e:[],{...Object(d.getEsQueryConfig)(Xe.services.uiSettings),dateFormatTZ:void 0}),Ne(!1),We(Object(O.d)(Re,je,ke,Object(o.isEmpty)(t)?[]:[t],le))}catch(e){Ne(!0),We(Object(O.d)(Re,je,ke,[],le))}}),[Re,je,ke,ie,T,r,le]);const rt=Object(i.useMemo)((()=>{if(ce)return l.a.createElement(Z,{grow:!1},l.a.createElement(R.g,{"data-test-subj":"alerts-histogram-panel-go-to-alerts-page",onClick:at,href:et(Object(v.d)())},F))}),[ce,at,et]),st=Object(i.useMemo)((()=>{return null==W?ye:(e=W,A.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.topNLabel",{values:{fieldName:e},defaultMessage:"Top {fieldName}"}));var e}),[W,ye]),ot=Object(i.useMemo)((()=>_e&&void 0!==Se?Se:ze),[_e,Se,ze]);return l.a.createElement(E.c,{show:!Ce&&ot},l.a.createElement(_.a,{height:ae,hasBorder:!0,paddingSize:ne,"data-test-subj":"alerts-histogram-panel",$toggleStatus:ot},l.a.createElement(g.a,{alignHeader:e,id:Me,inspectTitle:M,outerDirection:"column",title:st,titleSize:ve,toggleStatus:ot,toggleQuery:Ee?void 0:$e,showInspectButton:!Be&&null==n,subtitle:!Ce&&me&&nt,isInspectDisabled:De},l.a.createElement(a.EuiFlexGroup,{alignItems:"flexStart","data-test-subj":"panelFlexGroup",gutterSize:"none"},l.a.createElement(a.EuiFlexItem,{grow:!1},de&&l.a.createElement(l.a.Fragment,null,l.a.createElement(_.b,{"data-test-subj":"stackByComboBox",inputRef:re,onSelect:qe,prepend:be,ref:s,selected:Re,useLensCompatibleFields:Be,width:ge}),oe&&l.a.createElement(l.a.Fragment,null,l.a.createElement(a.EuiSpacer,{"data-test-subj":"placeholderSpacer",size:"s"}),l.a.createElement(a.EuiToolTip,{"data-test-subj":"placeholderTooltip",content:N},l.a.createElement(_.b,{"data-test-subj":"stackByPlaceholder",isDisabled:!0,onSelect:o.noop,prepend:V.b,selected:"",useLensCompatibleFields:Be,width:ge})))),null!=w&&w),null!=n&&!Be&&l.a.createElement(ee,{grow:!1},n(Me)),rt)),ot?Be?l.a.createElement(G.a,{"data-test-subj":"embeddable-matrix-histogram",extraActions:j,extraOptions:{filters:T},getLensAttributes:U,height:null!=t?t:155,id:Ie,inspectTitle:null!=M?M:ye,scopeId:H.SourcererScopeName.detections,stackByField:Re,timerange:Ue}):Ce?l.a.createElement(S.a,null):l.a.createElement(C,{chartHeight:t,data:it,from:je,legendItems:lt,legendPosition:I,legendMinWidth:se?300:void 0,loading:He,to:ke,showLegend:ue,updateDateRange:he}):null))}));ne.displayName="AlertsHistogramPanel"},657:function(e,t,n){"use strict";n.d(t,"a",(function(){return j}));var a=n(40),i=n(2),l=n.n(i),r=n(103),s=n(126),o=n(118),u=n(105),c=n(111),d=n(139),m=n(42),p=n(246),b=n.n(p),g=n(125),f=n(106),y=n(242),v=n(248),h=n(560);const E={title:{type:g.a.TEXT,validations:[{validator:g.h.emptyField("")}]},description:{type:g.a.TEXTAREA,validations:[]}};var S=n(159),x=n(196);const O=Object(g.j)({component:g.b}),k=l.a.memo((({closeSaveTimeline:e,initialFocus:t,timelineId:n,showWarning:s})=>{const{startTransaction:d}=Object(S.b)(),p=Object(i.useMemo)((()=>c.b.getTimelineByIdSelector()),[]),{isSaving:k,description:j="",status:T,title:w="",timelineType:M}=Object(u.a)((e=>Object(m.pick)(["isSaving","description","status","title","timelineType"],p(e,n)))),I=b()(k),C=Object(r.useDispatch)(),A=Object(y.a)({timelineId:o.c.active,timelineType:f.l.default}),D=Object(i.useCallback)(((e,t)=>(t&&C(c.a.updateTitleAndDescription({id:n,...e})),Promise.resolve())),[C,n]),N=Object(i.useMemo)((()=>({title:w,description:j})),[w,j]),{form:F}=Object(g.k)({id:"timelineTitleAndDescriptionForm",schema:E,onSubmit:D,options:{stripEmptyFields:!1},defaultValue:N}),{isSubmitted:P,isSubmitting:R,submit:L}=F,B=Object(i.useCallback)((()=>{d({name:x.f.SAVE}),L()}),[L,d]),_=Object(i.useCallback)((()=>{s&&A(),e()}),[e,A,s]),q=Object(i.useMemo)((()=>T===f.k.draft&&s?M===f.l.template?h.e:h.d:h.c),[s,T,M]),z=Object(i.useMemo)((()=>T===f.k.draft?M===f.l.template?h.l:h.k:M===f.l.template?h.h:h.g),[T,M]),V=Object(i.useMemo)((()=>T===f.k.draft&&s?M===f.l.template?h.l:h.k:h.j),[s,T,M]),$=Object(i.useMemo)((()=>h.p(M)),[M]),Q=Object(i.useMemo)((()=>`${h.m} (${h.i})`),[]),U=Object(i.useMemo)((()=>({"aria-label":h.n,autoFocus:"title"===t,"data-test-subj":"save-timeline-title",disabled:k,spellCheck:!0,placeholder:M===f.l.template?v.k:v.l})),[t,k,M]),H=Object(i.useMemo)((()=>({"aria-label":h.m,autoFocus:"description"===t,"data-test-subj":"save-timeline-description",disabled:k,placeholder:v.f})),[t,k]);return Object(i.useEffect)((()=>{P&&!k&&I&&e()}),[P,k,I,e]),l.a.createElement(a.EuiModal,{"data-test-subj":"save-timeline-modal",maxWidth:1024,onClose:e},k&&l.a.createElement(a.EuiProgress,{size:"s",color:"primary",position:"absolute","data-test-subj":"progress-bar"}),l.a.createElement(a.EuiModalHeader,{"data-test-subj":"modal-header"},z),l.a.createElement(a.EuiModalBody,null,s&&l.a.createElement(a.EuiFlexItem,{grow:!0},l.a.createElement(a.EuiCallOut,{title:$,color:"danger",iconType:"warning","data-test-subj":"save-timeline-callout"}),l.a.createElement(a.EuiSpacer,{size:"m"})),l.a.createElement(g.c,{form:F},l.a.createElement(a.EuiFlexItem,{grow:!0},l.a.createElement(O,{path:"title",fullWidth:!0,label:h.o,euiFieldProps:U}),l.a.createElement(a.EuiSpacer,null)),l.a.createElement(a.EuiFlexItem,{grow:!0},l.a.createElement(O,{label:Q,path:"description",fullWidth:!0,euiFieldProps:H}),l.a.createElement(a.EuiSpacer,null)),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"s"},l.a.createElement(a.EuiFlexItem,{grow:!1,component:"span"},l.a.createElement(a.EuiButton,{size:"s",fill:!1,onClick:_,isDisabled:k,"data-test-subj":"close-button"},q)),l.a.createElement(a.EuiFlexItem,{grow:!1,component:"span"},l.a.createElement(a.EuiButton,{size:"s",isDisabled:k||R,fill:!0,onClick:B,"data-test-subj":"save-button"},V)))))))}));k.displayName="TimelineTitleAndDescription";const j=l.a.memo((({initialFocus:e,timelineId:t,toolTip:n})=>{const m=Object(r.useDispatch)(),p=Object(i.useMemo)((()=>Object(d.createSelector)(c.b.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.showSaveModal)&&void 0!==t&&t}))),[]),b=Object(u.a)((e=>p(e,t))),[g,f]=Object(i.useState)(!1),y=Object(i.useCallback)((()=>{f(!1),b&&m(c.a.toggleModalSaveTimeline({id:o.c.active,showModalSaveTimeline:!1}))}),[m,f,b]),v=Object(i.useCallback)((()=>{f(!0)}),[f]),{kibanaSecuritySolutionsPrivileges:{crud:E}}=Object(s.a)(),S=Object(i.useMemo)((()=>E?n:h.b),[n,E]),x=Object(i.useMemo)((()=>l.a.createElement(a.EuiButtonIcon,{"aria-label":h.f,isDisabled:!E,onClick:v,iconType:"pencil","data-test-subj":"save-timeline-button-icon"})),[v,E]);return"title"===e&&b||g?l.a.createElement(l.a.Fragment,null,x,l.a.createElement(k,{closeSaveTimeline:y,initialFocus:e,timelineId:t,showWarning:"title"===e&&b})):l.a.createElement(a.EuiToolTip,{content:null!=S?S:"","data-test-subj":"save-timeline-btn-tooltip"},x)}));j.displayName="SaveTimelineButton"},658:function(e,t,n){"use strict";n.d(t,"b",(function(){return be})),n.d(t,"a",(function(){return ve}));var a=n(42),i=n(40),l=n(2),r=n.n(l),s=n(103),o=n(41),u=n.n(o),c=n(59),d=n(111),m=n(133),p=n(190),b=n(110),g=n(941),f=n(106),y=n(105),v=n(302),h=n(148),E=n(268),S=n(104),x=n.n(S),O=(n(21),n(220)),k=n(913),j=n(124),T=n(606),w=n(309),M=n(118),I=n(519),C=n(915),A=n(5);const D=A.i18n.translate("xpack.securitySolution.timeline.tabs.queyTabTimelineTitle",{defaultMessage:"Query"}),N=A.i18n.translate("xpack.securitySolution.timeline.tabs.eqlTabTimelineTitle",{defaultMessage:"Correlation"}),F=A.i18n.translate("xpack.securitySolution.timeline.tabs.analyserTabTimelineTitle",{defaultMessage:"Analyzer"}),P=A.i18n.translate("xpack.securitySolution.timeline.tabs.notesTabTimelineTitle",{defaultMessage:"Notes"}),R=A.i18n.translate("xpack.securitySolution.timeline.tabs.pinnedTabTimelineTitle",{defaultMessage:"Pinned"}),L=A.i18n.translate("xpack.securitySolution.timeline.tabs.securityAssistantTimelineTitle",{defaultMessage:"Elastic AI Assistant"}),B=A.i18n.translate("xpack.securitySolution.timeline.tabs.discoverInTimeline",{defaultMessage:"Discover"}),_=A.i18n.translate("xpack.securitySolution.timeline.tabs.sessionTabTimelineTitle",{defaultMessage:"Session View"});var q=n(17),z=n(640);const V=u.a.div.attrs((({$isVisible:e=!1,isOverflowYScroll:t=!1})=>({style:{display:e?"flex":"none",overflow:t?"hidden scroll":"hidden"}}))).withConfig({displayName:"HideShowContainer",componentId:"sc-1ib7jds-0"})(["flex:1;"]);var $=u()(V).withConfig({displayName:"_StyledHideShowContainer",componentId:"sc-1ib7jds-1"})(["overflow:hidden !important;"]);const Q=(e,t=r.a.createElement(i.EuiSkeletonText,{lines:10}))=>{var n;const a=r.a.forwardRef(((n,a)=>r.a.createElement(l.Suspense,{fallback:t},r.a.createElement(e,x()({},n,{ref:a})))));return a.displayName=`${null!==(n=e.displayName)&&void 0!==n?n:"Tab"}WithSuspense`,a},U=u.a.div.withConfig({displayName:"AssistantTabContainer",componentId:"sc-1ib7jds-2"})(["overflow-y:auto;width:100%;"]),H=Q(Object(l.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(15),n.e(16),n.e(48)]).then(n.bind(null,1663))))),G=Q(Object(l.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(15),n.e(16),n.e(45)]).then(n.bind(null,1670))))),W=Q(Object(l.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(46)]).then(n.bind(null,1649))))),K=Q(Object(l.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(41)]).then(n.bind(null,1673))))),Y=Q(Object(l.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(15),n.e(47)]).then(n.bind(null,1650))))),J=Q(Object(l.lazy)((()=>Promise.all([n.e(1),n.e(5),n.e(7),n.e(10),n.e(9),n.e(13),n.e(49)]).then(n.bind(null,1651))))),X=Q(Object(l.lazy)((()=>n.e(44).then(n.bind(null,1674))))),Z=Object(l.memo)((({isAssistantEnabled:e,renderCellValue:t,rowRenderers:n,timelineId:a,shouldRefocusPrompt:s,setConversationId:o})=>r.a.createElement(l.Suspense,{fallback:r.a.createElement(i.EuiSkeletonText,{lines:10})},r.a.createElement(U,null,r.a.createElement(O.a,{isAssistantEnabled:e,conversationId:z.a,setConversationId:o,shouldRefocusPrompt:s})))));Z.displayName="AssistantTab";const ee=Object(l.memo)((({activeTimelineTab:e,renderCellValue:t,rowRenderers:n,timelineId:a,timelineType:i,setConversationId:s,showTimeline:o})=>{const u=Object(j.a)("discoverInTimeline"),{hasAssistantPrivilege:c,isAssistantEnabled:d}=Object(w.a)(),m=Object(l.useCallback)((e=>{switch(e){case M.d.graph:return r.a.createElement(W,{timelineId:a});case M.d.notes:return r.a.createElement(K,{timelineId:a});case M.d.session:return r.a.createElement(J,{timelineId:a});default:return null}}),[a]),p=Object(l.useMemo)((()=>[M.d.graph,M.d.notes,M.d.session].includes(e)),[e]),{conversations:b}=Object(T.a)(),g=Object(l.useMemo)((()=>b[z.a].messages.length>0),[b]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(V,{$isVisible:M.d.query===e,"data-test-subj":`timeline-tab-content-${M.d.query}`},r.a.createElement(H,{renderCellValue:t,rowRenderers:n,timelineId:a})),r.a.createElement(V,{$isVisible:M.d.pinned===e,"data-test-subj":`timeline-tab-content-${M.d.pinned}`},r.a.createElement(Y,{renderCellValue:t,rowRenderers:n,timelineId:a})),i===f.l.default&&r.a.createElement(V,{$isVisible:M.d.eql===e,"data-test-subj":`timeline-tab-content-${M.d.eql}`},r.a.createElement(G,{renderCellValue:t,rowRenderers:n,timelineId:a})),r.a.createElement(V,{$isVisible:p,isOverflowYScroll:e===M.d.session,"data-test-subj":`timeline-tab-content-${M.d.graph}-${M.d.notes}`},p&&m(e)),c&&r.a.createElement($,{$isVisible:e===M.d.securityAssistant,isOverflowYScroll:e===M.d.securityAssistant,"data-test-subj":"timeline-tab-content-security-assistant"},(e===M.d.securityAssistant||g)&&r.a.createElement(Z,{isAssistantEnabled:d,renderCellValue:t,rowRenderers:n,timelineId:a,setConversationId:s,shouldRefocusPrompt:o&&e===M.d.securityAssistant})),u&&r.a.createElement(V,{$isVisible:M.d.discover===e,"data-test-subj":`timeline-tab-content-${M.d.discover}`},r.a.createElement(X,null)))}));ee.displayName="ActiveTimelineTab";const te=u()(i.EuiBadge).withConfig({displayName:"CountBadge",componentId:"sc-1ib7jds-3"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeS)),ne=u()(i.EuiTab).withConfig({displayName:"StyledEuiTab",componentId:"sc-1ib7jds-4"})([".euiTab__content{display:flex;flex-direction:row;white-space:pre;}:focus{text-decoration:none;> span > span{text-decoration:underline;}}"]),ae=({renderCellValue:e,rowRenderers:t,timelineId:n,timelineFullScreen:o,timelineType:u,graphEventId:c,sessionViewConfig:m,timelineDescription:p})=>{const b=Object(j.a)("discoverInTimeline"),{hasAssistantPrivilege:g}=Object(w.a)(),v=Object(s.useDispatch)(),h=Object(l.useMemo)((()=>Object(C.a)()),[]),E=Object(l.useMemo)((()=>Object(C.g)()),[]),S=Object(l.useMemo)((()=>Object(C.e)()),[]),x=Object(l.useMemo)((()=>Object(C.d)()),[]),O=Object(l.useMemo)((()=>Object(C.c)()),[]),T=Object(l.useMemo)((()=>Object(C.b)()),[]),A=Object(y.b)((e=>h(e,n))),V=Object(y.b)((e=>E(e,n))),$=Object(y.b)((e=>S(e,n))),Q=Object(y.a)((e=>O(e,n))),U=Object(y.a)((e=>T(e,n))),H=Object(y.a)((e=>x(e))),G=Object(q.b)().isEnterprise(),[W,K]=Object(l.useState)(z.a),{reportAssistantInvoked:Y}=Object(k.a)(),J=Object(l.useMemo)((()=>{const e=Object.values(U).reduce(((e,t)=>[...e,...t]),[]);return[...Q,...e]}),[Q,U]),X=Object(l.useMemo)((()=>H.filter((e=>J.includes(e.id))).length+(Object(a.isEmpty)(p)?0:1)),[H,J,p]),Z=Object(l.useCallback)((e=>{v(d.a.setActiveTabTimeline({id:n,activeTab:e}))}),[v,n]),ae=Object(l.useCallback)((()=>{Z(M.d.query)}),[Z]),ie=Object(l.useCallback)((()=>{Z(M.d.eql)}),[Z]),le=Object(l.useCallback)((()=>{Z(M.d.graph)}),[Z]),re=Object(l.useCallback)((()=>{Z(M.d.notes)}),[Z]),se=Object(l.useCallback)((()=>{Z(M.d.pinned)}),[Z]),oe=Object(l.useCallback)((()=>{Z(M.d.session)}),[Z]),ue=Object(l.useCallback)((()=>{Z(M.d.securityAssistant),A!==M.d.securityAssistant&&Y({conversationId:W,invokedBy:z.a})}),[A,W,Y,Z]),ce=Object(l.useCallback)((()=>{Z(M.d.discover)}),[Z]);return Object(l.useEffect)((()=>{c||A!==M.d.graph||ae()}),[A,c,ae]),r.a.createElement(r.a.Fragment,null,!o&&r.a.createElement(i.EuiTabs,null,r.a.createElement(ne,{"data-test-subj":`timelineTabs-${M.d.query}`,onClick:ae,isSelected:A===M.d.query,disabled:!1,key:M.d.query},r.a.createElement("span",null,D),V&&r.a.createElement(I.b,null)),u===f.l.default&&r.a.createElement(ne,{"data-test-subj":`timelineTabs-${M.d.eql}`,onClick:ie,isSelected:A===M.d.eql,disabled:!1,key:M.d.eql},r.a.createElement("span",null,N),V&&r.a.createElement(I.a,null)),r.a.createElement(i.EuiTab,{"data-test-subj":`timelineTabs-${M.d.graph}`,onClick:le,isSelected:A===M.d.graph,disabled:!c,key:M.d.graph},F),G&&r.a.createElement(i.EuiTab,{"data-test-subj":`timelineTabs-${M.d.session}`,onClick:oe,isSelected:A===M.d.session,disabled:null===m,key:M.d.session},_),r.a.createElement(ne,{"data-test-subj":`timelineTabs-${M.d.notes}`,onClick:re,isSelected:A===M.d.notes,disabled:u===f.l.template,key:M.d.notes},r.a.createElement("span",null,P),V&&X>0&&u===f.l.default&&r.a.createElement("div",null,r.a.createElement(te,null,X))),r.a.createElement(ne,{"data-test-subj":`timelineTabs-${M.d.pinned}`,onClick:se,disabled:u===f.l.template,isSelected:A===M.d.pinned,key:M.d.pinned},r.a.createElement("span",null,R),V&&$>0&&u===f.l.default&&r.a.createElement("div",null,r.a.createElement(te,null,$))),g&&r.a.createElement(ne,{"data-test-subj":`timelineTabs-${M.d.securityAssistant}`,onClick:ue,disabled:u===f.l.template,isSelected:A===M.d.securityAssistant,key:M.d.securityAssistant},r.a.createElement("span",null,L)),b&&r.a.createElement(ne,{"data-test-subj":`timelineTabs-${M.d.discover}`,onClick:ce,isSelected:A===M.d.discover,disabled:!1,key:M.d.discover},r.a.createElement("span",null,B))),r.a.createElement(ee,{activeTimelineTab:A,renderCellValue:e,rowRenderers:t,timelineId:n,timelineType:u,timelineDescription:p,setConversationId:K,showTimeline:V}))},ie=Object(l.memo)(ae);var le=n(170),re=n(178),se=n(722),oe=n(45),ue=n(56),ce=n(102),de=n(221),me=n(122);const pe=u.a.div.withConfig({displayName:"TimelineTemplateBadge",componentId:"sc-4r2lej-0"})(["background:",";color:#fff;padding:10px 15px;font-size:0.8em;"],(({theme:e})=>e.eui.euiColorVis3_behindText)),be=Object(l.createContext)({timelineId:null}),ge=({timelineId:e})=>{const t=Object(l.useMemo)((()=>d.b.getTimelineByIdSelector()),[]);return Object(y.b)((n=>{var a;return(null!==(a=t(n,e))&&void 0!==a?a:m.b).isSaving}))?r.a.createElement(i.EuiProgress,{size:"s",color:"primary",position:"absolute"}):null},fe=r.a.memo(ge),ye=({renderCellValue:e,rowRenderers:t,timelineId:n})=>{const o=Object(s.useDispatch)(),u=Object(l.useRef)(null),S=Object(l.useMemo)((()=>d.b.getTimelineByIdSelector()),[]),x=Object(l.useMemo)((()=>me.e.scopeIdSelector()),[]),{selectedPatterns:O,selectedDataViewId:k}=Object(y.a)((e=>x(e,b.SourcererScopeName.timeline))),{dataViewId:j,indexNames:T,graphEventId:w,savedObjectId:I,timelineType:C,description:A,sessionViewConfig:D,initialized:N}=Object(y.a)((e=>{var t;return Object(a.pick)(["indexNames","dataViewId","graphEventId","savedObjectId","timelineType","description","sessionViewConfig","initialized"],null!==(t=S(e,n))&&void 0!==t?t:m.b)})),{timelineFullScreen:F}=Object(re.c)();Object(l.useEffect)((()=>{I||N||o(d.a.createTimeline({id:n,columns:p.b,dataViewId:k,indexNames:O,expandedDetail:v.a.getExpandedDetail(),show:!1}))}),[]);const P=Object(l.useCallback)((()=>{!I||null==k||null===j&&0===T.length||j===k&&T.sort().join()===O.sort().join()||o(d.a.updateDataView({dataViewId:k,id:n,indexNames:O}))}),[o,I,k,j,O,T,n]);Object(l.useEffect)((()=>{P()}),[k,O]);const R=Object(l.useCallback)((()=>{var e;const t=null===(e=u.current)||void 0===e?void 0:e.querySelector(se.a);var n,a;null!=t?t.focus():null===(n=u.current)||void 0===n||null===(a=n.querySelector(".globalFilterBar__addButton"))||void 0===a||a.focus()}),[u]),L=Object(l.useCallback)((()=>{var e,t;null===(e=u.current)||void 0===e||null===(t=e.querySelector(`.${h.d}`))||void 0===t||t.focus()}),[u]),B=Object(l.useCallback)((e=>{Object(c.isTab)(e)&&Object(h.l)({containerElement:u.current,keyboardEvent:e,onSkipFocusBeforeEventsTable:R,onSkipFocusAfterEventsTable:L})}),[u,R,L]),_=Object(l.useMemo)((()=>({timelineId:n})),[n]),q=(()=>{const{search:e,pathname:t}=Object(oe.useLocation)(),{spaces:n}=Object(ce.j)().services,a=Object(l.useMemo)((()=>d.b.getTimelineByIdSelector()),[]),{resolveTimelineConfig:s,savedObjectId:o,show:u,graphEventId:c,activeTab:p}=Object(y.a)((e=>{var t;return null!==(t=a(e,M.c.active))&&void 0!==t?t:m.b})),b=Object(l.useCallback)((()=>{var a,l,d;const m=new URLSearchParams(e),b=null!==(a=m.get(de.a.timeline))&&void 0!==a?a:void 0,g={id:null!=o?o:"",isOpen:!!u,activeTab:p,graphEventId:c},f=null!==(l=Object(ue.safeDecode)(null!=b?b:""))&&void 0!==l?l:g,y=null==f?void 0:f.id;if(!n||"conflict"!==(null==s?void 0:s.outcome)||null==(null==s?void 0:s.alias_target_id)||null==y)return null;const v=null!==(d=null==s?void 0:s.alias_target_id)&&void 0!==d?d:"",h={...f,id:v},E=Object(ue.encode)(h);m.set(de.a.timeline,E);const S=`${t}?${m.toString()}${window.location.hash}`;return r.a.createElement(r.a.Fragment,null,n.ui.components.getLegacyUrlConflict({objectNoun:de.a.timeline,currentObjectId:y,otherObjectId:v,otherObjectPath:S}),r.a.createElement(i.EuiSpacer,null))}),[p,c,t,null==s?void 0:s.alias_target_id,null==s?void 0:s.outcome,o,e,u,n]);return Object(l.useMemo)((()=>b()),[b])})();return r.a.createElement(be.Provider,{value:_},r.a.createElement(le.B,{"data-test-subj":"timeline","data-timeline-id":n,onKeyDown:B,ref:u},r.a.createElement(fe,{timelineId:n}),C===f.l.template&&r.a.createElement(pe,null,E.f),q,r.a.createElement(le.y,{$isVisible:!F,"data-test-subj":"timeline-hide-show-container"},r.a.createElement(g.b,{timelineId:n}),r.a.createElement(g.a,{timelineId:n})),r.a.createElement(ie,{graphEventId:w,sessionViewConfig:D,renderCellValue:e,rowRenderers:t,timelineId:n,timelineType:C,timelineDescription:A,timelineFullScreen:F})))};ye.displayName="StatefulTimelineComponent";const ve=r.a.memo(ye)},659:function(e,t,n){"use strict";n.d(t,"a",(function(){return C}));var a=n(2),i=n.n(a),l=n(41),r=n.n(l),s=n(40),o=n(103),u=n(42);const c=n(5).i18n.translate("xpack.securitySolution.components.histogram.stackByOptions.stackByLabel",{defaultMessage:"Stack by"});var d=n(166),m=n(520),p=n(456),b=n(959),g=n(151),f=n(114),y=n(311),v=n(390),h=n(177),E=n(124),S=n(211),x=n(403),O=n(726),k=n(645);const j=({isInitialLoading:e,barChart:t,configs:n,stackByField:a,scopeId:l})=>e?i.a.createElement(k.a,null):i.a.createElement(O.a,{barChart:t,configs:n,stackByField:a,scopeId:l}),T=i.a.memo(j);j.displayName="MatrixHistogramChartContentComponent";var w=n(413);const M=r()(m.a).withConfig({displayName:"HistogramPanel",componentId:"sc-cnfih-0"})(["display:flex;flex-direction:column;",""],(({height:e})=>null!=e?`min-height: ${e}px;`:"")),I=({chartHeight:e,defaultStackByOption:t,endDate:n,errorMessage:l,filterQuery:r,getLensAttributes:m,headerChildren:O,histogramType:k,hideHistogramIfEmpty:j=!1,id:I,indexNames:C,runtimeMappings:A,isPtrIncluded:D,legendPosition:N,lensAttributes:F,mapping:P,onError:R,paddingSize:L="m",panelHeight:B=300,setAbsoluteRangeDatePickerTarget:_=f.a.global,setQuery:q,showInspectButton:z=!1,showLegend:V,showSpacer:$=!0,stackByOptions:Q,startDate:U,subtitle:H,scopeId:G,sourcererScopeId:W,title:K,titleSize:Y,yTickFormatter:J,skip:X,hideQueryToggle:Z=!1,applyGlobalQueriesAndFilters:ee=!0})=>{const te=`${I}-embeddable`,ne=Object(o.useDispatch)(),ae=Object(a.useCallback)((({x:e})=>{if(!e)return;const[t,n]=e;ne(Object(g.setAbsoluteRangeDatePicker)({id:_,from:new Date(t).toISOString(),to:new Date(n).toISOString()}))}),[ne,_]),ie=Object(a.useMemo)((()=>Object(p.b)({chartHeight:e,from:U,legendPosition:N,to:n,onBrushEnd:ae,yTickFormatter:J,showLegend:V})),[e,U,N,n,ae,J,V]),[le,re]=Object(a.useState)(!0),[se,oe]=Object(a.useState)(t);Object(a.useEffect)((()=>{oe(t)}),[t]);const ue=Object(a.useCallback)((e=>{var n;oe(null!==(n=Q.find((t=>t.value===e.target.value)))&&void 0!==n?n:t)}),[t,Q]),{toggleStatus:ce,setToggleStatus:de}=Object(h.a)(I),[me,pe]=Object(a.useState)(X||!ce);Object(a.useEffect)((()=>{pe(X||!ce)}),[X,ce]);const be=Object(a.useCallback)((e=>{de(e),pe(!e)}),[pe,de]),ge=Object(E.a)("chartEmbeddablesEnabled"),fe={endDate:n,errorMessage:l,filterQuery:r,histogramType:k,indexNames:C,onError:R,startDate:U,stackByField:se.value,runtimeMappings:A,isPtrIncluded:D,skip:me||ge},[ye,{data:ve,inspect:he,totalCount:Ee,refetch:Se}]=Object(b.a)(fe),xe=Object(a.useMemo)((()=>null!=K&&"function"==typeof K?K(se):K),[K,se]),Oe=Object(w.a)({visualizationId:te}),ke=Object(a.useMemo)((()=>{if(le)return null;if("function"==typeof H){if(ge){if(!Oe||(e=Oe[0],!Object.values(null!==(t=e.aggregations)&&void 0!==t?t:{}).some((({buckets:e})=>e.length>0))))return H(0);const n=Oe[0].hits.total;return n>=0?H(n):null}return Ee>=0?H(Ee):null}var e,t;return H}),[ge,le,H,Ee,Oe]),je=Object(a.useMemo)((()=>!!(Ee<=0&&j)),[Ee,j]),Te=Object(a.useMemo)((()=>Object(p.c)(ve,P)),[ve,P]);Object(a.useEffect)((()=>{ye||le||q({id:I,inspect:he,loading:ye,refetch:Se}),le&&Te&&ve&&re(!1)}),[Te,ve,I,he,ge,le,ye,Se,re,q]);const we=Object(a.useMemo)((()=>({from:U,to:n})),[U,n]),Me=Object(a.useMemo)((()=>({dnsIsPtrIncluded:null!=D&&D,filters:r?[{query:Object(u.isString)(r)?JSON.parse(r):r,meta:{}}]:void 0})),[D,r]);return je?null:i.a.createElement(i.a.Fragment,null,i.a.createElement(y.a,{show:!le,targetClassNames:[S.a]},i.a.createElement(M,{"data-test-subj":`${I}Panel`,height:ce?B:void 0,paddingSize:L},ye&&!le&&i.a.createElement(s.EuiProgress,{"data-test-subj":"initialLoadingPanelMatrixOverTime",size:"xs",position:"absolute",color:"accent"}),i.a.createElement(d.a,{id:I,height:ce?void 0:0,title:xe,titleSize:Y,toggleStatus:ce,toggleQuery:Z?void 0:be,subtitle:ke,inspectMultiple:!0,showInspectButton:z&&!ge,isInspectDisabled:void 0===r},i.a.createElement(s.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},(m||F)&&we&&!ge&&i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(v.a,{className:"histogram-viz-actions",extraOptions:Me,getLensAttributes:m,isInspectButtonDisabled:void 0===r,lensAttributes:F,queryId:I,stackByField:se.value,timerange:we,title:K})),i.a.createElement(s.EuiFlexItem,{grow:!1},Q.length>1&&i.a.createElement(s.EuiSelect,{onChange:ue,options:Q,prepend:c,value:null==se?void 0:se.value})),i.a.createElement(s.EuiFlexItem,{grow:!1},O))),ce?ge?i.a.createElement(x.a,{scopeId:W,applyGlobalQueriesAndFilters:ee,"data-test-subj":"embeddable-matrix-histogram",extraOptions:Me,getLensAttributes:m,height:null!=e?e:150,id:te,inspectTitle:K,lensAttributes:F,stackByField:se.value,timerange:we}):i.a.createElement(T,{isInitialLoading:le,barChart:Te,configs:ie,stackByField:se.value,scopeId:G}):null)),$&&i.a.createElement(s.EuiSpacer,{"data-test-subj":"spacer",size:"l"}))},C=i.a.memo(I)},660:function(e,t,n){"use strict";n.d(t,"b",(function(){return T})),n.d(t,"a",(function(){return w}));var a=n(130),i=n.n(a),l=n(42),r=n(2),s=n(103),o=n(3),u=n(51),c=n(102),d=n(216),m=n(111),p=n(518),b=n(115),g=n(113);const f=n(5).i18n.translate("xpack.securitySolution.timelineEvents.errorSearchDescription",{defaultMessage:"An error has occurred on timeline events search"});var y=n(118),v=n(175),h=n(302),E=n(108),S=n(303),x=n(4);const O="timelineEventsQuery",k=[{field:"@timestamp",direction:g.b.asc,type:"date",esTypes:["date"]}],j=e=>({...Object(l.isEmpty)(null==e?void 0:e.eventCategoryField)?{}:{eventCategoryField:null==e?void 0:e.eventCategoryField},...Object(l.isEmpty)(null==e?void 0:e.size)?{}:{size:null==e?void 0:e.size},...Object(l.isEmpty)(null==e?void 0:e.tiebreakerField)?{}:{tiebreakerField:null==e?void 0:e.tiebreakerField},...Object(l.isEmpty)(null==e?void 0:e.timestampField)?{}:{timestampField:null==e?void 0:e.timestampField}}),T=({dataViewId:e,endDate:t,eqlOptions:n,id:a=O,indexNames:T,fields:w,filterQuery:M,runtimeMappings:I,startDate:C,language:A="kuery",limit:D,sort:N=k,skip:F=!1,timerangeKind:P})=>{const[{pageName:R}]=Object(v.a)(),L=Object(s.useDispatch)(),{data:B}=Object(c.j)().services,_=Object(r.useRef)(l.noop),q=Object(r.useRef)(new AbortController),z=Object(r.useRef)(new o.Subscription),[V,$]=Object(r.useState)(!1),[Q,U]=Object(r.useState)(a===y.c.active?h.a.getActivePage():0),[H,G]=Object(r.useState)(null),W=Object(r.useRef)(null),{startTracking:K}=Object(S.a)(),Y=Object(r.useCallback)((()=>{null!=a&&p.a.some((e=>e===a))&&(L(m.a.clearEventsLoading({id:a})),L(m.a.clearEventsDeleted({id:a})))}),[L,a]),J=Object(r.useCallback)((e=>{Y(),a===y.c.active&&(h.a.setExpandedDetail({}),h.a.setActivePage(e)),U(e)}),[Y,a]),X=Object(r.useCallback)((()=>{null!=_.current&&_.current(),J(0)}),[J]),Z=Object(r.useCallback)((e=>{L(m.a.setTimelineUpdatedAt({id:a,updated:e}))}),[L,a]),[ee,te]=Object(r.useState)({id:a,inspect:{dsl:[],response:[]},refetch:X,totalCount:-1,pageInfo:{activePage:0,querySize:0},events:[],loadPage:J,updatedAt:0}),{addWarning:ne}=Object(E.a)(),ae=Object(r.useCallback)((async(t,n)=>{if(null==t||""===R||F)return;const i=async()=>{W.current=t,q.current=new AbortController,$(!0);const{endTracking:i}=K({name:`${x.l} timeline events search`});z.current=B.search.search(t,{strategy:"eql"===t.language?"timelineEqlSearchStrategy":"timelineSearchStrategy",abortSignal:q.current.signal,indexPattern:{id:e}}).subscribe({next:e=>{Object(u.isCompleteResponse)(e)?(i("success"),$(!1),te((i=>{const l={...i,events:(r=e.edges,r.map((e=>e.node))),inspect:Object(b.getInspectResponse)(e,i.inspect),pageInfo:e.pageInfo,totalCount:e.totalCount,updatedAt:Date.now()};var r;return Z(l.updatedAt),a===y.c.active&&(h.a.setExpandedDetail({}),h.a.setPageName(R),"eql"===t.language?(h.a.setEqlRequest(t),h.a.setEqlResponse(l)):(h.a.setRequest(t),h.a.setResponse(l))),n&&n(l),l})),z.current.unsubscribe()):Object(u.isErrorResponse)(e)&&(i("invalid"),$(!1),ne(f),z.current.unsubscribe())},error:e=>{i(q.current.signal.aborted?"aborted":"error"),$(!1),B.search.showError(e),z.current.unsubscribe()}})};if(a===y.c.active&&""!==h.a.getPageName()&&R!==h.a.getPageName()){if(h.a.setPageName(R),q.current.abort(),$(!1),"eql"===t.language?(W.current=h.a.getEqlRequest(),_.current=i.bind(null,h.a.getEqlRequest())):(W.current=h.a.getRequest(),_.current=i.bind(null,h.a.getRequest())),te((e=>{const n="eql"===t.language?h.a.getEqlResponse():h.a.getResponse();return null!=n?{...n,refetch:X,loadPage:J}:e})),"eql"!==t.language&&null!=h.a.getResponse())return;if("eql"===t.language&&null!=h.a.getEqlResponse())return}z.current.unsubscribe(),q.current.abort(),await i(),_.current=i}),[R,F,a,K,B.search,e,Z,ne,X,J]);Object(r.useEffect)((()=>{0!==T.length&&G((e=>{var l,r,s,o,u,c;const m=e,p={defaultIndex:null!==(l=null==e?void 0:e.defaultIndex)&&void 0!==l?l:[],filterQuery:null!==(r=null==e?void 0:e.filterQuery)&&void 0!==r?r:"",querySize:null!==(s=null==e?void 0:e.pagination.querySize)&&void 0!==s?s:0,sort:null!==(o=null==e?void 0:e.sort)&&void 0!==o?o:k,timerange:null!==(u=null==e?void 0:e.timerange)&&void 0!==u?u:{},runtimeMappings:null!==(c=null==e?void 0:e.runtimeMappings)&&void 0!==c?c:{},...j(m)},b=C&&t?{timerange:{interval:"12h",from:C,to:t}}:{},f={defaultIndex:T,filterQuery:Object(d.a)(M),querySize:D,sort:N,runtimeMappings:I,...b,...j(n)},v=i()(p,f)?Q:0,E={defaultIndex:T,factoryQueryType:g.A.all,fieldRequested:w,fields:w,filterQuery:Object(d.a)(M),pagination:{activePage:v,querySize:D},language:A,runtimeMappings:I,sort:N,...b,...n||{}};return Q!==v&&(U(v),a===y.c.active&&h.a.setActivePage(v)),i()(e,E)?e:E}))}),[L,T,Q,t,n,M,a,A,D,C,N,w,I]);const ie=Object(r.useCallback)((async e=>{a===y.c.active&&"absolute"!==P&&i()(W.current,H)||await ae(H,e)}),[a,H,ae,P]);return Object(r.useEffect)((()=>{Object(l.isEmpty)(M)&&te({id:a,inspect:{dsl:[],response:[]},refetch:X,totalCount:-1,pageInfo:{activePage:0,querySize:0},events:[],loadPage:J,updatedAt:0})}),[M,a,X,J]),[V,ee,ie]},w=({dataViewId:e,endDate:t,eqlOptions:n,id:a=O,indexNames:i,fields:l,filterQuery:s,runtimeMappings:o,startDate:u,language:c="kuery",limit:d,sort:m=k,skip:p=!1,timerangeKind:b})=>{const[g,f,y]=T({dataViewId:e,endDate:t,eqlOptions:n,id:a,indexNames:i,fields:l,filterQuery:s,runtimeMappings:o,startDate:u,language:c,limit:d,sort:m,skip:p,timerangeKind:b});return Object(r.useEffect)((()=>{y&&y()}),[y]),[g,f]}},662:function(e,t,n){"use strict";n.d(t,"a",(function(){return s}));var a=n(2),i=n(102),l=n(109),r=n(59);const s=({closePopover:e,draggableId:t,fieldName:n,keyboardHandlerRef:s,openPopover:o})=>{const{timelines:u}=Object(i.j)().services,c=u.getUseAddToTimeline(),{beginDrag:d,cancelDrag:m,dragToLocation:p,endDrag:b,hasDraggableLock:g}=c({draggableId:t,fieldName:n}),[f,y]=Object(a.useState)(null),v=Object(a.useCallback)((()=>{y((e=>e?(m(e),null):null))}),[m]),h=Object(a.useCallback)((n=>{const a=document.querySelector(`[data-rbd-drag-handle-draggable-id="${t}"]`);var i;a&&((g()||!g()&&" "===n.key)&&(n.preventDefault(),n.stopPropagation()),(({beginDrag:e,cancelDragActions:t,closePopover:n,draggableElement:a,dragActions:i,dragToLocation:s,endDrag:o,keyboardEvent:u,openPopover:c,setDragActions:d})=>{let m=null;switch(u.key){case" ":i?(o(i),d(null)):(null!=n&&n(),d(e()));break;case"Escape":t();break;case"Tab":(e=>{const t=e.querySelectorAll("a, button");t.forEach((e=>{e.setAttribute("tabindex","-1")})),setTimeout((()=>{t.forEach((e=>{e.setAttribute("tabindex","0")}))}),0)})(a);break;case"ArrowUp":m=a.getBoundingClientRect(),s({dragActions:i,position:{x:m.x,y:m.y-l.f}});break;case"ArrowDown":m=a.getBoundingClientRect(),s({dragActions:i,position:{x:m.x,y:m.y+l.f}});break;case"ArrowLeft":m=a.getBoundingClientRect(),s({dragActions:i,position:{x:m.x-l.f,y:m.y}});break;case"ArrowRight":m=a.getBoundingClientRect(),s({dragActions:i,position:{x:m.x+l.f,y:m.y}});break;case"Enter":Object(r.stopPropagationAndPreventDefault)(u),i||null==c||c()}})({beginDrag:d,cancelDragActions:v,closePopover:e,dragActions:f,draggableElement:a,dragToLocation:p,endDrag:b,keyboardEvent:n,openPopover:o,setDragActions:y}),null===(i=s.current)||void 0===i||i.focus())}),[d,v,e,f,t,p,b,g,s,o,y]);return Object(a.useMemo)((()=>({onBlur:v,onKeyDown:h})),[v,h])}},667:function(e,t){e.exports=function(){}},670:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"b",(function(){return l}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.dragAndDrop.copyToClipboardTooltip",{defaultMessage:"Copy to Clipboard"}),l=a.i18n.translate("xpack.securitySolution.dragAndDrop.draggableKeyboardInstructionsNotDraggingScreenReaderOnly",{defaultMessage:"Press enter for options, or press space to begin dragging."});a.i18n.translate("xpack.securitySolution.dragAndDrop.fieldLabel",{defaultMessage:"Field"}),a.i18n.translate("xpack.securitySolution.dragAndDrop.closeButtonLabel",{defaultMessage:"Close"})},671:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(40),i=n(2),l=n.n(i),r=n(140),s=n(939);const o=l.a.memo((({hideActions:e=[],modalTitle:t,onClose:n,onOpen:i})=>l.a.createElement(a.EuiModal,{"data-test-subj":"open-timeline-modal",maxWidth:1100,onClose:n},l.a.createElement(s.a,{closeModalTimeline:n,hideActions:e,isModal:!0,defaultPageSize:10,onOpenTimeline:i,title:null!=t?t:r.H}))));o.displayName="OpenTimelineModal"},672:function(e,t,n){"use strict";n.d(t,"b",(function(){return y})),n.d(t,"a",(function(){return v})),n.d(t,"c",(function(){return h}));var a=n(42),i=n(2),l=n(103),r=n(5),s=n(161),o=n(12),u=n(108),c=n(116),d=n(158),m=n(164),p=n(254),b=n(148),g=n(909),f=n(110);const y="createRuleFromTimeline",v="createRuleFromEql",h=e=>{const t=Object(l.useDispatch)(),{addError:n}=Object(u.a)(),{browserFields:h,dataViewId:E,selectedPatterns:S}=Object(c.d)(f.SourcererScopeName.timeline),x=Object(i.useRef)(!1),[O,k]=Object(i.useState)(null),[j,T]=Object(i.useState)(!1),w=Object(i.useCallback)((e=>{T(!0),k(e),e.dataViewId===E||Object(a.isEmpty)(e.indexNames)||t(d.a.setSelectedDataView({id:f.SourcererScopeName.timeline,selectedDataViewId:e.dataViewId,selectedPatterns:e.indexNames}))}),[E,t]),[M]=Object(i.useState)({dataViewId:E,selectedPatterns:S}),I=Object(i.useMemo)((()=>null==O||Object(a.isEmpty)(h)||null!==O.dataViewId&&null!==E&&E!==O.dataViewId?null:h),[h,E,O]),C=Object(p.e)(y),A=Object(i.useMemo)(C,[C]),D=Object(p.e)(v),N=Object(i.useMemo)(D,[D]),F=Object(i.useCallback)((()=>{if(null!=O&&null!=I){try{const t=()=>{var e,t,n,a,i,l,r;return{dataProviders:null!=O.dataProviders&&O.dataProviders.length>0?Object(s.f)(Object(b.g)(O.dataProviders,I),{fields:[],title:S.join(",")}):"",query:{query:null!==(e=null===(t=O.kqlQuery.filterQuery)||void 0===t||null===(n=t.kuery)||void 0===n?void 0:n.expression)&&void 0!==e?e:"",language:null!==(a=null===(i=O.kqlQuery.filterQuery)||void 0===i||null===(l=i.kuery)||void 0===l?void 0:l.kind)&&void 0!==a?a:"kuery"},filters:null!==(r=O.filters)&&void 0!==r?r:[],eqlOptions:{}}},n=()=>{var e;return{dataProviders:"",query:{query:null!==(e=O.eqlOptions.query)&&void 0!==e?e:"",language:"eql"},filters:[],eqlOptions:{eqlOptions:O.eqlOptions}}},a=x.current?n():t();T(!1),e({index:S,queryBar:{filters:""!==a.dataProviders?[...a.filters,Object(g.b)(a.dataProviders)]:a.filters,query:a.query,saved_id:null},...a.eqlOptions})}catch(e){T(!1),n(e,{toastMessage:r.i18n.translate("xpack.securitySolution.ruleFromTimeline.error.toastMessage",{defaultMessage:"Failed to create rule from timeline with id: {id}",values:{id:O.id}}),title:r.i18n.translate("xpack.securitySolution.ruleFromTimeline.error.title",{defaultMessage:"Failed to import rule from timeline"})})}x.current=!1,M.dataViewId!==E&&t(d.a.setSelectedDataView({id:f.SourcererScopeName.timeline,selectedDataViewId:M.dataViewId,selectedPatterns:M.selectedPatterns}))}}),[n,E,t,M.dataViewId,M.selectedPatterns,I,S,O,e]);Object(i.useEffect)((()=>{null!=I&&F()}),[F,I]);const P=Object(i.useCallback)((e=>{null!=O&&e===O.id||Object(m.h)({timelineId:e,onOpenTimeline:w,updateIsLoading:({id:e,isLoading:n})=>t(Object(o.updateIsLoading)({id:e,isLoading:n})),updateTimeline:Object(m.b)(t)})}),[t,w,O]),[R,L]=Object(i.useState)(!1);return Object(i.useEffect)((()=>{if(!R){let e=null;null!=A?e=A:null!=N&&(e=N,x.current=!0),null!=e&&(L(!0),P(e),T(!0))}}),[P,A,N,R]),{loading:j,onOpenTimeline:w}}},673:function(e,t,n){"use strict";n.d(t,"a",(function(){return c}));var a=n(2),i=n.n(a),l=n(130),r=n.n(l),s=n(13),o=n(72),u=n(14);const c=Object(a.memo)((({dateRangeFrom:e,dateRangeTo:t,hideSavedQuery:n=!1,indexPattern:l,isLoading:c=!1,isRefreshPaused:d,filterQuery:m,filterManager:p,filters:b,onChangedQuery:g,onSubmitQuery:f,refreshInterval:y,savedQuery:v,onSavedQuery:h,dataTestSubj:E,displayStyle:S,isDisabled:x})=>{const O=Object(a.useCallback)((e=>{null==e.query||r()(e.query,m)||f(e.query)}),[m,f]),k=Object(a.useCallback)((e=>{g&&null!=e.query&&!r()(e.query,m)&&g(e.query)}),[m,g]),j=Object(a.useCallback)((e=>{const{query:t,filters:n,timefilter:a}=e.attributes;f(t,a),p.setFilters(n||[]),h(e)}),[p,f,h]),T=Object(a.useCallback)((()=>{null!=v&&(f({query:"",language:v.attributes.query.language}),p.setFilters([]),h(void 0))}),[p,f,h,v]),w=Object(a.useCallback)((e=>{p.setFilters(e)}),[p]),M=Object(a.useMemo)((()=>[l]),[l]),I=Object(a.useMemo)((()=>new s.TimeHistory(new u.Storage(localStorage))),[]);return i.a.createElement(o.SearchBar,{showSubmitButton:!1,dateRangeFrom:e,dateRangeTo:t,filters:b,indexPatterns:M,isLoading:c,isRefreshPaused:d,query:m,onClearSavedQuery:T,onFiltersUpdated:w,onQueryChange:k,onQuerySubmit:O,onSaved:h,onSavedQueryUpdated:j,refreshInterval:y,showAutoRefreshOnly:!1,showFilterBar:!n,showDatePicker:!1,showQueryInput:!0,showSaveQuery:!0,timeHistory:I,dataTestSubj:E,savedQuery:v,displayStyle:S,isDisabled:x})}));c.displayName="QueryBar"},674:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(40),i=n(2),l=n.n(i),r=n(41);const s=n.n(r)()((({iconSide:e,children:t,...n})=>l.a.createElement(a.EuiLink,n,t))).withConfig({displayName:"Link",componentId:"sc-z5mbxm-0"})(["",""],(({iconSide:e,theme:t})=>Object(r.css)(["align-items:center;display:inline-flex;vertical-align:top;white-space:nowrap;"," ",""],"left"===e&&Object(r.css)([".euiIcon{margin-right:",";}"],t.eui.euiSizeXS),"right"===e&&Object(r.css)(["flex-direction:row-reverse;.euiIcon{margin-left:",";}"],t.eui.euiSizeXS))));s.displayName="Link";const o=l.a.memo((({ariaLabel:e,children:t,color:n,dataTestSubj:r,disabled:o,href:u,iconSide:c="left",iconSize:d="s",iconType:m,onClick:p})=>{const b=Object(i.useCallback)((e=>"object"==typeof e&&null!=e&&"props"in e&&e.props&&e.props.children?b(e.props.children):null!=e&&Object.keys(e).length>0?e:""),[]),g=Object(i.useMemo)((()=>e||b(t)),[e,t,b]);return l.a.createElement(s,{className:"siemLinkIcon",color:n,"data-test-subj":r,disabled:o,href:u,iconSide:c,onClick:p,"aria-label":g},l.a.createElement(a.EuiIcon,{size:d,type:m}),l.a.createElement("span",{className:"siemLinkIcon__label"},t))}));o.displayName="LinkIcon"},675:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=(e,t)=>{const n=window.URL.createObjectURL(e),a=document.createElement("a");a.href=n,a.download=t,a.click(),window.URL.revokeObjectURL(n),a.remove()}},676:function(e,t,n){"use strict";n.d(t,"a",(function(){return h}));var a=n(40),i=n(42),l=n(2),r=n.n(l),s=n(41),o=n.n(s),u=n(106),c=n(479),d=n(164),m=n(140),p=n(117),b=n(268),g=n(113);const f=o()(a.EuiFlexItem).withConfig({displayName:"TimelineContentItem",componentId:"sc-t3gz96-0"})(["max-width:calc(100% - 56px);"]),y=o()(a.EuiFilterButton).withConfig({displayName:"StyledEuiFilterButton",componentId:"sc-t3gz96-1"})(["border-top:0;border-bottom:0;"]),v=({hideUntitled:e=!1,getSelectableOptions:t,onClosePopover:n,onTimelineChange:s,timelineType:o,placeholder:v})=>{const[h,E]=Object(l.useState)(50),[S,x]=Object(l.useState)(0),[O,k]=Object(l.useState)(""),[j,T]=Object(l.useState)(!1),{fetchAllTimeline:w,timelines:M,loading:I,totalCount:C}=Object(c.b)(),A=Object(l.useRef)(null),D=Object(l.useRef)(null),N=Object(l.useMemo)((()=>Object(i.debounce)(500,k)),[]),F=Object(l.useCallback)((e=>{N(e)}),[N]),P=Object(l.useCallback)((()=>{T(!j)}),[j]),R=Object(l.useCallback)(((e,t,n)=>{if(e<t&&A.current&&D.current){const e=A.current.clientHeight,t=D.current.clientHeight;n>10&&t-n<1.2*e&&t>S&&(x(t),E(h+50))}}),[S,h]),L=Object(l.useCallback)(((e,t)=>{const n=Object(d.f)({...e,title:e.timelineTitle})?m.ab:e.timelineTitle,l=null!=e.description&&e.description.trim().length>0?e.description:null;return r.a.createElement(a.EuiFlexGroup,{gutterSize:"s",justifyContent:"spaceBetween",alignItems:"center",responsive:!1},r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiIcon,{type:"on"===e.checked?"check":"empty",color:"primary"})),r.a.createElement(f,{grow:!0},r.a.createElement(a.EuiFlexGroup,{gutterSize:"none",direction:"column",responsive:!1},r.a.createElement(a.EuiFlexItem,{"data-test-subj":"timeline"},r.a.createElement(a.EuiToolTip,{content:n,anchorClassName:"eui-textTruncate eui-alignMiddle"},r.a.createElement(a.EuiHighlight,{search:t},n))),r.a.createElement(a.EuiFlexItem,null,r.a.createElement(a.EuiToolTip,{content:l,anchorClassName:"eui-textTruncate eui-alignMiddle"},r.a.createElement(a.EuiTextColor,{color:"subdued",component:"span"},r.a.createElement("small",null,null!=l?l:Object(p.d)())))))),r.a.createElement(a.EuiFlexItem,{grow:!1},r.a.createElement(a.EuiIcon,{type:null!=e.favorite&&Object(i.isEmpty)(e.favorite)?"starEmpty":"starFilled"})))}),[]),B=Object(l.useCallback)((e=>{const t=e.filter((e=>"on"===e.checked));var a;null!=t&&t.length>0&&s(Object(i.isEmpty)(t[0].timelineTitle)?m.ab:t[0].timelineTitle,"-1"===t[0].id?null:t[0].id,null!==(a=t[0].graphEventId)&&void 0!==a?a:""),n()}),[n,s]),_=Object(l.useCallback)(((e,t)=>r.a.createElement(r.a.Fragment,null,t,e)),[]),q=Object(l.useMemo)((()=>({"data-test-subj":"timeline-super-select-search-box",placeholder:null!=v?v:b.e(o),onSearch:F,incremental:!1,append:r.a.createElement(y,{"data-test-subj":"only-favorites-toggle",hasActiveFilters:j,onClick:P},m.D)})),[P,F,j,o,v]),z=Object(l.useMemo)((()=>({rowHeight:50,showIcons:!1,windowProps:{onScroll:({scrollOffset:t})=>R((null!=M?M:[]).filter((t=>!e||""!==t.title)).length,C,t),outerRef:A,innerRef:D}})),[R,e,C,M]);return Object(l.useEffect)((()=>{w({pageInfo:{pageIndex:1,pageSize:h},search:O,sort:{sortField:u.f.updated,sortOrder:g.b.desc},onlyUserFavorite:j,status:null,timelineType:o})}),[w,j,h,O,o]),r.a.createElement(a.EuiSelectable,{"data-test-subj":"selectable-input",height:260,isLoading:I&&null==M,listProps:z,renderOption:L,onChange:B,searchable:!0,searchProps:q,singleSelection:!0,options:(V=t({timelines:null!=M?M:[],onlyFavorites:j,searchTimelineValue:O,timelineType:o}),V.map((({title:e,...t})=>({...t,title:void 0,timelineTitle:e}))))},_);var V},h=Object(l.memo)(v)},677:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=n(5).i18n.translate("xpack.securitySolution.alertsView.osqueryAlertTitle",{defaultMessage:"Run Osquery"})},678:function(e,t,n){const a=n(292);e.exports=(e,t)=>{const n=a(e,t);return n?n.version:null}},679:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(2),i=n.n(a),l=n(41);const r=n.n(l).a.div.withConfig({displayName:"Wrapper",componentId:"sc-4ssvqk-0"})(["",""],(({theme:e})=>Object(l.css)([".siemSubtitle__item{color:",";font-size:",";line-height:",";@media only screen and (min-width:","){display:inline-block;margin-right:",";&:last-child{margin-right:0;}}}"],e.eui.euiTextSubduedColor,e.eui.euiFontSizeXS,e.eui.euiLineHeight,e.eui.euiBreakpoints.s,e.eui.euiSize)));r.displayName="Wrapper";const s=i.a.memo((({children:e,dataTestSubj:t="header-panel-subtitle"})=>"string"==typeof e?i.a.createElement("p",{className:"siemSubtitle__item siemSubtitle__item--text","data-test-subj":t},e):i.a.createElement("div",{className:"siemSubtitle__item siemSubtitle__item--node","data-test-subj":t},e)));s.displayName="SubtitleItem";const o=i.a.memo((({items:e})=>i.a.createElement(r,{className:"siemSubtitle"},Array.isArray(e)?e.map(((e,t)=>i.a.createElement(s,{key:t},e))):i.a.createElement(s,null,e))));o.displayName="Subtitle"},680:function(e,t,n){"use strict";n.d(t,"a",(function(){return r}));var a=n(2),i=n(4),l=n(102);const r=({defaultValue:e,key:t,plugin:n=i.i,isInvalidDefault:r})=>{const{storage:s}=Object(l.j)().services,[o,u]=Object(a.useState)(!1),[c,d]=Object(a.useState)(e),m=Object(a.useCallback)((()=>{const a=s.get(`${n}.${t}`),i=typeof a!=typeof e,l=null!=r&&r(a);d(i||l?e:a)}),[e,r,t,n,s]),p=Object(a.useCallback)((e=>{if("function"==typeof e){const a=e;d((e=>{const i=a(e);return s.set(`${n}.${t}`,i),i}))}else s.set(`${n}.${t}`,e),d(e)}),[t,n,s]);return Object(a.useEffect)((()=>{o||(m(),u(!0))}),[o,m]),[c,p,u]}},681:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"d",(function(){return l})),n.d(t,"a",(function(){return r})),n.d(t,"b",(function(){return s}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.eventsViewer.showingLabel",{defaultMessage:"Showing"}),l=(a.i18n.translate("xpack.securitySolution.eventsViewer.eventsLabel",{defaultMessage:"Events"}),e=>a.i18n.translate("xpack.securitySolution.eventsViewer.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {event} other {events}}"})),r=a.i18n.translate("xpack.securitySolution.eventsViewer.actionsColumnLabel",{defaultMessage:"Actions"}),s=a.i18n.translate("xpack.securitySolution.eventsViewer.timelineEvents.errorSearchDescription",{defaultMessage:"An error has occurred on timeline events search"})},682:function(e,t,n){"use strict";n.d(t,"c",(function(){return i})),n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return r}));var a=n(5);const i=e=>a.i18n.translate("xpack.securitySolution.configurations.suppressedAlerts",{defaultMessage:"Alert has {numAlertsSuppressed} suppressed alerts",values:{numAlertsSuppressed:e}}),l=180,r=190},699:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var a=n(40),i=n(2),l=n.n(i);const r=n(5).i18n.translate("xpack.securitySolution.accessibility.tooltipWithKeyboardShortcut.pressTooltipLabel",{defaultMessage:"Press"}),s=({additionalScreenReaderOnlyContext:e="",content:t,shortcut:n,showShortcut:i})=>l.a.createElement(l.a.Fragment,null,l.a.createElement("div",{"data-test-subj":"content"},t),""!==e&&l.a.createElement(a.EuiScreenReaderOnly,{"data-test-subj":"additionalScreenReaderOnlyContext"},l.a.createElement("p",null,e)),i&&l.a.createElement(a.EuiText,{color:"subdued","data-test-subj":"shortcut",size:"s",textAlign:"center"},l.a.createElement("span",null,r)," ",l.a.createElement(a.EuiBadge,{color:"hollow"},n))),o=l.a.memo(s);o.displayName="TooltipWithKeyboardShortcut"},701:function(e,t,n){"use strict";n.d(t,"a",(function(){return m})),n.d(t,"b",(function(){return g}));var a=n(40),i=n(2),l=n.n(i),r=n(140);const s=l.a.memo((({onClick:e})=>l.a.createElement(a.EuiButtonEmpty,{color:"text","data-test-subj":"open-timeline-button",iconSide:"left",iconType:"folderOpen",onClick:e},r.G)));s.displayName="OpenTimelineModalButton";var o=n(671),u=n(248),c=n(412),d=n(912);const m="add-timeline-button",p=["createFrom"],b=({timelineId:e})=>{const[t,n]=Object(i.useState)(!1),[r,b]=Object(i.useState)(!1),g=Object(i.useCallback)((()=>n(!t)),[t]),f=Object(i.useCallback)((()=>n(!1)),[]),y=Object(i.useCallback)((()=>b(!1)),[]),v=Object(i.useCallback)((()=>{f(),b(!0)}),[f]),h=Object(i.useMemo)((()=>l.a.createElement(a.EuiButtonIcon,{className:m,"data-test-subj":"settings-plus-in-circle",iconType:"plusInCircle",color:"primary",size:"m",onClick:g,"aria-label":u.a})),[g]);return l.a.createElement(l.a.Fragment,null,l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiPopover,{anchorPosition:"downRight",button:h,id:"timelineSettingsPopover",panelProps:{"data-test-subj":"timeline-addPopupPanel"},isOpen:t,closePopover:f,ownFocus:!0,repositionOnScroll:!0},l.a.createElement(a.EuiFlexGroup,{alignItems:"flexStart",direction:"column",gutterSize:"none"},l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(c.c,{timelineId:e,title:u.h,closeGearMenu:f})),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(d.a,{closeGearMenu:f,timelineId:e,title:u.g})),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(s,{onClick:v}))))),r?l.a.createElement(o.a,{onClose:y,hideActions:p}):null)},g=l.a.memo(b)},715:function(e,t,n){e.exports=n(33)(811)},716:function(e,t,n){e.exports=n(33)(1608)},717:function(e,t,n){e.exports=n(33)(3344)},718:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return g}));var a=n(40),i=n(50),l=n.n(i),r=n(2),s=n.n(r),o=n(41),u=n.n(o),c=n(47),d=n(551),m=n(168);d.f;const p=u.a.h3.withConfig({displayName:"TitleText",componentId:"sc-7x1zh4-0"})(["margin:0 5px;cursor:default;user-select:none;"]);p.displayName="TitleText",s.a.memo((({noteIds:e})=>s.a.createElement(a.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},s.a.createElement(a.EuiFlexItem,{grow:!1},s.a.createElement(a.EuiIcon,{color:"text",size:"l",type:"editorComment"})),s.a.createElement(a.EuiFlexItem,{grow:!1},s.a.createElement(a.EuiTitle,{size:"s"},s.a.createElement(p,null,d.e))),s.a.createElement(a.EuiFlexItem,{grow:!1},s.a.createElement(m.c,{color:"hollow"},e.length))))).displayName="NotesCount";const b=({newNote:e,user:t})=>({created:l.a.utc().toDate(),id:Object(c.v4)(),lastEdit:null,note:e,saveObjectId:null,user:t,version:null}),g=({associateNote:e,newNote:t,updateNewNote:n,updateNote:a,user:i})=>{const l=b({newNote:t,user:i});a(l),e(l.id),n("")}},721:function(e,t,n){"use strict";n.d(t,"d",(function(){return i})),n.d(t,"a",(function(){return l})),n.d(t,"f",(function(){return r})),n.d(t,"e",(function(){return s})),n.d(t,"c",(function(){return o})),n.d(t,"b",(function(){return u}));var a=n(5);const i="timeline",l=a.i18n.translate("xpack.securitySolution.actions.cellValue.addToTimeline.displayName",{defaultMessage:"Add to timeline"}),r=a.i18n.translate("xpack.securitySolution.actions.cellValue.addToNewTimeline.displayName",{defaultMessage:"Investigate in timeline"}),s=e=>a.i18n.translate("xpack.securitySolution.actions.addToTimeline.addedFieldMessage",{values:{fieldOrValue:e},defaultMessage:"Added {fieldOrValue} to timeline"}),o=a.i18n.translate("xpack.securitySolution.actions.cellValue.addToTimeline.warningTitle",{defaultMessage:"Unable to add to timeline"}),u=a.i18n.translate("xpack.securitySolution.actions.cellValue.addToTimeline.warningMessage",{defaultMessage:"Filter received is empty or cannot be added to timeline"})},722:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"b",(function(){return m}));var a=n(40),i=n(2),l=n.n(i),r=n(41),s=n.n(r),o=n(497);const u="exit-full-screen",c=s()(a.EuiButton).withConfig({displayName:"StyledEuiButton",componentId:"sc-ve6et8-0"})(["margin:",";"],(({theme:e})=>e.eui.euiSizeS)),d=({fullScreen:e,setFullScreen:t})=>{const n=Object(i.useCallback)((()=>{t(!1)}),[t]),r=Object(i.useCallback)((e=>{"Escape"===e.key&&(e.preventDefault(),n())}),[n]);return e?l.a.createElement(l.a.Fragment,null,l.a.createElement(a.EuiWindowEvent,{event:"keydown",handler:r}),l.a.createElement(c,{className:u,"data-test-subj":"exit-full-screen",fullWidth:!1,iconType:"fullScreen",isDisabled:!e,onClick:n},o.a)):null};d.displayName="ExitFullScreenComponent";const m=l.a.memo(d)},723:function(e,t,n){"use strict";n.d(t,"a",(function(){return d}));var a=n(40),i=n(2),l=n.n(i),r=n(41),s=n.n(r),o=n(294);const u=s.a.div.withConfig({displayName:"PlaceHolder",componentId:"sc-pcodem-0"})(["padding:",";"],(e=>e.theme.eui.euiSizeS)),c=({count:e,onClick:t})=>{const n=Object(i.useCallback)((()=>t&&t()),[t]);return e?t?l.a.createElement(a.EuiLink,{onClick:n},l.a.createElement("b",null,l.a.createElement(o.a,{count:e}))):l.a.createElement("b",null,l.a.createElement(o.a,{count:e})):l.a.createElement(u,null)};c.displayName="ChartLabelComponent";const d=l.a.memo(c)},724:function(e,t,n){"use strict";n.d(t,"b",(function(){return y})),n.d(t,"a",(function(){return v}));var a=n(40),i=n(2),l=n.n(i),r=n(57),s=n(8),o=n(41),u=n.n(o),c=n(297),d=n(424),m=n(725);const p={chartMargins:{top:0,bottom:0,left:0,right:0},partition:{idealFontSizeJump:1.1,outerSizeRatio:1,emptySizeRatio:.8,circlePadding:4}},b=u()(a.EuiFlexGroup).withConfig({displayName:"DonutTextWrapper",componentId:"sc-g5h38u-0"})(["top:",";width:100%;max-width:77px;position:absolute;z-index:1;",""],(({$isChartEmbeddablesEnabled:e,$dataExists:t})=>e&&!t?"66%":"34%;"),(({className:e,$donutTextWrapperStyles:t})=>e&&t?`&.${e} {${t}}`:"")),g=u()(a.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItem",componentId:"sc-g5h38u-1"})(["position:relative;align-items:center;"]),f=({children:e,dataExists:t,donutTextWrapperClassName:n,donutTextWrapperStyles:r,isChartEmbeddablesEnabled:s,label:o,title:u})=>{const{euiTheme:c}=Object(a.useEuiTheme)(),d=Object(i.useMemo)((()=>({color:c.colors.disabled})),[c.colors.disabled]),m=s?void 0:"eui-textTruncate";return l.a.createElement(a.EuiFlexGroup,{alignItems:"center",justifyContent:"center",responsive:!1,gutterSize:"l","data-test-subj":"donut-chart"},l.a.createElement(g,{grow:s},l.a.createElement(b,{$dataExists:t,$donutTextWrapperStyles:r,$isChartEmbeddablesEnabled:s,alignItems:"center",className:n,direction:"column",gutterSize:"none",justifyContent:"center"},l.a.createElement(a.EuiFlexItem,null,u),o&&l.a.createElement(a.EuiFlexItem,{className:m},l.a.createElement(a.EuiToolTip,{content:o},l.a.createElement(a.EuiText,{className:m,size:"s",style:t?void 0:d},o)))),e))},y=l.a.memo(f),v=({data:e,fillColor:t,height:n=90,label:o,legendItems:u,onPartitionClick:b,title:g,totalCount:f})=>{const{baseTheme:v,theme:h}=Object(c.i)(),E=Object(i.useCallback)((e=>{if(b){var t;const n=e.flat(2),a=n.length>0&&"groupByRollup"in n[0]&&null!=(null===(t=n[0])||void 0===t?void 0:t.groupByRollup)?`${n[0].groupByRollup}`:"";Object(s.isEmpty)(a.trim())||b(a.toLowerCase())}}),[b]);return l.a.createElement(y,{dataExists:null!=e&&e.length>0,label:o,title:g,isChartEmbeddablesEnabled:!1},l.a.createElement(l.a.Fragment,null,null==e||null==f||0===f?l.a.createElement(m.a,{size:n}):l.a.createElement(r.Chart,{size:n},l.a.createElement(r.Settings,{theme:[p,h],baseTheme:v,onElementClick:E}),l.a.createElement(r.Partition,{id:"donut-chart",data:e,layout:r.PartitionLayout.sunburst,valueAccessor:e=>e.value,valueFormatter:e=>`${Object(r.defaultPartitionValueFormatter)(e)}`,layers:[{groupByRollup:e=>{var t;return null!==(t=e.label)&&void 0!==t?t:e.key},nodeLabel:e=>e,shape:{fillColor:t}}]})),u&&(null==u?void 0:u.length)>0&&l.a.createElement(a.EuiFlexItem,null,l.a.createElement(d.a,{legendItems:u,height:n}))))}},725:function(e,t,n){"use strict";n.d(t,"b",(function(){return o})),n.d(t,"a",(function(){return m}));var a=n(2),i=n.n(a),l=n(41),r=n.n(l),s=n(40);const o="#FAFBFD",u=r.a.div.withConfig({displayName:"BigRing",componentId:"sc-1m6sj8k-0"})(["border-radius:50%;",""],(({size:e})=>`height: ${e}px;\n    width: ${e}px;\n    background-color: ${o};\n    text-align: center;\n    line-height: ${e}px;`)),c=r.a.div.withConfig({displayName:"SmallRing",componentId:"sc-1m6sj8k-1"})(["border-radius:50%;",""],(({size:e})=>`\n    height: ${e}px;\n    width: ${e}px;\n    background-color: ${Object(s.useEuiBackgroundColor)("plain")};\n    display: inline-block;\n    vertical-align: middle;`)),d=({size:e=90,donutWidth:t=20})=>e-t>0?i.a.createElement(u,{size:e,"data-test-subj":"empty-donut"},i.a.createElement(c,{size:e-t,"data-test-subj":"empty-donut-small"})):null,m=i.a.memo(d)},726:function(e,t,n){"use strict";n.d(t,"a",(function(){return L}));var a=n(104),i=n.n(a),l=n(40),r=n(2),s=n.n(r),o=n(57),u=n(42),c=n(343),d=n.n(c),m=n(47),p=n(41),b=n.n(p),g=n(130),f=n.n(g),y=n(153),v=n(102),h=n(456),E=n(293),S=n(228),x=n(327),O=n(917),k=n(297),j=n(424),T=n(390),w=n(311),M=n(211);const I=b()(l.EuiFlexItem).withConfig({displayName:"LegendFlexItem",componentId:"sc-1257qcd-0"})(["overview:hidden;"]),C=e=>null!=e&&!!Object(u.get)("value.length",e)&&(e.value||[]).every((({x:e,y:t})=>Object(u.isNumber)(t)&&t>=0)),A=["y"],D=[e=>Object(S.a)(e.g)?e.g:x.c],N=({data:e,forceHiddenLegend:t=!1,yAxisTitle:n,...a})=>{const l=Object(k.i)(),c=Object(v.m)(),m=Object(u.get)("configs.axis.xTickFormatter",a),p=Object(u.get)("configs.axis.yTickFormatter",a),b=Object(u.getOr)(0,"configs.axis.tickSize",a),g=`stat-items-barchart-${e[0].key}-x`,f=`stat-items-barchart-${e[0].key}-y`,y={...k.e,...d()(Object(u.get)("configs.settings",a),l)},h=Object(r.useMemo)((()=>d()({tickLine:{size:b}},Object(u.getOr)({},"configs.axis.bottom.style",a))),[a,b]),E=Object(r.useMemo)((()=>d()({tickLine:{size:b}},Object(u.getOr)({},"configs.axis.left.style",a))),[a,b]),S=Object(u.get)("configs.axis.bottom.labelFormat",a);return a.width&&a.height?s.a.createElement(o.Chart,null,s.a.createElement(o.Settings,i()({},y,{showLegend:y.showLegend&&!t})),e.map((e=>{var t;const n=e.key;return C(e)?s.a.createElement(o.BarSeries,{id:n,key:n,name:e.key,xScaleType:Object(u.getOr)(o.ScaleType.Linear,"configs.series.xScaleType",a),yScaleType:Object(u.getOr)(o.ScaleType.Linear,"configs.series.yScaleType",a),xAccessor:"x",yAccessors:A,timeZone:c,splitSeriesAccessors:D,data:null!==(t=e.value)&&void 0!==t?t:[],stackAccessors:Object(u.get)("configs.series.stackAccessors",a),color:e.color?e.color:void 0,barSeriesStyle:Object(u.get)("configs.series.barSeriesStyle",a)}):null})),s.a.createElement(o.Axis,{id:g,position:o.Position.Bottom,showOverlappingTicks:!1,style:h,tickFormat:m,labelFormat:S}),s.a.createElement(o.Axis,{id:f,position:o.Position.Left,style:E,tickFormat:p,title:n})):null};N.displayName="BarChartBaseComponent";const F=s.a.memo(N);F.displayName="BarChartBase";const P=[],R=({barChart:e,configs:t,stackByField:n,scopeId:a,visualizationActionsOptions:o})=>{const{ref:c,width:d,height:p}=Object(E.b)(),b=Object(r.useMemo)((()=>null!=e&&null!=n?e.map(((e,t)=>{var i;return{color:null!==(i=e.color)&&void 0!==i?i:t<h.a.length?h.a[t]:void 0,dataProviderId:Object(y.i)(`draggable-legend-item-${Object(m.v4)()}-${n}-${e.key}`),scopeId:a,field:n,value:e.key}})):P),[e,n,a]),g=Object(u.get)("yAxisTitle",t),f=Object(u.get)("customHeight",t),v=Object(u.get)("customWidth",t),S=Object(k.g)(f,p),x=Object(k.h)(v,d),A=Object(r.useMemo)((()=>{return t=e,Array.isArray(t)&&!Object(k.f)(t)&&t.some(C);var t}),[e]);return s.a.createElement(k.d,null,s.a.createElement(w.a,{targetClassNames:[M.a]},A&&e&&s.a.createElement(k.a,{gutterSize:"none"},s.a.createElement(l.EuiFlexItem,{grow:!0},s.a.createElement(k.c,{ref:c,height:S},s.a.createElement(F,{configs:t,data:e,yAxisTitle:g,forceHiddenLegend:null!=n,height:S,width:S}))),s.a.createElement(I,{grow:!1},s.a.createElement(j.a,{legendItems:b,height:p}))),!A&&s.a.createElement(O.a,{height:S,width:x,data:e}),null!=o&&s.a.createElement(T.a,i()({},o,{className:"viz-actions"}))))},L=s.a.memo(R,((e,t)=>e.stackByField===t.stackByField&&e.scopeId===t.scopeId&&f()(e.configs,t.configs)&&f()(e.barChart,t.barChart)))},795:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));const a=n(5).i18n.translate("securitySolutionPackages.ecsDataQualityDashboard.incompatibleTab.dataQualityDashboardConversationId",{defaultMessage:"Data Quality dashboard"})},796:function(e,t,n){!function(e){"use strict";var t,n=[],a="ResizeObserver loop completed with undelivered notifications.";!function(e){e.BORDER_BOX="border-box",e.CONTENT_BOX="content-box",e.DEVICE_PIXEL_CONTENT_BOX="device-pixel-content-box"}(t||(t={}));var i,l=function(e){return Object.freeze(e)},r=function(e,t){this.inlineSize=e,this.blockSize=t,l(this)},s=function(){function e(e,t,n,a){return this.x=e,this.y=t,this.width=n,this.height=a,this.top=this.y,this.left=this.x,this.bottom=this.top+this.height,this.right=this.left+this.width,l(this)}return e.prototype.toJSON=function(){var e=this;return{x:e.x,y:e.y,top:e.top,right:e.right,bottom:e.bottom,left:e.left,width:e.width,height:e.height}},e.fromRect=function(t){return new e(t.x,t.y,t.width,t.height)},e}(),o=function(e){return e instanceof SVGElement&&"getBBox"in e},u=function(e){if(o(e)){var t=e.getBBox(),n=t.width,a=t.height;return!n&&!a}var i=e,l=i.offsetWidth,r=i.offsetHeight;return!(l||r||e.getClientRects().length)},c=function(e){var t;if(e instanceof Element)return!0;var n=null===(t=null==e?void 0:e.ownerDocument)||void 0===t?void 0:t.defaultView;return!!(n&&e instanceof n.Element)},d="undefined"!=typeof window?window:{},m=new WeakMap,p=/auto|scroll/,b=/^tb|vertical/,g=/msie|trident/i.test(d.navigator&&d.navigator.userAgent),f=function(e){return parseFloat(e||"0")},y=function(e,t,n){return void 0===e&&(e=0),void 0===t&&(t=0),void 0===n&&(n=!1),new r((n?t:e)||0,(n?e:t)||0)},v=l({devicePixelContentBoxSize:y(),borderBoxSize:y(),contentBoxSize:y(),contentRect:new s(0,0,0,0)}),h=function(e,t){if(void 0===t&&(t=!1),m.has(e)&&!t)return m.get(e);if(u(e))return m.set(e,v),v;var n=getComputedStyle(e),a=o(e)&&e.ownerSVGElement&&e.getBBox(),i=!g&&"border-box"===n.boxSizing,r=b.test(n.writingMode||""),c=!a&&p.test(n.overflowY||""),d=!a&&p.test(n.overflowX||""),h=a?0:f(n.paddingTop),E=a?0:f(n.paddingRight),S=a?0:f(n.paddingBottom),x=a?0:f(n.paddingLeft),O=a?0:f(n.borderTopWidth),k=a?0:f(n.borderRightWidth),j=a?0:f(n.borderBottomWidth),T=x+E,w=h+S,M=(a?0:f(n.borderLeftWidth))+k,I=O+j,C=d?e.offsetHeight-I-e.clientHeight:0,A=c?e.offsetWidth-M-e.clientWidth:0,D=i?T+M:0,N=i?w+I:0,F=a?a.width:f(n.width)-D-A,P=a?a.height:f(n.height)-N-C,R=F+T+A+M,L=P+w+C+I,B=l({devicePixelContentBoxSize:y(Math.round(F*devicePixelRatio),Math.round(P*devicePixelRatio),r),borderBoxSize:y(R,L,r),contentBoxSize:y(F,P,r),contentRect:new s(x,h,F,P)});return m.set(e,B),B},E=function(e,n,a){var i=h(e,a),l=i.borderBoxSize,r=i.contentBoxSize,s=i.devicePixelContentBoxSize;switch(n){case t.DEVICE_PIXEL_CONTENT_BOX:return s;case t.BORDER_BOX:return l;default:return r}},S=function(e){var t=h(e);this.target=e,this.contentRect=t.contentRect,this.borderBoxSize=l([t.borderBoxSize]),this.contentBoxSize=l([t.contentBoxSize]),this.devicePixelContentBoxSize=l([t.devicePixelContentBoxSize])},x=function(e){if(u(e))return 1/0;for(var t=0,n=e.parentNode;n;)t+=1,n=n.parentNode;return t},O=function(){var e=1/0,t=[];n.forEach((function(n){if(0!==n.activeTargets.length){var a=[];n.activeTargets.forEach((function(t){var n=new S(t.target),i=x(t.target);a.push(n),t.lastReportedSize=E(t.target,t.observedBox),i<e&&(e=i)})),t.push((function(){n.callback.call(n.observer,a,n.observer)})),n.activeTargets.splice(0,n.activeTargets.length)}}));for(var a=0,i=t;a<i.length;a++)(0,i[a])();return e},k=function(e){n.forEach((function(t){t.activeTargets.splice(0,t.activeTargets.length),t.skippedTargets.splice(0,t.skippedTargets.length),t.observationTargets.forEach((function(n){n.isActive()&&(x(n.target)>e?t.activeTargets.push(n):t.skippedTargets.push(n))}))}))},j=function(){var e,t=0;for(k(t);n.some((function(e){return e.activeTargets.length>0}));)t=O(),k(t);return n.some((function(e){return e.skippedTargets.length>0}))&&("function"==typeof ErrorEvent?e=new ErrorEvent("error",{message:a}):((e=document.createEvent("Event")).initEvent("error",!1,!1),e.message=a),window.dispatchEvent(e)),t>0},T=[],w=function(e){if(!i){var t=0,n=document.createTextNode("");new MutationObserver((function(){return T.splice(0).forEach((function(e){return e()}))})).observe(n,{characterData:!0}),i=function(){n.textContent="".concat(t?t--:t++)}}T.push(e),i()},M=0,I={attributes:!0,characterData:!0,childList:!0,subtree:!0},C=["resize","load","transitionend","animationend","animationstart","animationiteration","keyup","keydown","mouseup","mousedown","mouseover","mouseout","blur","focus"],A=function(e){return void 0===e&&(e=0),Date.now()+e},D=!1,N=new(function(){function e(){var e=this;this.stopped=!0,this.listener=function(){return e.schedule()}}return e.prototype.run=function(e){var t,n=this;if(void 0===e&&(e=250),!D){D=!0;var a=A(e);t=function(){var t=!1;try{t=j()}finally{if(D=!1,e=a-A(),!M)return;t?n.run(1e3):e>0?n.run(e):n.start()}},w((function(){requestAnimationFrame(t)}))}},e.prototype.schedule=function(){this.stop(),this.run()},e.prototype.observe=function(){var e=this,t=function(){return e.observer&&e.observer.observe(document.body,I)};document.body?t():d.addEventListener("DOMContentLoaded",t)},e.prototype.start=function(){var e=this;this.stopped&&(this.stopped=!1,this.observer=new MutationObserver(this.listener),this.observe(),C.forEach((function(t){return d.addEventListener(t,e.listener,!0)})))},e.prototype.stop=function(){var e=this;this.stopped||(this.observer&&this.observer.disconnect(),C.forEach((function(t){return d.removeEventListener(t,e.listener,!0)})),this.stopped=!0)},e}()),F=function(e){!M&&e>0&&N.start(),!(M+=e)&&N.stop()},P=function(){function e(e,n){this.target=e,this.observedBox=n||t.CONTENT_BOX,this.lastReportedSize={inlineSize:0,blockSize:0}}return e.prototype.isActive=function(){var e,t=E(this.target,this.observedBox,!0);return e=this.target,!o(e)&&!function(e){switch(e.tagName){case"INPUT":if("image"!==e.type)break;case"VIDEO":case"AUDIO":case"EMBED":case"OBJECT":case"CANVAS":case"IFRAME":case"IMG":return!0}return!1}(e)&&"inline"===getComputedStyle(e).display&&(this.lastReportedSize=t),this.lastReportedSize.inlineSize!==t.inlineSize||this.lastReportedSize.blockSize!==t.blockSize},e}(),R=function(e,t){this.activeTargets=[],this.skippedTargets=[],this.observationTargets=[],this.observer=e,this.callback=t},L=new WeakMap,B=function(e,t){for(var n=0;n<e.length;n+=1)if(e[n].target===t)return n;return-1},_=function(){function e(){}return e.connect=function(e,t){var n=new R(e,t);L.set(e,n)},e.observe=function(e,t,a){var i=L.get(e),l=0===i.observationTargets.length;B(i.observationTargets,t)<0&&(l&&n.push(i),i.observationTargets.push(new P(t,a&&a.box)),F(1),N.schedule())},e.unobserve=function(e,t){var a=L.get(e),i=B(a.observationTargets,t),l=1===a.observationTargets.length;i>=0&&(l&&n.splice(n.indexOf(a),1),a.observationTargets.splice(i,1),F(-1))},e.disconnect=function(e){var t=this,n=L.get(e);n.observationTargets.slice().forEach((function(n){return t.unobserve(e,n.target)})),n.activeTargets.splice(0,n.activeTargets.length)},e}(),q=function(){function e(e){if(0===arguments.length)throw new TypeError("Failed to construct 'ResizeObserver': 1 argument required, but only 0 present.");if("function"!=typeof e)throw new TypeError("Failed to construct 'ResizeObserver': The callback provided as parameter 1 is not a function.");_.connect(this,e)}return e.prototype.observe=function(e,t){if(0===arguments.length)throw new TypeError("Failed to execute 'observe' on 'ResizeObserver': 1 argument required, but only 0 present.");if(!c(e))throw new TypeError("Failed to execute 'observe' on 'ResizeObserver': parameter 1 is not of type 'Element");_.observe(this,e,t)},e.prototype.unobserve=function(e){if(0===arguments.length)throw new TypeError("Failed to execute 'unobserve' on 'ResizeObserver': 1 argument required, but only 0 present.");if(!c(e))throw new TypeError("Failed to execute 'unobserve' on 'ResizeObserver': parameter 1 is not of type 'Element");_.unobserve(this,e)},e.prototype.disconnect=function(){_.disconnect(this)},e.toString=function(){return"function ResizeObserver () { [polyfill code] }"},e}();e.ResizeObserver=q,e.ResizeObserverEntry=S,e.ResizeObserverSize=r,Object.defineProperty(e,"__esModule",{value:!0})}(t)},899:function(e,t,n){"use strict";n.d(t,"b",(function(){return D})),n.d(t,"a",(function(){return B}));var a=n(42),i=n(40),l=n(44),r=n(2),s=n.n(r),o=n(41),u=n.n(o),c=n(103),d=n(46),m=n(117),p=n(383),b=n(111),g=n(179),f=n(346),y=n(5);const v=y.i18n.translate("xpack.securitySolution.timeline.toggleEventDetailsTitle",{defaultMessage:"Expand event details"}),h=y.i18n.translate("xpack.securitySolution.timeline.addedANoteLabel",{defaultMessage:"added a note"}),E=y.i18n.translate("xpack.securitySolution.timeline.addedADescriptionLabel",{defaultMessage:"added description"}),S=y.i18n.translate("xpack.securitySolution.timeline.anUnknownUserLabel",{defaultMessage:"an unknown user"}),x=y.i18n.translate("xpack.securitySolution.timeline.deleteNoteLabel",{defaultMessage:"Delete Note"}),O=y.i18n.translate("xpack.securitySolution.timeline.cancelDeleteNoteLabel",{defaultMessage:"Keep Note"}),k=y.i18n.translate("xpack.securitySolution.timeline.promptDeleteNoteLabel",{defaultMessage:"Delete timeline note?"});var j=n(118),T=n(105),w=n(657),M=n(110),I=n(116),C=n(102),A=n(108);const D=u.a.section.withConfig({displayName:"NotePreviewsContainer",componentId:"sc-16ieedj-0"})(["padding-top:",";"],(({theme:e})=>`${e.eui.euiSizeS}`));D.displayName="NotePreviewsContainer";const N=({eventId:e,timelineId:t})=>{const n=Object(c.useDispatch)(),{selectedPatterns:a}=Object(I.d)(M.SourcererScopeName.timeline),l=Object(r.useCallback)((()=>{n(b.a.toggleDetailPanel({panelView:"eventDetail",tabType:j.d.notes,id:t,params:{eventId:e,indexName:a.join(",")}}))}),[n,e,a,t]);return s.a.createElement(i.EuiButtonIcon,{title:v,"aria-label":v,color:"text",iconType:"arrowRight",onClick:l})},F=s.a.memo(N),P=s.a.memo((({closeModal:e,confirmModal:t})=>s.a.createElement(i.EuiConfirmModal,{title:k,onCancel:e,onConfirm:t,cancelButtonText:O,confirmButtonText:x,buttonColor:"danger",defaultFocusedButton:"confirm"})));P.displayName="DeleteNoteConfirm";const R=s.a.memo((({noteId:e})=>{const[t,n]=Object(r.useState)(null),{mutate:a,isLoading:l}=function(e){const{services:{http:t}}=Object(C.j)(),n=Object(c.useDispatch)(),{addError:a}=Object(A.a)();return Object(d.useMutation)({mutationFn:e=>t.fetch("/api/note",{method:"DELETE",body:JSON.stringify({noteId:e})}),onSuccess:()=>{e&&n(g.a.deleteNote({id:e}))},onError:e=>{var t;a(e,{title:(t=e,y.i18n.translate("xpack.securitySolution.timeline.deleteNoteError",{defaultMessage:"An error occurred deleting note {error}",values:{error:t}}))})}})}(e),o=Object(r.useCallback)((async()=>{n(e)}),[e]),u=Object(r.useCallback)((()=>{n(null)}),[]),m=Object(r.useCallback)((()=>{a(e),n(null)}),[a,e]),p=Object(r.useMemo)((()=>l||null==e),[l,e]);return s.a.createElement(s.a.Fragment,null,s.a.createElement(i.EuiButtonIcon,{title:x,"aria-label":x,"data-test-subj":"delete-note",color:"text",iconType:"trash",onClick:o,disabled:p}),null!=t&&s.a.createElement(P,{closeModal:u,confirmModal:m}))}));R.displayName="DeleteNoteButton";const L=s.a.memo((({eventId:e,timelineId:t,noteId:n})=>e&&t?s.a.createElement(s.a.Fragment,null,s.a.createElement(F,{eventId:e,timelineId:t}),s.a.createElement(R,{noteId:n})):s.a.createElement(R,{noteId:n})));L.displayName="NoteActions";const B=s.a.memo((({eventIdToNoteIds:e,notes:t,timelineId:n,showTimelineDescription:o})=>{const u=Object(r.useMemo)((()=>b.b.getTimelineByIdSelector()),[]),c=Object(T.a)((e=>n?u(e,n):null)),d=Object(r.useMemo)((()=>o&&n&&null!=c&&c.description?[{username:Object(m.a)(c.updatedBy),event:E,"data-test-subj":"note-preview-description",id:"note-preview-description",timestamp:c.updated?s.a.createElement(l.FormattedRelative,{"data-test-subj":"updated",value:new Date(c.updated)}):Object(m.e)(),children:s.a.createElement(i.EuiText,{size:"s"},c.description),timelineAvatar:s.a.createElement(i.EuiAvatar,{"data-test-subj":"avatar",name:null!=c.updatedBy?c.updatedBy:"?",size:"l"}),actions:s.a.createElement(w.a,{timelineId:n,initialFocus:"description"})}]:[]),[c,n,o]),g=Object(r.useMemo)((()=>Object(a.uniqBy)("savedObjectId",t).map((t=>{var a,r,o;const u=null!=e?Object.entries(e).reduce(((e,[n,a])=>{var i;return a.includes(null!==(i=t.noteId)&&void 0!==i?i:"")?n:e}),null):null!==(a=t.eventId)&&void 0!==a?a:null;return{"data-test-subj":`note-preview-${t.savedObjectId}`,username:Object(m.a)(t.updatedBy),event:h,timestamp:t.updated?s.a.createElement(l.FormattedRelative,{"data-test-subj":"updated",value:new Date(t.updated)}):Object(m.e)(),children:s.a.createElement("div",{className:f.a,tabIndex:0},s.a.createElement(i.EuiScreenReaderOnly,{"data-test-subj":"screenReaderOnlyUserAddedANote"},s.a.createElement("p",null,`${null!==(r=t.updatedBy)&&void 0!==r?r:S} ${h}`)),s.a.createElement(p.b,null,null!==(o=t.note)&&void 0!==o?o:"")),actions:s.a.createElement(L,{eventId:u,timelineId:n,noteId:t.savedObjectId}),timelineAvatar:s.a.createElement(i.EuiAvatar,{"data-test-subj":"avatar",name:null!=t.updatedBy?t.updatedBy:"?",size:"l"})}}))),[e,t,n]);return s.a.createElement(i.EuiCommentList,{"data-test-subj":"note-comment-list",comments:[...d,...g]})}));B.displayName="NotePreviews"},904:function(e,t,n){var a=n(1006),i=n(1010),l=n(614),r=n(258),s=n(1016);e.exports=function(e){return"function"==typeof e?e:null==e?l:"object"==typeof e?r(e)?i(e[0],e[1]):a(e):s(e)}},905:function(e,t,n){e.exports=n(33)(1215)},909:function(e,t,n){"use strict";n.d(t,"a",(function(){return S})),n.d(t,"b",(function(){return x}));var a=n(42),i=n(2),l=n.n(i),r=n(103),s=n(3),o=n(130),u=n.n(o),c=n(49),d=n(114),m=n(116),p=n(110),b=n(161),g=n(495),f=n(673),y=n(148),v=n(111);const h="timeline-filter-drop-area",E=(e=[])=>e.filter((e=>e.meta.controlledBy!==h)),S=Object(i.memo)((({dataProviders:e,filters:t,filterManager:n,filterQuery:a,from:o,fromStr:c,kqlMode:S,isRefreshPaused:O,savedQueryId:k,setFilters:j,setSavedQueryId:T,refreshInterval:w,timelineId:M,to:I,toStr:C,updateReduxTime:A})=>{const D=Object(r.useDispatch)(),[N,F]=Object(i.useState)(null!=c?c:new Date(o).toISOString()),[P,R]=Object(i.useState)(null!=C?C:new Date(I).toISOString()),{browserFields:L,indexPattern:B}=Object(m.d)(p.SourcererScopeName.timeline),[_,q]=Object(i.useState)(void 0),[z,V]=Object(i.useState)({query:null!=a?a.expression:"",language:null!=a?a.kind:"kuery"}),[$,Q]=Object(i.useState)(E(t)),[U,H]=Object(i.useState)(Object(b.f)(Object(y.g)(e,L),B)),G=Object(g.a)(),W=Object(i.useCallback)(((e,t)=>D(v.a.applyKqlFilterQuery({id:M,filterQuery:{kuery:{kind:t,expression:e},serializedQuery:Object(b.f)(e,B)}}))),[D,B,M]);Object(i.useEffect)((()=>{let e=!0;const a=new s.Subscription;return n.setFilters(t),a.add(n.getUpdates$().subscribe({next:()=>{if(e){const e=E(n.getFilters());j(e),Q(e)}}})),()=>{e=!1,a.unsubscribe()}}),[]),Object(i.useEffect)((()=>{const e=E(n.getFilters());u()(t,e)||n.setFilters(t)}),[t]),Object(i.useEffect)((()=>{V({query:null!=a?a.expression:"",language:null!=a?a.kind:"kuery"})}),[a]),Object(i.useEffect)((()=>{H(Object(b.f)(Object(y.g)(e,L),B))}),[e,L,B]),Object(i.useEffect)((()=>{null!=c&&null!=C?(F(c),R(C)):null!=o&&null!=I&&(F(new Date(o).toISOString()),R(new Date(I).toISOString()))}),[o,c,I,C]),Object(i.useEffect)((()=>{let e=!0;return async function(){if(null!=k&&null!=G)try{const n=await G.getSavedQuery(k);e&&null!=n&&q({...n,attributes:{...n.attributes,filters:E(t)}})}catch(e){q(void 0)}else e&&q(void 0)}(),()=>{e=!1}}),[k]);const K=Object(i.useCallback)(((e,t)=>{if((null==a||null!=a&&a.expression!==e.query||a.kind!==e.language)&&W(e.query,e.language),null!=t){const e=t.from.includes("now")||t.to.includes("now");A({id:d.a.timeline,end:t.to,start:t.from,isInvalid:!1,isQuickSelection:e,timelineId:M})}}),[a,M]),Y=Object(i.useCallback)((e=>{if(null!=e){if(e.id!==k&&T(e.id),null!=G&&""!==U){const t=null!=e.attributes.filters?e.attributes.filters.findIndex((e=>e.meta.controlledBy===h)):-1;G.updateQuery(e.id,{...e.attributes,filters:null!=e.attributes.filters?t>-1?[...e.attributes.filters.slice(0,t),x(U),...e.attributes.filters.slice(t+1)]:[...e.attributes.filters,x(U)]:[]})}}else T(null)}),[U,k,G]);return l.a.createElement(f.a,{dateRangeFrom:N,dateRangeTo:P,hideSavedQuery:"search"===S,indexPattern:B,isRefreshPaused:O,filterQuery:z,filterManager:n,filters:$,onSubmitQuery:K,refreshInterval:w,savedQuery:_,onSavedQuery:Y,dataTestSubj:"timelineQueryInput",displayStyle:"inPage"})})),x=e=>{const t=JSON.parse(e),n=Object.keys(t);return{...t,meta:{alias:h,controlledBy:h,negate:!1,disabled:!1,type:"custom",key:Object(a.isEmpty)(n)?"bool":n[0],value:e},$state:{store:c.FilterStateStore.APP_STATE}}}},910:function(e,t,n){"use strict";n.d(t,"a",(function(){return i}));var a=n(5);const i=e=>e?a.i18n.translate("xpack.securitySolution.toggleQuery.on",{defaultMessage:"Open"}):a.i18n.translate("xpack.securitySolution.toggleQuery.off",{defaultMessage:"Closed"})},911:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),l=n(40),r=n(106),s=n(140),o=n(209);const u=({timelineType:e,elasticTemplateTimelineCount:t,customTemplateTimelineCount:n})=>{const[u,c]=Object(a.useState)(null),d=Object(a.useMemo)((()=>e===r.l.template),[e]),m=Object(a.useMemo)((()=>d?u:null),[u,d]),p=Object(a.useMemo)((()=>null==m?null:m===r.g.elastic?r.k.immutable:r.k.active),[m]),b=Object(a.useMemo)((()=>[{id:r.g.elastic,name:s.s,disabled:!d,withNext:!0,count:null!=t?t:void 0},{id:r.g.custom,name:s.r,disabled:!d,withNext:!1,count:null!=n?n:void 0}]),[n,t,d]),g=Object(a.useCallback)((e=>{c(u===e?null:e)}),[c,u]),f=Object(a.useMemo)((()=>d?b.map((e=>i.a.createElement(l.EuiFilterButton,{hasActiveFilters:e.id===m,key:`template-timeline-filter-${e.id}`,numFilters:e.count,onClick:g.bind(null,e.id),withNext:e.withNext,isDisabled:e.disabled,"data-test-subj":e.name},e.name))):null),[m,b,d,g]),y=Object(a.useCallback)((async()=>{m!==r.g.custom&&await Object(o.f)()}),[m]);return{timelineStatus:p,templateTimelineType:m,templateTimelineFilter:f,installPrepackagedTimelines:y}}},912:function(e,t,n){"use strict";n.d(t,"a",(function(){return u}));var a=n(2),i=n.n(a),l=n(118),r=n(106),s=n(242);const o=({closeGearMenu:e,outline:t,title:n,timelineId:a=l.c.active})=>{const{getButton:i}=Object(s.b)({timelineId:a,timelineType:r.l.template,closeGearMenu:e});return i({outline:t,title:n})},u=i.a.memo(o);u.displayName="NewTemplateTimeline"},913:function(e,t,n){"use strict";n.d(t,"a",(function(){return r}));var a=n(2),i=n(606),l=n(102);const r=()=>{const{conversations:e}=Object(i.a)(),{services:{telemetry:t}}=Object(l.j)(),n=Object(a.useCallback)((t=>{var n;return(null!==(n=e[t])&&void 0!==n?n:{isDefault:!1}).isDefault?t:"Custom"}),[e]),r=Object(a.useCallback)((({fn:e,params:{conversationId:t,...a}})=>e({...a,conversationId:n(t)})),[n]);return{reportAssistantInvoked:e=>r({fn:t.reportAssistantInvoked,params:e}),reportAssistantMessageSent:e=>r({fn:t.reportAssistantMessageSent,params:e}),reportAssistantQuickPrompt:e=>r({fn:t.reportAssistantQuickPrompt,params:e})}}},914:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"b",(function(){return l})),n.d(t,"c",(function(){return r})),n.d(t,"d",(function(){return s})),n.d(t,"f",(function(){return o})),n.d(t,"e",(function(){return u}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.assistant.commentActions.addedNoteToTimelineToast",{defaultMessage:"Added note to timeline"}),l=a.i18n.translate("xpack.securitySolution.assistant.commentActions.addMessageContentAsTimelineNoteAriaLabel",{defaultMessage:"Add message content as a timeline note"}),r=a.i18n.translate("xpack.securitySolution.assistant.commentActions.addNoteToTimelineTooltip",{defaultMessage:"Add note to timeline"}),s=a.i18n.translate("xpack.securitySolution.assistant.commentActions.addToCaseExistingCase",{defaultMessage:"Add to existing case"}),o=a.i18n.translate("xpack.securitySolution.assistant.commentActions.elasticAiAssistantTitle",{defaultMessage:"Elastic AI Assistant"}),u=a.i18n.translate("xpack.securitySolution.assistant.commentActions.copyToClipboard",{defaultMessage:"Copy to clipboard"})},915:function(e,t,n){"use strict";n.d(t,"a",(function(){return s})),n.d(t,"g",(function(){return o})),n.d(t,"e",(function(){return u})),n.d(t,"c",(function(){return c})),n.d(t,"b",(function(){return d})),n.d(t,"d",(function(){return m})),n.d(t,"f",(function(){return p}));var a=n(139),i=n(118),l=n(515),r=n(376);const s=()=>Object(a.createSelector)(r.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.activeTab)&&void 0!==t?t:i.d.query})),o=()=>Object(a.createSelector)(r.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.show)&&void 0!==t&&t})),u=()=>Object(a.createSelector)(r.selectTimeline,(e=>{var t;return Object.keys(null!==(t=null==e?void 0:e.pinnedEventIds)&&void 0!==t?t:{}).length})),c=()=>Object(a.createSelector)(r.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.noteIds)&&void 0!==t?t:[]})),d=()=>Object(a.createSelector)(r.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.eventIdToNoteIds)&&void 0!==t?t:{}})),m=()=>Object(a.createSelector)(l.selectNotesById,(e=>Object.values(e))),p=()=>Object(a.createSelector)(r.selectTimeline,(e=>null==e?void 0:e.scrollToTop))},916:function(e,t,n){"use strict";n.d(t,"a",(function(){return I}));var a=n(104),i=n.n(a),l=n(57),r=n(55),s=n.n(r),o=n(2),u=n.n(o),c=n(41),d=n.n(c),m=n(40),p=n(51),b=n(4),g=n(681),f=n(259),y=n(659),v=n(161),h=n(102),E=n(604),S=n(200),x=n(457),O=n(131),k=n(169),j=n(273);const T=e=>({text:e,value:e}),w=d()(m.EuiButton).withConfig({displayName:"StyledLinkButton",componentId:"sc-11itwu1-0"})(["margin-left:0;@media only screen and (min-width:","){margin-left:",";}"],(e=>e.theme.eui.euiBreakpoints.m),(({theme:e})=>e.eui.euiSizeL)),M=({combinedQueries:e,deleteQuery:t,filters:n,from:a,headerChildren:r,indexPattern:c,indexNames:d,runtimeMappings:m,onlyField:M,paddingSize:I,query:C,queryType:A,setAbsoluteRangeDatePickerTarget:D,setQuery:N,showLegend:F,showSpacer:P=!0,scopeId:R,sourcererScopeId:L,to:B,toggleTopN:_,hideQueryToggle:q=!1})=>{const z=Object(o.useMemo)((()=>`eventsByDatasetOverview-${A}`),[A]);Object(o.useEffect)((()=>()=>{t&&t({id:z})}),[t,z]);const V=Object(h.j)(),{formatUrl:$,search:Q}=Object(k.m)(O.a.hosts),{navigateToApp:U}=V.services.application,[H]=Object(h.p)(b.O),G=Object(o.useCallback)((e=>{e.preventDefault(),U(b.l,{deepLinkId:O.a.hosts,path:Object(f.c)(S.HostsTableType.events,Q)})}),[U,Q]),W=Object(o.useMemo)((()=>u.a.createElement(w,{onClick:G,href:$(Object(f.c)(S.HostsTableType.events))},x.n)),[G,$]),[K,Y]=Object(o.useMemo)((()=>null==e?Object(v.i)({config:Object(p.getEsQueryConfig)(V.services.uiSettings),indexPattern:c,queries:[C],filters:n}):[e]),[e,V,c,C,n]);Object(j.a)({id:z,filterQuery:K,kqlError:Y,query:C,startDate:a,endDate:B});const J=Object(o.useMemo)((()=>{var e;return{...E.b,stackByOptions:null!=M?[T(M)]:E.b.stackByOptions,defaultStackByOption:null!=M?T(M):null!==(e=E.c.find((e=>"event.dataset"===e.text)))&&void 0!==e?e:E.c[0],legendPosition:l.Position.Right,subtitle:e=>`${g.c}: ${s()(e).format(H)} ${Object(g.d)(e)}`,titleSize:null==M?"m":"s"}}),[M,H]),X=Object(o.useMemo)((()=>null==M||null!=r?u.a.createElement(u.a.Fragment,null,r,null==M&&W):null),[M,r,W]);return u.a.createElement(y.a,i()({endDate:B,filterQuery:K,headerChildren:X,id:z,indexNames:d,runtimeMappings:m,onError:_,paddingSize:I,setAbsoluteRangeDatePickerTarget:D,setQuery:N,showSpacer:P,showLegend:F,skip:void 0===K,startDate:a,scopeId:R,sourcererScopeId:L},J,{title:null!=M?x.k(M):J.title,chartHeight:160,hideQueryToggle:q}))};M.displayName="EventsByDatasetComponent";const I=u.a.memo(M)},917:function(e,t,n){"use strict";n.d(t,"a",(function(){return d}));var a=n(2),i=n.n(a),l=n(40),r=n(41),s=n.n(r),o=n(297),u=n(327);const c=s()(l.EuiFlexGroup).withConfig({displayName:"FlexGroup",componentId:"sc-1719m3x-0"})(["height:",";width:",";position:relative;margin:0;"],(({height:e})=>e||"100%"),(({width:e})=>e||"100%"));c.displayName="FlexGroup";const d=({height:e="100%",width:t="100%",data:n})=>i.a.createElement(c,{justifyContent:"center",alignItems:"center",height:e,width:t},i.a.createElement(l.EuiFlexItem,{grow:!1},i.a.createElement(l.EuiText,{size:"s",textAlign:"center",color:"subdued","data-test-subj":"chartHolderText"},Object(o.f)(n)?u.a:u.b)))},918:function(e,t,n){"use strict";n.d(t,"f",(function(){return i})),n.d(t,"e",(function(){return l})),n.d(t,"g",(function(){return r})),n.d(t,"a",(function(){return s})),n.d(t,"b",(function(){return o})),n.d(t,"c",(function(){return u})),n.d(t,"h",(function(){return c})),n.d(t,"d",(function(){return d}));var a=n(5);const i=e=>a.i18n.translate("xpack.securitySolution.eventsTab.externalAlertsUnit",{values:{totalCount:e},defaultMessage:"external {totalCount, plural, =1 {alert} other {alerts}}"}),l=e=>a.i18n.translate("xpack.securitySolution.hosts.navigaton.eventsUnit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {event} other {events}}"}),r=a.i18n.translate("xpack.securitySolution.eventsTab.showing",{defaultMessage:"Showing"}),s=a.i18n.translate("xpack.securitySolution.eventsTab.alertsGraphTitle",{defaultMessage:"External alert trend"}),o=a.i18n.translate("xpack.securitySolution.eventsTab.errorFetchingAlertsData",{defaultMessage:"Failed to query alerts data"}),u=a.i18n.translate("xpack.securitySolution.eventsTab.errorFetchingEventsData",{defaultMessage:"Failed to query events data"}),c=a.i18n.translate("xpack.securitySolution.eventsTab.showExternalAlerts",{defaultMessage:"Show only external alerts"}),d=a.i18n.translate("xpack.securitySolution.eventsGraphTitle",{defaultMessage:"Events"})},919:function(e,t,n){"use strict";n.d(t,"c",(function(){return o})),n.d(t,"d",(function(){return u})),n.d(t,"f",(function(){return c})),n.d(t,"e",(function(){return d})),n.d(t,"a",(function(){return m})),n.d(t,"b",(function(){return p}));var a=n(42),i=n(50),l=n.n(i),r=n(920);const s=[],o=e=>{var t,n,a;return(null!==(t=null==e||null===(n=e.aggregations)||void 0===n||null===(a=n.alertsByGrouping)||void 0===a?void 0:a.buckets)&&void 0!==t?t:[]).reduce(((e,{key_as_string:t,key:n,alerts:a})=>{var i;return[...e,...(null!==(i=a.buckets)&&void 0!==i?i:[]).map((({key:e,doc_count:a})=>({x:e,y:a,g:null!=t?t:n.toString()})))]}),s)},u=(e,t,n,a,i)=>({aggs:{alertsByGrouping:{terms:{field:e,order:{_count:"desc"},size:10},aggs:{alerts:{date_histogram:{field:"@timestamp",fixed_interval:`${Math.floor(l()(n).diff(l()(t))/32)}ms`,min_doc_count:0,extended_bounds:{min:t,max:n}}}}}},query:{bool:{filter:[...a,{range:{"@timestamp":{gte:t,lte:n}}}]}},runtime_mappings:i,_source:!1,size:0}),c=({isInitialLoading:e,isLoadingAlerts:t})=>e&&t,d=e=>{try{return null==e||Object(a.isEmpty)(e)?{}:JSON.parse(e)}catch{return{}}},m=e=>{try{return Object(a.isEmpty)(e)?[]:[d(e)]}catch{return[]}},p=({callback:e,order:t}={})=>({id:"resetGroupByField",getDisplayName:()=>r.b,getIconType:()=>"editorRedo",type:"actionButton",isCompatible:async()=>!0,async execute({embeddable:t}){null==e||e();const n=t.getInput(),{attributes:{state:{visualization:{columns:a}}}}=n;t.updateInput({...n,attributes:{...n.attributes,state:{...n.attributes.state,visualization:{...n.attributes.state.visualization,columns:a.map((e=>({...e,hidden:!1})))}}}})},order:t})},920:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"b",(function(){return l}));var a=n(5);const i=a.i18n.translate("xpack.securitySolution.components.chartSettingsPopover.contextMenuItems.inspectTitle",{defaultMessage:"Inspect"}),l=a.i18n.translate("xpack.securitySolution.components.chartSettingsPopover.contextMenuItems.resetGroupByFieldsMenuItem",{defaultMessage:"Reset group by fields"})},921:function(e,t,n){"use strict";n.d(t,"a",(function(){return l}));var a=n(374);const i=new Set([a.b.STRING,a.b.BOOLEAN,a.b.NUMBER,a.b.IP]),l=e=>!!e&&i.has(e)},922:function(e,t,n){"use strict";n.d(t,"b",(function(){return u})),n.d(t,"c",(function(){return c})),n.d(t,"a",(function(){return m}));var a=n(2),i=n.n(a),l=n(40),r=n(44),s=n(58);const o={tall:490,short:250},u=Object(a.createContext)({tableId:null}),c=({height:e="tall"})=>i.a.createElement(l.EuiPanel,{color:"subdued"},i.a.createElement(l.EuiFlexGroup,{style:{height:o[e]},alignItems:"center",justifyContent:"center","data-test-subj":"loading-alerts-panel"},i.a.createElement(l.EuiFlexItem,{grow:!1},i.a.createElement(l.EuiLoadingSpinner,{size:"xl"})))),d={maxWidth:500},m=()=>{const{http:e}=Object(s.useKibana)().services;return i.a.createElement(l.EuiPanel,{color:"subdued","data-test-subj":"tGridEmptyState"},i.a.createElement(l.EuiFlexGroup,{alignItems:"center",justifyContent:"center"},i.a.createElement(l.EuiFlexItem,{grow:!1},i.a.createElement(l.EuiPanel,{hasBorder:!0,style:d},i.a.createElement(l.EuiFlexGroup,null,i.a.createElement(l.EuiFlexItem,null,i.a.createElement(l.EuiText,{size:"s"},i.a.createElement(l.EuiTitle,null,i.a.createElement("h3",null,i.a.createElement(r.FormattedMessage,{id:"xpack.securitySolution.eventsViewer.empty.title",defaultMessage:"No results match your search criteria"}))),i.a.createElement("p",null,i.a.createElement(r.FormattedMessage,{id:"xpack.securitySolution.eventsViewer.empty.description",defaultMessage:"Try searching over a longer period of time or modifying your search"})))),i.a.createElement(l.EuiFlexItem,{grow:!1},i.a.createElement(l.EuiImage,{size:"200",alt:"",url:e.basePath.prepend("/plugins/timelines/assets/illustration_product_no_results_magnifying_glass.svg")})))))))}},939:function(e,t,n){"use strict";n.d(t,"a",(function(){return ye}));var a=n(2),i=n.n(a),l=n(103),r=n(56),s=n(672),o=n(102),u=n(4),c=n(105),d=n(118),m=n(111),p=n(12),b=n(479),g=n(190),f=n(44),y=n(41),v=n.n(y),h=n(106),E=n(947),S=n(317),x=n(209),O=n(126),k=n(40),j=n(140),T=n(45),w=n(108),M=n(675);const I=({onComplete:e,isEnableDownloader:t,exportedIds:n})=>{const{tabName:i}=Object(T.useParams)(),{addSuccess:l}=Object(w.a)(),r=Object(a.useCallback)((t=>{null!=e&&e(),l({title:i===h.l.template?j.U(t):j.T(t),"data-test-subj":"addObjectToContainerSuccess"})}),[l,e,i]),s=Object(a.useCallback)((()=>{null!=e&&e()}),[e]);return Object(a.useEffect)((()=>{(async()=>{if(null!=n&&n.length&&t){const e=await Object(x.b)({ids:n});e instanceof Blob?(Object(M.a)(e,`${j.n}.ndjson`),r(n.length)):s()}})()}),[n,t]),null};I.displayName="ExportTimeline";const C=i.a.memo(I);var A=n(42);const D=i.a.memo((({title:e,closeModal:t,onDelete:n})=>{const{tabName:l}=Object(T.useParams)(),r=l===h.l.template?j.j:j.k,s=Object(a.useCallback)((()=>{const t=null!=e?e.trim():"",n=Object(A.isEmpty)(t)?j.ab:t;return i.a.createElement(f.FormattedMessage,{id:"xpack.securitySolution.open.timeline.deleteTimelineModalTitle",defaultMessage:'Delete "{title}"?',"data-test-subj":"title",values:{title:n}})}),[e]);return i.a.createElement(k.EuiConfirmModal,{buttonColor:"danger",cancelButtonText:j.b,confirmButtonText:j.h,defaultFocusedButton:k.EUI_MODAL_CONFIRM_BUTTON,onCancel:t,onConfirm:n,title:s()},i.a.createElement("div",{"data-test-subj":"warning"},r))}));D.displayName="DeleteTimelineModal";const N=Object(y.createGlobalStyle)(["div[data-popover-open]{display:none;}"]),F=i.a.memo((({deleteTimelines:e,isModalOpen:t,savedObjectIds:n,title:l,onComplete:r})=>{const{addSuccess:s}=Object(w.a)(),{tabName:o}=Object(T.useParams)(),u=Object(a.useCallback)((()=>{null!=r&&r()}),[r]),c=Object(a.useCallback)((()=>{n.length>0&&(e(n),s({title:o===h.l.template?j.S(n.length):j.R(n.length)})),null!=r&&r()}),[e,n,r,s,o]);return i.a.createElement(i.a.Fragment,null,t&&i.a.createElement(N,{"data-test-subj":"remove-popover"}),t?i.a.createElement(k.EuiModal,{maxWidth:600,onClose:u},i.a.createElement(D,{"data-test-subj":"delete-timeline-modal",onDelete:c,title:l,closeModal:u})):null)}));F.displayName="DeleteTimelineModalOverlay";const P=({deleteTimelines:e,ids:t,isEnableDownloader:n,isDeleteTimelineModalOpen:a,onComplete:l,title:r})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(C,{"data-test-subj":"TimelineDownloader",exportedIds:t,isEnableDownloader:n,onComplete:l}),null!=e&&i.a.createElement(F,{"data-test-subj":"DeleteTimelineModalOverlay",deleteTimelines:e,isModalOpen:a,onComplete:l,savedObjectIds:t,title:r})),R=i.a.memo(P),L=()=>{const[e,t]=Object(a.useState)(null),[n,i]=Object(a.useState)(!1),[l,r]=Object(a.useState)(!1),s=Object(a.useCallback)((()=>{i(!1),t(null)}),[e]),o=Object(a.useCallback)((e=>{i(!0),null!=e&&t(e)}),[]),u=Object(a.useCallback)((e=>{r(!0),null!=e&&t(e)}),[]),c=Object(a.useCallback)((()=>{r(!1),t(null)}),[]);return{actionItem:e,onCompleteEditTimelineAction:Object(a.useCallback)((()=>{i(!1),r(!1),t(null)}),[]),isDeleteTimelineModalOpen:n,onCloseDeleteTimelineModal:s,onOpenDeleteTimelineModal:o,isEnableDownloader:l,enableExportTimelineDownloader:u,disableExportTimelineDownloader:c}},B=v.a.div.withConfig({displayName:"SearchRowContainer",componentId:"sc-1dq1et8-0"})(["&:not(:last-child){margin-bottom:",";}"],(e=>e.theme.eui.euiSizeL));B.displayName="SearchRowContainer";const _=v()(k.EuiFlexGroup).withConfig({displayName:"SearchRowFlexGroup",componentId:"sc-1dq1et8-1"})(["margin-bottom:",";"],(e=>e.theme.eui.euiSizeXS));_.displayName="SearchRowFlexGroup";const q=i.a.memo((({favoriteCount:e,onlyFavorites:t,onQueryChange:n,onToggleOnlyFavorites:l,children:r,timelineType:s})=>{const o=Object(a.useMemo)((()=>({placeholder:s===h.l.default?j.L:j.M,incremental:!1,"data-test-subj":"search-bar"})),[s]);return i.a.createElement(B,null,i.a.createElement(_,{gutterSize:"s"},i.a.createElement(k.EuiFlexItem,null,i.a.createElement(k.EuiSearchBar,{box:o,onChange:n})),i.a.createElement(k.EuiFlexItem,{grow:!1},i.a.createElement(k.EuiFilterGroup,{fullWidth:!0},i.a.createElement(i.a.Fragment,null,i.a.createElement(k.EuiFilterButton,{"data-test-subj":"only-favorites-toggle",hasActiveFilters:t,onClick:l,numFilters:null!=e?e:void 0},j.D),!!r&&r)))))}));q.displayName="SearchRow";var z=n(104),V=n.n(z);const $=({actionTimelineToShow:e,deleteTimelines:t,enableExportTimelineDownloader:n,onOpenDeleteTimelineModal:a,onOpenTimeline:i,onCreateRule:l,onCreateRuleFromEql:r,hasCrudAccess:s})=>[{width:s?"80px":"150px",actions:[{name:j.g,icon:"timeline",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineType:h.l.default,timelineId:e})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:j.g,"data-test-subj":"create-from-template",available:t=>t.timelineType===h.l.template&&e.includes("createFrom")},{name:j.f,icon:"visText",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineType:h.l.template,timelineId:e})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:j.f,"data-test-subj":"create-template-from-timeline",available:t=>t.timelineType!==h.l.template&&e.includes("createFrom")},{name:j.E,icon:"copy",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineId:null!=e?e:""})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:j.E,"data-test-subj":"open-duplicate",available:t=>t.timelineType!==h.l.template&&e.includes("duplicate")},{name:j.F,icon:"copy",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineId:null!=e?e:""})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:j.F,"data-test-subj":"open-duplicate-template",available:t=>t.timelineType===h.l.template&&e.includes("duplicate")},{name:j.o,icon:"exportAction",onClick:e=>{null!=n&&n(e)},enabled:e=>null!=e.savedObjectId&&e.status!==h.k.immutable,description:j.o,"data-test-subj":"export-timeline",available:()=>e.includes("export")},{name:j.i,icon:"trash",onClick:e=>{null!=a&&a(e)},enabled:({savedObjectId:e,status:t})=>null!=e&&t!==h.k.immutable,description:j.i,"data-test-subj":"delete-timeline",available:()=>e.includes("delete")&&null!=t},{name:j.d,icon:"indexEdit",onClick:e=>{null!=l&&e.savedObjectId&&l(e.savedObjectId)},enabled:e=>null!=l&&null!=e.savedObjectId&&e.status!==h.k.immutable,description:j.d,"data-test-subj":"create-rule-from-timeline",available:({queryType:t})=>e.includes("createRule")&&null!=l&&null!=t&&t.hasQuery},{name:j.e,icon:"indexEdit",onClick:e=>{null!=r&&e.savedObjectId&&r(e.savedObjectId)},enabled:e=>null!=r&&null!=e.savedObjectId&&e.status!==h.k.immutable,description:j.d,"data-test-subj":"create-rule-from-eql",available:({queryType:t})=>e.includes("createRuleFromEql")&&null!=r&&null!=t&&t.hasEql}]}],Q="45px";var U=n(164),H=n(899),G=n(117),W=n(132);const K=v.a.span.withConfig({displayName:"LineClampTextContainer",componentId:"sc-4zme7l-0"})(["text-overflow:ellipsis;display:-webkit-box;-webkit-line-clamp:5;-webkit-box-orient:vertical;overflow:hidden;"]),Y=({itemIdToExpandedNotesRowMap:e,onOpenTimeline:t,onToggleShowNotes:n,timelineType:a})=>[{isExpander:!0,render:({notes:t,savedObjectId:a})=>null!=t&&t.length>0&&null!=a?i.a.createElement(k.EuiButtonIcon,{"data-test-subj":"expand-notes",onClick:()=>null!=e[a]?n(Object(A.omit)(a,e)):n({...e,[a]:i.a.createElement(H.a,{notes:t})}),"aria-label":e[a]?j.c:j.m,iconType:e[a]?"arrowDown":"arrowRight"}):null,width:Q},{dataType:"string",field:"title",name:a===h.l.default?j.Y:j.Z,render:(e,n)=>null!=n.savedObjectId?i.a.createElement(k.EuiLink,{"data-test-subj":`title-${n.savedObjectId}`,onClick:()=>t({duplicate:!1,timelineId:`${n.savedObjectId}`})},Object(U.f)(n)?j.ab:i.a.createElement(K,null,e)):i.a.createElement("div",{"data-test-subj":`title-no-saved-object-id-${e||"no-title"}`},Object(U.f)(n)?j.ab:e),sortable:!1},{dataType:"string",field:"description",name:j.l,render:e=>i.a.createElement(K,{"data-test-subj":"description"},null!=e&&e.trim().length>0?e:Object(G.d)()),sortable:!1},{dataType:"date",field:"updated",name:j.y,render:(e,t)=>i.a.createElement("div",{"data-test-subj":"updated"},null!=t.updated?i.a.createElement(W.b,{value:e}):Object(G.d)()),sortable:!0}],J=e=>e?[{dataType:"string",field:"updatedBy",name:j.B,render:e=>i.a.createElement("div",{"data-test-subj":"username"},Object(G.a)(e)),sortable:!1}]:[],X=({timelineType:e})=>{const t={note:{align:"center",field:"eventIdToNoteIds",name:i.a.createElement(k.EuiToolTip,{content:j.C},i.a.createElement(k.EuiIcon,{"data-test-subj":"notes-count-header-icon",size:"m",type:"editorComment"})),render:(e,t)=>i.a.createElement("span",{"data-test-subj":"notes-count"},Object(U.d)(t)),sortable:!1,width:Q},pinnedEvent:{align:"center",field:"pinnedEventIds",name:i.a.createElement(k.EuiToolTip,{content:j.J},i.a.createElement(k.EuiIcon,{"data-test-subj":"pinned-event-header-icon",size:"m",type:"pin"})),render:(e,t)=>i.a.createElement("span",{"data-test-subj":"pinned-event-count"},`${Object(U.e)(t)}`),sortable:!1,width:Q},favorite:{align:"center",field:"favorite",name:i.a.createElement(k.EuiToolTip,{content:j.p},i.a.createElement(k.EuiIcon,{"data-test-subj":"favorites-header-icon",size:"m",type:"starEmpty"})),render:e=>{const t=null!=e&&e.length>0?"starFilled":"starEmpty";return i.a.createElement(k.EuiIcon,{"data-test-subj":`favorite-${t}-star`,type:t,size:"m"})},sortable:!1,width:Q}},n=[t.note,t.favorite],a=[t.pinnedEvent,t.note,t.favorite];return e===h.l.template?n:a},Z=k.EuiBasicTable,ee=v()(Z).withConfig({displayName:"BasicTable",componentId:"sc-1yfhyq7-0"})([".euiTableCellContent{animation:none;}.euiTableRow-isExpandedRow .euiTableCellContent__text{width:100%;}"]);ee.displayName="BasicTable";const te=i.a.memo((({actionTimelineToShow:e,deleteTimelines:t,defaultPageSize:n,loading:l,itemIdToExpandedNotesRowMap:r,enableExportTimelineDownloader:s,onCreateRule:o,onCreateRuleFromEql:u,onOpenDeleteTimelineModal:c,onOpenTimeline:d,onSelectionChange:m,onTableChange:p,onToggleShowNotes:b,pageIndex:g,pageSize:f,searchResults:y,showExtendedColumns:v,sortField:E,sortDirection:S,tableRef:x,timelineType:k,totalSearchResultsCount:T})=>{const w={showPerPageOptions:v,pageIndex:g,pageSize:f,pageSizeOptions:[Math.floor(Math.max(n,1)/2),n,2*n],totalItemCount:T},M={sort:{field:E,direction:S}},I={selectable:e=>null!=e.savedObjectId&&e.status!==h.k.immutable,selectableMessage:e=>e?void 0:j.A,onSelectionChange:m},C=null!=x?{ref:x}:{},{kibanaSecuritySolutionsPrivileges:A}=Object(O.a)(),D=Object(a.useMemo)((()=>(({actionTimelineToShow:e,deleteTimelines:t,enableExportTimelineDownloader:n,itemIdToExpandedNotesRowMap:a,onCreateRule:i,onCreateRuleFromEql:l,onOpenDeleteTimelineModal:r,onOpenTimeline:s,onToggleShowNotes:o,showExtendedColumns:u,timelineType:c,hasCrudAccess:d})=>[...Y({itemIdToExpandedNotesRowMap:a,onOpenTimeline:s,onToggleShowNotes:o,timelineType:c}),...J(u),...X({timelineType:c}),...e.length?$({onCreateRule:i,onCreateRuleFromEql:l,actionTimelineToShow:e,deleteTimelines:t,enableExportTimelineDownloader:n,onOpenDeleteTimelineModal:r,onOpenTimeline:s,hasCrudAccess:d}):[]])({actionTimelineToShow:e,deleteTimelines:t,itemIdToExpandedNotesRowMap:r,enableExportTimelineDownloader:s,onCreateRule:o,onCreateRuleFromEql:u,onOpenDeleteTimelineModal:c,onOpenTimeline:d,onSelectionChange:m,onToggleShowNotes:b,showExtendedColumns:v,timelineType:k,hasCrudAccess:A.crud})),[e,t,r,s,o,u,c,d,m,b,v,k,A]),N=l||null==y?j.z:k===h.l.template?j.db:j.cb;return i.a.createElement(ee,V()({columns:D,"data-test-subj":"timelines-table",isExpandable:!0,isSelectable:e.includes("selectable"),itemId:"savedObjectId",itemIdToExpandedRowMap:r,items:null!=y?y:[],loading:l,noItemsMessage:N,onChange:p,pagination:w,selection:e.includes("selectable")?I:void 0,sorting:M},C))}));te.displayName="TimelinesTable";const ne=v.a.span.withConfig({displayName:"QueryText",componentId:"sc-1qxahey-0"})(["white-space:normal;word-break:break-word;"]),ae=i.a.memo((({deleteTimelines:e,defaultPageSize:t,favoriteCount:n,isLoading:l,itemIdToExpandedNotesRowMap:r,importDataModalToggle:s,onCreateRule:o,onCreateRuleFromEql:u,onDeleteSelected:c,onlyFavorites:d,onOpenTimeline:m,onQueryChange:p,onSelectionChange:b,onTableChange:g,onToggleOnlyFavorites:y,onToggleShowNotes:v,pageIndex:T,pageSize:w,query:M,refetch:I,searchResults:C,selectedItems:A,sortDirection:D,setImportDataModalToggle:N,sortField:F,timelineType:P=h.l.default,timelineStatus:B,timelineFilter:_,templateTimelineFilter:z,totalSearchResultsCount:V})=>{var $;const Q=Object(a.useRef)(),{actionItem:H,enableExportTimelineDownloader:G,isEnableDownloader:W,isDeleteTimelineModalOpen:K,onOpenDeleteTimelineModal:Y,onCompleteEditTimelineAction:J}=L(),{kibanaSecuritySolutionsPrivileges:X}=Object(O.a)(),{getBatchItemsPopoverContent:Z}=(({deleteTimelines:e,selectedItems:t,tableRef:n,timelineType:l=h.l.default})=>{const{enableExportTimelineDownloader:r,disableExportTimelineDownloader:s,isEnableDownloader:o,isDeleteTimelineModalOpen:u,onOpenDeleteTimelineModal:c,onCloseDeleteTimelineModal:d}=L(),m=Object(a.useCallback)((e=>{null!=e&&e(),null!=n&&null!=n.current&&n.current.changeSelection([]),s(),d()}),[s,d,n]),p=Object(a.useMemo)((()=>{return e=null!=t?t:[],(Array.isArray(e)?e:[e]).reduce(((e,t)=>null!=t.savedObjectId?[...e,t.savedObjectId]:[...e]),[]);var e}),[t]),b=Object(a.useCallback)((()=>r()),[r]),g=Object(a.useCallback)((()=>c()),[c]),f=Object(a.useCallback)((n=>{var a,r,s,c;const d=null==t||0===t.length,f=[];return t&&f.push(i.a.createElement(k.EuiContextMenuItem,{"data-test-subj":"export-timeline-action",disabled:d,icon:"exportAction",key:"ExportItemKey",onClick:b},j.o)),e&&f.push(i.a.createElement(k.EuiContextMenuItem,{"data-test-subj":"delete-timeline-action",disabled:d,icon:"trash",key:"DeleteItemKey",onClick:g},j.i)),i.a.createElement(i.a.Fragment,null,i.a.createElement(R,{deleteTimelines:e,ids:p,isEnableDownloader:o,isDeleteTimelineModalOpen:u,onComplete:m.bind(null,n),title:1!==(null==t?void 0:t.length)?l===h.l.template?j.N(null!==(a=null==t?void 0:t.length)&&void 0!==a?a:0):j.O(null!==(r=null==t?void 0:t.length)&&void 0!==r?r:0):null!==(s=null===(c=t[0])||void 0===c?void 0:c.title)&&void 0!==s?s:""}),i.a.createElement(k.EuiContextMenuPanel,{items:f}))}),[t,e,p,o,u,m,l,b,g]);return{onCompleteBatchActions:m,getBatchItemsPopoverContent:f}})({deleteTimelines:X.crud?e:void 0,selectedItems:A,tableRef:Q,timelineType:P}),ee=Object(a.useMemo)((()=>i.a.createElement(f.FormattedMessage,{id:"xpack.securitySolution.open.timeline.showingNTemplatesLabel",defaultMessage:"{totalSearchResultsCount} {totalSearchResultsCount, plural, one {template} other {templates}} {with}",values:{totalSearchResultsCount:V,with:i.a.createElement(ne,{"data-test-subj":"selectable-query-text"},M.trim().length?`${j.bb} "${M.trim()}"`:"")}})),[V,M]),ae=Object(a.useMemo)((()=>i.a.createElement(f.FormattedMessage,{id:"xpack.securitySolution.open.timeline.showingNTimelinesLabel",defaultMessage:"{totalSearchResultsCount} {totalSearchResultsCount, plural, one {timeline} other {timelines}} {with}",values:{totalSearchResultsCount:V,with:i.a.createElement(ne,{"data-test-subj":"selectable-query-text"},M.trim().length?`${j.bb} "${M.trim()}"`:"")}})),[V,M]),ie=Object(a.useMemo)((()=>null!=H&&null!=H.savedObjectId?[H.savedObjectId]:[]),[H]),le=Object(a.useCallback)((()=>{null!=I&&I()}),[I]),re=Object(a.useCallback)((()=>{null!=N&&N(!1)}),[N]),se=Object(a.useCallback)((()=>{null!=N&&N(!1),null!=I&&I()}),[N,I]),oe=Object(a.useMemo)((()=>{if(X.crud){const t=["createFrom","duplicate",...null!=o?["createRule"]:[],...null!=u?["createRuleFromEql"]:[]];return B!==h.k.immutable&&(t.push("export"),t.push("selectable")),null!=c&&null!=e&&B!==h.k.immutable&&t.push("delete"),t}return B!==h.k.immutable?["export","selectable"]:[]}),[o,u,B,c,e,X]),ue=Object(a.useMemo)((()=>i.a.createElement(i.a.Fragment,null,z)),[z]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(R,{deleteTimelines:e,ids:ie,isDeleteTimelineModalOpen:K,isEnableDownloader:W,onComplete:J,title:null!==($=null==H?void 0:H.title)&&void 0!==$?$:j.ab}),i.a.createElement(E.a,{checkBoxLabel:j.I,closeModal:re,description:j.P,errorMessage:j.t,failedDetailed:j.u,importComplete:se,importData:x.e,successMessage:j.V,showCheckBox:!1,showModal:null!=s&&s,submitBtnText:j.w,subtitle:j.x,title:j.v}),i.a.createElement("div",{className:U.a},!!_&&_,i.a.createElement(q,{"data-test-subj":"search-row",favoriteCount:n,onlyFavorites:d,onQueryChange:p,onToggleOnlyFavorites:y,query:M,timelineType:P},ue),i.a.createElement(S.a,{border:!0},i.a.createElement(S.d,null,i.a.createElement(S.c,null,i.a.createElement(S.e,{"data-test-subj":"query-message"},i.a.createElement(i.a.Fragment,null,j.Q," ",P===h.l.template?ee:ae))),i.a.createElement(S.c,null,B!==h.k.immutable&&i.a.createElement(i.a.Fragment,null,i.a.createElement(S.e,{"data-test-subj":"selected-count"},P===h.l.template?j.N(A.length):j.O(A.length)),i.a.createElement(S.b,{dataTestSubj:"batchActions",iconSide:"right",iconType:"arrowDown",popoverContent:Z,"data-test-subj":"utility-bar-action"},i.a.createElement("span",{"data-test-subj":"utility-bar-action-button"},j.a))),i.a.createElement(S.b,{dataTestSubj:"refreshButton",iconSide:"right",iconType:"refresh",onClick:le},j.K)))),i.a.createElement(te,{actionTimelineToShow:oe,"data-test-subj":"timelines-table",deleteTimelines:e,defaultPageSize:t,loading:l,itemIdToExpandedNotesRowMap:r,enableExportTimelineDownloader:G,onCreateRule:o,onCreateRuleFromEql:u,onOpenDeleteTimelineModal:Y,onOpenTimeline:m,onSelectionChange:b,onTableChange:g,onToggleShowNotes:v,pageIndex:T,pageSize:w,searchResults:C,showExtendedColumns:!0,sortDirection:D,sortField:F,timelineType:P,tableRef:Q,totalSearchResultsCount:V})))}));ae.displayName="OpenTimeline";var ie=n(166);const le=i.a.memo((({children:e,onAddTimelinesToFavorites:t,selectedTimelinesCount:n,title:a})=>i.a.createElement(ie.a,{title:a,split:!0,height:40},i.a.createElement(k.EuiFlexGroup,{gutterSize:"s",responsive:!1},t&&i.a.createElement(k.EuiFlexItem,{grow:!1},i.a.createElement(k.EuiButton,{"data-test-subj":"favorite-selected",iconSide:"left",iconType:"starEmptySpace",isDisabled:0===n,onClick:t},j.q)),e&&i.a.createElement(k.EuiFlexItem,null,e)))));le.displayName="TitleRow";const re=v.a.div.withConfig({displayName:"HeaderContainer",componentId:"sc-98e87t-0"})(["width:100%;"]);re.displayName="HeaderContainer";const se=Object(a.memo)((({deleteTimelines:e,defaultPageSize:t,favoriteCount:n,hideActions:l=[],isLoading:r,itemIdToExpandedNotesRowMap:s,onAddTimelinesToFavorites:o,onDeleteSelected:u,onlyFavorites:c,onOpenTimeline:d,onQueryChange:m,onSelectionChange:p,onTableChange:b,onToggleOnlyFavorites:g,onToggleShowNotes:f,pageIndex:y,pageSize:v,searchResults:h,selectedItems:E,sortDirection:S,sortField:x,timelineFilter:O,timelineType:j,templateTimelineFilter:T,title:w,totalSearchResultsCount:M})=>{const I=Object(a.useMemo)((()=>{const t=["createFrom","duplicate"];return null!=u&&null!=e&&t.push("delete"),t.filter((e=>!l.includes(e)))}),[u,e,l]),C=Object(a.useMemo)((()=>i.a.createElement(a.Fragment,{key:"search-row-content"},!!T&&T)),[T]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(k.EuiModalHeader,null,i.a.createElement(re,null,i.a.createElement(le,{"data-test-subj":"title-row",onAddTimelinesToFavorites:o,selectedTimelinesCount:E.length,title:w}))),i.a.createElement(k.EuiModalBody,null,i.a.createElement(i.a.Fragment,null,!!O&&i.a.createElement(i.a.Fragment,null,O,i.a.createElement(k.EuiSpacer,{size:"m"})),i.a.createElement(q,{"data-test-subj":"search-row",onlyFavorites:c,onQueryChange:m,onToggleOnlyFavorites:g,query:"",timelineType:j},C),i.a.createElement(te,{actionTimelineToShow:I,"data-test-subj":"timelines-table",deleteTimelines:e,defaultPageSize:t,loading:r,itemIdToExpandedNotesRowMap:s,onOpenTimeline:d,onSelectionChange:p,onTableChange:b,onToggleShowNotes:f,pageIndex:y,pageSize:v,searchResults:h,showExtendedColumns:!1,sortDirection:S,sortField:x,timelineType:j,totalSearchResultsCount:M}))))}));se.displayName="OpenTimelineModalBody";var oe=n(131),ue=n(169);let ce;!function(e){e.tab="tab",e.filter="filter"}(ce||(ce={}));var de=n(911),me=n(110),pe=n(116),be=n(159),ge=n(196);const fe=i.a.memo((({closeModalTimeline:e,defaultPageSize:t,hideActions:n=[],isModal:f=!1,importDataModalToggle:y,onOpenTimeline:v,setImportDataModalToggle:E,title:S})=>{const O=Object(l.useDispatch)(),{startTransaction:w}=Object(be.b)(),[M,I]=Object(a.useState)({}),[C,D]=Object(a.useState)(!1),[N,F]=Object(a.useState)(0),[P,R]=Object(a.useState)(t),[L,B]=Object(a.useState)(""),[_,q]=Object(a.useState)([]),[z,V]=Object(a.useState)("desc"),[$,Q]=Object(a.useState)("updated"),H=Object(a.useMemo)((()=>m.b.getTimelineByIdSelector()),[]),G=Object(c.b)((e=>{var t,n;return null!==(t=null===(n=H(e,d.c.active))||void 0===n?void 0:n.savedObjectId)&&void 0!==t?t:""})),{dataViewId:W,selectedPatterns:K}=Object(pe.d)(me.SourcererScopeName.timeline),Y=Object(a.useMemo)((()=>Object(U.b)(O)),[O]),J=Object(a.useCallback)((e=>O(Object(p.updateIsLoading)(e))),[O]),{customTemplateTimelineCount:X,defaultTimelineCount:Z,elasticTemplateTimelineCount:ee,favoriteCount:te,fetchAllTimeline:ne,timelines:ie,loading:le,totalCount:re,templateTimelineCount:fe}=Object(b.b)(),{timelineType:ye,timelineTabs:ve,timelineFilters:he}=(({defaultTimelineCount:e,templateTimelineCount:t})=>{const{formatUrl:n,search:l}=Object(ue.m)(oe.a.timelines),{navigateToUrl:r}=Object(o.j)().services.application,{tabName:s}=Object(T.useParams)(),[u,c]=Object(a.useState)(s===h.l.default||s===h.l.template?s:h.l.default),d=n(Object(ue.k)(h.l.default,l)),m=n(Object(ue.k)(h.l.template,l)),p=Object(a.useCallback)((e=>{e.preventDefault(),r(d)}),[r,d]),b=Object(a.useCallback)((e=>{e.preventDefault(),r(m)}),[r,m]),g=Object(a.useCallback)((e=>[{id:h.l.default,name:j.X,href:d,disabled:!1,onClick:e===ce.tab?p:A.noop},{id:h.l.template,name:j.W,href:m,disabled:!1,onClick:e===ce.tab?b:A.noop}]),[d,m,p,b]),f=Object(a.useCallback)(((e,t)=>{c((t=>(t!==e&&c(e),t)))}),[c]),y=Object(a.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(k.EuiTabs,{"data-test-subj":"open-timeline-subtabs"},g(ce.tab).map((e=>i.a.createElement(k.EuiTab,{"data-test-subj":`timeline-${ce.tab}-${e.id}`,isSelected:e.id===s,disabled:e.disabled,key:`timeline-${ce.tab}-${e.id}`,href:e.href,onClick:t=>{e.onClick(t),f(e.id,ce.tab)}},e.name)))),i.a.createElement(k.EuiSpacer,{size:"m"}))),[s]),v=Object(a.useMemo)((()=>i.a.createElement(k.EuiTabs,null,g(ce.filter).map((e=>i.a.createElement(k.EuiTab,{"data-test-subj":`open-timeline-modal-body-${ce.filter}-${e.id}`,isSelected:e.id===u,key:`timeline-${ce.filter}-${e.id}`,onClick:t=>{e.onClick(t),f(e.id,ce.filter)}},e.name))))),[u,g,f]);return{timelineType:u,timelineTabs:y,timelineFilters:v}})({defaultTimelineCount:Z,templateTimelineCount:fe}),{timelineStatus:Ee,templateTimelineFilter:Se,installPrepackagedTimelines:xe}=Object(de.a)({timelineType:ye,customTemplateTimelineCount:X,elasticTemplateTimelineCount:ee}),Oe=Object(a.useCallback)((()=>{ne({pageInfo:{pageIndex:N+1,pageSize:P},search:L,sort:{sortField:$,sortOrder:z},onlyUserFavorite:C,timelineType:ye,status:Ee})}),[ne,N,P,L,$,z,ye,Ee,C]),ke=Object(a.useCallback)((e=>{B(e.queryText.trim())}),[]),je=Object(a.useCallback)((async e=>{w({name:e.length>1?ge.f.BULK_DELETE:ge.f.DELETE}),e.includes(G)&&O(Object(p.createTimeline)({id:d.c.active,columns:g.b,dataViewId:W,indexNames:K,show:!1})),await Object(x.a)(e),Oe()}),[w,G,Oe,O,W,K]),Te=Object(a.useCallback)((async e=>{await je(e)}),[je]),we=Object(a.useCallback)((async()=>{await je((e=>e.reduce(((e,t)=>null!=t.savedObjectId?[...e,t.savedObjectId]:e),[]))(_)),Pe()}),[_,je]),Me=Object(a.useCallback)((e=>{q(e)}),[]),Ie=Object(a.useCallback)((({page:e,sort:t})=>{const{index:n,size:a}=e,{field:i,direction:l}=t;F(n),R(a),V(l),Q(i)}),[]),Ce=Object(a.useCallback)((()=>{D(!C)}),[C]),Ae=Object(a.useCallback)((e=>{I(e)}),[]),{navigateTo:De}=Object(o.l)(),Ne=Object(a.useCallback)((e=>De({deepLinkId:u.wc.rulesCreate,path:`?${s.b}=${Object(r.encode)(e)}`})),[De]),Fe=Object(a.useCallback)((e=>De({deepLinkId:u.wc.rulesCreate,path:`?${s.a}=${Object(r.encode)(e)}`})),[De]),Pe=Object(a.useCallback)((()=>{q([])}),[]),Re=Object(a.useCallback)((({duplicate:t,timelineId:n,timelineType:a})=>{t&&w({name:ge.f.DUPLICATE}),f&&null!=e&&e(),Object(U.h)({duplicate:t,onOpenTimeline:v,timelineId:n,timelineType:a,updateIsLoading:J,updateTimeline:Y})}),[J,Y]);return Object(a.useEffect)((()=>{(()=>{const e=document.querySelector(`.${U.a} input`);null!=e&&e.focus()})()}),[]),Object(a.useEffect)((()=>{(async()=>{await xe(),Oe()})()}),[Oe,xe]),f?i.a.createElement(se,{"data-test-subj":"open-timeline-modal",deleteTimelines:Te,defaultPageSize:t,favoriteCount:te,hideActions:n,isLoading:le,itemIdToExpandedNotesRowMap:M,onAddTimelinesToFavorites:void 0,onlyFavorites:C,onOpenTimeline:Re,onQueryChange:ke,onSelectionChange:Me,onTableChange:Ie,onToggleOnlyFavorites:Ce,onToggleShowNotes:Ae,pageIndex:N,pageSize:P,query:L,searchResults:ie,selectedItems:_,sortDirection:z,sortField:$,templateTimelineFilter:Se,timelineType:ye,timelineStatus:Ee,timelineFilter:he,title:S,totalSearchResultsCount:re}):i.a.createElement(ae,{"data-test-subj":"open-timeline",deleteTimelines:Te,defaultPageSize:t,favoriteCount:te,isLoading:le,itemIdToExpandedNotesRowMap:M,importDataModalToggle:y,onAddTimelinesToFavorites:void 0,onCreateRule:Ne,onCreateRuleFromEql:Fe,onDeleteSelected:we,onlyFavorites:C,onOpenTimeline:Re,onQueryChange:ke,onSelectionChange:Me,onTableChange:Ie,onToggleOnlyFavorites:Ce,onToggleShowNotes:Ae,pageIndex:N,pageSize:P,query:L,refetch:Oe,searchResults:ie,setImportDataModalToggle:E,selectedItems:_,sortDirection:z,sortField:$,templateTimelineFilter:Se,timelineType:ye,timelineStatus:Ee,timelineFilter:ve,title:S,totalSearchResultsCount:re})})),ye=i.a.memo(fe)},941:function(e,t,n){"use strict";n.d(t,"b",(function(){return fe})),n.d(t,"a",(function(){return Ae}));var a=n(40),i=n(2),l=n.n(i),r=n(42),s=n(103),o=n(41),u=n.n(o),c=n(44),d=n(51),m=n(114),p=n(105),b=n(118),g=n(106),f=n(111),y=n(133),v=n(412),h=n(4),E=n(12),S=n(102),x=n(169),O=n(131),k=n(248);const j=({timelineId:e})=>{const t=Object(i.useMemo)((()=>f.b.getTimelineByIdSelector()),[]),{cases:n,application:{navigateToApp:o}}=Object(S.j)().services,u=Object(s.useDispatch)(),{graphEventId:c,savedObjectId:d,status:m,title:v,timelineType:j}=Object(p.a)((n=>{var a;return Object(r.pick)(["graphEventId","savedObjectId","status","title","timelineType"],null!==(a=t(n,e))&&void 0!==a?a:y.b)})),[T,w]=Object(i.useState)(!1),[M,I]=Object(i.useState)(!1),C=Object(i.useCallback)((async t=>{I(!1),await o(h.l,{deepLinkId:O.a.case,path:null!=t?Object(x.b)({id:t.id}):Object(x.c)()}),u(Object(E.setInsertTimeline)({graphEventId:c,timelineId:e,timelineSavedObjectId:d,timelineTitle:v}))}),[u,c,o,d,e,v]),A=Object(S.h)(),D=Object(i.useCallback)((()=>{w((e=>!e))}),[]),N=Object(i.useCallback)((()=>w(!1)),[]),F=Object(i.useCallback)((()=>{N(),o(h.l,{deepLinkId:O.a.case,path:Object(x.c)()}).then((()=>{u(Object(E.setInsertTimeline)({graphEventId:c,timelineId:e,timelineSavedObjectId:d,timelineTitle:v.length>0?v:k.l})),u(Object(E.showTimeline)({id:b.c.active,show:!1}))}))}),[u,c,o,N,d,e,v]),P=Object(i.useCallback)((()=>{N(),I(!0)}),[I,N]),R=Object(i.useCallback)((()=>{I(!1)}),[I]),L=Object(i.useCallback)((()=>{w(!1)}),[]),B=Object(i.useMemo)((()=>l.a.createElement(a.EuiButton,{fill:!0,size:"m","data-test-subj":"attach-timeline-case-button",iconType:"arrowDown",iconSide:"right",onClick:D,disabled:m===g.k.draft||j!==g.l.default},k.c)),[D,m,j]),_=Object(i.useMemo)((()=>[l.a.createElement(a.EuiContextMenuItem,{key:"new-case","data-test-subj":"attach-timeline-new-case",onClick:F},k.e),l.a.createElement(a.EuiContextMenuItem,{key:"existing-case","data-test-subj":"attach-timeline-existing-case",onClick:P},k.d)]),[P,F]);return l.a.createElement(l.a.Fragment,null,l.a.createElement(a.EuiPopover,{id:"singlePanel",button:B,isOpen:T,closePopover:L,panelPaddingSize:"none",anchorPosition:"downLeft"},l.a.createElement(a.EuiContextMenuPanel,{items:_})),M&&n.ui.getAllCasesSelectorModal({onRowClick:C,onClose:R,owner:[h.i],permissions:A}))};j.displayName="AddToCaseButtonComponent";const T=l.a.memo(j);var w=n(701),M=n(657),I=n(149),C=n(130),A=n.n(C),D=n(3),N=n(13),F=n(113),P=n(108),R=n(5);const L=R.i18n.translate("xpack.securitySolution.timeline.kpiFailDescription",{defaultMessage:"An error has occurred"}),B=R.i18n.translate("xpack.securitySolution.timeline.kpiFailSearchDescription",{defaultMessage:"Failed to load KPIs"});var _=n(116),q=n(187),z=n(148),V=n(161),$=n(110),Q=n(519);const U=e=>R.i18n.translate("xpack.securitySolution.timeline.flyout.header.closeTimelineButtonLabel",{defaultMessage:"Close {isTimeline, select, true {timeline} false {template}}",values:{isTimeline:e}}),H=R.i18n.translate("xpack.securitySolution.timeline.properties.unsavedLabel",{defaultMessage:"Unsaved"}),G=R.i18n.translate("xpack.securitySolution.timeline.properties.autosavedLabel",{defaultMessage:"Autosaved"}),W=R.i18n.translate("xpack.securitySolution.timeline.properties.inspectTimelineTitle",{defaultMessage:"Timeline"}),K=R.i18n.translate("xpack.securitySolution.timeline.kpis.processKpiTitle",{defaultMessage:"Processes"}),Y=R.i18n.translate("xpack.securitySolution.timeline.kpis.hostKpiTitle",{defaultMessage:"Hosts"}),J=R.i18n.translate("xpack.securitySolution.timeline.kpis.sourceIpKpiTitle",{defaultMessage:"Source IPs"}),X=R.i18n.translate("xpack.securitySolution.timeline.kpis.destinationKpiTitle",{defaultMessage:"Destination IPs"}),Z=R.i18n.translate("xpack.securitySolution.timeline.kpis.userKpiTitle",{defaultMessage:"Users"}),ee=R.i18n.translate("xpack.securitySolution.timeline.properties.readMore",{defaultMessage:"Read More"}),te=({isOpen:e,title:t})=>R.i18n.translate("xpack.securitySolution.timeline.properties.timelineToggleButtonAriaLabel",{values:{isOpen:e,title:t},defaultMessage:"{isOpen, select, false {Open} true {Close} other {Toggle}} timeline {title}"}),ne=u()(a.EuiHealth).withConfig({displayName:"EuiHealthStyled",componentId:"sc-m1giyi-0"})(["display:block;"]),ae=u()(a.EuiButtonEmpty).withConfig({displayName:"StyledEuiButtonEmpty",componentId:"sc-m1giyi-1"})(["> span{padding:0;}"]),ie=u()(a.EuiFlexItem).withConfig({displayName:"TitleConatiner",componentId:"sc-m1giyi-2"})(["overflow:hidden;display:inline-block;text-overflow:ellipsis;"]),le=({timelineId:e,timelineStatus:t,timelineType:n,timelineTitle:o,updated:u,isOpen:d})=>{const m=Object(s.useDispatch)(),p=Object(i.useCallback)((()=>{m(f.a.showTimeline({id:e,show:!d})),Object(z.i)()}),[m,d,e]),b=Object(r.isEmpty)(o)?n===g.l.template?k.k:k.l:o,y=Object(i.useMemo)((()=>t===g.k.draft?l.a.createElement(l.a.Fragment,null,H):l.a.createElement(l.a.Fragment,null,G," ",l.a.createElement(c.FormattedRelative,{"data-test-subj":"timeline-status",key:"timeline-status-autosaved",value:new Date(u)}))),[t,u]);return l.a.createElement(ae,{"aria-label":te({isOpen:d,title:b}),className:z.b,flush:"both","data-test-subj":"flyoutOverlay",size:"s",isSelected:d,onClick:p},l.a.createElement(a.EuiFlexGroup,{gutterSize:"none",alignItems:"center",justifyContent:"flexStart",responsive:!1},l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiToolTip,{position:"top",content:y},l.a.createElement(ne,{color:t===g.k.draft?"warning":"success"}))),l.a.createElement(ie,{grow:!1},b),!d&&l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(Q.b,null))))},re=l.a.memo(le);var se=n(139),oe=n(55),ue=n.n(oe),ce=n(117);const de=u()(a.EuiStat).withConfig({displayName:"NoWrapEuiStat",componentId:"sc-iiqy2a-0"})(["& .euiStat__description{white-space:nowrap;}"]),me=l.a.memo((({kpis:e,isLoading:t})=>{const n="0,0.[000]a",[r]=Object(S.p)(h.O),s=Object(i.useMemo)((()=>({process:null===e?Object(ce.e)():ue()(e.processCount).format(n),user:null===e?Object(ce.e)():ue()(e.userCount).format(n),host:null===e?Object(ce.e)():ue()(e.hostCount).format(n),sourceIp:null===e?Object(ce.e)():ue()(e.sourceIpCount).format(n),destinationIp:null===e?Object(ce.e)():ue()(e.destinationIpCount).format(n)})),[e]),o=Object(i.useMemo)((()=>({process:ue()(null==e?void 0:e.processCount).format(r),user:ue()(null==e?void 0:e.userCount).format(r),host:ue()(null==e?void 0:e.hostCount).format(r),sourceIp:ue()(null==e?void 0:e.sourceIpCount).format(r),destinationIp:ue()(null==e?void 0:e.destinationIpCount).format(r)})),[e,r]);return l.a.createElement(a.EuiFlexGroup,{wrap:!0,"data-test-subj":"siem-timeline-kpis"},l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiToolTip,{position:"left",content:o.process},l.a.createElement(de,{"data-test-subj":"siem-timeline-process-kpi",title:s.process,description:K,titleSize:"s",isLoading:t}))),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiToolTip,{position:"left",content:o.user},l.a.createElement(de,{"data-test-subj":"siem-timeline-user-kpi",title:s.user,description:Z,titleSize:"s",isLoading:t}))),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiToolTip,{position:"left",content:o.host},l.a.createElement(de,{"data-test-subj":"siem-timeline-host-kpi",title:s.host,description:Y,titleSize:"s",isLoading:t}))),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiToolTip,{position:"left",content:o.sourceIp},l.a.createElement(de,{"data-test-subj":"siem-timeline-source-ip-kpi",title:s.sourceIp,description:J,titleSize:"s",isLoading:t}))),l.a.createElement(a.EuiFlexItem,{grow:!1,style:{minWidth:100}},l.a.createElement(a.EuiToolTip,{position:"left",content:o.destinationIp},l.a.createElement(de,{"data-test-subj":"siem-timeline-destination-ip-kpi",title:s.destinationIp,description:X,titleSize:"s",isLoading:t}))))}));me.displayName="TimelineKPIs";var pe=n(639);const be=u()(a.EuiFlexItem).withConfig({displayName:"ActiveTimelinesContainer",componentId:"sc-a6ccyo-0"})(["overflow:hidden;"]),ge=({timelineId:e})=>{const t=Object(s.useDispatch)(),{browserFields:n,indexPattern:o}=Object(_.d)($.SourcererScopeName.timeline),{uiSettings:u}=Object(S.j)().services,c=Object(i.useMemo)((()=>Object(d.getEsQueryConfig)(u)),[u]),g=Object(i.useMemo)((()=>f.b.getTimelineByIdSelector()),[]),{activeTab:v,dataProviders:h,kqlQuery:E,title:x,timelineType:O,status:k,updated:j,show:T,filters:M,kqlMode:C}=Object(p.a)((t=>{var n;return Object(r.pick)(["activeTab","dataProviders","kqlQuery","status","title","timelineType","updated","show","filters","kqlMode"],null!==(n=g(t,e))&&void 0!==n?n:y.b)})),A=Object(i.useMemo)((()=>!Object(r.isEmpty)(h)||!Object(r.isEmpty)(Object(r.get)("filterQuery.kuery.expression",E))),[h,E]),D=Object(i.useMemo)((()=>f.b.getKqlFilterQuerySelector()),[]),N=Object(s.useSelector)((t=>D(t,e))),F=Object(r.isEmpty)(h)&&Object(r.isEmpty)(N)&&"template"===O?" ":N,P=Object(i.useMemo)((()=>({query:F,language:"kuery"})),[F]),R=Object(i.useMemo)((()=>Object(V.d)({config:c,dataProviders:h,indexPattern:o,browserFields:n,filters:M||[],kqlQuery:P,kqlMode:C})),[n,h,c,M,o,C,P]),L=Object(i.useCallback)((()=>{t(f.a.showTimeline({id:e,show:!1})),Object(z.i)()}),[t,e]),{euiTheme:B}=Object(a.useEuiTheme)();return l.a.createElement(a.EuiPanel,{borderRadius:"none",grow:!1,paddingSize:"s",hasShadow:!1,"data-test-subj":"timeline-flyout-header-panel",style:{backgroundColor:B.colors.emptyShade,color:B.colors.text}},l.a.createElement(a.EuiFlexGroup,{alignItems:"center",gutterSize:"s",responsive:!1},l.a.createElement(w.b,{timelineId:e}),l.a.createElement(be,{grow:!1},l.a.createElement(re,{timelineId:e,timelineType:O,timelineTitle:x,timelineStatus:k,isOpen:T,updated:j})),T&&l.a.createElement(a.EuiFlexItem,null,l.a.createElement(a.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"s",responsive:!1},(v===b.d.query||v===b.d.eql)&&l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(I.b,{compact:!0,queryId:`${e}-${v}`,inputId:m.a.timeline,inspectIndex:0,isDisabled:!A||void 0===(null==R?void 0:R.filterQuery),title:W})),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiToolTip,{content:U("default"===O)},l.a.createElement(a.EuiButtonIcon,{"aria-label":U("default"===O),"data-test-subj":"close-timeline",iconType:"cross",onClick:L})))))))},fe=l.a.memo(ge),ye=u.a.div.withConfig({displayName:"StyledDiv",componentId:"sc-a6ccyo-1"})(["display:-webkit-box;-webkit-line-clamp:1;-webkit-box-orient:vertical;overflow:hidden;word-break:break-word;"]),ve=({description:e,onclick:t})=>{const[n,i]=Object(pe.a)(e);return l.a.createElement(l.a.Fragment,null,l.a.createElement(ye,{ref:i},e),n&&l.a.createElement(a.EuiButtonEmpty,{flush:"left",onClick:t},ee))},he=u()(a.EuiFlexGroup).withConfig({displayName:"StyledTimelineHeader",componentId:"sc-a6ccyo-2"})([""," flex:0;"],(({theme:e})=>`margin: ${e.eui.euiSizeXS} ${e.eui.euiSizeS} 0 ${e.eui.euiSizeS};`)),Ee=u.a.span.withConfig({displayName:"TimelineStatusInfoContainer",componentId:"sc-a6ccyo-3"})([""," white-space:nowrap;"],(({theme:e})=>`margin-left: ${e.eui.euiSizeS};`)),Se=u.a.div.withConfig({displayName:"KpisContainer",componentId:"sc-a6ccyo-4"})(["",""],(({theme:e})=>`margin-right: ${e.eui.euiSizeM};`)),xe=u()(a.EuiFlexItem).withConfig({displayName:"RowFlexItem",componentId:"sc-a6ccyo-5"})(["flex-direction:row;align-items:center;"]),Oe=u.a.h3.withConfig({displayName:"TimelineTitleContainer",componentId:"sc-a6ccyo-6"})(["display:-webkit-box;overflow:hidden;-webkit-line-clamp:1;-webkit-box-orient:vertical;word-break:break-word;"]),ke=({timelineId:e})=>{const t=Object(i.useMemo)((()=>f.b.getTimelineByIdSelector()),[]),{title:n,timelineType:s}=Object(p.a)((n=>{var a;return Object(r.pick)(["title","timelineType"],null!==(a=t(n,e))&&void 0!==a?a:y.b)})),o=Object(i.useMemo)((()=>s===g.l.template?k.k:k.l),[s]),u=Object(i.useMemo)((()=>n||o),[n,o]);return l.a.createElement(a.EuiToolTip,{content:u,position:"bottom"},l.a.createElement(a.EuiText,null,l.a.createElement(Oe,{"data-test-subj":"timeline-title"},u)))},je=l.a.memo(ke),Te=({timelineId:e})=>{const t=Object(i.useMemo)((()=>f.b.getTimelineByIdSelector()),[]),n=Object(p.a)((n=>{var a;return(null!==(a=t(n,e))&&void 0!==a?a:y.b).description})),r=Object(s.useDispatch)(),o=Object(i.useCallback)((t=>{r(Object(E.setActiveTabTimeline)({id:e,activeTab:b.d.notes,scrollToTop:!0}))}),[r,e]);return l.a.createElement(a.EuiText,{size:"s","data-test-subj":"timeline-description"},l.a.createElement(ve,{description:n||k.f,onclick:o}))},we=l.a.memo(Te),Me=({timelineId:e})=>{const t=Object(i.useMemo)((()=>Object(se.createSelector)(f.b.selectTimeline,(e=>{var t,n;return{status:null!==(t=null==e?void 0:e.status)&&void 0!==t?t:g.k.draft,updated:null!==(n=null==e?void 0:e.updated)&&void 0!==n?n:void 0}}))),[]),{status:n,updated:r}=Object(p.a)((n=>t(n,e)));return Object(i.useMemo)((()=>n===g.k.draft),[n])?l.a.createElement(a.EuiText,{size:"xs"},l.a.createElement(a.EuiTextColor,{color:"warning","data-test-subj":"timeline-status"},H)):l.a.createElement(a.EuiText,{size:"xs"},l.a.createElement(a.EuiTextColor,{color:"default"},G," ",l.a.createElement(c.FormattedRelative,{"data-test-subj":"timeline-status",key:"timeline-status-autosaved",value:new Date(r)})))},Ie=l.a.memo(Me),Ce=({timelineId:e})=>{var t;const{selectedPatterns:n,indexPattern:o,browserFields:u}=Object(_.d)($.SourcererScopeName.timeline),c=Object(i.useMemo)((()=>Object(q.i)()),[]),m=Object(i.useMemo)((()=>Object(q.b)()),[]),g=Object(i.useMemo)((()=>e===b.c.active),[e]),h=Object(p.a)((e=>g?{from:c(e.inputs.timeline),to:m(e.inputs.timeline),interval:""}:{from:c(e.inputs.global),to:m(e.inputs.global),interval:""})),{uiSettings:E}=Object(S.j)().services,x=Object(i.useMemo)((()=>Object(d.getEsQueryConfig)(E)),[E]),O=Object(i.useMemo)((()=>f.b.getTimelineByIdSelector()),[]),k=Object(s.useSelector)((t=>{var n;return null!==(n=O(t,e))&&void 0!==n?n:y.b})),{dataProviders:j,filters:w,timelineType:I,kqlMode:C,activeTab:R}=k,z=Object(i.useMemo)((()=>f.b.getKqlFilterQuerySelector()),[]),Q=Object(s.useSelector)((t=>z(t,e))),U=Object(r.isEmpty)(j)&&Object(r.isEmpty)(Q)&&"template"===I?" ":Q,H=Object(i.useMemo)((()=>({query:U,language:"kuery"})),[U]),G=Object(i.useMemo)((()=>Object(V.d)({config:x,dataProviders:j,indexPattern:o,browserFields:u,filters:w||[],kqlQuery:H,kqlMode:C})),[u,j,x,w,o,C,H]),W=Object(i.useMemo)((()=>Object(r.isEmpty)(j)&&Object(r.isEmpty)(w)&&Object(r.isEmpty)(H.query)||void 0===(null==G?void 0:G.filterQuery)),[j,w,H,G]),[K,Y]=(({timerange:e,filterQuery:t,defaultIndex:n,isBlankTimeline:a})=>{const{data:l}=Object(S.j)().services,s=Object(i.useRef)(r.noop),o=Object(i.useRef)(new AbortController),u=Object(i.useRef)(new D.Subscription),[c,d]=Object(i.useState)(!1),[m,p]=Object(i.useState)(null),[b,g]=Object(i.useState)(null),{addError:f,addWarning:y}=Object(P.a)(),v=Object(i.useCallback)((e=>{if(null==e)return;const t=async()=>{o.current=new AbortController,d(!0),u.current=l.search.search(e,{strategy:"timelineSearchStrategy",abortSignal:o.current.signal}).subscribe({next:e=>{Object(N.isCompleteResponse)(e)?(d(!1),g(e),u.current.unsubscribe()):Object(N.isErrorResponse)(e)&&(d(!1),y(L),u.current.unsubscribe())},error:e=>{d(!1),f(e,{title:B}),u.current.unsubscribe()}})};u.current.unsubscribe(),o.current.abort(),t(),s.current=t}),[l.search,f,y]);return Object(i.useEffect)((()=>{p((a=>{const i={...null!=a?a:{},defaultIndex:n,timerange:e,filterQuery:t,factoryQueryType:F.A.kpi};return A()(a,i)?a:i}))}),[n,e,t]),Object(i.useEffect)((()=>(a?(d(!1),g(null)):v(m),()=>{u.current.unsubscribe(),o.current.abort()})),[a,m,v]),[c,b]})({defaultIndex:n,timerange:h,isBlankTimeline:W,filterQuery:null!==(t=null==G?void 0:G.filterQuery)&&void 0!==t?t:""}),J=Object(S.h)();return l.a.createElement(he,{alignItems:"center",gutterSize:"s"},l.a.createElement(a.EuiFlexItem,null,l.a.createElement(a.EuiFlexGroup,{"data-test-subj":"properties-left",direction:"column",gutterSize:"none"},l.a.createElement(xe,null,l.a.createElement(je,{timelineId:e}),l.a.createElement(M.a,{timelineId:e,initialFocus:"title"}),l.a.createElement(Ee,null,l.a.createElement(Ie,{timelineId:e}))),l.a.createElement(xe,null,l.a.createElement(we,{timelineId:e}),l.a.createElement(M.a,{timelineId:e,initialFocus:"description"})))),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(Se,null,R===b.d.query?l.a.createElement(me,{kpis:Y,isLoading:K}):null)),l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(a.EuiFlexGroup,{gutterSize:"s"},l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(v.a,{timelineId:e})),J.create&&J.read&&l.a.createElement(a.EuiFlexItem,{grow:!1},l.a.createElement(T,{timelineId:e})))))};Ce.displayName="FlyoutHeaderComponent";const Ae=l.a.memo(Ce)},942:function(e,t,n){"use strict";n.d(t,"b",(function(){return E})),n.d(t,"a",(function(){return O})),n.d(t,"c",(function(){return I}));var a=n(2),i=n.n(a),l=n(40),r=n(106),s=n(676),o=n(169);const u="timeline";var c=n(5);const d=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.insertTimelineButtonLabel",{defaultMessage:"Insert timeline link"}),m=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.noTimelineNameFoundErrorMsg",{defaultMessage:"No timeline name found"}),p=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.noTimelineIdFoundErrorMsg",{defaultMessage:"No timeline id found"}),b=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.noParenthesesErrorMsg",{defaultMessage:"Expected left parentheses"}),g=e=>c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.failedRetrieveTimelineErrorMsg",{defaultMessage:"Failed to retrieve timeline id: { timelineId }",values:{timelineId:e}}),f=c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.timelineErrorTitle",{defaultMessage:"Timeline Error"});var y=n(131);const v=({onClosePopover:e,onInsert:t})=>{const{formatUrl:n}=Object(o.m)(y.a.timelines),u=Object(a.useCallback)((({timelines:e})=>[...e.map(((e,t)=>({description:e.description,favorite:e.favorite,label:e.title,id:e.savedObjectId,key:`${e.title}-${t}`,title:e.title,checked:void 0})))]),[]),c=Object(a.useCallback)(((e,a,i)=>{const l=n(Object(o.l)(null!=a?a:"",i),{absolute:!0,skipSearch:!0});t(`[${e}](${l})`,{block:!1})}),[n,t]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(l.EuiModalHeader,null),i.a.createElement(l.EuiModalBody,null,i.a.createElement(s.a,{hideUntitled:!0,getSelectableOptions:u,onTimelineChange:c,onClosePopover:e,timelineType:r.l.default})))},h=Object(a.memo)(v),E={name:u,button:{label:d,iconType:"timeline"},helpText:i.a.createElement(l.EuiCodeBlock,{language:"md",paddingSize:"s",fontSize:"l"},"[title](url)"),editor:function({node:e,onSave:t,onCancel:n}){return i.a.createElement(h,{onClosePopover:n,onInsert:t})}};var S=n(56),x=n(478);const O=function(){const e=this.Parser,t=e.prototype.inlineTokenizers,n=e.prototype.inlineMethods,a=function(e,t,n){let a=0;if("["!==t[a])return!1;if(n)return!0;function i(e,n){if(t[a]!==e)throw new Error(b);a++;let i="",l=0;for(;a<t.length;a++){const r=t[a];if(r===n&&0===l)return a++,i;r===n?l--:r===e&&l++,i+=r}return""}const l=i("[","]"),r=i("(",")"),s=e.now();if(!l)return this.file.info(m,{line:s.line,column:s.column}),!1;try{var o;const t=r.split("?"),n=Object(x.parse)(t[1]),a=Object(S.safeDecode)(null!==(o=n.timeline)&&void 0!==o?o:""),{id:i="",graphEventId:c=""}=null!=a?a:{id:null,graphEventId:""};return i?e(`[${l}](${r})`)({type:u,id:i,title:l,graphEventId:c}):(this.file.info(p,{line:s.line,column:s.column+r.indexOf("id")}),!1)}catch{this.file.info((e=>c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.toolTip.timelineUrlIsNotValidErrorMsg",{defaultMessage:"Timeline URL is not valid => {timelineUrl}",values:{timelineUrl:e}}))(r),{line:s.line,column:s.column})}return!1},i=function(e,t,n){return!(!1===t.startsWith("[")||!0===t.startsWith("[")&&!t.includes("timelines?timeline=(id"))&&a.call(this,e,t,n)};i.locator=(e,t)=>e.indexOf("[",t),t.timeline=i,n.splice(n.indexOf("url"),0,u)};var k=n(103),j=n(164),T=n(12),w=n(108);const M=({id:e,title:t,graphEventId:n})=>{const{addError:r}=Object(w.a)(),s=(()=>{const e=Object(k.useDispatch)();return Object(a.useCallback)(((t,n,a)=>{Object(j.h)({graphEventId:a,timelineId:t,onError:n,updateIsLoading:({id:t,isLoading:n})=>e(Object(T.updateIsLoading)({id:t,isLoading:n})),updateTimeline:Object(j.b)(e)})}),[e])})(),o=Object(a.useCallback)(((e,t)=>{r(e,{title:f,toastMessage:g(t)})}),[r]),u=Object(a.useCallback)((()=>s(null!=e?e:"",o,n)),[e,n,s,o]);return i.a.createElement(l.EuiToolTip,{content:(d=null!=e?e:"",c.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.toolTip.timelineId",{defaultMessage:"Timeline id: { timelineId }",values:{timelineId:d}}))},i.a.createElement(l.EuiLink,{onClick:u,"data-test-subj":`markdown-timeline-link-${e}`},t));var d},I=Object(a.memo)(M)},945:function(e,t,n){"use strict";n.d(t,"a",(function(){return V}));var a=n(42),i=n(40),l=n(2),r=n.n(l),s=n(41),o=n.n(s),u=n(150),c=n(106),d=n(183),m=n(5);const p=m.i18n.translate("xpack.securitySolution.editDataProvider.doesNotExistLabel",{defaultMessage:"does not exist"}),b=m.i18n.translate("xpack.securitySolution.editDataProvider.existsLabel",{defaultMessage:"exists"}),g=m.i18n.translate("xpack.securitySolution.editDataProvider.fieldLabel",{defaultMessage:"Field"}),f=m.i18n.translate("xpack.securitySolution.editDataProvider.placeholder",{defaultMessage:"Select a field"}),y=m.i18n.translate("xpack.securitySolution.editDataProvider.isLabel",{defaultMessage:"is"}),v=m.i18n.translate("xpack.securitySolution.editDataProvider.isOneOfLabel",{defaultMessage:"is one of"}),h=m.i18n.translate("xpack.securitySolution.editDataProvider.isNotLabel",{defaultMessage:"is not"}),E=m.i18n.translate("xpack.securitySolution.editDataProvider.isNotOneOfLabel",{defaultMessage:"is not one of"}),S=m.i18n.translate("xpack.securitySolution.editDataProvider.includesPlaceholder",{defaultMessage:"enter one or more values"}),x=m.i18n.translate("xpack.securitySolution.editDataProvider.operatorLabel",{defaultMessage:"Operator"}),O=m.i18n.translate("xpack.securitySolution.editDataProvider.saveButton",{defaultMessage:"Save"}),k=m.i18n.translate("xpack.securitySolution.editDataProvider.valuePlaceholder",{defaultMessage:"value"}),j=m.i18n.translate("xpack.securitySolution.editDataProvider.valueLabel",{defaultMessage:"Value"}),T=m.i18n.translate("xpack.securitySolution.editDataProvider.selectAnOperatorPlaceholder",{defaultMessage:"Select an operator"}),w=e=>m.i18n.translate("xpack.securitySolution.editDataProvider.unavailableOperator",{values:{operator:e},defaultMessage:"{operator} operator is unavailable with templates"}),M=[{label:y},{label:h},{label:v},{label:E},{label:b},{label:p}],I=[],C=e=>e?Object.keys(e).sort().map((t=>{return{label:t,options:(n=e[t],null!=n.fields&&Object.keys(n.fields).length>0?Object.keys(n.fields):I).map((e=>({label:e})))};var n})):I,A=({browserFields:e,selectedField:t,selectedOperator:n,type:i})=>{const l=t.length>0?t[0].label:"",r=n.length>0?n[0].label:"",s=e&&null!=Object(d.a)(e)[l],o=-1!==Object(a.findIndex)((e=>e.label===r),M),u=i===c.a.template&&(r===v||r===E);return s&&o&&!u},D=e=>{switch(e.length>0?e[0].label:""){case y:case h:return u.d;case v:case E:return u.c;case b:case p:return u.b;default:return u.d}},N=e=>{switch(e.length>0?e[0].label:""){case h:case E:case p:return!0;default:return!1}},F=e=>Array.isArray(e)?e.length?`${e[0]}`:"":`${e}`;var P=n(148);const R=({value:e,onChangeCallback:t})=>{const[n,a]=Object(l.useState)(L(e));Object(l.useEffect)((()=>{t(B(n))}),[n,t]);const s=Object(l.useCallback)(((e,t=n)=>{const i=e.trim().toLowerCase();i&&-1===t.findIndex((e=>e.label.trim().toLowerCase()===i))&&a([...n,{label:e}])}),[n]),o=Object(l.useCallback)((e=>{a(e)}),[]);return r.a.createElement(i.EuiComboBox,{noSuggestions:!0,isClearable:!0,"data-test-subj":"is-one-of-combobox-input",selectedOptions:n,placeholder:S,onCreateOption:s,onChange:o})},L=e=>Object(P.k)(e)?e.map((e=>({label:String(e)}))):[],B=e=>e.map((e=>e.label)),_=({value:e,onChangeCallback:t})=>{const[n,a]=Object(l.useState)(q(e));Object(l.useEffect)((()=>{t(F(n))}),[n,t]);const s=Object(l.useCallback)((e=>{a(e.target.value)}),[]);return r.a.createElement(i.EuiFieldText,{className:"edit-data-provider-value",onChange:s,placeholder:k,value:F(n)})},q=e=>{var t;return Object(P.k)(e)?null!==(t=e[0])&&void 0!==t?t:"":e},z="edit-data-provider-save";o.a.div.withConfig({displayName:"HeaderContainer",componentId:"sc-1dznxok-0"})(["width:",";"],400).displayName="HeaderContainer";const V=r.a.memo((({andProviderId:e,browserFields:t,field:n,isExcluded:s,onDataProviderEdited:o,operator:c,providerId:d,timelineId:m,value:S,type:k=u.a.default})=>{const[I,F]=Object(l.useState)([{label:n}]),[P,L]=Object(l.useState)(((e,t)=>":"===t?e?[{label:h}]:[{label:y}]:"includes"===t?e?[{label:E}]:[{label:v}]:e?[{label:p}]:[{label:b}])(s,c)),[B,q]=Object(l.useState)(S),V=Object(l.useMemo)((()=>P.length>0&&(P[0].label===v||P[0].label===E)),[P]),$=Object(l.useMemo)((()=>k!==u.a.template&&P.length>0&&P[0].label!==b&&P[0].label!==p&&!V),[V,k,P]),Q=Object(l.useMemo)((()=>V&&Array.isArray(B)&&!B.length),[V,B]),U=()=>{const e=document.getElementsByClassName("edit-data-provider-value");if(e.length>0)e[0].focus();else{const e=document.getElementsByClassName(z);e.length>0&&e[0].focus()}},H=Object(l.useCallback)((e=>{F(e),k===u.a.template&&q(`{${e[0].label}}`),U()}),[k]),G=Object(l.useCallback)((e=>{L(e),U()}),[]),W=Object(l.useCallback)((e=>{q(e)}),[]),K=Object(l.useCallback)((()=>{o({andProviderId:e,excluded:N(P),field:I.length>0?I[0].label:"",id:m,operator:D(P),providerId:d,value:B,type:k})}),[o,e,P,I,m,d,B,k]);return Object(l.useEffect)((()=>((()=>{const e=void 0!==window.pageXOffset?window.pageXOffset:(document.documentElement||document.body.parentNode||document.body).scrollLeft,t=void 0!==window.pageYOffset?window.pageYOffset:(document.documentElement||document.body.parentNode||document.body).scrollTop;window.onscroll=()=>window.scrollTo(e,t)})(),()=>{window.onscroll=()=>a.noop})),[]),r.a.createElement(i.EuiPanel,{paddingSize:"s"},r.a.createElement(i.EuiFlexGroup,{direction:"column",gutterSize:"none"},r.a.createElement(i.EuiFlexItem,{grow:!0},r.a.createElement(i.EuiFormRow,{label:g},r.a.createElement(i.EuiComboBox,{autoFocus:!0,"data-test-subj":"field",isClearable:!1,onChange:H,options:C(t),placeholder:f,selectedOptions:I,singleSelection:{asPlainText:!0},fullWidth:!0}))),r.a.createElement(i.EuiFlexItem,{grow:!1},r.a.createElement(i.EuiSpacer,{size:"m"})),r.a.createElement(i.EuiFlexItem,{grow:!0},r.a.createElement(i.EuiFlexGroup,{gutterSize:"s",direction:"row",justifyContent:"spaceBetween"},r.a.createElement(i.EuiFlexItem,{grow:!0},r.a.createElement(i.EuiFormRow,{label:x},r.a.createElement(i.EuiComboBox,{"data-test-subj":"operator",isClearable:!1,onChange:G,options:M,placeholder:T,selectedOptions:P,singleSelection:{asPlainText:!0},style:{minWidth:152}}))))),r.a.createElement(i.EuiFlexItem,{grow:!1},r.a.createElement(i.EuiSpacer,{size:"m"})),r.a.createElement(i.EuiFlexItem,{grow:!1},$&&r.a.createElement(i.EuiFormRow,{label:j},r.a.createElement(_,{onChangeCallback:W,value:S})),V&&k!==u.a.template&&r.a.createElement(i.EuiFormRow,{label:j},r.a.createElement(R,{onChangeCallback:W,value:S}))),r.a.createElement(i.EuiFlexItem,{grow:!1},r.a.createElement(i.EuiSpacer,{size:"m"})),r.a.createElement(i.EuiFlexItem,{grow:!1},k===u.a.template&&V&&r.a.createElement(r.a.Fragment,null,r.a.createElement(i.EuiCallOut,{color:"warning",iconType:"warning",size:"s",title:w(P[0].label)}),r.a.createElement(i.EuiSpacer,{size:"m"})),r.a.createElement(i.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"none"},r.a.createElement(i.EuiFlexItem,{grow:!1},r.a.createElement(i.EuiButton,{className:z,color:"primary","data-test-subj":"save",fill:!0,isDisabled:!A({type:k,browserFields:t,selectedField:I,selectedOperator:P})||Q,onClick:K,size:"m"},O))))))}));V.displayName="StatefulEditDataProvider"},947:function(e,t,n){"use strict";n.d(t,"a",(function(){return E}));var a=n(2),i=n.n(a),l=n(40),r=n(108),s=n(5);const o=s.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.cancelTitle",{defaultMessage:"Cancel"}),u=s.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.overwriteExceptionLabel",{defaultMessage:'Overwrite existing exception lists with conflicting "list_id"'}),c=s.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.overwriteActionConnectorsLabel",{defaultMessage:'Overwrite existing connectors with conflicting action "id"'}),d=e=>s.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importExceptionsFailedLabel",{values:{totalExceptions:e},defaultMessage:"Failed to import {totalExceptions} {totalExceptions, plural, =1 {exception} other {exceptions}}"}),m=e=>s.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importConnectorsFailedLabel",{values:{totalConnectors:e},defaultMessage:"Failed to import {totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}}"}),p=s.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsWarningButton",{defaultMessage:"Go to connectors"}),b=s.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsAdditionalPrivilegesError",{defaultMessage:"You need additional privileges to import rules with actions."}),g=(e,t,n)=>{const a=n.map((t=>e(t.error.message))),i=new Error(a.join(". "));return i.stack=void 0,i.name="Network errors",i.raw_network_error=t,i};var f=n(407);const y=({actionConnectorsWarnings:e,importedActionConnectorsCount:t})=>{const{http:n}=Object(f.b)().services;if(!t||!e.length)return null;const{actionPath:a,message:r,buttonLabel:o}=e[0];return i.a.createElement(l.EuiCallOut,{"data-test-subj":"actionConnectorsWarningsCallOut",size:"m",heading:"h2",iconType:"warning",title:i.a.createElement("span",{"data-test-subj":"actionConnectorsWarningsCallOutTitle"},(u=t,s.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsWarningTitle",{values:{totalConnectors:u},defaultMessage:"{totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}} imported"}))),color:"warning"},i.a.createElement(l.EuiFlexGroup,{direction:"column",gutterSize:"none"},i.a.createElement(l.EuiFlexItem,{"data-test-subj":"actionConnectorsWarningsCallOutMessage"},i.a.createElement(l.EuiText,{size:"xs"},r)),i.a.createElement(l.EuiFlexItem,null,i.a.createElement(l.EuiFlexGroup,{gutterSize:"none",direction:"columnReverse",alignItems:"flexEnd"},i.a.createElement(l.EuiButton,{"data-test-subj":"actionConnectorsWarningsCallOutButton",color:"warning",href:n.basePath.prepend(a)},o||p)))));var u};y.displayName="ActionConnectorWarningsComponent";const v=i.a.memo(y);v.displayName="ActionConnectorWarnings";const h=({checkBoxLabel:e,closeModal:t,description:n,errorMessage:p,failedDetailed:f,importComplete:y,importData:h,showCheckBox:E=!0,showExceptionsCheckBox:S=!1,showActionConnectorsCheckBox:x=!1,showModal:O,submitBtnText:k,subtitle:j,successMessage:T,title:w})=>{const[M,I]=Object(a.useState)(null),[C,A]=Object(a.useState)(!1),[D,N]=Object(a.useState)(!1),[F,P]=Object(a.useState)(!1),[R,L]=Object(a.useState)(!1),{addError:B,addSuccess:_}=Object(r.a)(),[q,z]=Object(a.useState)([]),[V,$]=Object(a.useState)(0),Q=Object(a.useCallback)((()=>{t(),N(!1),P(!1),L(!1),z([])}),[t,N,P]),U=Object(a.useCallback)((e=>{A(!1),I(null),y(),e&&(y(),Q())}),[Q,y]),H=Object(a.useCallback)((async()=>{if(null!=M){A(!0);const e=new AbortController;try{const{action_connectors_warnings:t,...n}=await h({fileToImport:M[0],overwrite:D,overwriteExceptions:F,overwriteActionConnectors:R,signal:e.signal}),a=n.action_connectors_success_count;z(t),$(a),(({importResponse:e,exceptionsIncluded:t,actionConnectorsIncluded:n,successMessage:a,errorMessage:i,errorMessageDetailed:l,addError:r,addSuccess:o})=>{if(e.success)return e.success_count>0&&o(a(e.success_count)),t&&e.exceptions_success&&null!=e.exceptions_success_count&&e.exceptions_success_count>0&&o((c=e.exceptions_success_count,s.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.exceptionsSuccessLabel",{values:{totalExceptions:c},defaultMessage:"Successfully imported {totalExceptions} {totalExceptions, plural, =1 {exception} other {exceptions}}."}))),void(n&&e.action_connectors_success&&null!=e.action_connectors_success_count&&e.action_connectors_success_count>0&&o((u=e.action_connectors_success_count,s.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.connectorsSuccessLabel",{values:{totalConnectors:u},defaultMessage:"Successfully imported {totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}}."}))));var u,c;if(e.errors.length>0){if(n&&null!=e.action_connectors_errors&&e.action_connectors_errors.length>0){const{mappedErrors:t,numberOfActions:n}=(e=>{let t="";return{mappedErrors:e.map((e=>{const{id:n,error:a}=e;t=t&&t!==n?`${t},${n}`:n;const{status_code:i,message:l}=a||{};let r;return r=403===i?b:l,{...e,error:{...a,message:r}}})),numberOfActions:new Set(t&&[...t.split(",")]).size}})(e.action_connectors_errors);return r(g(l,e,t),{title:m(n||t.length)})}r(g(l,e,e.errors),{title:i(e.errors.length)}),t&&null!=e.exceptions_errors&&e.exceptions_errors.length>0&&r(g(l,e,e.exceptions_errors),{title:d(e.exceptions_errors.length)})}})({importResponse:n,exceptionsIncluded:S,actionConnectorsIncluded:x,successMessage:T,errorMessage:p,errorMessageDetailed:f,addError:B,addSuccess:_}),U(!(null!=t&&t.length))}catch(e){Q(),B(e,{title:p(1)})}}}),[M,h,D,F,R,S,T,p,f,B,_,x,U,Q]),G=Object(a.useCallback)((()=>{Q()}),[Q]),W=Object(a.useCallback)((()=>{N((e=>!e))}),[]),K=Object(a.useCallback)((()=>{P((e=>!e))}),[]),Y=Object(a.useCallback)((()=>{L((e=>!e))}),[]);return i.a.createElement(i.a.Fragment,null,O&&i.a.createElement(l.EuiModal,{onClose:G,maxWidth:"750px"},i.a.createElement(l.EuiModalHeader,null,i.a.createElement(l.EuiModalHeaderTitle,null,w)),i.a.createElement(l.EuiModalBody,null,i.a.createElement(l.EuiText,{size:"s"},i.a.createElement("h4",null,n)),i.a.createElement(l.EuiSpacer,{size:"s"}),i.a.createElement(l.EuiFilePicker,{"data-test-subj":"rule-file-picker",accept:".ndjson",id:"rule-file-picker",initialPromptText:j,onChange:e=>{I(e&&e.length>0?e:null)},display:"large",fullWidth:!0,isLoading:C}),i.a.createElement(l.EuiSpacer,{size:"s"}),i.a.createElement(v,{actionConnectorsWarnings:q,importedActionConnectorsCount:V}),i.a.createElement(l.EuiSpacer,{size:"s"}),E&&i.a.createElement(i.a.Fragment,null,i.a.createElement(l.EuiCheckbox,{"data-test-subj":"importDataModalCheckboxLabel",id:"importDataModalCheckboxLabel",label:e,checked:D,onChange:W}),S&&i.a.createElement(l.EuiCheckbox,{"data-test-subj":"importDataModalExceptionsCheckboxLabel",id:"importDataModalExceptionsCheckboxLabel",label:u,checked:F,onChange:K}),x&&i.a.createElement(l.EuiCheckbox,{"data-test-subj":"importDataModalActionConnectorsCheckbox",id:"importDataModalActionConnectorsCheckbox",label:c,checked:R,onChange:Y}))),i.a.createElement(l.EuiModalFooter,null,i.a.createElement(l.EuiButtonEmpty,{onClick:G},o),i.a.createElement(l.EuiButton,{"data-test-subj":"import-data-modal-button",onClick:H,disabled:null==M||C,fill:!0},k))))};h.displayName="ImportDataModalComponent";const E=i.a.memo(h);E.displayName="ImportDataModal"},949:function(e,t,n){"use strict";n.d(t,"a",(function(){return p}));var a=n(2),i=n.n(a),l=n(103),r=n(656),s=n(299),o=n(151),u=n(114),c=n(457),d=n(312);const m=({combinedQueries:e,filters:t,headerChildren:n,onlyField:m,paddingSize:p,query:b,showLegend:g,setAbsoluteRangeDatePickerTarget:f=u.a.global,runtimeMappings:y,hideQueryToggle:v=!1})=>{const h=Object(l.useDispatch)(),{signalIndexName:E}=Object(s.a)(),S=(x=t,Object(a.useMemo)((()=>[...x,...Object(d.d)(!1)]),[x]));var x;const O=Object(a.useCallback)((({x:e})=>{if(!e)return;const[t,n]=e;h(Object(o.setAbsoluteRangeDatePicker)({id:f,from:new Date(t).toISOString(),to:new Date(n).toISOString()}))}),[h,f]);return i.a.createElement(r.a,{combinedQueries:e,filters:S,headerChildren:n,legendPosition:"right",onlyField:m,paddingSize:p,query:b,showLegend:g,showLinkToAlerts:null==m,showStackBy:null==m,showTotalAlertsCount:!0,signalIndexName:E,runtimeMappings:y,title:c.b,titleSize:null==m?"m":"s",updateDateRange:O,hideQueryToggle:v})};m.displayName="SignalsByCategoryComponent";const p=i.a.memo(m)},950:function(e,t,n){"use strict";n.d(t,"a",(function(){return B}));var a=n(42),i=n(2),l=n.n(i),r=n(103),s=n(106),o=n(105),u=n(111),c=n(40),d=n(53),m=n.n(d),p=n(41),b=n.n(p),g=n(117),f=n(638),y=n(150),v=n(484);const h=b()(c.EuiBadge).withConfig({displayName:"ProviderBadgeStyled",componentId:"sc-l32wgy-0"})([".euiToolTipAnchor{&::after{font-style:normal;content:'|';padding:0px 3px;}}&.globalFilterItem{white-space:nowrap;min-width:",";display:flex;&.globalFilterItem-isDisabled{text-decoration:line-through;font-weight:400;font-style:italic;}&.globalFilterItem-isError{box-shadow:0 1px 1px -1px rgba(152,162,179,0.2),0 3px 2px -2px rgba(152,162,179,0.2),inset 0 0 0 1px #bd271e;}}"],(({$timelineType:e})=>e===s.l.template?"140px":"none"));h.displayName="ProviderBadgeStyled";const E=b.a.div.withConfig({displayName:"ProviderFieldBadge",componentId:"sc-l32wgy-1"})(["display:block;color:#fff;padding:6px 8px;font-size:0.6em;"]),S=b()(E).withConfig({displayName:"StyledTemplateFieldBadge",componentId:"sc-l32wgy-2"})(["background:",";text-transform:uppercase;"],(({theme:e})=>e.eui.euiColorVis3_behindText)),x=b()(E).withConfig({displayName:"ConvertFieldBadge",componentId:"sc-l32wgy-3"})(["background:",";cursor:pointer;&:hover{text-decoration:underline;}"],(({theme:e})=>e.eui.euiColorDarkShade)),O=({type:e,toggleType:t})=>e!==y.a.template?l.a.createElement(x,{onClick:t},v.d):l.a.createElement(S,null,v.v),k=l.a.memo(O),j={tabIndex:-1},T=l.a.memo((({deleteProvider:e,field:t,isEnabled:n,isExcluded:r,operator:o,providerId:u,togglePopover:c,toggleType:d,displayValue:p,val:b,type:E,timelineType:S})=>{const x=Object(i.useCallback)((t=>{t.stopPropagation&&t.stopPropagation(),e()}),[e]),O=Object(i.useMemo)((()=>m()("globalFilterItem",{"globalFilterItem-isDisabled":!n,"globalFilterItem-isExcluded":r})),[n,r]),T=Object(i.useMemo)((()=>Object(a.isString)(b)&&""===b?Object(g.b)():b),[b]),w=Object(i.useMemo)((()=>r?l.a.createElement("span",null,v.p," "):null),[r]),M=Object(i.useMemo)((()=>l.a.createElement(l.a.Fragment,null,w,o!==y.b?l.a.createElement("span",{className:"field-value"},`${t}: "${"includes"===o?p:T}"`):l.a.createElement("span",{className:"field-value"},t," ",v.j))),[p,t,T,o,w]),I=Object(i.useMemo)((()=>v.u({field:t,value:`${T}`})),[t,T]);return l.a.createElement(f.a,{id:`${u}-${t}-${b}`},l.a.createElement(l.a.Fragment,null,l.a.createElement(h,{className:O,color:"hollow",title:"",iconOnClick:x,iconOnClickAriaLabel:v.s,iconType:"cross",iconSide:"right",onClick:c,onClickAriaLabel:I,closeButtonProps:j,"data-test-subj":"providerBadge",$timelineType:S},M),S===s.l.template&&o!==y.c&&l.a.createElement(k,{toggleType:d,type:E})))}));T.displayName="ProviderBadge";var w=n(0),M=n.n(w),I=n(945);const C="edit-data-provider",A="exclude-data-provider",D="enable-data-provider",N="filter-for-field-present-data-provider",F="delete-data-provider",P=b()(c.EuiPopover).withConfig({displayName:"MyEuiPopover",componentId:"sc-2zwix7-0"})(["height:100%;user-select:none;"]);P.displayName="MyEuiPopover";class provider_item_actions_ProviderItemActions extends l.a.PureComponent{constructor(...e){super(...e),M()(this,"onDataProviderEdited",(({andProviderId:e,excluded:t,field:n,id:a,operator:i,providerId:l,value:r,type:s})=>{null!=this.props.onDataProviderEdited&&this.props.onDataProviderEdited({andProviderId:e,excluded:t,field:n,id:a,operator:i,providerId:l,value:r,type:s}),this.props.closePopover()})),M()(this,"onFilterForFieldPresent",(()=>{const{andProviderId:e,field:t,timelineId:n,providerId:a,value:i,type:l}=this.props;null!=this.props.onDataProviderEdited&&this.props.onDataProviderEdited({andProviderId:e,excluded:!1,field:t,id:`${n}`,operator:y.b,providerId:a,value:i,type:l}),this.props.closePopover()}))}render(){const{andProviderId:e,browserFields:t,button:n,closePopover:a,deleteProvider:i,field:r,isEnabled:o,isExcluded:u,isLoading:d,isOpen:m,operator:p,providerId:b,timelineId:g,timelineType:f,toggleEnabledProvider:h,toggleExcludedProvider:E,toggleTypeProvider:S,value:x,type:O}=this.props,k=(({andProviderId:e,browserFields:t,deleteItem:n,field:a,isEnabled:i,isExcluded:r,isLoading:o,operator:u,onDataProviderEdited:c,onFilterForFieldPresent:d,providerId:m,timelineId:p,timelineType:b,toggleEnabled:g,toggleExcluded:f,toggleType:h,type:E,value:S})=>[{id:0,items:[{className:C,disabled:o,icon:"pencil",name:v.g,panel:1},{className:A,disabled:o,icon:r?"plusInCircle":"minusInCircle",name:r?v.o:v.i,onClick:f},{className:D,disabled:o,icon:i?"eyeClosed":"eye",name:i?v.w:v.t,onClick:g},{className:N,disabled:o,icon:"logstashFilter",name:v.k,onClick:d},b===s.l.template?{className:"convert-to-field-data-provider",disabled:o||u===y.c,icon:"visText",name:E===y.a.template?v.c:v.d,onClick:h}:{name:null},{className:F,disabled:o,icon:"trash",name:v.e,onClick:n}].filter((e=>null!=e.name))},{content:null!=t&&null!=p&&null!=c?l.a.createElement(I.a,{andProviderId:e,browserFields:t,field:a,isExcluded:r,onDataProviderEdited:c,operator:u,providerId:m,timelineId:p,value:S,type:E}):null,id:1,title:v.h,width:400}])({andProviderId:e,browserFields:t,deleteItem:i,field:r,isEnabled:o,isExcluded:u,isLoading:d,onDataProviderEdited:this.onDataProviderEdited,onFilterForFieldPresent:this.onFilterForFieldPresent,operator:p,providerId:b,timelineId:g,timelineType:f,toggleEnabled:h,toggleExcluded:E,toggleType:S,value:x,type:O});return l.a.createElement(P,{id:`popoverFor_${b}-${r}-${x}`,isOpen:m,closePopover:a,button:n,anchorPosition:"downCenter",panelPaddingSize:"none",ownFocus:!0},l.a.createElement("div",{style:{userSelect:"none"}},l.a.createElement(c.EuiContextMenu,{initialPanelId:0,panels:k,"data-test-subj":"providerActions"})))}}var R=n(227),L=n(133);const B=l.a.memo((({andProviderId:e,browserFields:t,deleteProvider:n,field:c,kqlQuery:d,isEnabled:m,isExcluded:p,isPopoverOpen:b,onDataProviderEdited:g,operator:f,providerId:v,register:h,setIsPopoverOpen:E,timelineId:S,toggleEnabledProvider:x,toggleExcludedProvider:O,toggleTypeProvider:k,displayValue:j,val:w,type:M=y.a.default,wrapperRef:I})=>{const C=Object(i.useMemo)((()=>u.b.getTimelineByIdSelector()),[]),A=Object(o.b)((e=>{var t,n;return S&&null!==(t=null===(n=C(e,S))||void 0===n?void 0:n.timelineType)&&void 0!==t?t:s.l.default})),{isLoading:D}=Object(o.a)((e=>{var t;return null!==(t=C(e,null!=S?S:""))&&void 0!==t?t:L.b})),N=Object(i.useCallback)((()=>{E(!b)}),[b,E]),F=Object(i.useCallback)((()=>{var e;E(!1),null==I||null===(e=I.current)||void 0===e||e.focus()}),[I,E]),P=Object(i.useCallback)((()=>{x(),F()}),[F,x]),B=Object(i.useCallback)((()=>{O(),F()}),[O,F]),_=Object(i.useCallback)((()=>{k(),F()}),[k,F]),[q,z]=Object(i.useState)(!1),V=Object(r.useDispatch)();Object(i.useEffect)((()=>{null!=h&&(V(R.a.registerProvider({provider:{...h,and:[]}})),z(!0))}),[q,V,h,z]);const $=Object(i.useCallback)((()=>{q&&null!=h&&V(R.a.unRegisterProvider({id:h.id}))}),[q,V,h]);Object(i.useEffect)((()=>()=>{$()}),[$]);const Q=Object(i.useMemo)((()=>l.a.createElement(T,{deleteProvider:D?a.noop:n,field:c,kqlQuery:d,isEnabled:m,isExcluded:p,providerId:v,togglePopover:N,toggleType:_,displayValue:null!=j?j:String(w),val:w,operator:f,type:M,timelineType:A})),[n,j,c,m,p,D,d,_,f,v,A,N,M,w]);return l.a.createElement(provider_item_actions_ProviderItemActions,{andProviderId:e,browserFields:t,button:Q,closePopover:F,deleteProvider:n,field:c,kqlQuery:d,isEnabled:m,isExcluded:p,isLoading:D,isOpen:b,onDataProviderEdited:g,operator:f,providerId:v,timelineId:S,timelineType:A,toggleEnabledProvider:P,toggleExcludedProvider:B,toggleTypeProvider:_,value:w,type:M})}));B.displayName="ProviderItemBadge"},958:function(e,t,n){"use strict";n.d(t,"a",(function(){return F}));var a=n(2),i=n.n(a),l=n(103),r=n(51),s=n(115),o=n(114),u=n(134),c=n(102),d=n(161),m=n(122),p=n(133),b=n(111),g=n(272),f=n(40),y=n(41),v=n.n(y),h=n(916),E=n(949),S=n(116),x=n(641);const O=v.a.div.withConfig({displayName:"TopNContainer",componentId:"sc-149y4ld-0"})(["min-width:600px;"]),k=v()(f.EuiButtonIcon).withConfig({displayName:"CloseButton",componentId:"sc-149y4ld-1"})(["position:absolute;right:4px;top:4px;"]),j=v()(f.EuiSuperSelect).withConfig({displayName:"ViewSelect",componentId:"sc-149y4ld-2"})(["width:170px;"]),T=v.a.div.withConfig({displayName:"TopNContent",componentId:"sc-149y4ld-3"})(["margin-top:4px;margin-right:",";.euiPanel{border:none;}"],(({theme:e})=>e.eui.euiSizeXS)),w=({combinedQueries:e,defaultView:t,deleteQuery:n,filters:l,field:r,from:s,indexPattern:o,options:u,paddingSize:c,query:d,showLegend:m,setAbsoluteRangeDatePickerTarget:p,setQuery:b,scopeId:f,to:y,toggleTopN:v})=>{const[w,M]=Object(a.useState)(t),I=Object(a.useCallback)((e=>M(e)),[M]),C=Object(g.b)({scopeId:f,view:w}),{selectedPatterns:A,runtimeMappings:D}=Object(S.d)(C);Object(a.useEffect)((()=>{M(t)}),[t]);const N=Object(a.useMemo)((()=>i.a.createElement(j,{"data-test-subj":"view-select",disabled:1===u.length,onChange:I,options:u,valueOfSelected:w})),[I,u,w]),F=Object(a.useMemo)((()=>Object(g.d)({filters:l,tableId:f,view:w})),[l,f,w]);return i.a.createElement(O,{"data-test-subj":"topN-container"},i.a.createElement(T,null,"raw"===w||"all"===w?i.a.createElement(h.a,{combinedQueries:e,deleteQuery:n,filters:F,from:s,headerChildren:N,indexPattern:o,indexNames:A,runtimeMappings:D,onlyField:r,paddingSize:c,query:d,queryType:"topN",showLegend:m,setAbsoluteRangeDatePickerTarget:p,setQuery:b,showSpacer:!1,toggleTopN:v,scopeId:f,sourcererScopeId:C,to:y,hideQueryToggle:!0}):i.a.createElement(E.a,{combinedQueries:e,filters:F,headerChildren:N,onlyField:r,paddingSize:c,query:d,showLegend:m,setAbsoluteRangeDatePickerTarget:p,runtimeMappings:D,hideQueryToggle:!0})),i.a.createElement(k,{"aria-label":x.c,"data-test-subj":"close",iconType:"cross",onClick:v}))};w.displayName="TopNComponent";const M=i.a.memo(w);var I=n(118);const C=[],A={query:"",language:"kuery"},D=Object(l.connect)((()=>{const e=m.d.globalQuerySelector(),t=m.d.globalFiltersQuerySelector(),n=b.b.getTimelineByIdSelector(),a=m.d.getTimelineSelector(),i=b.b.getKqlFilterQuerySelector();return(l,r)=>{var s,o;const u=null!==(s=n(l,I.c.active))&&void 0!==s?s:p.b,c=null!==(o=u.filters)&&void 0!==o?o:C,d=a(l),{globalFilters:m}=r;return{activeTimelineEventType:u.eventType,activeTimelineFilters:u.activeTab===I.d.query?c:C,activeTimelineFrom:d.timerange.from,activeTimelineKqlQueryExpression:u.activeTab===I.d.query?i(l,I.c.active):null,activeTimelineTo:d.timerange.to,dataProviders:u.activeTab===I.d.query?u.dataProviders:[],globalQuery:e(l),globalFilters:null!=m?m:t(l),kqlMode:u.kqlMode}}})),N=({activeTimelineEventType:e,activeTimelineFilters:t,activeTimelineFrom:n,activeTimelineKqlQueryExpression:l,activeTimelineTo:m,browserFields:p,dataProviders:b,field:f,indexPattern:y,globalFilters:v=C,globalQuery:h=A,kqlMode:E,onFilterAdded:S,paddingSize:x,showLegend:O,scopeId:k,toggleTopN:j})=>{const{uiSettings:T}=Object(c.j)().services,{from:w,deleteQuery:I,setQuery:D,to:N}=Object(u.a)(),F=Object(g.a)(Object(s.isActiveTimeline)(null!=k?k:"")?e:void 0),P=Object(a.useMemo)((()=>{var e;return Object(s.isActiveTimeline)(null!=k?k:"")?null===(e=Object(d.d)({browserFields:p,config:Object(r.getEsQueryConfig)(T),dataProviders:b,filters:t,indexPattern:y,kqlMode:E,kqlQuery:{language:"kuery",query:null!=l?l:""}}))||void 0===e?void 0:e.filterQuery:void 0}),[k,p,T,b,t,y,E,l]),R=Object(a.useMemo)((()=>Object(g.c)(k)?"alert":F[0].value),[F,k]);return i.a.createElement(M,{combinedQueries:P,"data-test-subj":"top-n",defaultView:R,deleteQuery:Object(s.isActiveTimeline)(null!=k?k:"")?void 0:I,field:f,filters:Object(s.isActiveTimeline)(null!=k?k:"")?C:v,from:Object(s.isActiveTimeline)(null!=k?k:"")?n:w,indexPattern:y,options:F,paddingSize:x,query:Object(s.isActiveTimeline)(null!=k?k:"")?A:h,showLegend:O,setAbsoluteRangeDatePickerTarget:Object(s.isActiveTimeline)(null!=k?k:"")?o.a.timeline:o.a.global,setQuery:D,scopeId:k,to:Object(s.isActiveTimeline)(null!=k?k:"")?m:N,toggleTopN:j,onFilterAdded:S})};N.displayName="StatefulTopNComponent";const F=D(i.a.memo(N))},959:function(e,t,n){"use strict";n.d(t,"a",(function(){return S}));var a=n(130),i=n.n(a),l=n(42),r=n(2),s=n(3),o=n(51),u=n(216),c=n(102),d=n(338),m=n(115),p=n(5);const b=p.i18n.translate("xpack.securitySolution.matrixHistogram.errorSearchDescription",{defaultMessage:"An error has occurred on matrix histogram search"}),g=p.i18n.translate("xpack.securitySolution.matrixHistogram.failSearchDescription",{defaultMessage:"Failed to run search on matrix histogram"});var f=n(108),y=n(303),v=n(4);const h=[],E=({endDate:e,errorMessage:t,filterQuery:n,histogramType:a,indexNames:p,isPtrIncluded:E,onError:S,stackByField:x,runtimeMappings:O,startDate:k,threshold:j,skip:T=!1,includeMissingData:w=!0})=>{const{data:M}=Object(c.j)().services,I=Object(r.useRef)(l.noop),C=Object(r.useRef)(new AbortController),A=Object(r.useRef)(new s.Subscription),[D,N]=Object(r.useState)(!1),{startTracking:F}=Object(y.a)(),[P,R]=Object(r.useState)({defaultIndex:p,factoryQueryType:d.i,filterQuery:Object(u.a)(n),histogramType:a,timerange:{interval:"12h",from:k,to:e},stackByField:x,runtimeMappings:O,threshold:j,...null!=E?{isPtrIncluded:E}:{},...null!=w?{includeMissingData:w}:{}}),{addError:L,addWarning:B}=Object(f.a)(),[_,q]=Object(r.useState)({data:[],inspect:{dsl:[],response:[]},refetch:I.current,totalCount:-1,buckets:[]}),z=Object(r.useCallback)((e=>{const n=async()=>{C.current=new AbortController,N(!0);const{endTracking:n}=F({name:`${v.l} matrixHistogram ${a}`});A.current=M.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:C.current.signal}).subscribe({next:e=>{if(Object(o.isCompleteResponse)(e)){const t=Object(l.getOr)(h,d.k[a],e.rawResponse);N(!1),q((n=>({...n,data:e.matrixHistogramData,inspect:Object(m.getInspectResponse)(e,n.inspect),refetch:I.current,totalCount:t.reduce(((e,t)=>t.doc_count+e),0),buckets:t}))),n("success"),A.current.unsubscribe()}else Object(o.isErrorResponse)(e)&&(N(!1),B(b),n("invalid"),A.current.unsubscribe())},error:e=>{N(!1),L(e,{title:null!=t?t:g}),n("error"),A.current.unsubscribe()}})};A.current.unsubscribe(),C.current.abort(),n(),I.current=n}),[M.search,a,B,L,t,F]);return Object(r.useEffect)((()=>{R((t=>{const l={...t,defaultIndex:p,filterQuery:Object(u.a)(n),histogramType:a,timerange:{interval:"12h",from:k,to:e},stackByField:x,threshold:j,...null!=E?{isPtrIncluded:E}:{}};return i()(t,l)?t:l}))}),[p,e,n,k,x,a,j,E]),Object(r.useEffect)((()=>(T||z(P),()=>{A.current.unsubscribe(),C.current.abort()})),[P,z,T]),Object(r.useEffect)((()=>{T&&(N(!1),A.current.unsubscribe(),C.current.abort())}),[T]),[D,_,Object(r.useCallback)(((e,t)=>{z({...P,timerange:{interval:"12h",from:t,to:e}})}),[P,z])]},S=e=>{const[t,n]=E({...e,includeMissingData:!0}),a=Object(r.useMemo)((()=>!e.stackByField.endsWith(".ip")),[e.stackByField]),[i,l]=E({...e,includeMissingData:!1,skip:a||void 0===e.filterQuery||e.skip}),s=Object(r.useMemo)((()=>t||i),[t,i]),o=Object(r.useMemo)((()=>{if(a)return n;const{data:e,inspect:t,totalCount:i,refetch:r,buckets:o}=n,{data:u,inspect:c,totalCount:d,refetch:m}=l,p=()=>{r(),m()};return s?{data:[],inspect:{dsl:[],response:[]},refetch:p,totalCount:-1,buckets:[]}:{data:[...e,...u],inspect:{dsl:[...t.dsl,...c.dsl],response:[...t.response,...c.response]},totalCount:i+d,refetch:p,buckets:o}}),[s,n,l,a]);return[s,o]}},972:function(e,t,n){var a=n(549)("set",n(1027));a.placeholder=n(550),e.exports=a},973:function(e,t,n){e.exports=n(33)(3822)},974:function(e,t,n){e.exports={ary:n(975),assign:n(998),clone:n(999),curry:n(1e3),forEach:n(625),isArray:n(258),isError:n(1001),isFunction:n(629),isWeakMap:n(1004),iteratee:n(1005),keys:n(717),rearg:n(1020),toInteger:n(627),toPath:n(1022)}},975:function(e,t,n){var a=n(435);e.exports=function(e,t,n){return t=n?void 0:t,t=e&&null==t?e.length:t,a(e,128,void 0,void 0,void 0,void 0,t)}},976:function(e,t,n){e.exports=n(33)(3349)},977:function(e,t,n){var a=n(341),i=n(342);e.exports=function(e,t,n){var l=1&t,r=a(e);return function t(){return(this&&this!==i&&this instanceof t?r:e).apply(l?n:this,arguments)}}},978:function(e,t,n){var a=n(616),i=n(341),l=n(617),r=n(620),s=n(626),o=n(443),u=n(342);e.exports=function(e,t,n){var c=i(e);return function i(){for(var d=arguments.length,m=Array(d),p=d,b=s(i);p--;)m[p]=arguments[p];var g=d<3&&m[0]!==b&&m[d-1]!==b?[]:o(m,b);return(d-=g.length)<n?r(e,t,l,i.placeholder,void 0,m,g,void 0,void 0,n-d):a(this&&this!==u&&this instanceof i?c:e,this,m)}}},979:function(e,t){e.exports=function(e,t){for(var n=e.length,a=0;n--;)e[n]===t&&++a;return a}},980:function(e,t,n){var a=n(438),i=n(621),l=n(981),r=n(983);e.exports=function(e){var t=l(e),n=r[t];if("function"!=typeof n||!(t in a.prototype))return!1;if(e===n)return!0;var s=i(n);return!!s&&e===s[0]}},981:function(e,t,n){var a=n(982),i=Object.prototype.hasOwnProperty;e.exports=function(e){for(var t=e.name+"",n=a[t],l=i.call(a,t)?n.length:0;l--;){var r=n[l],s=r.func;if(null==s||s==e)return r.name}return t}},982:function(e,t){e.exports={}},983:function(e,t,n){var a=n(438),i=n(622),l=n(439),r=n(258),s=n(440),o=n(984),u=Object.prototype.hasOwnProperty;function c(e){if(s(e)&&!r(e)&&!(e instanceof a)){if(e instanceof i)return e;if(u.call(e,"__wrapped__"))return o(e)}return new i(e)}c.prototype=l.prototype,c.prototype.constructor=c,e.exports=c},984:function(e,t,n){var a=n(438),i=n(622),l=n(441);e.exports=function(e){if(e instanceof a)return e.clone();var t=new i(e.__wrapped__,e.__chain__);return t.__actions__=l(e.__actions__),t.__index__=e.__index__,t.__values__=e.__values__,t}},985:function(e,t,n){e.exports=n(33)(3677)},986:function(e,t){var n=/\{\n\/\* \[wrapped with (.+)\] \*/,a=/,? & /;e.exports=function(e){var t=e.match(n);return t?t[1].split(a):[]}},987:function(e,t){var n=/\{(?:\n\/\* \[wrapped with .+\] \*\/)?\n?/;e.exports=function(e,t){var a=t.length;if(!a)return e;var i=a-1;return t[i]=(a>1?"& ":"")+t[i],t=t.join(a>2?", ":" "),e.replace(n,"{\n/* [wrapped with "+t+"] */\n")}},988:function(e,t,n){e.exports=n(33)(3674)},989:function(e,t,n){var a=n(625),i=n(990),l=[["ary",128],["bind",1],["bindKey",2],["curry",8],["curryRight",16],["flip",512],["partial",32],["partialRight",64],["rearg",256]];e.exports=function(e,t){return a(l,(function(n){var a="_."+n[0];t&n[1]&&!i(e,a)&&e.push(a)})),e.sort()}},990:function(e,t,n){var a=n(991);e.exports=function(e,t){return!(null==e||!e.length)&&a(e,t,0)>-1}},991:function(e,t,n){var a=n(992),i=n(993),l=n(994);e.exports=function(e,t,n){return t==t?l(e,t,n):a(e,i,n)}},992:function(e,t){e.exports=function(e,t,n,a){for(var i=e.length,l=n+(a?1:-1);a?l--:++l<i;)if(t(e[l],l,e))return l;return-1}},993:function(e,t){e.exports=function(e){return e!=e}},994:function(e,t){e.exports=function(e,t,n){for(var a=n-1,i=e.length;++a<i;)if(e[a]===t)return a;return-1}},995:function(e,t,n){var a=n(441),i=n(442),l=Math.min;e.exports=function(e,t){for(var n=e.length,r=l(t.length,n),s=a(e);r--;){var o=t[r];e[r]=i(o,n)?s[o]:void 0}return e}},996:function(e,t,n){var a=n(616),i=n(341),l=n(342);e.exports=function(e,t,n,r){var s=1&t,o=i(e);return function t(){for(var i=-1,u=arguments.length,c=-1,d=r.length,m=Array(d+u),p=this&&this!==l&&this instanceof t?o:e;++c<d;)m[c]=r[c];for(;u--;)m[c++]=arguments[++i];return a(p,s?n:this,m)}}},997:function(e,t,n){var a=n(618),i=n(619),l=n(443),r="__lodash_placeholder__",s=128,o=Math.min;e.exports=function(e,t){var n=e[1],u=t[1],c=n|u,d=c<131,m=u==s&&8==n||u==s&&256==n&&e[7].length<=t[8]||384==u&&t[7].length<=t[8]&&8==n;if(!d&&!m)return e;1&u&&(e[2]=t[2],c|=1&n?0:4);var p=t[3];if(p){var b=e[3];e[3]=b?a(b,p,t[4]):p,e[4]=b?l(e[3],r):t[4]}return(p=t[5])&&(b=e[5],e[5]=b?i(b,p,t[6]):p,e[6]=b?l(e[5],r):t[6]),(p=t[7])&&(e[7]=p),u&s&&(e[8]=null==e[8]?t[8]:o(e[8],t[8])),null==e[9]&&(e[9]=t[9]),e[0]=t[0],e[1]=c,e}},998:function(e,t,n){e.exports=n(33)(3642)},999:function(e,t,n){var a=n(628);e.exports=function(e){return a(e,4)}}}]);